Turkiye's Law No. 6563 on the Regulation of Electronic Commerce covers every commercial message. This includes newsletters, bulk SMS, and promotional calls. The rule is simple. Get the recipient's consent before you send, and keep proof.
The İleti Yönetim Sistemi (IYS) makes that proof easy to check. It stores every consent record in one national database with a timestamp.
For an SME, this changes marketing operations concretely. Consent no longer lives in a spreadsheet or an email tool; it lives in a system regulators, your customers, and you can all check. That sounds like a burden, but it removes ambiguity: you always know who you may contact, through which channel, and since when.
What IYS Is and Why It Matters for Small Businesses
The scope of the Message Management System
The İleti Yönetim Sistemi is a central consent database. Turkiye's Ministry of Trade authorized it. IYS A.Ş. operates it under TOBB. TOBB is the Union of Chambers and Commodity Exchanges of Turkiye.
Any business that sends commercial electronic messages manages recipient permissions there.
IYS covers three channels: SMS, email, and voice calls. It tracks each one separately. Recipients can log in, see every brand they have approved, and withdraw consent per channel from a single screen. Every record carries a timestamp, so both sides work from the same version of the truth.
Why the stakes are higher for SMEs
Registration is a legal requirement, not an option. A business faces administrative fines if it sends SMS or email without recording consent in IYS. In bulk campaigns, the fines apply per recipient.
One unauthorized send to a few hundred contacts can grow into a large cost. It can badly hurt a small company's budget.
Beyond penalties, there is also a commercial argument. Permission-based marketing reaches people who opted in. This lifts open and response rates instead of diluting them.
Spending a limited budget on recipients who never consented is a double loss. You waste your spend and damage your reputation.
One detail works in favor of smaller companies. Businesses with fewer than 5,000 approved contact addresses use the core IYS service free of charge. So a small business uses the same national system as a large corporation, at no extra cost. Above that threshold, you need paid packages or integrator support.
The Legal Framework: Law No. 6563 and Where KVKK Fits In
What Law No. 6563 requires
Law No. 6563 has been in force since 2015. It made approval mandatory before sending any commercial electronic message. A 2017 amendment added central management of those approvals.
The Ministry of Trade then launched IYS. You can read the law in full at mevzuat.gov.tr. The platform itself is at iys.org.tr
Three obligations matter most in daily operations:
- Prior consent. You must get approval before sending any promotional message. You can collect it online, for example through a web form, an SMS code, or a checkbox at checkout. The service provider must provide full proof.
- The right to refuse. Every commercial message must include an easy way to opt out. Consent stays valid until the recipient withdraws it. You must process a refusal within three business days. Opt-outs submitted through IYS propagate automatically.
- Penalties. Sending without registration or valid consent leads to administrative fines. The fines increase for repeat violations. Regulators calculate them per recipient, so a bulk campaign raises the risk quickly. The Ministry of Trade changes amounts from time to time. Check its announcements for the latest figures.
An unauthorized bulk campaign is not a single violation. Regulators assess fines per recipient. One mistaken send to a few thousand contacts can turn a routine campaign into a serious financial event. Verify consent before the send, not after the complaint.
How IYS supports KVKK compliance
Consent records count as personal data. A phone number, an email address, and a stated preference all fall under the Personal Data Protection Law (KVKK). IYS approval alone is not enough. You must store that data according to KVKK's security rules.
IYS helps here, not adds work. It keeps consent records in an encrypted database with controlled access. This avoids a much riskier option. Without IYS, you may leave contact data scattered across spreadsheets, CRM exports, and an unaudited marketing tool.
The two frameworks also align on the recipient's side. Recipients of unwanted commercial messages can complain to both the Ministry of Trade and the Personal Data Protection Authority. Proper IYS use stops those complaints.
The system blocks any send to a recipient without valid consent. It also updates every party when a recipient withdraws permission.
Registering for IYS Through e-Devlet
Registration is mandatory for all service providers and completed through e-Devlet. Before starting, confirm your MERSİS record is current and your authorized representative holds a valid e-signature.
- Sign in to e-Devlet. Search for the "İleti Yönetim Sistemi Başvuru" service to reach the dedicated section maintained by the Ministry of Trade.
