Introduction
SIM card registration and identity verification rules in Turkey are among the most important compliance issues in the electronic communications sector. Mobile phone numbers are no longer used only for voice calls and SMS. They are now connected to banking applications, e-government services, social media accounts, two-factor authentication, digital wallets, delivery platforms, online marketplaces, mobile signatures, business communication systems and personal identity verification processes.
Because of this role, a mobile line registered under the wrong person’s name can create serious legal consequences. Fraud, SIM swap attacks, unauthorized subscription contracts, identity theft, phishing, money laundering, illegal betting, cybercrime, harassment, unlawful commercial messages and financial fraud may all be connected to improperly registered or weakly verified mobile lines.
Turkey therefore regulates mobile subscription registration and identity verification through a combination of electronic communications law, BTK regulations, consumer protection rules, personal data protection law, e-Government mechanisms, dealer obligations and administrative sanctions. The main regulatory authority is the Information and Communication Technologies Authority, known as BTK. BTK states that it regulates and supervises the telecommunications sector in Turkey.
The legal framework is not limited to physical SIM cards. It also applies to electronic subscription processes, SIM change applications, number portability, operator change applications, eSIM activation, foreign subscriber records and identity verification through digital channels. For operators, dealers, MVNOs, technology companies and foreign investors, the key compliance question is clear: can the operator prove that the real subscriber was properly identified and that the relevant subscription or SIM transaction was lawfully approved?
Legal Framework of SIM Card Registration in Turkey
SIM card registration in Turkey is mainly governed by Law No. 5809 on Electronic Communications, BTK secondary regulations, the Electronic Communications Sector Consumer Rights Regulation and the Regulation on the Identity Verification Process of Applicants in the Electronic Communications Sector.
The identity verification regulation applies to several important transactions in the electronic communications sector, including subscription contracts, number portability applications, operator change applications, qualified electronic certificate applications, registered electronic mail applications and SIM card change applications where transaction documents are created electronically.
This is important because Turkish law does not treat SIM registration as a simple sales process. The creation of a mobile subscription contract and later SIM replacement or transfer-related transactions require reliable identification of the applicant. The operator or service provider must be able to show that the person requesting the transaction is truly the subscriber or the legally authorized representative.
The regulation’s purpose is to prevent suspicious transactions, forgery and fraud, while protecting consumer rights, national security, public order and emergency communication needs.
Why SIM Card Registration Matters
SIM card registration matters because a mobile line can operate as a digital identity layer. Banks send SMS verification codes to mobile numbers. E-commerce platforms confirm orders through phone numbers. Government services may use mobile verification. Social media accounts may be recovered through a phone number. Corporate systems may use SMS-based two-factor authentication.
If a SIM card is issued to the wrong person, or if a person’s line is transferred fraudulently, the harm may extend far beyond telecom service. A victim may lose access to bank accounts, crypto accounts, e-mail accounts, social media profiles, customer accounts and personal data. For businesses, fraudulent SIM cards may be used in phishing, bulk spam, illegal call centers, fraud rings or unlawful marketing.
Therefore, identity verification is both a consumer protection measure and a cybersecurity measure. Operators must ensure that SIM activation, SIM replacement, eSIM profile activation, number portability and mobile subscription transactions are conducted securely.
Subscription Contract and Applicant Verification
A mobile subscription contract must be connected to a properly verified subscriber. In ordinary practice, this means that the operator or dealer must verify the person’s identity before activating the line. In electronic channels, the applicable regulation provides specific identity verification methods.
After the 2026 amendments, identity verification may be performed through several regulated methods, including e-Government, video verification with an NFC-capable electronic identity document, verification through a temporary electronic identity document with password or fingerprint hash, face-to-face channels with a transaction-specific video image, and verification through the Presidency of Migration Management for certain foreign applicants.
This means that identity verification is not left to arbitrary commercial practice. Operators must use the legally recognized methods and preserve transaction records. A mobile operator or dealer cannot rely merely on informal visual inspection, an unverified photocopy or a weak online form where the law requires a regulated verification process.
e-Government Identity Verification
One of the most important identity verification methods is e-Government approval. The e-Government service page for BTK’s e-registration approval process confirms that users must log in with accepted identity verification methods to use the service, including e-Government password and Turkish Republic identity card.
In practice, e-Government approval provides a strong evidentiary layer because the user signs into an official identity infrastructure and approves the transaction. For telecom operators, this reduces disputes over whether the subscriber actually accepted the transaction. For consumers, it reduces the risk of unauthorized subscription contracts being created in their name.
However, operators should still provide clear information before approval. The subscriber should understand the service number, transaction type, tariff, contract terms, identity verification process and personal data processing details.
Video Identity Verification
Video identity verification is another important method. The regulation allows identity verification through artificial intelligence or an authorized representative, provided that the process is conducted securely and in accordance with technical requirements. The applicant’s identity information, including the identity document photo, may be obtained through near field communication, and the applicant’s live image is compared with the identity document photo.
The consolidated regulation also states that video identity verification cannot be performed without the applicant’s explicit consent under KVKK. Before video verification, the obligation to inform must be fulfilled separately from obtaining explicit consent.
This is a crucial compliance point. Operators cannot treat video verification as a purely technical step. It involves personal data, and in some cases biometric-related data or highly sensitive identity materials. The applicant must be informed clearly, and explicit consent must be obtained where required.
Liveness Detection and Fraud Prevention
The regulation includes detailed safeguards for video verification. It requires techniques to confirm that the applicant is physically present during the verification process. The applicant’s face must be clearly visible in a bright environment, with eyes open and from different angles. The live image is compared with the photograph on the identity document by artificial intelligence or an authorized representative under the relevant criteria.
The applicant may also be required to read a transaction-specific approval statement, confirming the name, service number, transaction type and date-time of approval.
If there is doubt about document validity, forgery or fraud, the video verification process must be terminated. If low light, poor image quality, poor transmission or other uncertainty prevents proper verification, the process must be cancelled.
These rules are important for preventing forged identity documents, deepfake risks, remote fraud, unauthorized SIM changes and subscription fraud. The operator’s duty is not only to complete the sale but to stop suspicious transactions.
Responsibility of Operators and Dealers
The regulation expressly places responsibility for correct identification on the operator or service provider. It states that correct identification of the applicant in identity verification transactions is the responsibility of the operator/service provider.
This rule is especially important in dealer networks. Mobile operators often rely on dealers, franchise stores, call centers, online channels and third-party service points. However, using a dealer does not eliminate operator responsibility. If a dealer creates a line using false identity documents, completes an unauthorized SIM replacement or fails to preserve verification records, the operator may still face regulatory and civil consequences.
Operators should therefore implement dealer compliance programs. These should include staff training, transaction monitoring, suspicious transaction flags, periodic audits, document controls, system restrictions, disciplinary procedures and immediate escalation for suspected fraud.
SIM Change and SIM Swap Risk
SIM card change applications are expressly included among the regulated transaction types covered by the identity verification framework. This is because SIM replacement is one of the highest-risk mobile transactions.
A SIM swap attack occurs when a fraudster obtains control of a victim’s mobile number by convincing the operator or dealer to issue a replacement SIM or eSIM profile. Once the fraudster controls the number, they may receive SMS verification codes and access banking, crypto, e-mail or social media accounts.
Operators should treat SIM changes as high-risk transactions. Additional verification may be justified where there are fraud indicators, recent account changes, unusual location data, high-value subscriber risk, corporate lines, financial-sector customers or repeated failed attempts.
Practical safeguards include:
Enhanced identity verification.
Cooling-off periods for suspicious requests.
Notification to the existing line before SIM replacement.
Dealer-level restrictions.
Fraud scoring.
Transaction-specific video confirmation.
Audit logs.
Internal approval for high-risk replacements.
Rapid complaint channels for victims.
SIM swap prevention is not only a customer service issue. It is a legal, cybersecurity and financial fraud prevention obligation.
eSIM Activation and Identity Verification
eSIM technology allows a subscriber profile to be activated digitally without inserting a physical SIM card. While eSIM is technologically different from a physical SIM, the legal risk is similar or higher. The question remains whether the real subscriber was properly verified before activation.
eSIM activation can be convenient, but it can also be abused if remote identity verification is weak. Fraudsters may attempt to obtain eSIM activation links, QR codes or digital profiles. Therefore, eSIM issuance should be tied to strong applicant verification, secure delivery, device control, audit logs and anti-fraud monitoring.
If a provider offers eSIM-based connectivity in Turkey, it should assess whether it is an authorized operator, MVNO, reseller, technology provider or foreign roaming provider. It should also analyze BTK authorization, subscriber identity rules, data localization where applicable, KVKK and cybersecurity obligations.
