Penetration Testing Requirements in Türkiye: BDDK, TCMB, the Security Guide and Law 7545

The Regulation on Banks' Information Systems and Electronic Banking Services (Bankaların Bilgi Sistemleri ve Elektronik Bankacılık Hizmetleri Hakkında Yönetmelik) was published in the Resmî Gazete on 15 March 2020 (no. 31069). After a June 2020 amendment, a first group of articles took effect on 1 July 2020 and the rest on 1 January 2021.

• Article 18(7): the bank has penetration tests performed at least once a year by independent teams that have no role in the design, development, implementation or operation of the services it provides through information systems.
• Article 18(2): the bank's incident response team (SOME) is responsible for performing, or having performed, routine penetration testing.
• Article 3 defines a penetration test as testing to find vulnerabilities before they are exploited.

The regulation does not require testers to hold a TSE certificate, and it does not split scope into internet-facing, internal or post-change tests. The yearly test is a floor: routine testing by the SOME is expected between annual tests.

Payment and electronic money institutions are supervised by the Central Bank (TCMB). Its communiqué on the information systems of payment and e-money institutions (Resmî Gazete 1 December 2021, no. 31676, amended in 2023) sets the most detailed testing rule in Türkiye:

• Article 12(3): penetration tests are performed at least once a year, following scenarios that cover internal and external threats, by people with no information security role in the institution who hold a national or international penetration testing certification.
• Article 12(4): tests follow the method in Annex 5.
• Article 12(5): findings are remediated by priority under an action plan approved by the board.
• Article 12(6): an annual report to TCMB covers breaches, penetration test results and critical vulnerabilities.

Presidential Circular 2019/12 on information and communication security measures makes the Information and Communication Security Guide (Bilgi ve İletişim Güvenliği Rehberi) mandatory for all public bodies and critical infrastructure operators, with a compliance audit at least once a year. The current version, v1.1 of 1 March 2026, is published by the Cybersecurity Presidency (Siber Güvenlik Başkanlığı), which took over the powers of the former Digital Transformation Office.

Section 3.1.11, Penetration Tests and Security Audits, scales with the criticality level of the asset group:

• Level 1: external and internal penetration tests and security audits at regular intervals, under an NDA with a documented scope that includes social engineering; testing with different user profiles; re-testing of fixes with separation of duties; findings scored on a comparable scale.
• Level 2: penetration tests and security audits at least once a year.
• Level 3: regular red-team exercises, and a vulnerability scan and security audit before any hardware or software joins the network.

The circular also requires critical data (population, health, genetic and biometric data) to be stored in the country, and bars public data from cloud storage except the institution's own systems or domestic providers under its control.

Türkiye certifies penetration testing firms through the TSE Pentest Firm Certificate (TSE Sızma Testi Yapan Firma Belgesi), in levels A, B and C under TS 13638, with graded expert registration and yearly audits by TSE.

For public procurement the certificate becomes a hard requirement. The Ministry of Industry and Technology's regulation on authorizing participants in public IT service procurement (Resmî Gazete 29 June 2022) creates a Pentest Authorization Certificate (Sızma Testi Yetki Belgesi), which requires an ISO/IEC 27001 certificate together with a type A or B TSE pentest firm certificate. Since 29 September 2023, Article 89/A of the Public Procurement General Communiqué requires that certificate in tenders for penetration testing services, including from subcontractors that perform the tests.

Banks are not bound by the TSE scheme under the BDDK regulation; they need independent teams. Payment institutions need certified testers under the TCMB communiqué.

The Cybersecurity Law (Siber Güvenlik Kanunu, Law No. 7545, Resmî Gazete 19 March 2025) created a single authority, the Cybersecurity Presidency, and gives it powers that matter to any buyer or vendor:

• the Presidency can carry out, or have carried out, vulnerability and penetration tests (Article 5);
• it runs testing, certification and authorization of cybersecurity products and firms (Articles 5 and 6);
• products, systems and services for public bodies and critical infrastructure must come from experts or firms authorized and certified by the Presidency (Article 7(1)(c));
• vulnerabilities found must be reported to the Presidency without delay (Article 7(1)(b)).

