Türkiye's central bank opens biometrics for remote ID checks

What happened

The Central Bank of the Republic of Türkiye published an amendment to the communiqué on the information systems of payment and electronic money institutions on Friday, 4 September 2026, in issue 33360 of the Official Gazette. Its full title is the Communiqué Amending the Communiqué on the Information Systems of Payment and Electronic Money Institutions and the Data Sharing Services of Payment Service Providers in the Field of Payment Services. The original text being amended had been published in the Official Gazette of 1 December 2021, issue 31676. The amendment entered into force on the date of publication, and its provisions are executed by the Governor of the central bank.

The part that drew attention is the opening it creates for biometric data in remote identification. Anadolu Agency covered it the same day under the headline “TCMB, uzaktan kimlik doğrulamada ‘biyometrik' seçeneğini getirdi”. The text also defines the concept of an identity document and spells out which document and which method a remote identity check must rely on.

The details

Article 1 adds a definition of identity document to the first paragraph of Article 3 of the communiqué: the identity card defined in the Turkish Republic Identity Card Regulation published in the Official Gazette of 3 December 2019, issue 30967. Article 2 replaces the phrase T.C. Identity Card in Article 10 with identity document and repeals the references to official in the sixteenth paragraph of the same article. Article 3 adds the phrase covering the biometric data of the person to be identified to the first paragraph of Article 22.

The authenticity of the identity document obtained for remote identification will be checked primarily using near field communication. Originality and integrity tests will be run on security features visible under white light, on the photograph and on the signature in particular, and both faces of the document will be recorded without interruption. Where near field communication cannot be used, at least one of optical character recognition, a card reader, or another method determined by the bank after obtaining the opinion of MASAK will apply. Identification of foreign nationals may be carried out remotely within the scope of the Financial Crimes Investigation Board General Communiqué (Serial No: 19), published in the Official Gazette of 30 April 2021, issue 31470, using a passport that complies with standard 9303 of the International Civil Aviation Organization and supports near field communication. Under the newly added paragraph, applying the provisions of the first paragraph is not mandatory when a remote communication tool is used while running processes tied to information, contracts, receipts and similar documents.

Why it matters

First, the amendment turns remote identification from an exception into a process with a described method: which document counts, how authenticity is tested, and when a fallback method takes over are all set out in the text. Second, tying the identity document definition to the Turkish Republic Identity Card Regulation narrows and makes predictable the set of documents institutions will accept. Third, naming an ICAO 9303 compliant passport for foreign nationals gives cross border customer onboarding a written frame. Fourth, not mandating the first paragraph for information, contract and receipt processes removes the burden of treating every remote contact as a full identity check. That assessment is ours.

Because the communiqué took effect on the day of publication, there is no transition window for compliance. A verification flow built on near field communication demands device support, recording quality and a well designed fallback path on the implementation side. That reading is ours.

What it means for businesses in Türkiye

The rules bind payment and electronic money institutions directly, but they also reach the onboarding flows of e-commerce and service businesses integrated with those institutions. The to do list is concrete: ask your payment provider which method it uses for remote identification, find out which fallback it drops to on devices where near field communication fails, and if you serve foreign nationals, confirm that the passport based path is open. In your onboarding screens, make sure the step that requires an uninterrupted recording of both faces of the identity document is explained in a way that does not cost you the customer.

Bringing biometric data into the process also raises the privacy notice and explicit consent side: which data is processed for which purpose, who stores it and for how long must be consistent with the texts you show the customer. Measure drop off during registration and place the verification step at the most meaningful point of the flow rather than in front of the first click. That assessment is ours.

Sources

Official Gazette, the communiqué text of 4 September 2026, issue 33360 (primary official source) · Anadolu Agency, report on the central bank adding a biometric option to remote identity verification · Alomaliye, article by article coverage of the amendment to the information systems communiqué