Foreign Subscribers and 2026 Record Update Rules
Foreign subscribers are an important part of Turkey’s mobile communications market. Tourists, students, foreign workers, investors, refugees, diplomats and temporary residents may all obtain or use mobile services in Turkey. Identity verification for foreign subscribers can be more complex because they may not have a Turkish identity card, Turkish citizenship number or ordinary e-Government access.
The 2026 BTK Board decision concerning Law No. 7571 and temporary Article 8 of Law No. 5809 introduced specific procedures for updating foreign natural-person subscriber records. The decision states that mobile operators must allow foreign natural-person subscribers within the relevant scope to apply for record updates within six months starting from 25 June 2026.
The same procedure states that the mobile operator verifies the subscriber’s identity through the procedures used for contract establishment under the Consumer Rights Regulation. It also provides a specific approval text for updating the subscription record in place of a new subscription contract.
If foreign subscribers do not apply or their identity cannot be verified, the procedure provides for staged restriction and eventual closure of relevant lines under specified conditions.
This development is highly important for operators, dealers and foreign subscribers. It shows that Turkey is strengthening the connection between active mobile lines and verified subscriber identity records.
Verification through the Presidency of Migration Management
The 2026 amendment also introduced a verification route through the Presidency of Migration Management for foreign applicants who do not have certain electronic identity documents. The regulation provides that foreign applicants without YAKB or TEKB may be verified through the Presidency of Migration Management under specified procedures.
For foreign applicants without a foreign identity number, the regulation allows use of a passport or equivalent international travel document serial number combined with the issuing country code for that transaction.
This mechanism is important because it provides a structured identity verification route for foreigners who may not fit standard Turkish citizen verification channels. Operators should ensure that foreign subscriber onboarding systems are updated to reflect these procedures.
Excessive Number of Mobile Lines
Another compliance issue is the number of lines registered under one person. Fraudsters may attempt to register multiple lines under the same identity, use bulk SIM cards for unlawful activity, or abuse weak registration controls.
The 2026 BTK procedure includes rules for subscribers with more mobile lines than the specified number. It provides that, for subscribers with excess lines under the relevant framework, operators must close excess mobile lines by 25 December 2026 if the subscriber does not choose which lines to keep, with protection of older subscriptions under the stated method. It also states that no penalty, commitment fee, withdrawal fee or similar charge may be collected from the subscriber in that context.
This reflects a broader policy concern: mobile lines should be traceable, limited and connected to verified subscribers. Operators should monitor multiple-line registrations, unusual activation patterns and suspicious dealer activity.
Personal Data Protection and KVKK
SIM registration involves significant personal data processing. Operators may process names, surnames, Turkish identity numbers, foreign identity numbers, passport data, address data, phone numbers, e-mail addresses, identity document images, video verification recordings, biometric-related verification data, transaction records, location information, IP data, port information and approval logs.
KVKK defines personal data as any information relating to an identified or identifiable natural person, and processing includes collection, recording, storage, protection, alteration, disclosure, transfer and other operations performed on personal data.
Therefore, SIM registration data must be processed lawfully, fairly and proportionately. Operators should not collect more data than necessary. They should not use identity verification data for marketing, profiling or unrelated commercial purposes. The identity verification regulation also states that data obtained in the verification process must be used only for identity verification and administrative or judicial authority processes.
Data Security in SIM Registration
Identity verification data is highly sensitive in practice. A leak of identity document images, video verification records or SIM transaction logs can create serious fraud and privacy risks. The identity verification regulation requires operators and service providers to store identity verification information by ensuring privacy, security and integrity of transaction records and to take necessary technical and administrative measures.
Operators should implement:
Encryption.
Role-based access controls.
Multi-factor authentication.
Audit logs.
Dealer access restrictions.
Secure video storage.
Tamper-resistant transaction logs.
Fraud monitoring.
Retention schedules.
Data minimization.
Secure deletion procedures.
Incident response plans.
If personal data is obtained unlawfully by others, the data controller must notify the Personal Data Protection Board within the shortest time; KVKK materials state that where notification cannot be made within 72 hours for a justified reason, the reason for delay must be explained.
Burden of Proof in Disputes
SIM registration disputes often involve the question of proof. A subscriber may claim that a line was opened without consent, a SIM was replaced fraudulently, a number was ported without authorization or an electronic subscription contract was not approved.
