Significant Amendments to the Payment Services Secondary Legislation

October 2023

The long-awaited amendments to the secondary legislation of the Law No. 6493 on Payment and Security Settlement Systems, Payment Services and Electronic Money Institutions (“Law”), namely the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (“Regulation”) and the Communiqué on Information Systems of Payment and Electronic Money Institutions and Data Sharing Services of Payment Service Providers in the Field of Payment Services (“Communiqué”) entered into force following their promulgation in the Official Gazette dated 7 October 2023.

Amendments made by the Central Bank of the Republic of Türkiye (“CBRT”), especially in the Regulation, may necessitate adjustments in the existing and planned business models of many stakeholders operating in the payment services sector, whether licensed or unlicensed.

Significant amendments made to the Regulation are summarized as follows:

Digital wallet service was defined and became subject to licensing.

The definition of digital wallet service and the scope of the license:

The Regulation defines digital wallet as “a payment instrument that is offered as an electronic device, online service or application where the information regarding the payment account or payment instrument specified by the customer is stored, and which enables the customer to perform payment transactions using the information regarding the payment account or payment instrument specified by the customer“.

To provide digital wallet services, it is necessary to have a license at least for “issuance of payment instruments”. Moreover, depending on the nature of services intended for customers through the digital wallet, if necessary, a license must be obtained also to cover the pertinent subparagraphs of Article 4/1 of the Regulation.

Specific regulation regarding the scope of the license concerning certain business models where digital wallet is used:

  • In the business model where the digital wallet is used as a payment instrument in merchants and the funds related to the payment transaction in these transactions are transferred through the institution providing digital wallet service, the relevant institution is required to have an electronic money issuance license. However, the transactions where the funds related to the payment are transferred through the institution providing digital wallet service since the institution providing digital wallet service provides the payment services required for the direct use of the payment account or payment instrument associated with the digital wallet in the payment transaction to be carried out in the merchant, fall outside the scope of this
  • If a payment account held by another payment service provider or a payment instrument issued by another payment service provider, linked to the digital wallet, is to be directly used for payment transactions in merchants, the relevant institution must possess a license for initiating payment orders under Article 4/1(f) of the
 

Exceptions to the digital wallet service:

The following services are not considered as digital wallet services:

  • Electronic devices, online services or applications where only the payment account before the payment service provider offering the service and the payment instrument issued by this payment service provider can be designated and
  • Services that store sensitive customer data on behalf of the merchant or payment service provider within the limits permitted by the legislation, provided that they meet the following criteria in a cumulative manner:

 

    • not to be a direct party to any legal transaction with the customer;
    • not to create the impression before the customer that the payment transaction is carried out through the legal entity storing data;
    • the legal entity storing data should not be the owner of the fund subject to the payment transaction at any time of the payment transaction;
    • the rights and obligations regarding the operations carried out should be clearly determined in the agreement between the parties; and
    • Persons who store sensitive customer data on behalf of the merchant or payment service provider within the limits permitted by the legislation should not be the sole visible face of the service vis-à-vis the customer

 

  • Payment services regulated under Article 12/2 of the
  • Prepaid instruments that can be used only in the issuer’s own network of stores, only for purchasing of a certain group of goods or services, or only in a certain service network due to an agreement.

Accordingly, it is considered that digital wallet products that solely perform card storage functions are also subject to licensing unless they fall under any of the exceptions mentioned above.

Compliance Period: Persons currently providing services that fall within the definition of digital wallet services must apply to the CBRT to obtain necessary licenses and become compliant with the regulations in Article 4/A of the Regulation by 7 October 2024.

The obligation to obtain permission from the CBRT for intra-group share acquisitions and transfers has been abolished.

Intra-group share acquisitions and transfers that lead to changes in the shareholding structure of electronic money and payment institutions have been facilitated. It has been stipulated that the share acquisitions and transfers occurring between the companies within the same group, which do not impact directly or indirectly the shareholding ratio of the ultimate shareholders of the institutions, do not require approval from the CBRT. It is necessary and sufficient to notify the CBRT of such a share transfer within 10 business days following from the date when the institution becomes aware of such share transfer. However, the CBRT reserves the authority to request the suspension of the transaction or to request reinstatement if the transaction has been completed, if it deems necessary.

The scope of operations that can be carried out by the institutions has been expanded.

The scope of commercial operations that payment and electronic money institutions can engage in has been expanded to include the following:

  • Following services; but in the case where these services are provided by the institutions other than those licensed under Article 4/1/(f) and (g), on the condition that these services are provided only in relation to the accounts held within their own institution;
    • with respect to the legal entities; services that, in accordance with the Law, do not fall within the scope of payment services but facilitate, secure, or enhance the administrative and operational processes of legal entities and merchants, such as commercial debt and credit management, accounting, invoicing, product, inventory, and supply management, (value added services); and
    • with respect to real persons; services that, in accordance with the Law, do not fall within the scope of payment services but facilitate, secure, or enhance payment services provided by supporting financial status and financial awareness of the individuals such as individual financial budget management, invoice management, account verification, and payment reminders (qualified services).
  • Services to be provided as an interface provider in accordance with the relevant legislation, except for transactions related to the sale and purchase of precious metals and precious stones and foreign exchange.
  • Ancillary services that may increase the use of the payment services of the financial institution, such as marketing and directing the customer to the systems of the relevant financial institution to access the services of the financial institutions, except for transactions related to foreign exchange trading and provided that the service does constitute the entire main operation of the financial institution.
  • Services to be provided within the scope of intermediation of operations related to the purchase and sale of processed precious metals and precious stones, provided that the amount of transactions intermediated within a month is limited to one per cent of the payment volume in the previous calendar year and subject to other conditions under the legislation.

