TROY DIGITAL

Target: TROY - Türkiye’s Payment Method Operator: Bankalararası Kart Merkezi A.Ş. (BKM) Controlling shareholder: Central Bank of the Republic of Türkiye (CBRT/TCMB) Domain: Digital Research date: 26 October 2026

Enterprise Technology Stack & Vendor Relationships

Corporate identity, ownership and core payment infrastructure

TROY was established in 2016 as Türkiye’s domestic card-payment scheme under Bankalararası Kart Merkezi A.Ş. (BKM). TROY supports debit, credit and prepaid cards and provides payment functionality across domestic ATMs, POS terminals, e-commerce and mobile payment channels. Its official materials describe cooperation with card issuers and payment service providers in Türkiye.¹

BKM, established in 1990, operates the Domestic Clearing and Settlement System (YTH), which clears and settles domestic interbank transactions involving credit, debit and prepaid cards. The Central Bank of the Republic of Türkiye identifies BKM as a licensed payment-system operator, with its operating licence dating to June 2015.²

A January 2025 CNBC-e report identified the CBRT as BKM’s controlling shareholder, holding 51.01% of its equity. The reported remaining shareholdings included Halkbank, Ziraat Bankası, Garanti Bankası, Akbank, İş Bankası and other Turkish financial institutions.³

TROY’s official FAQ describes the scheme’s underlying transaction infrastructure and confirms support for physical POS transactions, ATM withdrawals, online payments, NFC, contactless technology, QR-code transactions and international transactions using eligible co-branded cards.⁴

Domestic card processing and international network arrangements

TROY’s domestic operation is supported by BKM’s wider interbank infrastructure, which connects participating financial institutions and provides clearing and settlement functions.²

TROY states that cards carrying its logo alongside an international scheme logo may be used abroad wherever the corresponding international scheme is accepted. International usability is therefore dependent on the relevant card configuration and acceptance arrangement.⁴

Discover Global Network identifies TROY among its international network-alliance participants. Discover’s network materials list TROY alongside other domestic and regional schemes, including RuPay, JCB, Elo, BC Card and UnionPay.⁵

Discover’s corporate description also identifies TROY as Türkiye’s domestic card scheme within its global alliance ecosystem. This establishes an international payment-network relationship but does not disclose the physical processing location of individual TROY transactions.⁶

Merchant-processing partners and intermediaries

Worldline’s payment-product documentation identifies TROY as a supported payment method. Its documented TROY merchant-processing capabilities include local acquiring arrangements, domestic 3D Secure authentication, chargebacks, refunds, recurring payments, tokenization, delayed capture and settlement options.⁷

Worldline describes working with local acquirers to support merchant acceptance of TROY cards. The documentation does not identify Worldline as the supplier of BKM’s core domestic switching system or establish that Worldline hosts TROY’s central transaction database.⁷

Google Play payment integration

On 15 April 2025, TRT Haber reported BKM’s announcement that TROY cards could be added to Google Play accounts for digital-content purchases, following a payment-acceptance integration.⁸

BKM separately announced the Google Play integration through its corporate LinkedIn account, acknowledging Google’s cooperation in expanding TROY acceptance on international digital platforms. The public statement establishes a Google Play payment-acceptance relationship.⁹

The Google Play announcement does not identify Google Cloud as TROY’s infrastructure provider or establish any relationship between TROY and Project Nimbus.^{8, 9}

Authentication and digital payment security

TROY identifies GO Secure Pay as a digital-payment authentication service developed by BKM. Its corporate documentation describes information exchange among the merchant, issuing financial institution and cardholder to authenticate online transactions and reduce fraud risk.¹⁰

The consumer-facing GO Secure Pay documentation describes a one-time SMS verification code sent to the mobile number registered with the issuing bank or electronic money institution. The user enters the code to authorize the relevant online transaction.¹¹

Scale and continuing operation

In September 2025, BKM General Manager Ozan Deniz reported that approximately 67 million TROY-branded cards had been issued and that TROY had reached approximately 20% of Turkish card expenditure. The same interview described continuing development of BKM’s digital payment and fraud-related infrastructure.¹²

Israeli-origin enterprise software

No public evidence identified of a direct TROY/BKM licensing, subscription, integration or procurement relationship involving Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, Palo Alto Networks or another specifically identified Israeli-origin enterprise-software provider.

