Open banking in Turkey is a regulatory and technical framework that allows banks and licensed payment institutions to share customer financial data — with explicit customer consent — through secure APIs with authorized third-party providers. It enables services such as multi-bank account aggregation, initiated payments from third-party apps, and faster credit and lending decisions, all without customers needing to log into each bank separately.
Open banking is legal and actively regulated in Turkey. It falls primarily under the Banking Regulation and Supervision Agency (BDDK) and the Central Bank of the Republic of Turkey (TCMB), building on the Payment Services Regulation that first came into force in 2019.
How Open Banking Works in Turkey
At its core, open banking replaces manual or screen-scraping methods of data sharing with standardized, secure Application Programming Interfaces (APIs). When a customer gives explicit consent, a licensed third-party provider (TPP) — such as a personal finance app, an accounting platform, or a lending service — can:
- Retrieve account information: balances, transaction history, and account details across multiple banks (Account Information Services, AIS)
- Initiate payments: trigger a payment directly from the customer’s bank account without routing through a card network (Payment Initiation Services, PIS)
This is different from traditional banking APIs, which banks historically built for internal or partner use only. Open banking standardizes and regulates this access so that any authorized provider — not just the bank’s chosen partners — can build on top of it.
The Regulatory Framework
Turkey’s approach to open banking developed gradually rather than through a single landmark law, layering several regulations over time:
- Payment Services Regulation (2019): Established the licensing regime for payment institutions and e-money institutions and introduced the obligation for API-based integration between banks and licensed third parties.
- BDDK oversight: As Turkey’s banking regulator, BDDK sets the rules banks must follow when exposing account data and payment initiation capabilities to licensed providers.
- TCMB’s Instant Payment System (FAST): While not open banking regulation itself, FAST’s infrastructure has become tightly integrated with open banking use cases, particularly for instant payment initiation.
- TROY integration: Turkey’s national card scheme has also aligned with open banking infrastructure, supporting broader interoperability across payment rails.
Unlike the EU’s PSD2, which created a single unified open banking mandate across member states, Turkey’s framework is administered primarily through BDDK’s payment services rules, with the Central Bank’s payment infrastructure (FAST) playing a complementary role.
Who Can Access Open Banking Data in Turkey
Access is restricted to licensed entities. To participate as a third-party provider, a company generally needs one of the following:
- A Payment Institution license issued by BDDK
- An Electronic Money Institution (e-money) license
- Status as a licensed bank
This licensing requirement is a key safeguard: it means only vetted, regulated companies can request access to customer financial data, and only with the customer’s explicit, revocable consent.
Why Open Banking Matters for Turkey’s Fintech Sector
Open banking underpins several fast-growing categories in the Turkish fintech ecosystem:
- Personal finance management apps that let users see all their bank accounts in one dashboard
- SME accounting and ERP tools that automatically reconcile bank transactions
- Alternative lending platforms that use real-time transaction data (rather than only credit bureau scores) to assess creditworthiness
- Payment initiation services that let merchants accept direct bank transfers instead of relying solely on card networks
For foreign investors and fintech founders evaluating Turkey, open banking is one of the clearest signals of how far the regulatory environment has matured: a licensed, API-first data-sharing framework instead of ad hoc bilateral agreements between banks and select partners.
Challenges and Limitations
Open banking adoption in Turkey still faces some practical hurdles:
- Fragmented API standards: Unlike the EU, which pushed toward standardized API specifications, individual banks in Turkey have historically implemented APIs with some variation, which can complicate integration for smaller fintechs.
- Licensing costs and timelines: Obtaining a Payment Institution or e-money license from BDDK involves capital requirements and compliance processes that can be a barrier for early-stage startups.
- Consumer awareness: Many retail customers are still unfamiliar with the concept, which slows adoption of consent-based data sharing compared to card payments or direct bank transfers they’re already used to.
Frequently Asked Questions
Is open banking legal in Turkey? Yes. It operates under BDDK’s Payment Services Regulation, which requires licensed banks and payment institutions to support API-based data sharing with customer consent.
Is open banking safe? Data can only be shared with the customer’s explicit, revocable consent, and only with entities that hold a valid BDDK license. Licensed providers are required to meet security standards for handling financial data.
Which regulator oversees open banking in Turkey? Primarily the Banking Regulation and Supervision Agency (BDDK), with the Central Bank of the Republic of Turkey (TCMB) playing a supporting role through payment infrastructure like FAST.
Do I need a license to build an open banking product in Turkey? Yes. Companies that want to access customer account data or initiate payments on a customer’s behalf generally need a Payment Institution license, an Electronic Money Institution license, or bank status from BDDK.
How is Turkey’s open banking model different from the EU’s PSD2? The EU mandates a single, harmonized open banking framework across all member states under PSD2. Turkey’s model instead layers open banking obligations into its existing Payment Services Regulation and licensing regime, administered by BDDK, without a single unified “Turkish PSD2” law.