- Fill out the application form. Enter the company's registered title, MERSİS number, and address. Also list the brand names you use for commercial messages.
- You may also need to report how many approved contact addresses you hold, per channel. Inconsistencies can later become verification problems.
- Sign the undertaking. Download the Basic Services Usage Agreement and sign it with your e-signature. If your company operates under joint representation, all authorized signatories may need to sign.
- Submit. Upload your trademark registration documents together with the signed undertaking.
After approval, you access the management panel through your company account at iys.org.tr. An authorized integrator will also guide you through the application itself.
If your approved contact list exceeds 5,000 addresses, the free tier no longer covers you. Review the paid packages before you plan your marketing budget. The consent-request module is free only up to 5,000 addresses.
Businesses above that threshold face a second reality. Updating thousands of records by hand is not sustainable. API integration becomes a need, not a convenience.
When you connect your CRM to IYS via API, permission changes sync automatically. This is where an authorized IYS integrator meaningfully reduces the operational load.
Managing Consent in the IYS Panel
Migrating your existing permission lists
Your first task after registration is transferring the consent you already hold. Most SMEs collected approved numbers and addresses long before IYS existed. Until those records are inside IYS, they are not legally valid, regardless of how carefully you collected them.
For a handful of contacts, manual entry works. For larger lists, use the CSV upload. Put one recipient per row. Add supporting fields like name, consent date, and consent source.
Before you upload, clean the list and confirm that every entry represents a genuine, documented approval. Uploading unverified data simply moves an old problem into a system where it becomes visible. A shorter, accurate list is worth more than a long, questionable one.
Choosing How to Move Consent Data Into IYS
| Method | Best suited to | Effort | Sync behavior |
|---|---|---|---|
| Typing into the panel | Fewer than ~50 records, updates now and then | Low setup, high upkeep | By hand, one record at a time |
| CSV bulk upload | First move of a list you already hold | Medium setup, medium upkeep | In batches, repeated for each update |
| API integration | Steady flow from a website, CRM, or online shop | Higher setup, near-zero upkeep | On its own, close to real time |
Use CSV once to migrate your existing records, then move ongoing consent traffic to the API. Any process that depends on someone remembering to log in will eventually miss the three-business-day window.
Keeping records current: additions, opt-outs, and reporting
Registration is the start of the work, not the end of it:
- New approvals. Report every new consent within three business days. Choose the panel, bulk upload, or an integrator's API. The API sends the consent automatically.
- Refusals. Log every opt-out, whether a STOP reply or an unsubscribe click, and update IYS within three business days. Refusals that come through IYS appear in your panel automatically. Record those that arrive through your own channels.
- Sync. Use IYS as the single source of truth. Send campaigns only to contacts approved there. Reconcile IYS with your internal lists regularly.
- Reporting and logs. Each record shows the time, method, and wording of the consent. In an audit or complaint, these timestamped logs are your evidence.
One timing rule is easy to miss. Send the recipient a consent confirmation within 24 hours. Record the consent in IYS within three business days.
Late approvals are not legally valid. So you cannot message those people, even if they said yes.
Running Permission-Based SMS and Email Campaigns
Checking consent before every send
Before every campaign, verify that IYS marks each recipient as approved. Channel-level accuracy matters more than most teams expect. IYS records consent per channel. A customer who approved SMS has not automatically approved email.
Filter by the channel you plan to use. This prevents a common compliance failure: reusing a segment across all channels just because it once performed well.
If you work with an integrator, this verification is automatic. The IYS integration service It validates recipient consent before the send and removes anyone without valid approval. Without an integration, download the current approved list from the panel and compare it against your campaign list manually. The rules prohibit messaging a contact marked refused, and it damages customer trust.
Finally, include a clear opt-out in every message. This meets the legal requirement. It also captures opt-outs that never come through IYS.
Handling opt-out requests
Processing a refusal promptly is not optional. Customers who keep receiving messages after asking to stop file complaints, and complaints lead to inspections.
Make opting out clear: use a reply keyword for SMS and a visible unsubscribe link in email. Send that refusal to IYS automatically when you can. Webhook support helps here.