No public evidence identified that any Israeli-origin enterprise-security technology is embedded in TROY’s core payment switch, authorization infrastructure, fraud systems or payment-network administration.

Systems integrators and outsourcing

Worldline is a documented provider of TROY merchant-acceptance capabilities, including local acquiring integration and payment-processing functionality.⁷

No public evidence identified of Worldline deploying an Israeli-origin technology product specifically for TROY or BKM.

No public evidence identified of another named systems integrator implementing Israeli-origin technology within TROY’s core processing infrastructure.

Surveillance, Biometrics & Retail Technology

Facial recognition and biometric identification

TROY’s documented consumer-payment technologies include NFC contactless payments, mobile payments, wearable payments and QR-code payments. Its published technology catalogue identifies these payment functions without identifying an Israeli-origin facial-recognition or biometric-surveillance supplier.¹³

No public evidence identified of TROY/BKM procuring facial-recognition, gait-analysis or biometric-surveillance products from Trigo, BriefCam, AnyVision/Oosto, Trax or comparable Israeli-origin providers.

No public evidence identified of a TROY/BKM biometric identification deployment specifically targeting Palestinian populations or individuals in occupied territories.

Transaction authentication and fraud prevention

GO Secure Pay provides an authentication process for e-commerce transactions, including cardholder verification through issuer-linked mobile telephone details. Its documented purpose is authorization and fraud prevention in card payments.¹¹

TROY’s corporate documentation describes risk-based identity verification and secure exchange of authentication information between transaction participants. It does not identify an Israeli biometric or behavioural-surveillance vendor as part of the service.¹⁰

Fraud-information sharing through SİPER

On 9 December 2022, the CBRT announced SİPER, a security-layering service developed with BKM for the FAST instant-payment system. The service was designed to support rapid exchange of information and documents relating to suspected fraud and other unlawful payment activity.¹⁴

In September 2025, BKM General Manager Ozan Deniz described SİPER as a continuously operating fraud-information platform allowing participating institutions to update individual cases and share supporting documentation. His remarks also described BKM services involving data mining and artificial intelligence.¹²

The described SİPER functionality concerns payment-security information sharing among participating financial institutions. The reviewed descriptions do not identify an Israeli-origin surveillance supplier, Israeli government recipient or occupied-territory deployment.^{12, 14}

Predictive analytics and workforce monitoring

No public evidence identified of TROY/BKM deploying Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring or workforce-surveillance systems.

No public evidence identified of TROY/BKM using Israeli-origin behavioural analytics to monitor employees or conduct law-enforcement surveillance.

Indirect deployment through third-party platforms

TROY’s documented payment ecosystem includes issuing banks, acquiring institutions, merchants, international card-network partners and supported merchant-processing platforms.^{4, 7}

No public evidence identified that these documented relationships introduce a specific Israeli-origin facial-recognition, biometric-surveillance or predictive-policing product into TROY/BKM infrastructure.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Domestic financial infrastructure

BKM operates the Domestic Clearing and Settlement System, which processes domestic interbank card transactions under the Turkish payment-system regulatory framework.²

The CBRT’s 2024 financial-infrastructure disclosures identify BKM’s GEÇİT API Gateway as a common technical infrastructure for regulated payment-account data-sharing services. The CBRT states that GEÇİT was developed using domestic personnel and technical resources.¹⁵

The CBRT’s 2025 annual-report material records continued expansion of GEÇİT. By the end of 2025, 39 payment service providers had completed technical certification as account-servicing providers, and 41 third-party providers were participating under the relevant service role.¹⁶

