Quick answer: KEP and secure e‑signature are different tools. A secure e‑signature proves and applies a natural person’s legally significant electronic signature; KEP provides evidence-oriented registered electronic correspondence. Turkish private-law legal entities are among the mandatory electronic-notification recipients and must control their UETS account; mali mühür is used for specified GİB e‑document processes.
This guide explains the digital-tool decision question: which tool solves which Turkish business workflow. For detailed setup instructions, use the dedicated guides linked below.
Four Digital Tools, Four Different Jobs
| Tool |
Identifies |
Main purpose |
Typical trigger |
| Secure e‑signature |
Natural person |
Legally significant electronic signing |
MERSİS/corporate/public digital action that requires secure e‑signature |
| KEP |
KEP account holder / organisation |
Registered electronic correspondence with evidence records |
Regulatory, contractual or institutional workflow requiring/providing KEP |
| UETS / e‑Tebligat |
Turkish private-law legal entity or another statutory recipient |
Receive statutory electronic notifications |
Mandatory-recipient status under the Notification Law |
| Mali mühür |
Legal entity / taxpayer |
Entity authentication in specified GİB e‑document systems |
e‑Fatura/e‑Arşiv/e‑Defter or another GİB workflow requiring the certificate |
Decision rule: Do not buy all digital tools as a generic “company setup bundle” before checking which workflow actually triggers each one.
When Do You Need Secure E‑Signature?
Use secure e‑signature when a natural person needs to sign electronically under Law No. 5070 and the target platform/transaction supports or requires that method.
Examples can include:
- specified MERSİS corporate decision modules;
- digital signature declarations and public applications where supported;
- electronic contracts where secure e‑signature is an appropriate execution form;
- other official systems that explicitly accept/require secure e‑signature.
A secure e‑signature has the same legal effect as a handwritten signature under Law No. 5070, subject to the statutory exceptions, including transactions that require an official form or special ceremony and the separate restrictions for certain guarantee contracts.
Read the full E‑Signature for Companies in Turkey guide.
When Do You Need KEP?
KEP is for registered electronic correspondence where proof of sender, recipient, timing and content matters. It can be required by a specific Ministry, regulator, application, contractual framework or sector rule.
BTK does not describe KEP as a universal system that every company must use for every official communication. Identify the actual legal or process trigger first. For operation, BTK states that sending through KEP requires an electronic signature, while receive-only use does not require one for that function; a legal entity can assign one or more işlem yetkilisi to operate the account on its behalf.
Read the full KEP Address in Turkey guide.
KEP Is Not UETS
This is the most common digital-compliance mix-up.
Since 1 January 2019, formal electronic notifications under the Notification Law are delivered through UETS, not through KEP. Existing KEP addresses are not the company’s UETS e‑Tebligat address.
For a Turkish company, UETS is not merely an optional inbox choice. Private-law legal entities are among the recipients subject to mandatory electronic notification. Confirm the company’s allocated UETS account, authorised user, verified alert details and internal monitoring owner through the current PTT/institutional process. A manager or ownership change does not by itself remove the legal entity’s recipient status.
Activation matters: PTT states that a UETS address shown as “Aktivasyon Bekliyor” is not ready to receive e-notifications until it is activated. For a legal-entity account, the transaction official can perform activation through the supported UETS access routes such as e-Devlet, e-signature or mobile signature. SMS/e-mail alerts are useful controls, but a missing or late alert does not invalidate the electronic notification.
UETS is primarily a notification-receipt system for messages sent by authorities authorised under the Notification Law. KEP continues as a separate registered electronic-correspondence service.
UETS Delivery Rule: Five Days, Not “24 Hours in KEP”
PTT explains that a UETS electronic notification is legally deemed served at the end of the fifth day following the date it reaches the recipient’s UETS address, even if it is not opened. A missing or delayed SMS/email alert does not change that legal effect.
Do not apply this UETS statutory rule to KEP messages, and do not use the old statement that every KEP message becomes legally read after 24 hours. The effect of a KEP message depends on the legal/contractual context in which it is sent.
When Do You Need Mali Mühür?
Mali mühür is not the company director’s personal e‑signature. It is an entity-level certificate used in specified GİB e‑document systems.
A legal entity can need mali mühür when its e‑Fatura/e‑Arşiv/e‑Defter or other GİB workflow requires it. The need is therefore connected to the taxpayer’s current e‑document system—not simply to the company’s existence.
Read the full Financial Seal (Mali Mühür) guide.
Turkish digital business tools solve different identity, signing, correspondence and notification problems.
Which Tool for Which Task?
| Task |
Likely tool / system |
What to verify |
| Electronically sign a qualifying MERSİS decision |
Secure e‑signature |
Whether the specific MERSİS module supports the action |
| Send registered electronic correspondence to an institution |
KEP |
Whether the institution accepts/requires KEP |
| Receive statutory electronic notification |
UETS |
Notification Law and UETS recipient status |
| Use GİB e‑Fatura as a legal entity |
Mali mühür / approved integration model |
Current GİB technical model |
| Sign a commercial contract electronically |
Secure e‑signature may be appropriate |
Representation authority and whether special form is legally required |
| Submit a tax declaration |
e‑Beyanname / licensed-professional filing arrangement |
Do not assume personal e‑signature or mali mühür is the universal filing method |
| Open/manage a corporate bank account |
Bank-specific authentication |
Bank KYC and signatory rules remain separate |
Company Formation: Which Tools Are Needed on Day One?
