The infrastructure needed to accept card payments on a website is obtained by signing a merchant agreement with a bank or a payment institution authorized by the Central Bank of the Republic of Turkey; the application includes a review of business details and the website where sales will occur, and payment infrastructure is integrated into the website after approval. Which route to choose depends on the business structure, sales volume, and how quickly it wants to start.

This article answers how to obtain a virtual POS step by step: the differences between banks and payment institutions, how to verify an institution’s license through the official list, what must be ready on the website before applying, what 3D Secure and PCI DSS mean, and the items determining cost. No commission figures are given because rates vary by institution and agreement.

What is a virtual POS, and how does it differ from a physical POS device?

It is a merchant service allowing card payments through a payment form on a website instead of through a device. The customer enters card details on the website or on a secure page opened by the payment provider, the transaction is approved by the bank, and the amount reaches the business’s account within the period specified in the agreement.

With a physical POS, the card is read by a device and the cardholder is present. In online payments, the card is not physically present; additional layers therefore come into play for authentication, fraud prevention, and card data protection. This is also why the sales website is evaluated alongside the business during the application stage.

A bank virtual POS or a payment institution?

Both routes perform the same job; the difference lies in the counterparty to the agreement, the extent of the application, and how integration is handled. A bank makes a merchant agreement directly, while a payment institution enables acceptance of cards from many banks through a single infrastructure.

CriterionBank virtual POSLicensed payment institution
Contracting partyThe bank the business works withPayment institution authorized by the CBRT
ApplicationThrough a branch or commercial banking unit; the business’s history may be examined in greater detailMostly online application and document upload
Installments and card coverageInstallments generally limited to the bank’s own card programCards from different banks can be brought together in one infrastructure
IntegrationThe bank’s technical documentation or a ready-made platform moduleReady-made plugins and shared payment page options are common
Suitable situationA business with established commercial relationships and regular turnoverA new store wanting to open quickly

Some businesses start with a payment institution and make a separate bank agreement once sales stabilize, while others use both infrastructures together. When choosing, compare not only commission but also settlement time, the refund process, and the quality of technical support.

If sales take place only through social media or messaging and no website exists yet, solutions such as payment links offered by some institutions can provide a temporary starting point. However, as the product count increases, moving to a store with cart, inventory, and order tracking is healthier for both customer experience and record keeping. Whichever route is chosen initially, collecting payments in an account opened in the business’s name simplifies accounting.

Where can a payment institution’s license be verified?

Companies providing payment services in Turkey obtain operating authorization from the Central Bank under Law No. 6493, and the current list of these institutions is published on the CBRT website. Before signing an agreement, search for the company’s legal name on this list; logos or statements on a promotional page are not sufficient on their own.

The table on the CBRT payment institutions pageshows which payment services each institution is authorized to provide.

The same page states that the authorization of institutions licensed under Article 12, paragraph one, subparagraph (c) of the Law is limited to “acceptance of payment instruments.” Electronic money institutions appear in a separate list. The current text of the law can be read on the Law No. 6493 page in the Legislation Information System .

Pay attention to an exact match of legal names; the brand name and the company’s registered legal name may differ. Infrastructure collecting card details should not be connected to the website until it is confirmed that the company in the contract and the listed company are the same.

Page contents

Trustworthy web agency: handshaking client and team, trust shield illustration

What must be ready on the website before applying

A virtual POS application generally requires less follow-up when the sales website is live and its legal pages are complete. Many institutions also examine the website while assessing the application; missing pages are among the main causes of delayed approval. The points checked before applying are:

  • Product or service descriptions and tax-inclusive prices are visible on the website.
  • Pre-contractual information and the distance sales contract are published where customers can open and read them before payment.
  • Withdrawal rights, refund conditions, and delivery terms are clearly documented on a separate page.
  • The privacy notice under KVKK (Turkey’s Personal Data Protection Law) and the privacy policy are published.
  • The business’s legal name, address, telephone, and email address appear on the contact page.
  • The website opens with HTTPS, and cart and order steps work without problems.

ETBİS (Turkey’s Electronic Commerce Information System) registration through e-Devlet is also required before opening for sales. If the store is being built from scratch, these pages and the payment step are prepared within the e-commerce website development process.

Which documents are requested in a virtual POS application?

Required documents vary by institution and whether the business is a sole proprietorship or a company; the common requirement is paperwork showing the business’s identity, tax registration, and signing authority. The account receiving payments is also generally expected to be opened in the business’s name.

The current, complete list should always be obtained from the bank or payment institution receiving the application. The authorized person’s telephone and email details must also be current during the application; these channels are used if the institution requests additional information. The activity declared on the application form must match the website’s products; declaring a different industry while selling other products can lead to suspension of the agreement. Notifying the institution if the product range expands later prevents possible future interruptions.

Note: This section explains the application process in general terms and does not replace financial or legal advice. Support from an accountant or legal professional is recommended for contract provisions, tax obligations, and invoicing requirements.

The virtual POS application process, step by step

The process includes several stages from selecting an institution to the first real payment reaching the account. The typical flow is as follows:

  1. Determine business needs: single payments or installments, whether foreign cards are required, and estimated monthly sales volume.
  2. Obtain proposals from several banks and licensed payment institutions, and verify license status through the CBRT list.
  3. Prepare the website for application with legal pages and product information.
  4. Complete the application form, submit the requested documents, and sign the merchant agreement.
  5. Install the payment module on the website using the institution’s test credentials and perform trial transactions.
  6. Switch to live keys and check successful payment, failed payment, and refund scenarios using a small real payment.

During testing, ensure that order statuses update correctly and that customers see a clear message when payment fails. Skipping these checks can produce orders whose payment has been collected but which still appear pending in the system. Comparing transactions in the institution’s panel with store orders in the first days after going live is also a good habit.