Amendments have been made to the principles regarding the calculation of the institutions’ equity and the security deposit to be kept by the institutions at the CBRT.

The amount of the security deposit to be kept by payment and electronic money institutions at the CBRT has been added to the deduction items to be taken into account in the calculation of equity.

Additionally, the provisions regarding the requirement for the free reserves included in the equity calculation to be readily available to cover potential losses, to be explicitly indicated in the accounting records, and to be approved by the independent audit firm conducting the independent audit of the organization for the purpose of mitigating risks have been repealed.

Furthermore, the changes clearly stipulate that payment funds and funds received in exchange for electronic money issuance cannot be used as a security deposit.

The number of criteria to be taken into consideration by the CBRT when determining the total amount of the security deposit that the institution is required to keep with the CBRT has been reduced. Accordingly, only the following two criteria will be taken into consideration by the CBRT:

  • No administrative fine has been imposed under the Law and
  • Complaints and objection applications that have been resulted against the institution before the arbitral tribunals of the Payment and Electronic Money Institutions Union of Türkiye (“TÖDEB”) do not account for more than 10% of the total applications related to the institution.

The amount of security deposit that the institution is required to keep with the CBRT will be increased by 25% if the above two criteria are not met individually, and by 100% if they are not met jointly.

The obligation for the institutions to obtain approval from the CBRT for changes in their trade name has been abolished.

The process for changing the trade name of payment and electronic money institutions has been simplified; it is now sufficient to notify the CBRT within 20 business days after the internal procedures related to such change has been completed.

The requirement for risk management personnel to be full-time employees of the institution has been introduced.

It is explicitly stipulated that at least one of the risk management personnel within the payment and electronic money institution must be a full-time employee of the institution.

The process and the documents in relation to obtaining an activity license has been amended.

Time limits have been introduced for completing missing information and documents submitted during the initial notification stage of the license application and the application process for expanding the scope of the license. Applications that are not completed within the specified time frame will be considered as if they were never made.

Furthermore, new documents have been added to those that must be submitted to the CBRT as part of the intelligence examination stage.

New regulations have been introduced that also concern card system institutions with regard to the issuance and acceptance of payment instruments.

Payment service providers issuing payment instruments compatible with multiple card system institutions are obliged to do the following in cases where a customer requests the issuance of the payment instrument to be associated with a specific card system institution;

  • to issue the payment instrument compatible with the card system institutions requested by the customer, and
  • not to treat the customer differently based on the card system institution in a manner to make the process of issuing a payment instrument compatible with the customer’s chosen card system institution more difficult for the customer before and after the issuance of the payment

The term “card system institution” as mentioned in the Regulation refers to the entities defined in Article 3/1(f) of the Law No. 5464. Relevant provisions will enter into force as of 31 March 2024.

An obligation of equal treatment has been introduced for payment service providers regarding their relationships with other payment service providers with whom they have a control relationship.

In accordance with the paragraph 4 and subsequent paragraphs added to Article 8 of the Regulation, following obligations have been introduced for the payment services providers with respect to the payment account services and infrastructure services related to the payment services, which are provided to the other payment service providers;

  • the obligation to provide services of the same nature to the payment service provider over which they have control and other payment service providers on the same terms, conditions, facilities, and fee policy, and
  • the obligation not to direct or coerce their own customers to obtain services from the payment service provider over which they have control in a way that would give that provider an advantageous position over other payment service providers.

New rules have been introduced concerning the enforcement of the administrative and judicial requests on the customer’s rights and receivables before the institution.

It has been stipulated that measures, attachments, and all types of administrative and judicial requests concerning the rights and receivables of the customers before the payment and electronic money institutions respectively, will exclusively be executed by the relevant institution. Similarly, it is specified that the requests conveyed to the banks in relation to the protection accounts holding the payment fund and the accounts holding the funds received in exchange for electronic money issuance, will be enforced by the banks limited to the relevant fund if the bank has information regarding the ultimate ownership of these funds on a customer-by-customer basis.

Additional regulations have been introduced regarding the payment order initiation service.

For a payment transaction to be considered as a payment order initiation service, the party initiating the payment must use a payment service provider other than the one where their payment account, from which the payment transaction will take place, is held in order to issue the payment order. The same paragraph also specifies the types of applications that will not be considered as payment initiation services.

New regulations have been introduced for one-time payment transactions conducted through remote communication tools.

Payment service providers have been authorized to decide to which customers and for which types of services they will offer the option to carry out one-time payment transactions via remote communication tools. Based on the results obtained from the risk assessment, the payment service provider may decide whether the payment transaction should take place through the simultaneous physical presence of the parties involved.

The amounts specified in the regulations related to low-value payment transactions, as well as low-value payment instruments and electronic money, have been increased.

The reference amounts used in determining the payment transactions and payment instruments to which Article 73 of the Regulation will apply have been increased.

Exceptions have been introduced regarding the compliance period for data sharing services.

Compliance period for the institutions that meet certain conditions regarding the payment order initiation service and account information service has been extended.

Contact: