Payment gateway integration in Turkey: virtual POS, 3D Secure and installments
Payment gateway integration connects your online store to a bank or a licensed payment institution so it can take card payments. In Turkey you choose between a bank virtual POS and a payment institution, then build the 3D Secure flow, installments, refunds and server-side confirmation, test it in a sandbox and go live. Keeping card data off your own servers is the simplest route for both security and PCI DSS scope.
What is payment gateway integration?
Payment gateway integration is the software connection that lets your online store take card payments through a bank or a payment provider. In Turkey the usual term is virtual POS, the online version of a card terminal. The customer enters card details, the issuing bank approves the payment, and the money reaches your account on the agreed schedule.
This guide is for companies selling to Turkish customers, including foreign companies with a Turkish entity. The market works differently from what many international teams expect. Card installments are part of everyday shopping, 3D Secure is the norm, and not every international gateway onboards Turkish merchants. Check the provider's current country support before you plan around it.
Bank virtual POS or payment institution: what is the difference?
The difference is who you sign with. With a bank virtual POS you sign a merchant agreement directly with one bank. With a payment institution you sign once with a provider that already works with many banks. Payment institutions in Turkey are licensed by the Central Bank of the Republic of Türkiye, so check the licence before you sign.
| Bank virtual POS | Payment institution | |
|---|---|---|
| Agreement | One merchant agreement per bank | One agreement with one provider |
| Onboarding | Bank review, usually slower | Usually faster |
| Fees | More room to negotiate at high volume | Standard tariffs, practical at low volume |
| Installments | Mostly limited to that bank's card programme | Installments across many banks' cards through one integration |
| Technical work | Separate integration and testing per bank | One integration, one set of docs |
| Money flow | Straight to your bank account | Through the provider, then to your account |
Many stores start with a payment institution and add a direct bank POS once volume settles. If the software is built to support more than one provider from the start, that change is small.
How does 3D Secure work in Turkey?
3D Secure is the step where the cardholder's own bank verifies the payment, usually with a one-time code by SMS or an approval in the banking app. The customer leaves your site for the bank's page and then returns. Most online card payments in Turkey use it, and non-3D payments are only possible where the bank or provider allows them under specific conditions. For unverified transactions, chargeback risk usually stays with the merchant.
The return from the bank page is the fragile part. Customers close tabs, lose connection or press back. The order status has to stay correct in every one of those cases.
How do fees and settlement work?
The fee, called commission locally, is taken from each successful payment. Settlement time, called valör in Turkish, is how long it takes for the money to reach your account. The two are linked: as a general tendency, faster settlement costs more and longer settlement can lower the rate. Rates depend on the provider, sector, volume and your agreement, so we do not quote figures. When comparing offers, also ask about installment rates, foreign and commercial card rates, whether fees are returned on refunds, setup or monthly fees, and how tariffs can change. Run last year's sales through each offer and compare the totals.
How do installments work?
Installments let the customer split a card payment into several monthly charges, with the options depending on the card. Your store looks up the card programme from the first digits and shows the installment options for that card. You decide which counts to offer, whether the customer or you absorb the extra cost, and which products qualify. Installment counts for some product groups are capped by regulation and the caps change over time, so ask your provider for the current rules. The installment total shown on screen must match the amount sent to the bank exactly.
How are refunds and cancellations handled?
A cancellation reverses a payment before the daily batch closes. A refund returns all or part of the amount after that. They may look the same in the admin panel, but they are different operations with different fee effects. Your admin should support partial refunds, and each refund should update the order, stock and invoice together. In Turkey invoices are issued electronically, which we explain in e-invoice integration in Turkey.
Should card data pass through your servers?
No. For most stores the best setup is one where card numbers never touch your servers. Any system that stores, processes or transmits card data falls under PCI DSS, the card industry security standard. Hosted payment pages and embedded payment fields keep the card number with the provider. For saved cards, use the provider's tokenization and store only their token. Your provider will tell you which compliance questionnaire applies.
Payment gateway integration step by step
- 01 Choose the provider Compare a bank POS and payment institutions using the same sales scenario, including installments.
- 02 Apply as a merchant Apply in your company's name. Providers usually expect the distance sales contract, return policy and contact pages to be live.
- 03 Get sandbox access Use the provider's test keys and test cards for all development.
- 04 Build the payment flow Order creation, payment form, 3D Secure redirect, return page and installment lookup.
- 05 Verify on the server Check the signature, amount and currency of the provider's notification, and ignore duplicates.
- 06 Add refunds and reporting Cancellation, partial refund and payment status in the admin, linked to each order.
- 07 Test every scenario Success, decline, abandoned 3D, duplicate notification, stock running out and refunds.
- 08 Go live carefully Switch to live keys, run a few small real payments, refund them and check settlement.
How is a payment confirmed?
A payment is confirmed by a signed server-to-server notification, not by what the browser reports. Browser data can be tampered with. The provider's webhook is signed with a secret key and verified on your side. We check three things: the signature is valid, the amount and currency match the order, and the payment has not been processed before. Cart totals are always calculated on the server. If the customer closes the tab on the bank page, the order stays pending until the notification or a status check settles it.
How do we build payment integrations at RadKod?
We integrate the bank or payment institution you choose, following its documentation. Card data does not touch your servers, results are verified server-side, and refunds and payment status are visible in the admin. We do not lock the payment code to a single provider. The merchant account, admin login and API keys are opened in your company's name, just like the domain, hosting and code.
Our quote fits on one page and the definition of done is signed on day one: every listed scenario passes in the sandbox and the first live payments are checked together with you. Bugs found in the 30 days after handover are fixed free of charge. If you are weighing a platform against custom software, see e-commerce platform or custom build. For new stores see our e-commerce service, and for connecting payments to an existing system see integrations.
Frequently asked questions
How long does payment gateway integration take?
With good provider documentation, the technical part usually takes a few weeks at most. Merchant approval often sets the pace, so start the application alongside development.
Can a foreign company take card payments in Turkey?
Local banks and payment institutions generally onboard companies registered in Turkey. Requirements differ by provider, so ask them directly about your company structure.
Do we have to offer installments?
No, but many Turkish shoppers expect them, especially for higher-priced items. You choose the counts and who absorbs the extra cost.
Can we skip 3D Secure?
Only if your bank or provider allows it, usually under specific conditions. Chargeback risk on unverified payments generally stays with the merchant. We recommend 3D Secure.
Can we use more than one provider?
Yes. If the software supports it, payments can be routed by card type or amount, and sales continue if one provider has an outage.
Can customers save their cards?
Yes, through the provider's tokenization. You store a token, never the card number.
Can we switch providers later?
Yes. With a provider-independent payment layer the switch is small. Saved card tokens usually cannot be moved to the new provider.
Sources
- 01 PCI Security Standards Council · PCI Security Standards Council
- 02 Central Bank of the Republic of Türkiye · Türkiye Cumhuriyet Merkez Bankası
- 03 EMVCo · EMVCo