On 17 March 2026, the CBRT announced version 2.0.0 of the BKM-developed open-banking infrastructure. The update introduced expanded account-information capabilities, card-information and transaction services, scheduled payment initiation and recurring payment initiation.¹⁷

Data processed and recipients

TROY’s privacy notice identifies BKM as a data controller for personal data obtained through the relevant TROY communication channels. The categories listed include names, Turkish identification numbers, card information, transaction locations, email addresses and telephone numbers.¹⁸

The same notice describes potential transfers of personal data to card issuers, acquirers, merchants, contracted business partners and legally authorized public institutions, as well as judicial and administrative authorities where applicable.¹⁸

The privacy notice also acknowledges data-subject rights concerning disclosures to recipients domestically or abroad. It does not identify a specific Israeli recipient, data centre, cloud region or processing subcontractor.¹⁸

International routing and processing

TROY’s international acceptance arrangements include cards co-branded with eligible international payment systems. Its public FAQ refers specifically to the Discover and Diners Club acceptance networks.⁴

Discover Global Network independently lists TROY among its international alliance participants. This establishes network connectivity but does not establish that any particular TROY transaction is routed, stored or processed in Israel.⁵

Worldline’s documentation describes domestic acquiring and international settlement options for merchants accepting TROY. It does not establish the geographic location of every transaction-processing, tokenization, fraud-monitoring or backup environment.⁷

Israeli data centres and infrastructure

No public evidence identified of TROY/BKM owning, operating, leasing or colocating data-centre facilities in Israel.

No public evidence identified of a TROY/BKM production processing environment, backup environment, disaster-recovery facility or cloud region physically located in Israel.

No public evidence identified of payment, identity, communications or behavioural data controlled by TROY/BKM being stored or processed within Israeli jurisdiction.

No public evidence identified of Israeli state authorities obtaining contractual or jurisdictional access to TROY/BKM payment data through an identified infrastructure provider.

Project Nimbus and sovereign-cloud contracts

No public evidence identified of TROY/BKM participating in Project Nimbus or providing cloud-computing, AI, data-storage or infrastructure services to Israeli government institutions through that programme.

No public evidence identified of a TROY/BKM sovereign-cloud, data-residency or infrastructure-resilience contract with an Israeli state or military institution.

The documented Google Play integration concerns acceptance of TROY cards for digital purchases. The public announcement does not establish any BKM participation in Google Cloud’s Israeli government programmes.⁸

Defence, Intelligence & Security Sector Technology Relationships

Military and intelligence contracts

No public evidence identified of a direct contract, partnership, service agreement or procurement award between TROY/BKM and the Israeli Ministry of Defence, Israel Defense Forces, Israeli intelligence agencies or Israeli state-security institutions.

No public evidence identified of BKM supplying card-processing infrastructure, transaction intelligence, fraud-monitoring systems or payment databases to Israeli military or intelligence bodies.

Dual-use payment and security infrastructure

BKM’s payment-related infrastructure includes interbank clearing, cardholder authentication, regulated open-banking data exchange and fraud-information sharing.^{2, 10, 14, 17}

No public evidence identified of these systems being deployed for Israeli military operations, intelligence collection, law-enforcement surveillance or operations within occupied territories.

No public evidence identified of a specific Israeli military, police or intelligence customer using BKM’s SİPER or GEÇİT services.

Digital distribution and institutional devices

TROY’s documented integration with Google Play allows supported cards to be used for purchases on Google’s digital-content platform.^{8, 9}

No public evidence identified of TROY/BKM supplying enterprise device-management software, internal application distribution, mobile-device provisioning or payment applications to Israeli military or government devices.

Offensive cyber and digital weapons

No public evidence identified of TROY/BKM developing, selling, licensing, maintaining or distributing offensive cyber tools, zero-day exploits, interception software or digital weapons.

