and WCAG 2.2 for banking, in one package.
KVKK cookie management on local hosting for the Turkish banking sector, support for configuration aligned with BDDK requirements and a WCAG 2.2 AA-focused accessibility infrastructure. A single-embed solution for banks, participation banks, investment firms and fintech.
Frameworks covered under Turkish banking regulations
The badges above are supported standards. cerez.io is not an institution that issues a "BDDK compliance certificate"; it provides support for configuration aligned with BDDK requirements.
Banking's special compliance burden.
Far beyond a standard e-commerce site: multiple regulators, high security requirements, a local data hosting obligation and accessibility rights for people with disabilities must all be managed at once.
Consent without an audit log does not meet the burden of proof.
Under the BDDK Information Systems Communiqué, web components processing customer data must produce auditable logs. The KVKK explicit consent burden of proof also rests in your consent record. cerez.io stores the record of IP + timestamp + consent version + accepted categories in a data center in Turkey with 365+ day retention.
- Retrospective consent log records ready for a BDDK audit
- Under KVKK Article 9, all data is in a data center in Turkey
- Timestamped log, version tracking and CSV/XLSX export
GA4 or Meta Pixel should not run after a customer logs in.
Article 73 of Banking Law No. 5411, the customer confidentiality obligation: transferring data that can be linked to a customer to 3rd-party analytics tools without consent carries serious audit risk. cerez.io blocks all external scripts until consent is obtained; only permitted categories are loaded.
- GA4, Meta Pixel, Hotjar, LinkedIn Insight consent-based control
- Granular script management with the data-cb-category attribute
- Google Consent Mode v2 signals are updated on time
Access to e-banking is a fundamental right; no customer with a disability should be left out.
The EAA 2019/882 Directive directly covers banking services; in force since 28 June 2025. According to TÜİK 2022 data, around 12.8 percent of Turkey's population has a disability. Access to e-banking for elderly, visually impaired and cognitively challenged customers is both a legal obligation and a corporate responsibility.
- 10+ ready-made profiles: senior, visually impaired, cognitive, seizure safe
- EAA statement generator: documenting and publishing the obligation
- WCAG 2.2 scanner: 0-100 compliance score + prioritized violation report
A tool that knows Turkish banking regulations and keeps data in Turkey.
OneTrust and Cookiebot are powerful tools; however, on KVKK Article 9 data location, BDDK regulations and Turkish support, the advantage of a local solution is clear.
OneTrust / Cookiebot
Powerful but far from Turkey.
- Consent log in an EU/US data center, KVKK Article 9 risk
- No configuration support specific to BDDK + KAİK regulations
- No primary Turkish support channel, limited to business days
- WCAG accessibility widget is a separate product, separate invoice
"GDPR-compliant" and "KVKK + BDDK-compliant" are not the same thing.
cerez.io
Focused on Turkish regulations, local hosting.
- All consent data in Turkey, compliant with KVKK Article 9
- Templates and configuration specific to BDDK + KVKK + KAİK regulations
- Turkish support, response within business days
- Cookies + accessibility in one embed, one invoice
Honestly: at international scale OneTrust is broader; for Turkish banking compliance we are more specific.
Banking profile examples.
The scenarios below are not real customer cases; they are representative examples showing common need profiles in the banking sector.
5M+ monthly visitors, 10+ subdomains
Multi-domain: corporate site, e-banking, mobile, campaign, careers. Independent KVKK/EAA policy for each domain. Whitelabel + corporate identity. Enterprise plan + custom SLA.
KAİK + KVKK dual compliance
BDDK scope + KAİK accessibility guide covered with a single embed. Turkish bank legal text templates ready.
SPK + IAB TCF programmatic
Client confidentiality + investor disclosure for firms subject to SPK regulations. IAB TCF 2.3 certified CMP, ready for the EU programmatic ecosystem.
5-min setup before BDDK audit
Get started right away with the free plan before a license application or annual audit. Consent log retention is ready ahead of the audit; switching to Enterprise is flexible as your team grows.
Questions the banking sector asks
The most frequently asked questions on BDDK, KVKK, Law No. 5411, open banking and accessibility.
Why is cookie management critical in a BDDK information systems audit?
How does Banking Law No. 5411 affect cookies?
Why is WCAG 2.2 AA mandatory for a banking site?
What is the local advantage over a foreign CMP (OneTrust, Cookiebot)?
How do open banking + consent management work?
Are card details stored in cookies?
How is the multi-domain setup configured?
What is the difference between a demo call and a sales call?
A 30-minute demo with your banking team.
Live SDK setup with your technical + legal teams, a multi-domain example, consent log flow and WCAG widget test. Non-binding. Local hosting, Turkish-language support, BDDK + KVKK + EAA in a single package.
Note: cerez.io it is not an institution that issues a "BDDK compliance certificate". It provides support for a configuration aligned with BDDK requirements; for certification, the official audit mechanisms must be carried out.