Turkey's Information and Communication Technologies Authority (BTK) issued Resolution 2025/DK-YED-399 on 16 December 2025, entering into force on 1 April 2026. It introduces three mandatory regulatory rules for A2P SMS/MMS services to strengthen identity verification and combat cross-border telecom fraud.
1. Mandatory secure electronic signature for A2P submission login
Senders of A2P messages (SMS/MMS) or their authorized personnel must use a secure electronic signature to log into the message submission portal.
This replaces the old username-and-password-only login model. The secure electronic signature is tied to real identity, enabling traceability to individual responsible parties for message sending. It prevents account theft and abuse, provides legal grounds for liability pursuit in case of violations, and improves message origination security at the source.
2. Full URL blocking for inbound international A2P SMS
All inbound A2P SMS and MMS sent from abroad to Turkish subscribers that contain any URL or shortened links must be blocked by operators without termination. Error code 30007 will be returned for non-compliant messages, and liable parties may face fines.
This clause targets cross-border phishing fraud by cutting off distribution channels for scam links, which has significant impacts on cross-border e-commerce, logistics and other foreign enterprises. Traditional order-tracking A2P SMS with links cannot be delivered directly across borders. Enterprises may consider partnering with local providers such as Posta Güvercini, conduct business after authorization via Türkiye’s İYS messaging management system, though implementation workflows are still being refined.
3. KEP registered e-mail mandatory for A2P service applications
Operators offering A2P messaging services must submit service applications and supporting documents exclusively via KEP, Türkiye’s legally recognized registered electronic mail system.
KEP holds the same evidentiary weight as written documents under Turkish law. This requirement replaces ordinary email and paper applications, preserving legally valid business records to facilitate regulatory inspections and dispute resolution.
The three rules have clear roles: electronic signature and the ban on links in international A2P messages govern sending behaviours and message content; KEP email standardizes operator application workflows. For overseas companies, the top priority is removing URLs from A2P SMS templates and evaluating local compliant connectivity options in Türkiye. The rules become mandatory on 1 April 2026. Operators must complete system upgrades and process adjustments to meet regulatory requirements.
