Customs Brokerage IT: Five-Year Retention, Paperless Reality

Fail to produce a supporting document during a customs inspection in Türkiye and the 2026 bill is 11,952 TRY. The base irregularity fine is 1,494 TRY, but Article 241/6-(d) of the Customs Law multiplies it eightfold. That is per declaration.

The awkward part is that the penalty lands not because you lost the document, but because you couldn’t find it. The folder may still be sitting on the archive disk. If nobody remembers the password to a NAS commissioned five years ago, the document legally counts as not produced.

How long is five years, really?

Article 13 of the Customs Law requires documents covered by Article 11 to be retained for five years for customs control purposes. The clock doesn’t start on the transaction date; it starts at the end of the relevant year.

Status of the goods	Retention clock starts
Free circulation or export declaration	End of the year the declaration was registered
Goods with reduced/zero duty due to end-use	End of the year customs supervision ended
Goods under another customs procedure	End of the year that procedure ended
Goods placed in a free zone	End of the year the goods left the zone

An export declaration registered in January 2026 must therefore survive until 31 December 2031. Nearly six years. If your archive policy simply says “5 years,” it looks compliant on paper while leaving an eleven-month gap in practice.

Where does a “document” live in paperless customs?

Since 20 August 2019, export declarations in Türkiye are issued with a qualified electronic signature — no wet-ink signature. The record held in BİLGE, the customs administration’s electronic declaration system, is the original declaration. Article 114/9 of the Customs Regulation follows through: the declaration is stored electronically, while supporting documents are stored on paper or electronically depending on the medium of the original.

That second half is what most brokerages miss. If the wet-signed original of a certificate of origin reached your desk, scanning it doesn’t discharge the obligation: under Article 114/5 the customs administration may request the original whenever it sees fit. So you run a hybrid archive. An electronic record on one side, a physical folder on the other, and if nothing reconciles the two, your search starts with somebody’s memory rather than a declaration number.

Three rules that hold up in practice:

• One reference: address both archives by the same declaration registration number. The number on the folder spine, the number in the filename and the BİLGE record must match exactly.
• Year-based disposal calendar: decide deletion by registration year, not by individual file. Anchoring to the last day of the year removes the risk of destroying something early.
• Immutable copy: keep the declaration archive in a copy that neither ransomware nor an operator mistake can alter. We covered immutable backup and the 3-2-1-1-0 rule separately.

Five years or eight?

The Istanbul Customs Brokers Association has flagged a genuine mismatch: the Customs Law asks for five years, while the statute of limitations under the Misdemeanours Law can run to eight. A document you destroyed lawfully at the end of year five might have been the backbone of your defence in an investigation opened in year six.

This isn’t legal advice, it’s a risk preference. Weigh storage cost against the chance of standing there empty-handed. An eight-year declaration archive at a typical brokerage rarely exceeds a few terabytes, and its annual cost in object storage stays below a single eightfold penalty.

How much personal data does a brokerage carry?

Read those declaration attachments once more through a data protection lens. Signature circulars, powers of attorney, ID copies of the importer’s authorised signatory, driver details, staff e-signature certificates. For most of these the brokerage is the data controller, and Article 12 of KVKK — Türkiye’s personal data protection law, broadly the local counterpart of GDPR — applies in full.

The real tension: customs rules say “retain for five years,” while KVKK says “erase once the purpose is gone.” They don’t actually conflict, because Article 13 is itself the legal basis for retention. But when the retention period expires, periodic erasure has to genuinely run. If your inventory doesn’t break personal data categories and retention periods down by customs procedure, your VERBİS registration — the mandatory public register of data controllers — is incomplete too.

Frequently asked questions

Is a PDF copy of the declaration enough? For the declaration itself, the electronic record in the system governs. For attachments, the test is which medium holds the original. If the original is paper, a PDF copy alone doesn’t discharge the obligation.

What if the archive disk is stolen? Two separate problems. You can’t produce the documents, so Article 241/6 applies; and if personal data is involved, you owe KVKK a breach notification within 72 hours. On an encrypted disk, that second risk largely disappears.

Does cloud storage breach the rules? No. Customs legislation doesn’t mandate a specific medium — the document simply has to be produced in readable form on request. For files containing personal data, cross-border transfer rules need attention.

What happens to an e-signature when staff leave? Certificate revocation and removal of BİLGE authorisations belong on the same day. An open authorisation left behind by a departed employee is an ownerless risk on both the customs and the data protection side.

When did you last test whether your declaration archive actually restores? No archive policy counts as verified until a restore has been rehearsed. If you’d like to talk through the IT side of your foreign trade operation, get in touch.