Hotel compliance in Türkiye: the four steps of every stay

In Türkiye, every stay involves a payment, a fiscal document (an invoice or e-document), a guest identity notification (KBS) and personal data (KVKK). Hotel compliance means giving each of those four steps a named owner, a daily check and a route to the hotel's accountant or legal adviser when the hotel's own scope is unclear.

A guest reaches the desk at 23:40 with a passport, a company card and a reservation an agency made. Four things have to happen before the key is handed over, and in most hotels three different people own them. After reading this article you will be able to name each step, say who owns it in your property, and know which questions belong to your accountant or legal adviser rather than to the desk.

What does hotel compliance in Türkiye actually involve?#

It involves four steps that every stay produces: a payment, a fiscal document, a guest identity notification and personal data. Compliance is not one department; it is four steps that meet at the front desk.

The four steps appear in that order because a stay produces them in that order. Payment is a commercial act, not a legal duty in itself; the compliance question is how the money is guaranteed, recorded and then documented, not whether the guest paid. The fiscal document depends on the hotel's taxpayer scope: a paper invoice, an e-Fatura or an e-Arşiv invoice. Not every facility issues every type, and the choice is not the front desk's.

KBS is a legal duty of every lodging facility, and it covers local and foreign guests alike. KVKK attaches to any personal data the hotel collects, from the first enquiry to the record it still holds afterwards. The Identity Notification Law lists hotels, motels, pensions, holiday villages, campsites and similar lodging places, so the duty follows the facility, not the sign above the door.

In most properties the four steps sit with three people: front desk, finance and the night auditor. That split, not the rules, is where a step goes half done.

What does a hotel need to get right about payment?#

Payment is a commercial act, so the compliance work sits in how it is guaranteed, recorded and later documented. A payment that is taken but not written into the folio is the gap that surfaces at checkout.

A card guarantee, a pre-authorization hold, a cash deposit and an agency bill-to are four different things. Each has to be written against the reservation at check-in, not reconstructed later. A deposit that lives in the cash box and not in the guest's folio is the most common version of this failure, and it is discovered by the night auditor or by the guest.

Foreign currency: the hotel may trade in it, but which rate applies to a document is a tax question. The central bank publishes indicative rates daily, not hourly, and the accountant decides which rate and which day. For a private transaction between the parties, the rate is a matter of agreement; the tax treatment of that amount still belongs to the accountant.

Card data handling is a separate question with its own standards. It is answered by the hotel's bank and adviser, not improvised at the desk. Who is billed is decided at booking: an agency bill-to discovered at checkout becomes a correction, and corrections cost time on the busiest hour of the day. Write the refund rule down before the season: how a deposit is returned, by whom, and where the return is recorded.

Which fiscal document does a sale need: invoice, e-Fatura or e-Arşiv?#

It depends on two things: the hotel's own taxpayer scope and who is buying. The document type is a scope question for the accountant, while the information it must carry is fixed by law.

The Tax Procedure Law (Law No. 213) defines an invoice as the commercial document a merchant gives a customer showing the amount owed for goods sold or work done, and it lists the minimum contents: date, series and sequence number, the issuer's name, address, tax office and number, the customer's name, trade title, address and, if any, tax office and number, and the type, quantity, price and amount of the goods or work (mevzuat.gov.tr, consolidated text, 1 November 2026). The same law requires those who must keep books to retain their books and documents for five years from the calendar year after the year they relate to.

e-Fatura has been in use since 5 March 2010 under VUK General Communiqué No. 397, as the Revenue Administration (GİB) describes on its eBelge site (2026-11-01). It is not a new document type: it carries the information an invoice must contain, in a format set by GİB, and it travels between seller and buyer through a central GİB platform. Taxpayers registered for e-Fatura must send and receive the invoices they issue to each other as e-Fatura.

Sales to taxpayers who are not registered, and to people who are not taxpayers, go as an e-Arşiv invoice under Communiqué No. 509, delivered on paper or electronically as the buyer asks. A taxpayer without enough IT infrastructure can use the application through a private integrator, introduced by Communiqué No. 421. Where no invoice is required, the sale is documented by a payment recording device (ÖKC, a fiscal cash register) under Law No. 3100 (Official Gazette 15 December 1984): the receipt takes the place of an invoice, and the device must give a receipt for every sale, a daily closing receipt and totals in a fiscal memory.

The dates and money thresholds that bring a facility into each application are not stated here. GİB publishes a transition calendar, and the accountant reads it against the hotel's own status. For a side-by-side comparison, see e-Fatura vs e-Arşiv: invoicing guests and agencies in Türkiye.

KBS: who has to be recorded, and how fast?#

KBS (guest identity notification) is the step where the facility records who is staying and reports it to law enforcement. The law covers local and foreign guests alike, and it starts at the door, not at the end of the shift.

