Short answer: Outsource software development compliance means putting each regulatory duty into the contract and asking for evidence that the vendor meets it. The core texts are GDPR Article 28 and Chapter V for personal data, DORA Article 30 for EU financial entities and your regulator's outsourcing rules; responsibility stays with you, so the contract needs audit rights, subcontractor control, incident notice and a tested exit. With a partner in Turkey, add the Turkish rules that change standard clauses, such as Article 48 of Copyright Law No. 5846 and the central bank's in-country rule for payment institutions.
A compliance lead mid-procurement needs each required clause, the text behind it and the evidence that proves it, whether the work is called outsourcing or nearshore development. This guide maps them for a foreign fintech or other regulated buyer hiring a software partner in Turkey, and for an agency passing the terms down to subcontractors.
Disclosure: Fincode is a Turkish software company that sells this kind of work, so this guide is not neutral. It names and ranks no other company, and Fincode claims no third-party security certification. Texts were read on 5 November 2026. This is general information, not legal advice; the rules depend on your jurisdiction and regulator. Entity, signatory and VAT checks are in software development company in Turkey.
Who is liable when you outsource software development?
The regulated buyer stays liable: each text below lets you outsource the work, not the responsibility.
| Buyer | Text | What it says |
|---|---|---|
| EU financial entity | DORA, Regulation (EU) 2022/2554, Article 28(1)(a), applying since 17 January 2025 | Remains fully responsible for its duties when it uses ICT services |
| GDPR controller | GDPR Article 28(1) and (4) | Only processors with sufficient guarantees; a processor stays fully liable for its sub-processors |
| UK firm regulated by the FCA, except banks, building societies, IFPRU investment firms and payment or e-money institutions, which the FCA points to the EBA outsourcing guidelines | FCA guidance FG16/5, updated September 2019 | Keeps full accountability and cannot delegate it to the provider |
| Turkish payment or e-money institution | Communiqué of the central bank (TCMB) on information systems, Article 16(1), (3)(a) and (6) | Keeps decision power and responsibility, and answers for the provider's acts |
DORA Article 3(21) defines ICT services as those provided "on an ongoing basis", which fits maintenance, hosting and support more easily than a one-off build, so ask how the buyer's counsel classifies yours.
Software development outsourcing compliance: the clause map
Each clause below traces to a text, with evidence to request before signing.
| Clause | Legal basis | Evidence to ask for |
|---|---|---|
| Scope and locations | DORA 30(2)(a) and (b): services, countries of work and data storage, notice of changes | Countries, hosting regions and offices used |
| Processing on instructions | GDPR 28(3)(a) to (c): documented instructions, confidentiality, Article 32 measures | Confidentiality undertakings and the access policy |
| Subcontractors | GDPR 28(2) and (4); DORA 30(2)(a) and 29(2); TCMB 16(9)(e) | Named subcontractors and freelancers, and the flow-down clause |
| Audit and access | GDPR 28(3)(h); DORA 30(3)(e); TCMB 16(9)(ğ), (h) and (ı) | Audit consent for you, your auditor and supervisor, and who pays |
| Incident notice | GDPR 33(2): processor tells the controller without undue delay; DORA 30(2)(f): help free or at a cost fixed in advance | A named contact, a channel and a sample incident report |
| Regulator cooperation | DORA 30(2)(g); TCMB 16(9)(h), (ı) and (i) | A clause binding the vendor to answer the buyer's supervisor |
| Termination | DORA 28(7) and 30(2)(h): causes include significant breach, weak ICT risk management, a supervisor unable to supervise | Notice periods matching the buyer's policy |
| Exit and data | GDPR 28(3)(g); DORA 30(2)(d) and 30(3)(f); TCMB 16(9)(b) | A handover plan and a deletion confirmation |
| Ownership | TCMB 16(9)(d) and (j); Law No. 5846 Article 52 | The assignment deed and a contributor list |
| Training | DORA 30(2)(i) | Agreement to join the buyer's awareness sessions |
For critical or important functions, DORA Article 30(3) adds precise performance targets, tested contingency plans, threat-led penetration testing and an exit with a mandatory transition period. FG16/5 adds that under a non-UK contract, a firm should still ensure effective access to data and premises for itself, its auditor and the regulator. Its web page, updated 18 March 2026, says rules for notifying the FCA of material third-party arrangements apply from 18 March 2027.
Data transfer to a partner in Turkey: GDPR Chapter V and KVKK
Personal data that a vendor in Turkey can reach needs a GDPR Chapter V tool, because Turkey was not on the European Commission's adequacy list on 5 November 2026.