No public evidence identified of Israeli state actors deploying any TROY/BKM product as an offensive cyber capability.

Constructive-notice chronology

BKM’s Google Play integration was publicly announced in April 2025, and the CBRT announced a further GEÇİT infrastructure update in March 2026. Both developments occurred after 19 July 2024 and November 2024.^{8, 17}

No public evidence identified of either development involving provision to Israeli state, military or settlement entities.

Settlement nexus

No public evidence identified of TROY/BKM operating payment infrastructure specifically for Israeli settlements in the occupied West Bank, East Jerusalem or the occupied Syrian Golan.

No public evidence identified of TROY/BKM providing settlement-specific merchant acquiring, card authorization, transaction-processing or financial surveillance services through a named licensee or intermediary.

No public evidence identified of an Israeli settlement-based branch, subsidiary or local distribution operation belonging to TROY/BKM.

AI, Algorithmic & Autonomous Systems

Fraud analytics and data-mining activity

BKM’s SİPER service was announced in December 2022 as a security-layering mechanism for rapid information and document exchange concerning suspected misuse of the FAST payment system.¹⁴

During a September 2025 interview, BKM General Manager Ozan Deniz described services involving data mining and artificial intelligence in the context of BKM’s developing payment infrastructure.¹²

The reviewed public statements do not identify a specific third-party AI model supplier, model architecture, training environment or Israeli-origin analytics provider for SİPER.^{12, 14}

Algorithmic authentication and payment risk

TROY’s GO Secure Pay corporate description identifies risk-based identity verification and mechanisms designed to reduce fraudulent e-commerce transactions.¹⁰

The consumer documentation separately describes SMS-based transaction verification tied to the customer’s issuing financial institution.¹¹

No public evidence identified that TROY/BKM’s authentication services rely on AI technology developed by an Israeli-domiciled supplier.

AI provision to Israeli state bodies

No public evidence identified of TROY/BKM supplying AI, machine-learning, computer-vision, predictive-analytics or autonomous decision-support systems to Israeli state, military, police or intelligence institutions.

Training data and population surveillance

No public evidence identified of TROY/BKM AI models being trained on Palestinian civilian information, Israeli military surveillance datasets, intercepted communications or biometric data originating in occupied territories.

No public evidence identified of a BKM model being granted access to an Israeli military or intelligence data repository.

Autonomous systems and lethality

No public evidence identified of TROY/BKM supplying autonomous tracking, military threat-detection or target-generation software to Israeli security bodies.

No public evidence identified of purpose-built kinetic targeting, fire-control or weapons-effect systems produced by TROY/BKM. Such products, if subsequently identified, would require examination under Military.

Technology Ecosystem & R&D Footprint

Technology development in Türkiye

TROY’s official corporate description identifies its establishment in 2016 within BKM and describes continuing technological development of Türkiye’s domestic card-payment infrastructure.¹

The CBRT’s 2024 financial-infrastructure report states that BKM’s GEÇİT open-banking gateway was developed with domestic human and technical resources. This statement specifically concerns the development of GEÇİT and does not identify the origin of every underlying hardware or software component.¹⁵

The CBRT’s March 2026 announcement confirms continued development of BKM’s regulated open-banking services through version 2.0.0.¹⁷

Payments innovation and public transportation

TROY describes its technological solutions as covering contactless payments, mobile contactless functionality, wearable devices, transit payments, authentication services and QR-code payment systems.¹³

The BKM Transportation Platform provides open-loop card-payment functionality for public transportation systems. TROY describes the platform as supporting transit operators, card issuers and cardholders through integrated contactless payment acceptance.¹⁹

Israeli research and development operations

No public evidence identified of TROY/BKM operating an R&D centre, engineering office, accelerator, innovation laboratory or dedicated technology subsidiary in Israel.

No public evidence identified of TROY/BKM funding Israeli academic research in cybersecurity, artificial intelligence, payments, surveillance or military technology.

