BDDK + Circular 2025/10 Accessibility Compliance for Banks
Bring your internet banking, mobile banking and open banking interfaces to WCAG 2.2 A level while staying compliant with BDDK security requirements. The 21 June 2026 deadline has passed; start your compliance process without delay.
A Two-Layer Compliance Burden for Banks
All public and private banks in Turkey are covered by Circular 2025/10; the one-year compliance period ended on 21 June 2026 and the obligation is now in force. The fine tariff of Law No. 5378 (5,000-25,000 TL per finding) is, in its current form, aimed at physical accessibility; no direct web tariff has been set yet, and for banks the risk is not limited to this.
The security requirements of the BDDK Information Systems Regulation (e.g. CAPTCHA, OTP, session locking) can conflict with accessibility requirements. Complaints from disabled customers can be taken to the TBB Customer Complaints Arbitration Committee and lawsuits to consumer courts; reputational risk is a topic the entire banking sector watches closely.
The Right Solution for Your Bank Type
Deposit, participation and investment banks need to strike different balances between security and accessibility.
Deposit Banks
All banking products, high customer traffic. Internet and mobile banking are the main channels.
- CAPTCHA audio alternative
- Flexible OTP timeout
- Mobile WebView scanning
Participation Banks
Interest-free banking products. A sensitive customer base, with references to religious teaching that need to be inclusive.
- Interest-free product description texts
- Accessible contract PDF files
- Customer information texts
Investment Banks
B2B and HNW customer segment. SPK + BDDK dual regulation, content heavy on reports and charts.
- Text alternative for financial charts
- Accessible PDF reports
- Authorized user portal
Accessibility vs. Security Conflicts in Banking
The most common problems where BDDK regulation and WCAG 2.2 A collide.
Security Steps (CAPTCHA, OTP, e-Signature)
BDDK security requirements mandate CAPTCHA, OTP entry and device verification. Visual-only CAPTCHA is a WCAG 1.1.1 violation; an audio-based alternative and an extended timeout must be provided. OTP SMS messages with a short window such as 30 seconds can be insufficient for visually impaired users.
Mobile Banking SDK and Iframe Structures
Web-based modules embedded in mobile banking apps (e.g. investment, insurance) run inside iframes; native screen reader (TalkBack/VoiceOver) integration is usually missing. WCAG 4.1.2 (Name, Role, Value) violations are common.
Open Banking API Consent Screens
Under Banking Law No. 5411, open banking consent flows grant access to third-party finance apps. These consent screens are very short-lived and keyboard access is often broken. Disabled customers cannot use open banking services independently.
What Does Non-Compliance Cost a Bank?
For a bank, the risk is not only a fine; there is the annual BDDK audit, TBB Arbitration Committee complaints and reputation:
+ Ministry
+ TBB
cerez.io Bank Package
A bank-focused package aimed at BDDK, KVKK and Circular 2025/10 requirements.
WCAG 2.2 A Automatic Scanner
Multi-URL scanning for your internet banking and marketing site. Public pages are scanned in a real browser with axe-core; the result is a 0-100 Accessibility Health score and a fix list titled Fix now. Internal banking screens that require a session are not part of the automated scan; they need manual testing.
Accessibility Widget (30 Settings + 11 Profiles)
Widget for bank marketing pages and pre-login screens. Low vision, mobility impairment and senior profiles matter for banking. The Shadow DOM architecture does not conflict with BDDK security policies.
Accessibility Statement + BDDK Reporting
A statement in the 2025/10 format and a compliance status output for use in annual BDDK reporting. A management summary report for the risk management unit is generated automatically.
Local hosting + Enterprise contract
cerez.io infrastructure, data center in Turkey (KVKK Article 9 and BDDK data location requirement). Support times and channels are set in the Enterprise contract.
Works Seamlessly With Your Existing Banking Infrastructure
The Shadow DOM architecture does not violate BDDK security policies.
Bank Compliance in 5 Steps
Step-by-step WCAG 2.2 A preparation that respects BDDK requirements.
Marketing Site and Login Screen Scan (1 Week)
Campaign and marketing pages on the public domain and the banking login screen are scanned. The first list of Critical/Serious violations is reported.
Widget Integration: Public Pages
Without conflicting with BDDK security policies, the widget is activated for the public area (pre-login). Disabled customers gain access to screen reader, contrast and magnifier tools on the login screen.
Internal Banking WCAG A Fixes (1-3 Months)
Critical violations in investment, loan and insurance modules (unlabeled forms, timeouts, keyboard traps) are fixed by your team; the scan report gives fix guidance for every finding.
Accessibility Statement and BDDK Management Report
A statement describing the compliance status of the website is published in the footer. A management summary report is generated for the annual audit under the BDDK Information Systems Regulation.
Accessibility Logo Application
Once WCAG A is met, an "Accessibility Logo" application is made to the Ministry of Family and Social Services. In the bank's corporate communications, this logo builds customer trust.
3 Options for Banks
cerez.io Enterprise compared with foreign solutions and manual compliance.
Foreign Solutions
OneTrust / UserWay / AccessiBe
- $500 per month and up
- BDDK data localization risk
- KVKK Article 9 risk
- English-only support
- No Turkish banking legislation knowledge
- No BDDK audit assistance
Manual Compliance
Big4 consultant and in-house IT
- 6+ month project
- Consultant 500,000+ TL
- Managing BDDK vs. WCAG conflicts is hard
- Re-audit on every release
- No ongoing maintenance
- Manual management reporting
cerez.io Enterprise
Türkiye-based, aimed at BDDK requirements
- Public area in 1 week
- Local hosting
- Data in Türkiye (BDDK data localization expectation)
- E-mail support in Turkish
- Automatic management reporting
- Support terms set by contract
Early Access Pilot Banks
cerez.io is currently in early access. The statements below are compiled from the technical feedback of banks in the pilot program.
Our investment report PDFs were not screen reader compatible. With cerez.io's accessible PDF production guidelines, we created internal training material for financial chart captions.
Bank Enterprise for Your Bank
The Enterprise plan is recommended for all banks; support times and channels are set in the Enterprise contract.
Enterprise (Bank Package)
Bank and subsidiary sites in one panel (subscription per site), BDDK reporting support, unbranded widget. Support times and channels are set in the contract.
- Bank and subsidiary sites in one panel, subscription per site
- Support times set in the contract
- Support terms in the contract
- BDDK reporting support
- Unbranded widget (Powered by removed)
Banks: Frequently Asked Questions
Where does your bank stand on accessibility?
The one-year compliance period for banks ended on 21 June 2026. Consider the cerez.io Enterprise package for dual BDDK and WCAG compliance.