The identity verification framework places a strong evidentiary burden on operators and service providers. Legal summaries of the regulation note that operators and service providers bear the burden of proof in transactions, including objections in administrative or judicial processes.
Therefore, operators should preserve complete and reliable records. These may include e-Government approval records, video verification recordings, identity document verification logs, OTP delivery records, dealer information, transaction timestamps, IP addresses, device identifiers and customer notifications.
A weak record may turn a regulatory compliance issue into a civil compensation dispute.
Consumer Rights and Unauthorized Lines
Consumers may discover unauthorized lines registered in their name. This may occur due to identity theft, dealer fraud, forged documents, weak remote verification, database misuse or past registration errors.
In such cases, the consumer should immediately contact the operator, request investigation, file a complaint through BTK channels where necessary, preserve evidence and consider criminal complaint if identity theft or fraud is suspected. If financial harm occurred through SIM swap or unauthorized line use, civil compensation claims may also be relevant.
Operators should provide rapid fraud response channels. Delayed response can worsen harm. If a victim reports unauthorized SIM activity, the operator should suspend risky transactions, verify identity carefully, preserve logs and investigate dealer involvement.
Corporate Lines and Authorized Representatives
SIM registration for corporate lines requires additional attention. A company may obtain multiple mobile lines for employees, devices, field teams, vehicle tracking systems or IoT devices. In such cases, the person applying must have authority to represent the legal entity or must be properly authorized.
Operators should verify corporate authority, trade registry information, signatory circulars, powers of attorney and internal authorization documents where required. For corporate SIM changes and number portability, weak representative verification can cause disputes between companies, employees, former managers and operators.
Corporate customers should maintain internal policies identifying who may request new lines, SIM replacements, number transfers, eSIM activation or termination. This is especially important after employee departure, company restructuring, mergers or management changes.
Number Portability and Operator Change
Identity verification rules also apply to number portability and operator change applications where transaction documents are created electronically.
Number portability can be abused if fraudsters attempt to move a victim’s number to another operator. Therefore, porting requests must be tied to verified subscriber approval. Operators should check identity, subscription information, authorization and transaction-specific consent.
Disputes may arise where a number is ported without proper authority, where a corporate line is transferred by an unauthorized person, or where a consumer claims that they never approved the change. In such cases, the operator’s records become decisive.
SIM Registration for IoT and M2M Devices
SIM cards are not used only by people. They are also used in IoT and M2M devices, including smart meters, vehicle tracking systems, POS devices, alarm systems, industrial sensors, logistics trackers and connected machines.
IoT SIM registration raises special issues. The subscriber may be a company, but the SIM may be installed in a device used by employees, customers or third parties. The operator must identify the subscriber and contract party, but data protection obligations may extend to individuals whose data is generated by the device.
For IoT providers, contracts should define:
Who is the subscriber.
Who controls the SIM.
Who may request replacement.
Who processes location data.
Who receives usage records.
Who is responsible for device misuse.
Who responds to official requests.
How inactive lines are managed.
IoT SIMs can also be abused if they are removed from devices and used for other purposes. Operators and IoT providers should implement technical controls where possible.
Dealer Compliance and Audit
Dealer networks are one of the main risk points in SIM registration. A dealer may improperly copy identity documents, activate lines without consent, fail to verify the applicant, conduct suspicious bulk registrations or assist fraud.
Operators should audit dealers regularly. Dealer compliance programs should include:
Mandatory training.
Identity verification procedures.
Transaction monitoring.
Bulk activation alerts.
Random file audits.
Secure document handling.
Disciplinary sanctions.
Fraud reporting channels.
Mystery shopper controls.
System-level restrictions.
Immediate suspension for suspicious activity.
A strong dealer audit trail is essential for defending against BTK investigations and consumer claims.
Administrative Sanctions
Failure to comply with identity verification rules may lead to administrative sanctions. Legal summaries of the identity verification regulation state that non-compliance may trigger administrative fines under the relevant BTK administrative sanctions framework, and in repeated serious cases activity authorization may be at risk.
Sanctions are not the only risk. Operators may also face consumer complaints, civil claims, criminal investigations, KVKK proceedings and reputational harm. A major SIM registration weakness can affect thousands of subscribers and attract public attention.
For this reason, SIM registration compliance should be treated as a board-level risk for mobile operators and MVNOs.
Practical Compliance Checklist for Operators
Mobile operators, MVNOs and service providers should implement the following measures:
Use only legally recognized identity verification methods.
