Hotel compliance glossary for Türkiye: KBS, KVKK, e-Arşiv, ÖKC

Türkiye's hotel compliance terms are few but dense: KBS (guest identity notification), KVKK (personal data protection), e-Fatura and e-Arşiv (electronic invoices) and ÖKC (fiscal cash registers). Each marks a step in every stay. This glossary gives a plain definition, where the term appears and who owns it; your accountant and lawyer give the legal detail.

A new general manager takes over a coastal property in March, opens the front desk folder and finds five acronyms, three of them in a language she does not read yet, and no explanation of which one stops her from checking a guest in. This glossary is the page she needed on day one. After reading it you will know what each hotel compliance term in Türkiye means, where it appears in a stay, and which role in the hotel answers for it. The legal detail, dates, thresholds and penalties belong to your accountant and your lawyer.

What is KBS and what does it require at check-in?#

KBS (Kimlik Bildirme Sistemi, guest identity notification) is the system through which a lodging place records who is staying and reports it to law enforcement. It sits at check-in, and the front office owns it.

Law No. 1774 (Official Gazette, 11 July 1973) names hotels, motels, pensions, holiday villages, campsites and similar lodging places, and requires the responsible operator to keep the identity and arrival and departure records of everyone staying, local or foreign, day by day. An additional article of the same law requires lodging facilities to keep those records on computer and report them instantly to the general law enforcement by connecting to its computer terminals. The law also bars accommodating anyone who cannot prove their identity with an identity card or another officially valid document; confirm with your adviser which documents your property accepts at the desk.

The operator may delegate these duties to a manager, and in that case both are jointly responsible. Put the delegation in writing with a name and a date.

In practice, KBS runs as a web application that the facility's authorized person enters through e-Devlet, and that person can give other staff their own logins limited to guests only, staff only or both, according to the Gendarmerie General Command's KBS Tesis 2 information document (14 November 2018). Facilities that use hotel software can use the web service module: the authorized user registers the hotel's fixed IP address and a KBS password, and the identity number, password and IP are checked together on every call, the same document says.

Four things this article will not tell you, because we could not verify them: a deadline counted in hours, current fine amounts, which force receives your facility's notifications, and how long you keep your own KBS records. Ask the authority and your adviser.

KBS is one of the four steps of every stay in Türkiye: payment, fiscal document, identity notification and personal data.

What does KVKK mean for a hotel's front desk?#

KVKK (Kişisel Verilerin Korunması Kanunu, personal data protection law) is Law No. 6698, adopted on 24 March 2016 and published in the Official Gazette on 7 April 2016. For a hotel it means three working documents: a privacy notice, a consent record where consent is the basis, and a written route for a guest who asks about their own data.

Two definitions do most of the work. Açık rıza (explicit consent) is consent on a specific matter, based on information and given freely. Veri sorumlusu (data controller) is the person who sets the purposes and means of processing: in a hotel that is normally the operating company, not the receptionist.

Article 10 requires the controller, when collecting data, to tell people its identity, the purpose of processing, to whom and why the data may be transferred, the method and legal basis of collection, and their rights. That text is the aydınlatma metni, the privacy notice. The Personal Data Protection Authority's communiqué on the duty to inform (Official Gazette, 10 March 2018, No. 30356) adds four rules: the notice is given in every case of processing whatever the legal basis, it does not depend on the person asking for it, it must be provable by the controller, and it must be given separately by each department that processes data for a different purpose.

Where processing relies on explicit consent, the notice must be carried out separately from obtaining that consent. One combined tick-box does not do both jobs, and a signed registration card is not automatically a valid consent record. When data is not obtained from the person, they must be informed within a reasonable time, at the start of communication, or at the latest when the data is transferred.

İlgili kişi başvurusu is a data subject's application to the controller about their own data. Name a person and a written route before the first request arrives, not after. Saklama ve imha means retention and destruction: decide a period per data type and write it down. The periods themselves, breach notification timing, registry duties and transfer rules are for your counsel, not for a glossary.

What is the difference between e-Fatura, e-Arşiv and ÖKC?#

They answer different questions. e-Fatura and e-Arşiv are electronic versions of the invoice; ÖKC is the cash register that prints a receipt for sales where no invoice is required.

Mali belge (fiscal document) is the umbrella term: every sale needs one. Which one you issue depends on who is buying and on the taxpayer's scope, which is why the decision belongs to your accountant.

