What changed
On September 4, 2026, the Central Bank of the Republic of Türkiye (TCMB) published a communique in Official Gazette No. 33360 amending its 2021 rulebook governing payment and e-money institutions' information systems — the Ödeme ve Elektronik Para Kuruluşlarının Bilgi Sistemleri tebliğ, originally issued December 1, 2021 under Law No. 6493 (TCMB text). The amendment does three things, per a detailed breakdown by Turkish compliance publication Müşavirler Kulübü (source): it formally defines "identity document" (replacing a vague reference to "document"), it makes near-field-communication (NFC) chip-reading the primary method for verifying Turkish citizens remotely, and it explicitly authorizes collection of biometric data during that process. For the first time in the payment/e-money regime, it also lets payment and e-money institutions onboard foreign customers remotely, using passports that comply with the ICAO 9303 standard and carry an NFC chip.
This is not an isolated fintech tweak. It extends a pattern TCMB and MASAK (Turkey's Financial Crimes Investigation Board) have been building since June 27, 2026, when MASAK's own communique first allowed NFC-passport remote verification for non-Turkish nationals across all AML-obliged entities — banks, crypto-asset service providers, portfolio managers — subject to a three-month address-verification window, automatic high-risk classification, and a ban on transfers until address checks clear (Türkiye Today; Pekin Bayar Mizrahi). TCMB's September rule brings the payment-institution sector into that same framework roughly two months later.
The case for it
The strongest argument for this regulation isn't security theater — it's a real fraud problem meeting a real market failure. Remote onboarding via photo uploads and manual document review is trivially spoofable with consumer-grade editing tools; NFC chip reading cryptographically verifies that a passport or ID's embedded data hasn't been tampered with, which is a meaningfully higher bar than optical character recognition alone. And the foreigner provision solves an actual access problem: before this, a non-resident wanting a Turkish payment account or e-wallet — a remote worker, a property buyer, a digital nomad in a country with a large expat population — needed to show up in person at a branch. Turkey has spent years courting foreign investment and a fast-growing digital-nomad visa population; requiring physical presence for basic financial access was a self-inflicted friction point that pushed people toward informal or foreign-hosted alternatives entirely outside TCMB's supervision. Letting a verified ICAO passport substitute for a branch visit is, on its own, a liberalizing move, not a restrictive one.
Where it gets more complicated
The biometric-data provision deserves more scrutiny than it's getting. Turkey's own data protection authority, KVKK, has recent and directly relevant precedent here: an April 29, 2026 decision (No. 2026/921) held that biometric processing must clear proportionality, necessity, and data-minimization thresholds even where consent exists, and that regulators should default to less-intrusive alternatives — PINs, cards, supervised checks — before biometric systems, given that biometric data "cannot be forgotten" and typically doesn't change over a lifetime (KVKK announcement). That decision was about workplace attendance tracking, not fintech onboarding, and financial-crime prevention is a stronger necessity case than punch-clocks. But TCMB's communique doesn't appear to include the kind of proportionality guardrails — retention limits, breach-notification specifics, encryption standards for the biometric templates themselves — that KVKK's own doctrine would suggest should accompany a biometric mandate spanning every licensed payment institution's customer base. Centralizing facial-match and chip-derived biometric data across dozens of fintechs, several of them undercapitalized relative to the banks MASAK's June rule already covers, is a meaningfully larger attack surface than the status quo, and the rule is silent on what happens after a breach.
There's also a quieter equity problem: NFC-chip passports are standard in the US, EU, UK, and most of Asia, but far from universal. Travelers and remote customers from parts of Africa, South Asia, and Latin America where e-passport rollout lags will find the "more inclusive" foreigner provision doesn't actually reach them — they're still locked out of remote onboarding, just for a technical rather than a policy reason.
The right read
None of this argues for reversing the rule. Cryptographic chip verification beats photo uploads, and opening remote accounts to foreigners is a genuine improvement over branch-only access. But TCMB should pair the biometric mandate with the retention and breach-disclosure specificity that KVKK's own precedent implies is necessary, and regulators should track NFC-passport coverage gaps as a live equity question rather than declaring the access problem solved.
The policy design task now is making sure a rule that expands access on paper doesn't quietly narrow who it actually reaches in practice.