ince 1 April 2026, A2P SMS and MMS sent from abroad to subscribers in Türkiye are not carried or terminated by Turkish operators if they contain an internet address — a URL, a link or anything similar. That is BTK Board Decision 2025/DK-YED/399. Messages without links, including most one-time passwords, still deliver; anything with a link has to be rewritten, sent over a domestic route, or moved to another channel.
The same package of decisions also made secure e-signatures mandatory for logging in to SMS sending panels, set a format for alphanumeric sender IDs, and stopped operators from marketing to people who are not their subscribers. Commercial messages still need consent recorded in İYS, the national consent register. This guide covers each rule, what it means for international senders, and a checklist to stay compliant. Last reviewed: 26 September 2026.
Key takeaways
- From 1 April 2026, A2P SMS/MMS from abroad containing a URL is not delivered in Türkiye (BTK 2025/DK-YED/399).
- The decision text has no exemption for OTPs, short links or branded domains — treat any web address as a link.
- Logging in to A2P sending interfaces now requires a secure electronic signature; operators take A2P subscription applications by KEP (registered e-mail).
- Alphanumeric sender IDs must be 3–11 characters, cannot be digits only, and cannot imitate a phone number (BTK 2025/DK-YED/398).
- Commercial messages still require consent recorded in İYS; consents collected elsewhere must be added to İYS within three business days or they are invalid.
- Service messages — OTPs, delivery notices, account alerts — do not need İYS consent, provided they promote nothing.
What changed in Türkiye on 1 April 2026?
Three decisions of the Information and Communication Technologies Authority (BTK) took effect on the same day. BTK gives the same reason for all three: to stop calls and messages that defraud consumers or cause panic, and to stop messages sent for illegal betting and gambling.
| Rule | Source | Who it applies to | Effective | What to do |
|---|---|---|---|---|
| A2P SMS/MMS from abroad containing a URL is not carried or terminated | BTK 2025/DK-YED/399 (16 Dec 2025), adds Art. 8 to 2020/DK-YED/086 | Any sender whose traffic enters Türkiye from abroad | 1 Apr 2026 | Remove links, use a domestic route, or switch channel |
| Secure e-signature to log in to SMS/MMS sending interfaces | BTK 2025/DK-YED/399, amends Art. 3 of 2020/DK-YED/086 | Senders and authorised users of A2P panels | 1 Apr 2026 | Issue secure e-signatures to panel users |
| A2P subscription applications and documents received via KEP | BTK 2025/DK-YED/399, adds Art. 9 | Operators offering A2P services, and their business customers | 1 Apr 2026 | Have a KEP address ready for onboarding |
| Alphanumeric sender ID: 3–11 characters, not digits only, no look-alike characters, no leading, trailing or double spaces | BTK 2025/DK-YED/398 (16 Dec 2025), CLI Procedures Art. 7(3) | All A2P messages with an alphanumeric sender | 1 Apr 2026 | Validate every sender ID before registration |
| Operators and their agents may not call or text non-subscribers to market telecom services | BTK 2025/DK-YED/412 (23 Dec 2025) | Turkish operators, dealers and agents | 1 Apr 2026 | Relevant only if you market telecom services |
| No commercial message without consent recorded in İYS | Regulation on Commercial Communication and Commercial Electronic Messages, Arts. 5 and 7 (amended 4 Jan 2020) | Any business sending commercial electronic messages | In force since the 2020 amendment | Register in İYS and sync consents within three business days |
What exactly does Decision 399 block?
The operative sentence, added as Article 8 of BTK's 2020 decision on SMS services, reads in our translation: "Where A2P messages such as SMS and MMS sent from abroad to subscribers in our country contain an internet address (URL, link/connection, etc.), such messages shall not be carried or terminated by operators authorised by the Authority."
Three things follow from that wording. First, the rule is about origin: it covers traffic that reaches Türkiye from abroad. Second, it names URLs, links and connections "etc." and lists no exceptions — not for short links, not for your own branded domain, not for OTPs. Third, it is enforced at the network: the terminating operator simply does not deliver the message, so the first sign is usually a drop in delivered Türkiye traffic on templates that contain links.
| Example message (sent from abroad) | Contains a web address? | Outcome under Decision 399 |
|---|---|---|
| Your verification code is 528914. Do not share it. | No | Not affected |
| Your code is 528914. Verify at https://example.com/v | Yes | Not carried or terminated |
| Your order has shipped. Track it: b1.lc/x7Qa | Yes (short link) | Not carried or terminated |
| Sale ends tonight — shop at www.example.com | Yes (bare domain) | Not carried or terminated |
| Your parcel is out for delivery. Open the app for live tracking. | No | Not affected by 399 (other rules still apply) |
Short links are links. Shortening, branding or hiding a URL behind a redirect does not change what the message contains. If you rely on branded short links for attribution elsewhere, keep them out of SMS templates sent to Türkiye from abroad.
