Brazil: Anatel orders blocking of A2P SMS from unregistered senders

5 نوفمبر 2026

In brief

On 3 November 2026 Anatel's Conselho Diretor unanimously approved an order against A2P SMS fraud.
Operators must create a public short-code directory within 90 days and block unregistered codes (extendable by 30 days).
Aggregators, integrators and digital authentication platforms also take on duties, without being treated as telecom operators.

Brazil’s telecoms regulator, the Agência Nacional de Telecomunicações (Anatel), has decided that mobile operators must publicly identify the companies that send bulk SMS and block messages from those not registered. It matters because SMS remains a core authentication channel and, at the same time, a favourite route for fraud.

What has been decided

As TeleSíntese reported, the order was approved unanimously by the Conselho Diretor in a deliberative circuit on 3 November 2026, with Councillor Octavio Penna Pieranti as rapporteur. Deadlines run from its publication. It implements an action plan stemming from an August 2025 decision, drawn up with operators, message aggregators and ABR Telecom.

Operators of the Serviço Móvel Pessoal (SMP, mobile personal service) must maintain a centralised sector-wide short-code directory open to public consultation, identifying the legal entities responsible for sending. A2P (application-to-person) SMS will be restricted to companies listed in it.

Deadlines and duties

90 days: stop delivery of messages from unregistered short codes (extendable by 30 days with justification) and apply the measures for aggregators, integrators and originators.
60 days: each short code assigned, in principle, to a single legal entity; internal SMS security policies and a sector channel for alerts (extendable by the same period).
Automated monitoring of traffic to detect anomalous patterns, fraudulent campaigns, compromised credentials and identity spoofing, while respecting data protection and confidentiality of communications.
Periodic reports to the Grupo Técnico de Suporte à Segurança Pública (GT-Seg) on blocked messages and effectiveness indicators.

Digital platforms and limits

The decision also reaches those responsible for applications and platforms used to authenticate users, recover credentials and authorise transactions. They have 90 days to ensure sender identification, integrity and traceability, with security outcomes equivalent to those required of A2P SMS, without mandating a specific technology. The order clarifies that operators are not given a general duty to police third parties, and platforms are not treated as telecoms providers. The Superintendência Executiva will report back within 180 days and open a call for input (tomada de subsídios).

Our view at CEA Digital Law

The Euro-American Committee of Digital Law - CEA Digital Law welcomes the layered approach: verifiable sender registration, traceability and responsibility allocated according to each actor’s real control. It is a useful model for other countries in Latin America and the Caribbean and in Africa, where SMS is even more central to financial inclusion and sender registries are still emerging. In Europe, sender spoofing and payment fraud are being tackled through different routes, so the Brazilian experience offers a comparable case.

Open questions deserve follow-up: how blocking will be balanced against legitimate messages, how the directory will be governed, how security “equivalence” will be measured for alternative channels, and how personal data will be protected in monitoring. The planned consultation is a good opportunity for academia and industry to contribute evidence.