With Makdos's IYS panel and webhook alerts, a refusal lands in your own system right away. The consent status then updates on its own. If the customer opts out through e-Devlet or iys.org.tr, the change appears in your panel, and daily reports carry it into your systems.
The main rule is simple: never message a refused contact again. With older list-based processes, one person could be on three exports and still slip through two. With an integrated setup, you record the refusal once, in one place, and it applies to every sending channel.
See opt-outs as a retention signal, not a loss. A customer who leaves cleanly still sees the brand in a positive way. They are more likely to come back than a customer you had to ask twice to stop messaging.
Where Small Businesses Go Wrong: A Practical Checklist
Most SME compliance problems come from operations, not law. No one chooses to break the law. They just miss an update during a busy week. Add these points to your routine:
- Consolidate every permission you hold. Identify which channels each customer approved. If consent is missing, ask for it before you send anything. This includes the customer who gave you a phone number in your store.
- Register, then maintain. Upload existing approvals immediately, then keep adding new ones and removing refusals. Every skipped update is a penalty waiting for an audit.
- Respect the timing rules. Three business days for new approvals, three for refusals. Automate the process so the deadline is never a human responsibility.
- Limit and train panel access. Decide who manages the panel, train them properly, and create accounts only for them.
- Be transparent with customers. Publish a clear KVKK and communication-consent notice and mention IYS in it. Customers trust you more, not less, when they see where you store their permission.
- Monitor complaints. Track whether customers filed complaints through the panel or via Ministry of Trade notifications. If one appears, fix the underlying process, usually a segmentation error, not just the individual record.
- Follow regulatory updates. Thresholds, rules, and modules change; watch announcements from the Ministry of Trade and IYS A.Ş.
The underlying logic is good marketing practice regardless of the law: reach the people who want to hear from you, leave the others alone.
How Makdos Approaches IYS Integration
For most small businesses the problem is not understanding IYS but finding time to run it correctly every week. That is the gap an integrator fills.
Makdos is an IYS integrator approved by the Ministry of Trade. It sets up and manages the link between your systems and the national database. Help starts at the application stage: guidance through e-Devlet and defining your business partner. Then you use the IYS-issued Business Partner Code to make Makdos your integration partner.
Next, you use your own IYS management panel. You move your customer permissions over once, and they sync safely with IYS. Ongoing traffic flows through API integration and webhook notifications.
When a customer subscribes on your website, IYS receives the consent automatically. When someone opts out on the IYS side, the webhook delivers that change immediately. Nothing depends on someone remembering to log in.
The same logic extends across your communication stack. In business mail hosting Consent checks run automatically on bulk email sends. SMS integration blocks delivery to numbers without valid permission.
The system reports which recipients it removed for missing approval. That way, the error shows up before the send, not in a complaint.
Because consent records are personal data, the security layer around them matters as much as the integration. Firewall and security protect the systems that hold that data. Your KVKK and IYS duties then move in step, not as two projects
Support is the other half of the service. IYS ties directly to your revenue-generating channels. An unanswered question on a Friday afternoon can stop a campaign from going out. Makdos gives 24/7 technical support and advice for API errors, panel use, and IYS-side changes.
It also guides consent management and KVKK-aligned marketing practice. The setup grows with you. As your customer base grows, you can handle more records without rebuilding the integration.
Conclusion: Turn Compliance Into a Marketing Advantage
IYS puts commercial communication in Turkiye on a legal footing, and for small businesses it is genuinely non-negotiable. The essentials:
- IYS brings SMS, email, and voice-call consent into one national database. Registration under Law No. 6563 is a legal requirement.
- SMEs register through e-Devlet and move existing approvals into the system. They must report new consent within three business days. They must also handle refusals in the same time frame.
- Permission-based marketing makes campaigns more targeted while removing the risk of per-recipient fines.
- An authorized integrator turns integration, panel management, and support into someone else's operational problem.
So what should you do?
If you have not registered, do it now. Move your customer permissions into the system. If you are registered but do everything by hand, check whether those three-business-day updates happen every week. That is where most compliance gaps are.
If you would like the integration handled for you, review the Makdos IYS Integration Service and take the first step for your business today.