The invoice is defined in the Tax Procedure Law (VUK, Law No. 213, Article 229) as the commercial document a merchant gives a customer showing the amount owed for goods sold or work done. Article 230 sets the minimum contents: date, series and sequence number, the issuer's name, address, tax office and number, the customer's details, and the type, quantity, price and amount of the goods or work. Article 253 requires those who must keep books to retain books and documents for five years from the calendar year after the year they relate to.

e-Fatura has been in use since 5 March 2010 under VUK General Communiqué No. 397. GİB describes e-Fatura (opens in a new tab) as an electronic document in a format GİB sets, carrying the information an invoice must contain, travelling between seller and buyer through a central GİB platform. It is not a new document type and has the same qualities as a paper invoice; taxpayers registered for e-Fatura must send and receive the invoices they issue to each other as e-Fatura.

e-Arşiv works under VUK General Communiqué No. 509: taxpayers in the application issue e-Fatura to buyers registered for e-Fatura, and e-Arşiv Fatura to taxpayers not registered and to people who are not taxpayers. The e-Arşiv invoice is delivered on paper or electronically, as the buyer requests. Özel entegratör (private integrator, introduced by Communiqué No. 421) lets taxpayers without enough IT infrastructure use the application through an integrator. GİB publishes a transition calendar for taxpayers coming into scope; the dates and thresholds are not in this article, and you should not take them from a blog.

ÖKC (ödeme kaydedici cihaz, payment recording device) comes from Law No. 3100 (Official Gazette, 15 December 1984): first- and second-class merchants who sell goods to, or serve, people other than resellers use devices such as electronic cash registers. The sales receipt documents sales for which no invoice is required and takes the place of an invoice, and each device must give a receipt for every sale and a daily closing receipt and record totals in a fiscal memory.

What is the central tourism database and who reports to it?#

The Merkezi Turizm Veri Tabanı is the Ministry of Culture and Tourism's central tourism database, and circular 2026/1 (16.04.2026) asks accommodation facilities to feed it through their hotel management systems.

The circular cites Article 11 of the Tourism Incentive Law (No. 2634) and Law No. 7183 on the Türkiye Tourism Promotion and Development Agency, calls the data transfer an official obligation, asks for 2025 data to be sent in a single batch when the flow starts, and states no sanction. TGA's data transfer and integration guide (12 June 2026) says facilities using a hotel management system send data automatically through their software's API under anonymous IDs assigned by the software firm, not the facility certificate number. Facilities without a system, Ministry-certified and Basit Konaklama alike, enter the data at tesis-kunye.tga.gov.tr, where they can add staff such as reception or accounting as users.

The figures are narrow: guests checked in, person-nights and room-nights sold by guest nationality, the average room price in euros, and days open, all counting actual check-ins rather than future or cancelled reservations. For currency conversion the guide recommends the central bank selling rate of the month's last business day.

The reporting cadence is not settled in the sources we could read, so confirm it with TGA in writing. Confirm the current enforcement status and your specific scope with TGA. The text we could read does not specify penalties. Do not assume one, and do not assume there is none; confirm penalties and scope with TGA or a legal adviser.

This is the machinery behind how circular 2026/1 reporting to the central tourism database works.

Which certificate names will you meet on day one?#

Three: Turizm Yatırım Belgesi, Turizm İşletmesi Belgesi and, since a 2021 amendment, basit konaklama turizm işletmesi belgesi. They describe different stages and different scopes, and none of them means hotel.

The Tourism Incentive Law (Law No. 2634) defines the Turizm Yatırım Belgesi (tourism investment certificate) as the Ministry's certificate for an investor's investment period. It defines the Turizm İşletmesi Belgesi (tourism operation certificate) as the Ministry's certificate for tourism enterprises other than simple accommodation facilities. The basit konaklama turizm işletmesi belgesi (simple accommodation tourism operation certificate) was added by a 2021 amendment, under Temporary Article 11 of the same law. Article 11 requires certified enterprises to report to the Ministry, within periods the Ministry sets, the data used to determine the country's tourism indicators. That is the legal root under the reporting duty described above.

A certified facility may be a hotel, a pension, an apartment, a boutique property or a simple accommodation place. Write certified facility unless you know the type, and never use hotel as a synonym for all of them. Whether a facility licensed only by a municipality falls under circular 2026/1 was not confirmed beyond the circular's stated aim of covering all accommodation facilities in the country. Ask before you assume either way.

Who in the hotel owns each term?#

Each term has one accountable role, and the accountability is written into a job description rather than left in a shared inbox.

KBS belongs to the front office manager, with the delegation the law allows written down, because the operator and the delegate are jointly responsible. KVKK belongs to the operating company as controller, with a named data protection lead day to day, and each department that processes for its own purpose answering for its own notice. e-Fatura and e-Arşiv belong to finance and accounting, with the özel entegratör named in the contract and a person who reviews before anything is sent. ÖKC belongs to the outlet manager for the daily closing receipt, and to finance for the device records and the fiscal memory. The central tourism database belongs to whoever owns the property management system's data, with accounting supplying the euro average price and the exchange rate. Certificates belong to the general manager and the investment or legal team, because they change at acquisition, renovation and rebranding, not at check-in.

The front office terms that surround these duties are covered in front office terms such as folio, posting and routing, and the seasonal timing is in the pre-season compliance checklist for seasonal hotels.

What to do next#

Start with the two terms that touch law enforcement and money: KBS at the front desk and the fiscal document at the till. Write one accountable name next to each row of the ownership table, then take the finished list to your accountant and your lawyer and let them fill in the dates, thresholds and amounts. The glossary tells you what to ask; they tell you what applies to your property.