New Era of Obligations in Payment Services and Electronic Money Law

The regulation dated March 28, 2025, has redefined the access and BKM integration obligations of payment service providers, introduced requirements for participation in the FAST system and digital wallet licensing; these regulations are yielding multi-dimensional consequences in terms of digital security and economic rights.

Attorney Dr. Tolga Ersoy | 30/05/2025

Legal regulations concerning payment services and electronic money issuance hold vital importance for the integrity of the financial system and user security in our era of rapidly evolving digital financial transactions. In this context, the amendment to the Regulation, published in the Official Gazette dated March 28, 2025, and numbered 32855, constitutes a significant turning point, particularly regarding online access infrastructure and the obligation to integrate with the Funds Instant and Continuous Transfer System (FAST). These changes, beyond being mere technical regulations, are reshaping the legal responsibilities of payment service providers and influencing competitive conditions within the sector.

The amendments made to Article 59 of the regulation dated December 1, 2021, through the Regulation amendment, have repeatedly imposed obligations, particularly concerning the provision of online access infrastructure and the opening of this service to other authorized providers. In this context, payment service providers maintaining payment accounts are mandated to establish connections with the Interbank Card Center Inc. (BKM) and to create the necessary technical infrastructure. Pursuant to the provision, this obligation applies to entities integrated into the FAST system or those ranking among the top ten in terms of 2024 payment volume, with the scope of the obligation to be recalculated annually.

So, how does this regulation affect the legal responsibilities of payment service providers? The answer to this question can be articulated as, "How can a connection be established between technical actions giving rise to obligations and public oversight?" It is self-evident that the answer to this question is that payment services are no longer merely technical processes but also areas where legal obligations directly manifest. Accordingly, for providers failing to fulfill their obligations, both administrative sanctions and potential liability for damages may arise.

The Regulation also specifies in detail the timeframes for service providers offering online access to fulfill their obligations. Accordingly, entities ranking among the top ten in terms of payment volume and not currently providing online access must fulfill the relevant obligations within six months of establishing such access. Entities not integrated into the FAST system but providing access are similarly subject to these obligations. This transition period is highly consistent with a regulatory security perspective.

Amendments made to the provisional articles are crucial for clarifying critical timelines and exemptions related to implementation. Accordingly, entities offering digital wallet services that have not yet obtained an operating license must apply for a license by December 31, 2025. Furthermore, entities already integrated into the FAST system or ranking among the top ten in terms of payment volume are likewise obligated to fulfill their responsibilities by the same date. Such provisional provisions are important for ensuring a balance between vested rights and regulatory demands.

From a legal perspective, the nature of these amendments intersects with administrative law, consumer law, and information technology law. Particularly, in cases where users' online access requests are not met, there is a possibility of encountering new types of disputes, not only based on consumer law claims but also in the context of personal data security. Specifically, the failure or delay in providing access to users' payment account data may entail joint and several liabilities.

At this juncture, the following question arises: To what extent are payment service providers prepared for these new obligations? Is there a chasm between the envisioned infrastructural transformation and actual implementation? In response to this question, it must be stated that while major players in the sector are relatively prepared for this transformation, the existence of technical and financial challenges for medium and small-sized entities is self-evident. Therefore, not only the enforceability of the obligations determined by the Central Bank of the Republic of Turkey but also the oversight of these obligations and the legality of sanctions arising from their breach will be subject to consideration in the future.

Within the framework of the jurisprudence of the Constitutional Court and the European Court of Human Rights, digital rights and access to financial services are increasingly regarded as an expanding concept of rights. In this context, the obstruction of access to online payment accounts may constitute a direct interference with individuals' economic freedoms. Particularly, in the event of arbitrary disruption of service provision, violations of constitutionally guaranteed rights such as the principle of equality and the right to property may arise.

A notable sensitivity has recently been observed in the decisions of the Court of Cassation and Regional Courts of Justice regarding contractual provisions and service disruptions arising against users in the field of payment systems. A service provider's obstruction or delay of access by invoking technical reasons can be considered negligent conduct within the framework of positive law, potentially giving rise to liability for damages.

In this respect, the Regulation amendments have the potential to reshape not only corporate structures but also the perception of trust among users. Consequently, every regulation in this field touches upon the freedom of individuals to conduct their economic transactions, as much as it concerns the security of payment systems. However, this freedom gains meaning only within a predictable and enforceable legal framework.

The increase in administrative and technical obligations may have implications for competition law. The obligation to participate in the FAST system becoming a de facto barrier to competition for some actors may be subject to independent investigations by the Competition Authority in the future. In this context, legal oversight is required not only for the technical dimension of the legislation but also for competition order and market balance supervision.

The immediate effectiveness of the Regulation as of its enforcement date places obligated entities under time pressure, particularly concerning infrastructure investments. This situation may create a surge in operating license applications and lead to extended processing times at the Bank. Delays in these processes could result in some actors being excluded from the system. Therefore, a cautious and transition-enabling approach should be adopted in practice.

The regulation dated March 28, 2025, ushers in a new era in payment services, representing a reform in terms of both public assurance and service standardization. However, the proper implementation of this reform necessitates not only technical infrastructure but also the correct construction of legal interpretation and application. From a criminal law perspective, situations may arise where indirect criminal liability could be incurred in the event of a breach of obligations. Therefore, it is of paramount importance for both individuals and obligated entities to examine the relevant regulations and acquire detailed knowledge of their established rights and obligations before any dispute arises, thereby preventing damages that are difficult to remedy. In this process, consulting with a competent criminal law expert for their insights and assessments is crucial not only for mitigating existing risks but also for anticipating potential future legal consequences.