CMB VII-128.10: how valuation companies are preparing for the information systems communiqué

The Turkish Capital Markets Board (CMB, known locally as SPK) published its Communiqué on the Principles and Procedures for Information Systems Management (VII-128.10) in the Official Gazette on 13 March 2025, replacing the earlier Communiqué VII-128.9. It does not ask you to buy a new product; it expects information systems to be managed in a controlled and demonstrable way, from governance to daily operations.

The first thing an auditor asks for: evidence

The problem we see most often in the field is that the work being done is not written down. Backups are taken but there is no record of a restore test; permissions are granted but the permission matrix is out of date; incidents happen but no incident record is kept. To an auditor, a control that is not recorded is a control that was not performed.

The main headings of VII-128.10

• Senior management oversight, the information security policy and the assignment of responsibilities
• Asset inventory, risk assessment and the risk treatment plan
• Authentication, authorisation and audit trails
• Managing outsourced services (cloud, software, support) in terms of risk and contracts
• Incident management, backup and business continuity

We start preparation in five steps

• Scope analysis: which provisions apply to your institution, to what extent, and which exemptions and transitional provisions are in force?
• Current state assessment: for each heading we write the existing control and its evidence side by side.
• Quick wins: gaps that close quickly, such as multi-factor authentication, the permission matrix and a backup test.
• Documentation: we write policies, procedures and record templates around the processes that actually run; copy-and-paste documents fall apart at the auditor’s first question.
• Periodic review: compliance is not a project but a routine tied to a calendar.

For valuation companies that serve banks, the same preparation also pays off in the banks’ supplier audits and information security questionnaires. See our Real Estate Valuation page for details.

This article is for information only and does not constitute legal advice. It describes the regulatory framework in Turkey. The CMB’s official legislation system should be taken as the authoritative text.