Does the Turkish URL ban apply to OTP messages?
Only if the OTP contains a link. Decision 399 does not distinguish between marketing, transactional or authentication traffic; it looks at whether the message carries an internet address. A plain code such as "Your code is 528914" is unaffected. A "tap to verify" link, a magic-login URL or a web fallback link in the same message will stop delivery. Android's SMS Retriever hash string is not a web address, so it does not by itself turn an OTP into a link-bearing message.
The safest OTP template for Türkiye is the classic one: the code, a validity window, a do-not-share warning, and no link. Our SMS API lets you keep a separate Türkiye template so you do not have to change the message your other markets receive.
How can I still send links to users in Türkiye?
There are three legitimate options, and the right one depends on why the link is there.
- Take the link out. Most links in SMS are convenience, not necessity: "open the app", "check your account" or a short reference number usually does the same job without a URL.
- Send from inside Türkiye. Article 8 applies to traffic from abroad. Traffic submitted through a BTK-authorised operator's domestic A2P service is outside that article, but it brings the domestic obligations with it: secure e-signature login, KEP applications, İYS for commercial content and the new sender-ID format. Whether your organisation can contract that service directly is a question for the operator or a licensed local partner.
- Use another channel for link-heavy journeys. Decision 399 is written for A2P messages "such as SMS and MMS". For rich, link-bearing flows, WhatsApp Business or RCS are the usual candidates — check each channel's own rules and consent requirements before you move traffic.
What is İYS and does a foreign company need it?
İYS (İleti Yönetim Sistemi, the Message Management System) is Türkiye's national register of consent for commercial electronic messages. It was introduced by the January 2020 amendment to the Regulation on Commercial Communication and Commercial Electronic Messages, which is issued under Law No. 6563 on the Regulation of Electronic Commerce and enforced by the Ministry of Trade. The rules that matter for SMS are short and strict:
- Anyone who wants to send commercial electronic messages registers in İYS (Art. 5(2)).
- No commercial message may be sent to a recipient who has no consent recorded in İYS (Art. 5(3)).
- Consent collected outside İYS — on a web form, in a store, in an app — must be recorded in İYS within three business days; unrecorded consent is invalid (Art. 7(11)–(12)).
- Opt-outs you receive must be reported to İYS within three business days, and sending must stop within three business days of the request (Art. 9(6), Art. 10).
- Every commercial message must include a free opt-out on the same channel, and an SMS from a trader must show its MERSİS number (Arts. 8(3), 9(3)–(4)).
- The SMS platform you use must check İYS before starting a send and must not send for a business that is not registered in İYS (Art. 11(6)–(7)).
- Consent records are kept for three years after the consent ends (Art. 13(2)).
The obligation attaches to the sender of commercial messages to Turkish recipients, not to where the sender is incorporated. If you send marketing SMS to Türkiye, plan for İYS. We have not been able to confirm İYS's document requirements for foreign-registered businesses from an official source, so confirm the current onboarding steps with İYS directly before you rely on a timeline.
Which messages do not need İYS consent?
Article 6 lists the exemptions. Messages about goods or services the customer already has, ongoing subscriptions, collections and debt reminders, information updates, purchase and delivery notices, and messages a business is legally required to send need no prior consent and no İYS check. The catch is in the same article: these messages may not promote or advertise anything. An OTP is not a commercial message at all; an order confirmation with a discount code for the next purchase is.
What do the e-signature and KEP rules mean in practice?
Decision 399 changed BTK's 2020 rule so that the login screen of every SMS and MMS sending interface must require the sender, or the person authorised to send, to sign in with a secure electronic signature under Law No. 5070 on Electronic Signatures. Operators must also receive A2P subscription applications, and the documents that go with them, through KEP, Türkiye's registered electronic mail system.
If you hold a domestic A2P contract, every person who logs in to the panel needs their own secure e-signature — plan the rollout before a campaign deadline, not during one.
What are the new Turkish sender-ID format rules?
Decision 2025/DK-YED/398 added a paragraph to Article 7 of BTK's Procedures and Principles on the Use of Calling Line Identification. From 1 April 2026, the alphanumeric sender ID on an A2P message:
- must be at least 3 and at most 11 characters long;
- cannot consist only of digits, except for allocated short numbers in the National Numbering Plan;
- cannot use characters that imitate a number — for example the letter O in place of zero or I in place of one;
- cannot start or end with a space, or contain two or more consecutive spaces.
