Turkey's position and the 'reflection policy' heuristic
Advisor
After this lesson you can
Distinguish that BDDK/TCMB have no PQC-specific position for payments or finance today (recalling M10), and that SSB's separate, defence-focused national quantum roadmap does not substitute for one
Use the 'reflection policy' heuristic this course proposes (NOT an established regulatory term, but an explicitly labelled heuristic) to derive a local planning date from international timelines
In M10 you saw that BDDK/TCMB have no specific PQC position for payment systems today. This last lesson combines that gap with the international timelines you saw throughout M11 (EO 14412, the EU roadmap, DORA, the G7 CEG) and proposes a realistic local planning approach: an explicitly labelled heuristic developed by this course, “reflection policy.”
The full picture of the gap: no BDDK/TCMB position, and SSB is something else
As verified in M10, no specific, published PQC position from BDDK and TCMB for payment systems was found. Alongside that, Turkey does have a real, active national quantum initiative: the Türkiye Kuantum Platformu, run by SSB (Presidency of Defence Industries), aims to build national awareness and capability in quantum computing, communication and sensing. But it is critical not to confuse the two: SSB’s platform is a general, defence-industry-focused quantum technology development initiative; it is not a specific PQC migration requirement for a bank’s payment or PKI infrastructure. Telling an architect “Turkey has a quantum strategy, so finance regulation will come soon” ignores that these are different institutions with different purposes.
“Reflection policy”: an explicitly labelled heuristic
The “reflection policy” this course proposes is not an official BDDK/TCMB term or claim; it is a heuristic this course proposes so that banks do not simply wait without any planning when there is no local date. The logic is simple: Turkey’s financial regulation has historically tended to reflect EU-aligned rules in local legislation with some lag (a general observation, not based on a specific study); so you can take the nearest concrete international milestone (the EU roadmap’s 2030, which you saw in M11’s earlier lessons, or the G7’s 2035) and add a lag of 1-2ESTIMATED to derive a cautious internal planning date. For example, if you base it on the EU roadmap’s 2030 date for “high-risk use cases”, reflection policy suggests an internal target around 2031-2032.
It must be stressed that this is not a forecast but a planning tool with open assumptions. When presenting this date to an auditor or a board, saying “BDDK told us this” would be wrong and indefensible; the right frame is: “There is no official date from BDDK/TCMB today; that is a gap. Rather than standing still in that gap, we derived our own internal target from international milestones with an explicit lag assumption, and we label that assumption openly at every opportunity.” It is an application of the “when you find a gap, don’t invent figures, say there is a gap” discipline you saw again and again in M7-M10, this time bridging the gap with open assumptions instead of leaving it completely empty.
Numbers to know
As you saw in M10: no specific, published PQC position from BDDK/TCMB for payment systems was found while preparing this lesson; this is an honest gap
SSB (Presidency of Defence Industries) has a real 'Türkiye Kuantum Platformu', but it is general, defence- and industry-focused quantum technology development, not a finance-specific PQC migration requirement; the two must not be confused
'Reflection policy' (a heuristic this course proposes, NOT an official term): if there is no local date, derive a planning date by adding a lag of 1-2 years to international milestones (the EU's 2030, the G7's 2035); this is not a forecast but a cautious assumption
Lab: Derive the reflection policy date for your own bank
[not run] This is a planning exercise, not a runnable command
# Choose the nearest international milestone (e.g. the EU roadmap's 2030, since you are subject to DORA), add 1-2 years, and derive an internal planning date for your bank
Recorded output
Example: EU 2030 + 1-2 years = an internal planning target of 2031-2032; this is not an official requirement but a cautious assumption, and it should be labelled as such
At the table
How to say this in a bank meeting.
To an executive
We have not received a specific PQC date from BDDK/TCMB today; that does not stop us setting an internal target around 2030-2032. On the contrary, waiting until regulatory clarity arrives is itself a risk. Our own heuristic, which we call 'reflection policy', derives this internal target with defensible logic.
To an architect
'Reflection policy' is not a forecast but a planning tool with open assumptions: it rests on the general observation that Turkey's financial regulation has historically reflected EU-aligned rules in local legislation with some lag, not on a specific study. When presenting it to an auditor, it is critical to present it not as an official forecast but as an explicitly labelled internal assumption.
Objection
“"BDDK/TCMB gave no date. Where are you making up a date from?"”
Answer
We are not making it up; we are making an explicit assumption, and not hiding it: what we call 'reflection policy' is a planning heuristic this course proposes, not an official BDDK/TCMB term or claim. We set a cautious internal target by adding a reasonable lag to the nearest international milestone (such as the EU's 2030); that is more defensible than waiting with no target at all, because our assumptions are open and justified.
Presidency of Defence Industries (SSB), 2026. The source of SSB's real, active national quantum technologies roadmap; clarifies that it is not a finance-specific PQC regulation but a separate, defence- and industry-focused initiative
Central Bank of the Republic of Turkey (TCMB), 2026. The full list of TCMB's payment systems regulation; verification that, as of today, no regulation on this page mentions post-quantum or quantum, so the gap found in M10 holds in this module too
regulation list / 10 min
Checkpoint
Answer first, then compare with the model answer and score yourself against the rubric. Saved in this browser only.
01Recall
What is BDDK/TCMB's PQC position today (recall M10)? Does SSB's quantum platform substitute for it, and why?
Model answer
No specific, published PQC position from BDDK and TCMB for payment systems was found. SSB's Türkiye Kuantum Platformu does not substitute for one, because it is a general, defence-industry-focused quantum technology development initiative, not a specific PQC migration requirement for a bank's payment or PKI infrastructure.
02Recall
What is 'reflection policy', and why is it stressed that it is 'not an established regulatory term'?
Model answer
Reflection policy is a heuristic this course proposes: deriving an internal planning date by adding a lag of 1-2 years to the nearest international milestone. It is stressed that it is not an official BDDK/TCMB term, because presenting it as an official regulation would be misleading and indefensible; it is an explicitly labelled assumption.
03Scenario
A board says 'There's no local date, so let's wait.' Using the reflection policy heuristic, what alternative do you propose?
Model answer
Instead of waiting, I propose taking the nearest concrete international milestone (for example the EU roadmap's 2030 date for high-risk use cases) and adding a lag of 1-2 years to get a cautious internal planning target around 2031-2032. At every opportunity I state that this is not an official requirement but a planning tool with open assumptions.
A complete answer includes
Your score: 0/3
04Hostile
An auditor asks 'What is the source of your 2031-2032 date? Which regulation?' Explain honestly the real nature of reflection policy (a heuristic, not a regulation).
Model answer
The source of this date is not a regulation; there is no official PQC date from BDDK/TCMB today. To avoid standing still in that gap, we used the 'reflection policy' heuristic this course proposes: we derived our own internal target by adding a lag of 1-2 years to the nearest international milestone (the EU roadmap's 2030). It is not a forecast but an explicitly labelled assumption.
A complete answer includes
Your score: 0/3
Project linkThe final piece of the Turkey-specific timeline section of Project 4 (capstone); the reflection policy heuristic is used as the rationale for the capstone's own proposed timeline.