There is no responsible one-size-fits-all answer. Company incorporation can often be coordinated through a power of attorney without every foreign founder personally obtaining every Turkish digital credential before registration.
After registration, build the digital stack from actual triggers:
- Check who will manage/sign and whether secure e‑signature is needed for planned digital corporate actions.
- Determine whether a specific process requires KEP.
- Confirm the company’s mandatory UETS account, assign a controlled authorised user and implement a documented monitoring routine; daily checking can be an internal risk-control policy, not a universal statutory cadence.
- With the licensed SMMM, determine e‑Fatura/e‑Arşiv/e‑Defter obligations and whether mali mühür is needed.
- Keep bank credentials and professional tax-filing authority as separate layers.
This avoids paying for unused tools or, more importantly, assuming one credential can replace another.
Workon coordinates the digital-tool sequence around the company’s actual registration and operational requirements.
Foreign Founder: Can You Obtain These Remotely?
Remote availability differs by tool and provider.
| Tool |
Remote-planning question |
| Secure e‑signature |
What identity-verification route does the authorised certificate provider offer to the foreign applicant? |
| KEP |
Can the authorised representative/PoA holder complete the chosen provider’s corporate-account process? |
| UETS |
What account has been allocated to the company, who is the controlled authorised user and how will statutory notifications be monitored? |
| Mali mühür |
Are responsible-person records complete and who can receive the delivered certificate? |
Do not promise “fully remote digital setup” without checking each provider/institution separately.
Security and Access Control
Do not share a secure e‑signature PIN/token or other personal signing credential with staff. Likewise, KEP, UETS and mali mühür access should be assigned through controlled organisational procedures.
A practical control model:
- name an owner for each system;
- maintain authorised-user records;
- enable alerts where available;
- route legal/tax messages immediately to the relevant professional;
- revoke compromised certificates/credentials quickly;
- review access when managers or employees leave.
Common Digital-Tool Mistakes
| Mistake |
Correction |
| “KEP is the official government notification inbox” |
UETS handles statutory e‑Tebligat; KEP is separate registered electronic correspondence |
| “Every company must have KEP and QES before incorporation” |
Identify the actual process trigger for each tool |
| “Foreign e‑signatures can never have legal effect in Turkey” |
Law No. 5070 contains recognition mechanisms; platform compatibility must also be checked |
| “Mali mühür is the director’s company e‑signature” |
Mali mühür identifies the entity in specified GİB systems; secure e‑signature identifies the natural person |
| “Every tax return is signed with mali mühür/e‑signature by the founder” |
Tax filing follows separate e‑Beyanname/professional-authority rules |
How Workon Coordinates the Digital Business Stack
Workon coordinates company setup and operational readiness for foreign founders and overseas companies entering Türkiye. Depending on the agreed scope, this can include identifying the required digital tools, coordinating authorised-provider applications, and sequencing e‑signature, KEP, UETS-facing administration, mali mühür, licensed CPA and company-registration workflows.
Certificates and KEP services are issued by authorised providers. Regulated legal and tax services remain with appropriately licensed professionals.
Review Workon’s company registration and operational coordination service.
Official Sources
Last reviewed: 17 September 2026. Provider processes and digital-system requirements can change; verify the exact workflow before ordering credentials.
Frequently Asked Questions
No. Secure e-signature identifies and signs for a natural person, KEP provides evidence-oriented registered electronic correspondence, UETS is the statutory electronic-notification system for covered recipients, and mali mühür is an entity-level certificate used in specified GİB e-document workflows.
No blanket KEP-system rule makes every company use KEP for everything. A KEP requirement can arise from a specific law, regulator, Ministry process, tender, application, contract or business model. Sending through KEP requires an electronic signature, while receive-only use does not require one for that function. Turkish private-law legal entities are separately within the mandatory UETS electronic-notification framework.
Since 1 January 2019, statutory electronic notifications under the Notification Law are delivered through UETS. KEP remains a separate registered electronic-correspondence service. A company's KEP address should not be treated as its UETS e-Tebligat address.
A UETS address that is still shown as activation pending is not ready to receive e-notifications. For a legal-entity account, the transaction official can activate it through the supported UETS access routes such as e-Devlet, e-signature or mobile signature. Keep verified SMS\/e-mail alert details and an internal monitoring owner, but remember that a missing or delayed alert does not invalidate a notification.
No. Do not apply a universal 24-hour deemed-reading rule to KEP. The legal effect of a KEP message depends on the specific legal, regulatory or contractual context. The separate UETS framework generally deems an electronic notification served at the end of the fifth day following delivery to the UETS address.
Do not state that foreign electronic signatures can never have legal effect. Law No. 5070 contains recognition mechanisms, while the receiving platform or institution can also impose technical and provider-compatibility requirements. The exact transaction and signature source should be checked before relying on it.
No. Build the digital stack from actual triggers. Confirm and activate the company’s mandatory UETS recipient account, then determine whether planned corporate actions require secure e-signature, whether a process requires KEP and whether the company’s current GİB e-document workflow requires mali mühür. Provider issuance and setup timing are not universal.
Disclaimer: This guide provides general information, not legal, tax, cybersecurity or electronic-evidence advice. Mandatory-recipient status, provider identity checks, certificate validity, platform compatibility and delivery effects can change or depend on the transaction. Verify the live BTK, PTT and GİB rules and obtain appropriately qualified advice before relying on a digital credential or statutory notification deadline.