Run candidate names through our sender ID validator before you register them, and read how sender ID registration works if this is your first Türkiye launch.
Why can a Turkish SMS cost more than expected?
Not a regulation, but a frequent surprise: the Turkish letters ş, ğ and ı are not in the default GSM 7-bit alphabet, so unless the route supports the Turkish national language table one of them pushes the message into UCS-2 — 70 characters per segment instead of 160. Check templates in our GSM-7 / Unicode checker and see our guide to encoding and segmentation.
Compliance checklist for SMS to Türkiye
- Audit every template that can reach a +90 number and flag any URL, short link or bare domain.
- Rewrite flagged templates without links, or move those journeys to a domestic route or another channel.
- Keep OTP templates link-free: code, validity window, do-not-share warning.
- Validate alphanumeric sender IDs against the 3–11 character rules in Decision 398 before registration.
- Separate commercial and service traffic; keep promotional content out of service messages so the Article 6 exemption holds.
- For marketing, register in İYS, record consents within three business days, report opt-outs within three business days, and include a free opt-out and your MERSİS number where required.
- If you have a domestic A2P contract, issue secure e-signatures to panel users and keep a KEP address for operator correspondence.
- Monitor delivery receipts for Türkiye by template, so a link that slips back in is caught within hours, not at month-end.
How BroadNet handles Türkiye traffic
BroadNet terminates directly into Türkiye's three mobile operators — Turkcell, Vodafone Türkiye and Türk Telekom — with İYS consent checks built into promotional sends. See the Türkiye coverage page for routes and sender-ID lead times, the Türkiye regulation guide for the wider rule set, and our buyer's guide to SMS providers in Türkiye if you are comparing options.
Frequently asked questions
Why are my SMS to Turkey not delivered since April 2026?
If the messages come from abroad and contain a URL, short link or web address, BTK Decision 2025/DK-YED/399 bars Turkish operators from carrying or terminating them from 1 April 2026. Remove the link or send through a domestic route. If the messages have no link, check the sender ID against Decision 398 and your İYS status for marketing traffic.
Can I send OTP codes to Turkey from abroad?
Yes, as long as the message contains no link. Decision 399 targets messages with an internet address, whatever their purpose. A plain OTP with a code, a validity window and a do-not-share warning is not affected, and OTPs are not commercial messages, so they do not need İYS consent.
Do short links count as URLs under the Turkish rule?
Yes. The decision covers an internet address — "URL, link/connection, etc." — and makes no exception for shortened or branded links. A short link is still a web address, so a message containing one that is sent from abroad will not be delivered.
What is İYS in Turkey?
İYS (İleti Yönetim Sistemi) is the national register of consent for commercial electronic messages. Businesses sending marketing SMS must register in it, may only message recipients whose consent is recorded there, and must add consents collected elsewhere within three business days.
Do foreign companies need to register in İYS?
If they send commercial electronic messages to recipients in Türkiye, yes — the regulation requires anyone who wants to send commercial messages to register, and SMS platforms must not send for businesses that are not registered. Confirm the current onboarding documents with İYS directly.
How long do I have to record a consent in İYS?
Three business days. Consent collected outside İYS must be recorded in İYS within three business days, and consent that is not recorded is treated as invalid. Opt-outs have the same three-business-day deadline.
What is the e-signature rule for SMS panels in Turkey?
From 1 April 2026, the login screen of SMS and MMS sending interfaces must require the sender or an authorised person to sign in with a secure electronic signature. Operators also receive A2P subscription applications through KEP, the registered electronic mail system.
Can Turkish operators send marketing SMS to people who are not their customers?
No. BTK Decision 2025/DK-YED/412 bars operators and anyone acting for them, such as agents and dealers, from calling or texting people who are not their own subscribers to market or promote electronic communications services, from 1 April 2026.
Sources
- BTK Board Decision 2025/DK-YED/399 — SMS service provision (16 Dec 2025, PDF) — accessed 26 Sep 2026
- BTK Board Decision 2025/DK-YED/398 — Calling Line Identification procedures, sender-ID format (16 Dec 2025, PDF) — accessed 26 Sep 2026
- BTK Board Decision 2025/DK-YED/412 — unsolicited calls by operators (23 Dec 2025, PDF) — accessed 26 Sep 2026
- BTK Board decisions index — accessed 26 Sep 2026
- Regulation on Commercial Communication and Commercial Electronic Messages, consolidated text (mevzuat.gov.tr, PDF) — accessed 26 Sep 2026
- İYS — İleti Yönetim Sistemi — accessed 26 Sep 2026