- Module. In the standard contractual clauses (Decision 2021/914), Module Two fits a buyer that is the controller and Module Three a buyer that is itself a processor; Clause 14 requires an assessment of the destination's laws and practices.
- Subcontractors. GDPR Article 28(2) allows specific prior authorization, or general authorization with notice of changes and a right to object.
- Turkey's own rule. When personal data leaves Turkey, such as a Turkish client's data sent back to you, Article 9 of Law No. 6698 allows a standard contract published by the data protection authority (KVKK), notified within five business days of signing; Article 18 fines a missed notice TRY 50,000 to TRY 1,000,000, as the law states it before annual revaluation.
- Avoid the transfer. With synthetic or anonymized test data and no production access, there may be nothing to transfer; pseudonymized data is still personal data.
When the end client is a Turkish payment or e-money institution
If the software runs for an institution licensed by the Central Bank of the Republic of Türkiye (TCMB), its information systems communiqué (Resmî Gazete no. 31676, 1 December 2021) flows into your contract. The consolidated text read on 5 November 2026 includes amendments up to 4 September 2026.
| Article | Rule | For the vendor |
|---|---|---|
| 21(1) | Primary and secondary systems and backup centers are kept in Turkey; a carve-out covers foreign partners' systems in cross-border payments | Plan production and backups in Turkey |
| 21(2) | Systems that execute payment transactions, and their backups, are in principle in Turkey, and so are an outsourcer's systems used for that service | Operate such systems in Turkey |
| 16(7) | Cloud set up in Turkey; sensitive customer or personal data only in a private cloud dedicated to the institution or a TCMB-approved community cloud; test and development environments without customer data are exempt | Keep customer data out of build environments |
| 16(8) | Access limited to what the job requires | Expect narrow, role-based access |
| 16(9) | Minimum contract content, points (a) to (k) | Service levels, data destruction, IP, subcontractor flow-down, in-house-level audits, records for the TCMB |
| 16(13), added in October 2023 | For critical systems and security products, production or R&D in Turkey is an important criterion, and such providers need response teams in Turkey | Where your team sits can count |
Confirm the license on the TCMB's lists of payment institutions (opens in a new tab) and electronic money institutions (opens in a new tab), which show revoked licenses separately. Banks are on the BDDK institution list (opens in a new tab) and come under the banking regulator's own rules, not read for this guide.
How to verify a Turkish software partner in official registers
Check each fact in the issuing body's own register; no official list ranks or certifies software companies.
| Question | Official source | A pass does not prove |
|---|---|---|
| Does the company exist, and who represents it? | Trade Registry Gazette (opens in a new tab) notices; the Ministry of Trade's MERSİS (opens in a new tab) registry | Capability or current shareholders |
| Is the tax ID real? | Revenue Administration (GİB (opens in a new tab)); routes in the Turkey VAT number check | Good standing or sanctions status |
| Is the end client a licensed payment or e-money institution, or a bank? | TCMB lists; BDDK list | Anything about its vendors: the lists name institutions |
| Can an EU client record the vendor under DORA? | The vendor's legal entity identifier (LEI), checked in GLEIF's search (opens in a new tab) | Anything beyond identity |
The LEI row matters: Implementing Regulation (EU) 2024/2956, Article 3(5), requires an LEI or EU identifier (EUID) for each ICT provider that is a legal person in a financial entity's register of information, and recital 9 says providers outside the Union should be identified by LEI only. Ask early whether the vendor has one. Apply these checks to Fincode too; its registry details are published.
Outsourcing software development security: evidence, not badges
For fintech software development security, ask for artifacts that show how the vendor builds and tests, mapped to a public framework, rather than for a logo.
- NIST SSDF. SP 800-218 version 1.1 (February 2022) was NIST's final text on 5 November 2026; the Revision 1 draft of 17 December 2025 had no final version yet. Name tasks such as PS.3.2 (provenance data for each release, such as a software bill of materials), PW.4.4 (verify third-party and open-source components) and RV.1.1 (investigate vulnerability reports).
- OWASP ASVS. Version 5.0.0, published 30 May 2025, was the latest stable release on the project's site on 5 November 2026. Name the version and level, so the test report has a fixed target; mobile apps have MASVS, covered in fintech app development cost.
- ISO/IEC 27001. Compliance sites cite Annex A control 8.30, outsourced development, in the 2022 edition; ISO sells the text and it was not opened here, so ask your ISMS owner which controls apply.
- Licenses and secrets. A dependency and license list per release; test credentials during development and production secrets held by you, as in API key security.
A test report lists each case with environment, date and result, failures included; Fincode's sample test report shows one format. For trading software, an outside code review, which Fincode also sells, is another check.
Worked example: an IP clause that Turkish law changes
A template clause assigning all present and future work product on creation can fail for the future part under Turkish copyright law.