Maintain e-Government approval workflows.
Apply secure video identity verification where used.
Obtain explicit consent and provide KVKK notices where required.
Verify identity documents through appropriate systems.
Use liveness detection and fraud controls.
Preserve transaction-specific approval records.
Restrict dealer access to subscriber systems.
Monitor suspicious SIM replacement requests.
Notify subscribers of high-risk transactions.
Create rapid SIM swap response channels.
Audit dealers and sales points.
Apply special controls for corporate lines.
Update foreign subscriber verification procedures.
Monitor excessive line registrations.
Protect identity verification data with encryption and access controls.
Prepare data breach response procedures.
Maintain evidence for BTK and court disputes.
Practical Checklist for Subscribers
Subscribers should protect themselves by following these steps:
Do not share identity documents with untrusted dealers.
Do not approve unknown e-Government telecom transactions.
Check whether unknown lines are registered in your name.
React immediately if your mobile signal suddenly disappears.
Contact the operator if SIM swap is suspected.
Ask for written records of subscription and SIM change transactions.
Preserve SMS, e-mails and screenshots.
File a BTK complaint if the operator does not respond properly.
File a criminal complaint if identity theft or fraud is suspected.
Avoid sharing SMS verification codes with anyone.
Conclusion
SIM card registration and identity verification rules in Turkey are essential for telecom security, consumer protection and fraud prevention. A mobile number is now a digital identity tool. It is connected to banking, e-government, social media, business systems and personal communications. Therefore, a weak SIM registration process can cause serious harm.
Turkish law regulates this area through Law No. 5809, BTK rules, consumer protection principles, the identity verification regulation, e-Government approval mechanisms, foreign subscriber verification rules and KVKK. Operators must verify subscribers through legally recognized methods, preserve evidence, protect identity data, audit dealers, prevent SIM swap fraud and respond rapidly to complaints.
The 2026 amendments and BTK procedures show that Turkey is moving toward stricter verification, especially for foreign subscriber records and excess mobile lines. Operators must update their systems accordingly. Foreign subscribers, corporate customers and technology companies using mobile connectivity should also be aware of these rules.
The most important compliance principle is proof. In every SIM registration, SIM change, eSIM activation, number portability or subscription update, the operator must be able to prove who applied, how identity was verified, what transaction was approved and how the records were protected.
Frequently Asked Questions
Is SIM card registration mandatory in Turkey?
Yes. Mobile subscriptions must be connected to a verified subscriber identity. Operators must verify the applicant during subscription and certain later transactions such as SIM change, number portability and operator change.
Which authority regulates SIM registration in Turkey?
The main authority is BTK, the Information and Communication Technologies Authority. BTK regulates and supervises the electronic communications sector.
Which transactions require identity verification?
The identity verification framework covers subscription contracts, number portability, operator change applications, qualified electronic certificate applications, registered electronic mail applications and SIM card change applications where transaction documents are created electronically.
How can identity be verified electronically?
Identity may be verified through regulated methods such as e-Government, video verification with an electronic identity document, temporary electronic identity document methods, face-to-face video-based verification and Migration Authority verification for certain foreign applicants.
Can video identity verification be done without consent?
No. The regulation states that video identity verification cannot be performed without explicit consent under KVKK, and the obligation to inform must be fulfilled separately before obtaining consent.
Are foreign subscribers subject to special rules?
Yes. BTK’s 2026 procedure requires mobile operators to allow certain foreign natural-person subscribers to update their subscription records within six months from 25 June 2026 and sets out consequences where identity cannot be verified.
What is SIM swap fraud?
SIM swap fraud occurs when a fraudster obtains control of a victim’s mobile number by causing a replacement SIM or eSIM profile to be issued. This can allow the fraudster to receive SMS verification codes and access digital accounts.
Does KVKK apply to SIM registration?
Yes. SIM registration involves personal data such as identity information, phone numbers, document images, video verification records and transaction logs. KVKK applies to this processing.
Who is responsible for correct identity verification?
The regulation states that correct identification of the applicant is the responsibility of the operator or service provider.
What should operators do to reduce SIM registration risk?
Operators should use lawful identity verification methods, preserve evidence, secure identity data, audit dealers, monitor suspicious SIM changes, prevent SIM swap fraud, update foreign subscriber procedures and maintain BTK-ready compliance files.
No Responses