The Identity Notification Law (Law No. 1774, Official Gazette 11 July 1973) requires the responsible operator of every hotel, motel, pension, holiday village, campsite and similar lodging place to keep the identity and the arrival and departure records of everyone staying, local or foreign, day by day (mevzuat.gov.tr, consolidated text, 1 November 2026). An additional article requires lodging facilities to keep all records on computer and report them instantly to the general law enforcement by connecting to its computer terminals.

The law bars accommodating anyone who cannot prove their identity with an identity card or another officially valid document. That is a duty at the door, not a data entry task for later. The operator may delegate these duties to a manager; when it does, both are jointly responsible. Delegation moves the work, not the liability.

This article does not state a deadline in hours, which force receives a given facility's notifications, current fine amounts, or how children and companions are recorded. None of these was verified, and each should be confirmed with the authority and the adviser. Practically, the check-in flow is the only place where the identity document, the reservation and the notification meet. A notification typed later from a separate screen is typed from memory. For the full picture, see KBS explained: guest identity notification for hotels in Türkiye.

KVKK: what must a hotel tell a guest, and how long may it keep the data?#

KVKK (the personal data protection law) makes the hotel a data controller: it must tell people what it does with their data when it collects it, and it needs a lawful basis for each purpose it uses the data for.

The Personal Data Protection Law (Law No. 6698) was adopted on 24 March 2016 and published in the Official Gazette on 7 April 2016, No. 29677. It defines explicit consent (açık rıza) as consent on a specific matter, based on information and given freely. Consent to a newsletter is not consent to scan an identity document. It defines the data controller (veri sorumlusu) as the person who sets the purposes and means of processing; for guest data, that is the hotel.

Article 10 requires the controller, when collecting data, to tell people its identity, the purpose of processing, to whom and why the data may be transferred, the method and legal basis of collection, and their rights (mevzuat.gov.tr, consolidated text, 1 November 2026). Guest data runs from the first enquiry to the last retained record: reservation, identity document, KBS record, folio, invoice, camera footage, guest app activity, messages. Each purpose needs its own basis.

Who inside the hotel can open a guest record is a decision the hotel makes and should write down, because access is where most data questions start. Retention: the Tax Procedure Law gives five years for books and documents; other records follow other rules, and this article does not state them. For notices, consent and staff access in depth, see KVKK for hotels: notices, consent, staff access and retention.

Where do the four steps meet, and where do they break?#

They meet at four moments: check-in, during the stay, checkout and night audit. They break at the handoffs between the people who own them, usually without anyone noticing on the day.

Check-in is where all four steps touch one desk: the identity document is checked, the KBS record is created, the payment guarantee or deposit is written into the folio, invoice details are captured, and the KVKK notice is given or was already given at booking. During the stay, charges land where they happen: restaurant and bar sales through the outlet's own device, spa and extras on the folio. A room change or a new occupant changes the KBS record, not just the key card.

At checkout the folio and the document must agree. The e-document goes out after a person has looked at it, and the deposit is returned and the return is recorded. At night audit the business day is closed. Corrections are voided and reversed, never deleted, so the trail survives the correction.

The handoffs that fail: the booking name that does not match the identity document, the agency bill-to that becomes a guest invoice, a companion added at 01:00, a cash deposit that never reaches the folio. None of these failures needs a bad intention. Each needs one person to assume the next person did it.

What should a manager check every day?#

One page with four rows: a named owner, one check under a minute, and the question the hotel cannot answer itself. The page is reviewed at the morning meeting, not filed.

Each row names a person, not a department. A department cannot be asked why a notification is missing; a person can. Each row carries the adviser question, so the scope conversation happens once, in writing, before the season starts. Failures show up as exceptions in the folio and in the notification list, not as guest complaints, which is why the check is daily and dull.

The fifth duty is separate: Ministry circular 2026/1 (16.04.2026) obliges accommodation facilities and their software providers to send data to the central tourism database through a web-service API, as reported by alomaliye.com on 6 May 2026 and by Dünya on 18 May 2026. It is not one of the four steps, and its dates and cadence are treated in a separate article on Circular 2026/1 and reporting to the central tourism database. Nothing on this page is a legal opinion. It is an operating map, and the scope questions stay with the accountant and the legal adviser.

One observation from our own work: AI Otel's compliance layer is built so that KBS, KVKK, e-Fatura and e-Arşiv sit in the core of its hotel operating system, and e-invoices wait for a person's review before sending. It is built and working, ahead of launch.

What to do next#

Take the four rows, put a name and one daily check against each, and then ask your accountant the questions this article deliberately leaves open: which documents your facility must issue and from which date, which rate applies to a foreign-currency sale, and how long each record is kept. The four steps are simple; the ownership between them is what fails. If you want to see how the four steps can live in one system, request a briefing at https://ai-otel.com/contact.