Let us set up the payment infrastructure together

Briefly explain which platform the store uses, which institution supplied a proposal, and what problem occurs during payment, and a free preliminary assessment is provided. Once the integration and testing scope is clear, pricing information is sent the same day, and setup uses the business’s own accounts.

Items determining commission and cost

The cost of a virtual POS is more than a single commission rate; per-transaction deductions, installment differences, settlement time, and any fixed fees must be evaluated together. When comparing two proposals, ask both parties the same questions:

  • How are deductions calculated for single payments and installment transactions?
  • How many days does settlement take, and is early transfer charged separately?
  • Are there fixed charges such as setup, annual use, or a minimum turnover requirement?
  • Are foreign cards accepted, and are these transactions priced differently?
  • Are additional fees charged to the business for refunds and chargebacks?
  • What are the contract termination conditions and notice period?

If these items do not appear in the written proposal, clarify them before signing the contract. All setup and operating expenses outside payment infrastructure are discussed item by item in the article on the cost of setting up an e-commerce website .

Transparent pricing: calculator and budget planning illustration

What does 3D Secure do?

3D Secure is a security protocol that authenticates the cardholder through the card-issuing bank during online card payments. The customer enters a one-time code sent by their bank during payment or approves the transaction in the mobile banking application; this makes it harder for someone else to use the card.

The EMVCo 3-D Secure page, maintained by the organization managing the protocol standard, defines its purpose as preventing fraud in card-not-present transactions and securing e-commerce payments. For the business, a 3D Secure transaction adds a stage to payment; in return, it provides a stronger position in disputes based on unauthorized card use. Which transactions use 3D Secure and which are accepted directly is determined in the agreement with the institution.

Current versions of the protocol assess risk using device and order information transmitted with the transaction. As a result, some payments considered low risk may not require an additional customer step, while suspicious payments trigger authentication. A payment page that opens comfortably on mobile and a smooth return to the store from the bank approval screen are important to prevent abandonment at this stage.

PCI DSS: who is responsible for card data security?

PCI DSS is an international data security standard expected of every organization storing, processing, or transmitting card details. The PCI Security Standards Councilstates that the standard covers merchants, payment processors, banks, and service providers.

For a small store, the practical consequence is this: when card details are collected through a page or frame hosted by the payment institution, without the card number ever passing through the website’s own server, the website’s security burden decreases. Custom software recording card details directly in the website’s database requires much more extensive compliance work. Ask the institution which integration method requires which compliance declaration. The recommended connection method is generally stated clearly in institutions’ technical documentation; decide on integration after reading these documents and record every point where card information passes through the website.

Virtual POS integration in WooCommerce and ready-made platforms

In stores built with WordPress and WooCommerce, a virtual POS is usually connected through the institution’s official plugin. After installation, enter the keys obtained from the institution’s panel, enable test mode first, and then enable live mode.

Two approaches stand out in integration. In the first, customers are redirected to the institution’s page for payment and return to the website afterward; in the second, the payment area is displayed within the website through a frame supplied by the institution. Both methods require correctly defining the address where payment results are reported to the website; otherwise, an order may appear unpaid even though money has been collected.

Avoid unofficial plugins or those left without updates for a long time; a vulnerability at the payment step directly affects customer data. If plugin and WooCommerce updates are not performed regularly, the payment page may stop working after a version change. Such problems are addressed within WordPress troubleshooting , while WordPress maintenance services can be chosen for regular checks. In ready-made e-commerce packages, supported institutions depend on the package itself; payment integrations are also compared when choosing e-commerce scripts .

Common mistakes in the virtual POS process

Most mistakes arise from insufficient preparation before applying and signing contracts without reading them. Common examples include:

  • Applying while the website is under construction and legal pages are missing.
  • Looking only at commission rates while overlooking settlement time and fixed fees.
  • Signing an agreement without checking the institution’s license on the CBRT list.
  • Going live with infrastructure still in test mode or testing live keys in a testing environment.
  • Not learning in advance how to perform refunds and partial refunds through the panel.
  • Leaving the payment plugin without updates for years.

Most items on this list arise when payment infrastructure is treated as a separate job from the rest of the store. In fact, the cart, shipping options, invoicing information, and payment step work together; a change in one can affect another. Placing a small test order after an update or design change in the store is the simplest way to catch problems before customers notice them.

Let us start accepting online payments smoothly

Stores comparing institutions, facing rejected applications, or receiving errors at the payment step can call or message this number. Responses are provided between 09:00 and 21:00; the required steps are listed in sequence for each institution.

Frequently asked questions

Yes, sole proprietorships can also apply for a virtual POS through a bank or licensed payment institution. Since required documents vary by business type, obtain the current list from the institution receiving the application.

Generally, because a virtual POS involves a merchant agreement, a business with tax registration is required. Selling without tax registration should be evaluated with an accountant.

The timeframe varies by institution, completeness of documentation, and whether the website is ready. Applications made with a website whose legal pages are complete generally result in fewer additional requests.

Search for the company’s legal name in the payment institutions list published by the Central Bank of the Republic of Turkey. The table also shows which payment services the institution is authorized to provide.

Which transactions use 3D Secure is determined in the agreement with the bank or payment institution. By authenticating the cardholder, it provides additional protection against unauthorized card use.

Storing card data brings substantial obligations under PCI DSS and is therefore not preferred for small stores. Collecting card details on the payment institution’s page or frame reduces the website’s security burden.

Most institutions have an official WooCommerce plugin; install it, enter the keys obtained from the institution’s panel, and first perform trials in test mode. Switch to live mode after checking successful payment, failed payment, and refund scenarios.