As of October 2026 we found no published implementing regulation for the certification scheme. For a public body or critical infrastructure operator, the practical consequence is to buy security testing products and services through a provider that can meet the Presidency's authorization requirements as they are defined.

KVKK (Law No. 6698), Article 12, requires data controllers to prevent unlawful access to personal data and to safeguard it. The authority's Personal Data Security Guide (technical and administrative measures, April 2025 edition) says regular vulnerability scans and penetration tests are required, without setting a frequency or tester qualification.

Localization is explicit in finance:

• Banks: BDDK regulation Article 25(1) requires primary and secondary systems to be kept in Türkiye, and Article 25(5) extends that to systems used through outsourcing or the cloud and to their backups.
• Payment and e-money institutions: TCMB communiqué Article 21(1) requires primary and secondary systems and backup data centres in Türkiye; cloud services must be set up in the country.
• Public sector: Circular 2019/12 items 1 and 3, above.

A penetration test produces credentials, network maps and evidence of how to break in. A SaaS testing platform or a hosted AI model that processes them abroad deserves the same localization review as any outsourced system. An appliance that runs in the institution's own data centre, on its own models, avoids the question. See the sovereign AI red team guide.

1. 1Banks: schedule the yearly independent penetration test, and define the routine testing your SOME runs between annual tests.
2. 2Payment and e-money institutions: build internal and external threat scenarios, use certified testers with no security role in the institution, follow Annex 5, and prepare the annual report to TCMB.
3. 3Public bodies and critical infrastructure: classify asset groups by criticality, then plan regular tests (level 1), at least yearly tests (level 2) and red-team exercises (level 3) under the Security Guide.
4. 4Public tenders: require the Pentest Authorization Certificate from bidders and subcontractors.
5. 5Check where every security tool processes and stores test data against BDDK Article 25, TCMB Article 21 or Circular 2019/12.
6. 6Re-test every fix with separation of duties, and keep the evidence for the auditor.

The requirements by regulation page compares Türkiye with other jurisdictions.

Zero Hunt is an autonomous AI red team on an on-premise appliance: it runs black-box and gray-box penetration tests of networks and infrastructure from inside your data centre, on its own models, so findings and credentials do not leave Türkiye. Between the yearly independent tests it lets the security team test continuously and re-test every fix. Operators choose one of five autonomy levels that decide which actions wait for approval, and every finding is backed by Ed25519-signed, hash-chained evidence.

Zero Hunt maps findings to 34 frameworks, including ISO/IEC 27001, PCI DSS and SWIFT CSP. It does not ship a BDDK-, TCMB- or Security-Guide-specific report template, and it does not hold a TSE or Cybersecurity Presidency certificate. In Türkiye it is offered through local partners; see the partner program.

How often must a Turkish bank run a penetration test? At least once a year, by independent teams with no role in the services tested (BDDK regulation, Article 18(7)), with routine testing by the bank's incident response team in between.

Do penetration testers need a TSE certificate? For public tenders, yes: the Pentest Authorization Certificate requires a type A or B TSE certificate. Banks need independent teams under the BDDK rule. Payment and e-money institutions need testers with a national or international pentest certification.

What does the Information and Communication Security Guide require? Regular external and internal penetration tests and security audits, at least once a year for criticality level 2 and above, and regular red-team exercises at level 3. It is mandatory for public bodies and critical infrastructure operators.

Can a Turkish bank use a cloud pentest platform hosted abroad? Banks must keep primary and secondary systems in Türkiye, including outsourced and cloud systems and their backups. A tool that processes or stores test data abroad should be reviewed against Article 25 before use.

What changed with the 2025 Cybersecurity Law? It created the Cybersecurity Presidency, which certifies cybersecurity products and firms. Products and services for public bodies and critical infrastructure must come from firms it has authorized and certified.