BDDK + Circular 2025/10 Accessibility Compliance for Banks
Bring your internet banking, mobile banking and open banking interfaces to WCAG 2.2 A level while staying compliant with BDDK security requirements. Start your compliance process before the 21 June 2026 deadline.
A Two-Layer Compliance Burden for Banks
All public and private banks in Turkey fall under Circular 2025/10 and are in the 1-year compliance period group. For banks, the risk is not only the 5,000-25,000 TL administrative fine from the Ministry of Family and Social Services.
The security requirements of the BDDK Information Systems Regulation (e.g. CAPTCHA, OTP, session locking) can conflict with accessibility requirements. Complaints from disabled customers can be taken to the TBB Customer Complaints Arbitration Committee and lawsuits to consumer courts; reputational risk is a topic the entire banking sector watches closely.
The Right Solution for Your Bank Type
Deposit, participation and investment banks need to strike different balances between security and accessibility.
Deposit Banks
All banking products, high customer traffic. Internet and mobile banking are the main channels.
- CAPTCHA audio alternative
- Flexible OTP timeout
- Mobile WebView scanning
Participation Banks
Interest-free banking products. A sensitive customer base, with references to religious teaching that need to be inclusive.
- Interest-free product description texts
- Accessible contract PDF files
- Customer information texts
Investment Banks
B2B and HNW customer segment. SPK + BDDK dual regulation, content heavy on reports and charts.
- Text alternative for financial charts
- Accessible PDF reports
- Authorized user portal
Accessibility vs. Security Conflicts in Banking
The most common problems where BDDK regulation and WCAG 2.2 A collide.
Security Steps (CAPTCHA, OTP, e-Signature)
BDDK security requirements mandate CAPTCHA, OTP entry and device verification. Visual-only CAPTCHA is a WCAG 1.1.1 violation; an audio-based alternative and an extended timeout must be provided. OTP SMS messages with a short window such as 30 seconds can be insufficient for visually impaired users.
Mobile Banking SDK and Iframe Structures
Web-based modules embedded in mobile banking apps (e.g. investment, insurance) run inside iframes; native screen reader (TalkBack/VoiceOver) integration is usually missing. WCAG 4.1.2 (Name, Role, Value) violations are common.
Open Banking API Consent Screens
Under Banking Law No. 5411, open banking consent flows grant access to third-party finance apps. These consent screens are very short-lived and keyboard access is often broken. Disabled customers cannot use open banking services independently.
cerez.io Bank Package
A bank-focused package that delivers compliance with BDDK, KVKK and Circular 2025/10.
WCAG 2.2 A Automatic Scanner
Multi-URL scanning for your internet banking and marketing site. Instant violation report for public pages; manual checklist and consultant support for internal banking screens that require a session.
Accessibility Widget (40+ Features + 10+ Profiles)
Widget for bank marketing pages and pre-login screens. Profiles for the visually impaired, motor impairment and elderly users are critical for banking. The Shadow DOM architecture does not conflict with BDDK security policies.
Accessibility Statement + BDDK Reporting
A statement in the 2025/10 format and a compliance status output for use in annual BDDK reporting. A management summary report for the risk management unit is generated automatically.
Local Hosting + Enterprise SLA
cerez.io infrastructure, Turkey data center (KVKK Article 9 and BDDK data localization requirement). In the Enterprise plan, dedicated support, SLA and an on-premise deployment option are open for evaluation.
Works Seamlessly With Your Existing Banking Infrastructure
The Shadow DOM architecture does not violate BDDK security policies.
Bank Compliance in 5 Steps
Step-by-step WCAG 2.2 A compliance without violating BDDK requirements.
Marketing Site and Login Screen Scan (1 Week)
Campaign and marketing pages on the public domain and the banking login screen are scanned. The first list of Critical/Serious violations is reported.
Widget Integration: Public Pages (5 Minutes)
Without conflicting with BDDK security policies, the widget is activated for the public area (pre-login). Disabled customers gain access to screen reader, contrast and magnifier tools on the login screen.
Internal Banking WCAG A Fixes (1-3 Months)
Critical violations in the investment, loan and insurance modules (unlabeled forms, timeouts, keyboard traps) are fixed together with your team. cerez.io consulting provides recommendations that do not conflict with BDDK security requirements.
Accessibility Statement and BDDK Management Report
A statement describing the compliance status of the website is published in the footer. A management summary report is generated for the annual audit under the BDDK Information Systems Regulation.
Accessibility Logo Application
Once WCAG A is met, an "Accessibility Logo" application is made to the Ministry of Family and Social Services. In the bank's corporate communications, this logo builds customer trust.
3 Options for Banks
cerez.io Enterprise compared with foreign solutions and manual compliance.
Foreign Solutions
OneTrust / UserWay / AccessiBe
- $500 per month and up
- BDDK data localization risk
- KVKK Article 9 risk
- English-only support
- No Turkish banking legislation knowledge
- No BDDK audit assistance
Manual Compliance
Big4 consultant and in-house IT
- 6+ month project
- Consultant 500,000+ TL
- Managing BDDK vs. WCAG conflicts is hard
- Re-audit on every release
- No ongoing maintenance
- Manual management reporting
cerez.io Enterprise
Turkey-based and BDDK-compliant
- Public area in 1 week
- Local hosting
- BDDK data localization compliance
- Dedicated Turkish support
- Automatic management reporting
- SLA option
Early Access Pilot Banks
cerez.io is currently in early access. The statements below are compiled from the technical feedback of banks in the pilot program.
We needed to strike a balance between BDDK security requirements and accessibility. cerez.io consulting recommended suitable solutions for an audio CAPTCHA alternative and OTP timeout.
Our investment report PDFs were not screen reader compatible. With cerez.io's accessible PDF production guidelines, we created internal training material for financial chart captions.
Bank Enterprise for Your Bank
The Enterprise plan is recommended for all banks; BDDK audit reports, SLA and dedicated support are included.
Banks: Frequently Asked Questions
Where does your bank stand on accessibility?
Banks have a 1-year compliance period. Consider the cerez.io Enterprise package for dual BDDK and WCAG compliance.