Acquisitions and strategic investments

No public evidence identified of TROY/BKM acquiring an Israeli-origin cybersecurity, AI, payments or digital-infrastructure company.

No public evidence identified of TROY/BKM making strategic investments in Israeli venture-capital funds or technology startups.

Controlling principals and governance links

The identified controlling shareholder is the Central Bank of the Republic of Türkiye, which exercises institutional control over BKM through its majority shareholding.³

BKM General Manager Ozan Deniz was publicly identified in September 2025 as the executive describing BKM’s payment-processing, fraud-information and financial-technology programmes.¹²

No public evidence identified of Ozan Deniz or a specifically established TROY/BKM controlling principal holding a verified equity interest, directorship or disclosed personal investment in NSO Group, Cellebrite, Carbyne, Oosto, Wiz, Check Point, SentinelOne, Verint, NICE or a comparable Israeli military, intelligence or surveillance-technology company.

No public evidence identified of a TROY/BKM controlling principal holding a documented role in an Israeli military-technology company or a settlement-based enterprise.

Patents and intellectual property

No public evidence identified of a TROY/BKM patent co-development agreement, technology-licensing arrangement or joint intellectual-property portfolio with Technion, Hebrew University, the Weizmann Institute or another Israeli research institution.

No public evidence identified of an Israeli-domiciled patent assignee jointly developing TROY’s domestic clearing, authentication or open-banking infrastructure.

Civil Society Scrutiny & Regulatory History

Regulatory status and official oversight

The CBRT identifies BKM as a Turkish payment-system operator with a licence granted in June 2015. Its official description confirms BKM’s role in domestic interbank card clearing and settlement.²

The CBRT’s 2024 and 2025 financial-infrastructure reports document regulatory and technical certification arrangements for participants accessing GEÇİT open-banking services.^{15, 16}

The CBRT publicly announced new GEÇİT functionality in March 2026, confirming continued development within Türkiye’s regulated payment-services framework.¹⁷

UN and civil-society investigations

No public evidence identified in the accessible reviewed material of a target-specific finding that TROY or BKM supplied Israeli settlement operations, Israeli military surveillance or Israeli state-security technology.

No public evidence identified of a TROY/BKM-specific technology investigation by Who Profits, AFSC Investigate, Amnesty International, Human Rights Watch, B’Tselem, Al-Haq or SOMO.

No public evidence identified of a verified TROY/BKM technology contract named in the UN settlement-business investigations reviewed through available search results.

These findings are limited to the accessible material reviewed and do not constitute a comprehensive certification of absence from every historical database or investigation.

Boycott and divestment campaigns

No public evidence identified of an organized boycott, divestment or sanctions campaign specifically targeting TROY/BKM over the provision of technology to Israeli state institutions, military bodies or settlements.

No public evidence identified of a formal TROY/BKM corporate response to a technology-related Israel/Palestine boycott allegation.

Regulatory actions, export controls and litigation

No public evidence identified of an export-control enforcement action involving TROY/BKM technology supplied to Israel.

No public evidence identified of a regulatory investigation concerning TROY/BKM’s provision of surveillance technology, payment intelligence or cloud infrastructure to Israeli state institutions.

No public evidence identified of a court proceeding or sanctions enforcement case alleging TROY/BKM participation in technology services supporting settlement operations.

Documented public technology relationships

TROY’s April 2025 Google Play integration was publicly announced by BKM and reported by TRT Haber. The documented scope is acceptance of TROY cards for purchases on the Google Play platform.^{8, 9}

Discover Global Network publicly identifies TROY as a payment-network alliance participant, while Worldline documents TROY merchant-processing support.^{5, 7}

The publicly documented relationships establish payment acceptance, international card-network connectivity and merchant-processing capabilities. They do not identify a specific Israeli technology supplier, Israeli government customer or occupied-territory deployment.^{5, 7, 8}