Hypothetical clause, not a template. "Supplier hereby assigns to Client all intellectual property rights in all work product, existing or future, on creation."
Law No. 5846, read 5 November 2026 (paraphrased). Article 48(3) voids a transfer or license of a work not yet created or still to be completed. Article 50 keeps a promise to transfer such a work valid, but either side may end a promise covering all future works, or a whole type of work, one year after notice. Article 52 requires a written contract listing each right separately, and Article 49 makes an onward transfer depend on the author's written consent.
The usual repair. A master agreement in which the vendor undertakes to assign each deliverable on acceptance, plus a deed signed at each accepted milestone that lists the rights one by one and names every contributor, freelancers included.
TCMB Article 16(9)(d) also asks for IP terms, so one deed serves both.
Outsource software development communication: what to write down
Write down who tells whom, about what and through which channel: most clauses above work only when a notice reaches the right person.
- Named contacts for incidents, audits, subcontractor changes and regulator requests, each with a deputy.
- A notice channel that does not depend on the affected systems, with a written record of each notice.
- Change notices before a new location or subcontractor starts.
- Reporting on service levels, incidents and findings at an agreed interval; a TCMB-licensed client's senior management reports on its providers to the board yearly under Article 16(2).
- Language of record, so a bilingual contract has one controlling text.
- Hours. Turkey stays on UTC+3 all year, so the overlap shifts when your clocks change.
At each milestone, hand over the repository with history, build steps, the dependency and license list, the runbook and the signed deed. Fincode's white-label development page offers subcontract work; hold Fincode to the same list.
Frequently asked questions
Does DORA apply to a software vendor outside the EU?
Mostly through the client: the EU financial entity must put the Article 30 terms into contracts with ICT providers wherever they are based, weigh third-country subcontracting for critical or important functions under Article 29(2) and record the vendor's LEI.
Are the EBA outsourcing guidelines still in force?
As read on 5 November 2026, the EBA's page says its final guidelines on third-party risk for non-ICT services, announced on 18 September 2026, repeal the outsourcing guidelines once applicable, and it showed no application date. ICT third-party risk comes under DORA.
Can a Turkish payment institution use a developer abroad?
The articles read do not bar it: Article 21 keeps payment systems, and an outsourcer's systems for them, in Turkey; Article 16(13) weighs production or R&D in Turkey for critical systems and security products; test environments without customer data fall outside Article 16(7).
Is an ISO 27001 certificate enough evidence?
Not by itself. Check the certificate's scope; GDPR Article 28(5) treats codes of conduct and certifications approved under Articles 40 and 42 as one element of a processor's guarantees, not a substitute for the Article 28(3) contract, and DORA Article 30 asks for contract terms.
Sources
- EUR-Lex: Regulation (EU) 2022/2554 (DORA), Articles 3, 28 to 30 and 64 (opens in a new tab)
- EUR-Lex: Regulation (EU) 2016/679 (GDPR), Articles 28 and 33 and Chapter V (opens in a new tab)
- EUR-Lex: Commission Implementing Decision (EU) 2021/914, standard contractual clauses (Modules Two and Three, Clause 14) (opens in a new tab)
- EUR-Lex: Commission Implementing Regulation (EU) 2024/2956, register of information, recital 9 and Article 3 (opens in a new tab)
- European Commission: Adequacy decisions, read 5 November 2026 (opens in a new tab)
- European Banking Authority: Guidelines on outsourcing arrangements and third-party risk, status read 5 November 2026 (opens in a new tab)
- FCA FG16/5: Guidance for firms outsourcing to the cloud and other third-party IT services (updated September 2019) (opens in a new tab)
- NIST SP 800-218, SSDF version 1.1 (February 2022) (opens in a new tab)
- NIST SP 800-218 Rev. 1, SSDF version 1.2, initial public draft (17 December 2025) (opens in a new tab)
- OWASP ASVS project site: version 5.0.0, stable release, published 30 May 2025 (opens in a new tab)
- Mevzuat: Personal Data Protection Law No. 6698, Articles 9 and 18 (Turkish) (opens in a new tab)
- KVKK: Standard contracts for transfers abroad (Turkish) (opens in a new tab)
- TCMB: Communiqué on information systems of payment and e-money institutions, consolidated, Articles 16 and 21 (Turkish) (opens in a new tab)
- FCA: FG16/5 web page, last updated 18 March 2026, with the notice on material third-party arrangement rules from 18 March 2027 (opens in a new tab)
- Mevzuat: Law No. 5846 on Intellectual and Artistic Works, Articles 48 to 52 (Turkish) (opens in a new tab)
This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the editorial policy.