Open banking is the sharing, with the customer’s own consent, of information relating to the customer’s bank accounts or of payment instructions, through authorised third-party service providers and via a secure interface. Viewing accounts held at more than one bank in a single application, or paying for a purchase directly from an account without using a card, are the best-known examples of this model.

Legal basis

An amendment made in 2019 to Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions introduced two new payment services:

• Account information service: The online provision, with the customer’s consent, of information relating to the customer’s accounts held with one or more payment service providers.
• Payment initiation service: The initiation, at the customer’s request, of a payment order from the customer’s account held with another payment service provider.

The same amendment transferred the authorisation and supervision of payment institutions and electronic money institutions to the Central Bank of the Republic of Türkiye (TCMB). Detailed rules are set out in the Central Bank’s regulations and communiqués on payment services.

Customer consent

The cornerstone of open banking is the customer’s explicit consent. The service provider may access account information only within the scope and for the duration of the consent given by the customer. The scope and duration of the consent, and its withdrawal, must be clearly communicated to the customer. Strong authentication is a mandatory element in ensuring the security of access.

Banking secrecy and personal data

Banking legislation prohibits the disclosure to third parties of information constituting customer secrets without the customer’s request or instruction. Since data sharing in open banking is based on the customer’s instruction, it does not breach this prohibition; however, the shared data remain personal data within the scope of Law No. 6698 on the Protection of Personal Data. Service providers must fulfil the obligation to inform, process the data solely for the stated purpose and take the necessary security measures.

Allocation of liability

Who is liable to the customer in the event of an unauthorised or incorrectly executed payment transaction is one of the most important legal questions in open banking. The legislation governs the allocation of liability between the institution holding the customer’s account and the service provider initiating the payment order, as well as the right of recourse between them. Further clarifying this relationship by contract reduces disputes.

Assessment

Open banking is a new field that intertwines banking law with data protection, competition and consumer law. The authorisation process for financial technology start-ups, and secure interfaces and consent management for banks, form the principal compliance agenda in this area.