{"id":125241,"date":"2026-11-05T10:18:51","date_gmt":"2026-11-05T09:18:51","guid":{"rendered":"https:\/\/ceadigilaw.org\/?p=125241"},"modified":"2026-11-05T10:18:57","modified_gmt":"2026-11-05T09:18:57","slug":"brazil-anatel-orders-blocking-unregistered-sms","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/fr\/blog\/brazil-anatel-orders-blocking-unregistered-sms\/","title":{"rendered":"Brazil: Anatel orders blocking of A2P SMS from unregistered senders"},"content":{"rendered":"<div lang=\"en\">\n<div class=\"cea-blog-resumen\">\n<p><strong>In brief<\/strong><\/p>\n<ul>\n<li>On 3 November 2026 Anatel&#039;s Conselho Diretor unanimously approved an order against A2P SMS fraud.<\/li>\n<li>Operators must create a public short-code directory within 90 days and block unregistered codes (extendable by 30 days).<\/li>\n<li>Aggregators, integrators and digital authentication platforms also take on duties, without being treated as telecom operators.<\/li>\n<\/ul>\n<\/div>\n<p>Brazil&rsquo;s telecoms regulator, the Ag\u00eancia Nacional de Telecomunica\u00e7\u00f5es (Anatel), has decided that mobile operators must publicly identify the companies that send bulk SMS and block messages from those not registered. It matters because SMS remains a core authentication channel and, at the same time, a favourite route for fraud.<\/p>\n<h2>What has been decided<\/h2>\n<p>As <a href=\"https:\/\/telesintese.com.br\/operadoras-deverao-bloquear-quem-dispara-sms-irregular\/\" target=\"_blank\" rel=\"noopener\">TeleS\u00edntese<\/a> reported, the order was approved unanimously by the Conselho Diretor in a deliberative circuit on 3 November 2026, with Councillor Octavio Penna Pieranti as rapporteur. Deadlines run from its publication. It implements an action plan stemming from an August 2025 decision, drawn up with operators, message aggregators and ABR Telecom.<\/p>\n<p>Operators of the Servi\u00e7o M\u00f3vel Pessoal (SMP, mobile personal service) must maintain a centralised sector-wide short-code directory open to public consultation, identifying the legal entities responsible for sending. A2P (application-to-person) SMS will be restricted to companies listed in it.<\/p>\n<h2>Deadlines and duties<\/h2>\n<ul>\n<li><strong>90 days:<\/strong> stop delivery of messages from unregistered short codes (extendable by 30 days with justification) and apply the measures for aggregators, integrators and originators.<\/li>\n<li><strong>60 days:<\/strong> each short code assigned, in principle, to a single legal entity; internal SMS security policies and a sector channel for alerts (extendable by the same period).<\/li>\n<li><strong>Automated monitoring<\/strong> of traffic to detect anomalous patterns, fraudulent campaigns, compromised credentials and identity spoofing, while respecting data protection and confidentiality of communications.<\/li>\n<li><strong>Periodic reports<\/strong> to the Grupo T\u00e9cnico de Suporte \u00e0 Seguran\u00e7a P\u00fablica (GT-Seg) on blocked messages and effectiveness indicators.<\/li>\n<\/ul>\n<h2>Digital platforms and limits<\/h2>\n<p>The decision also reaches those responsible for applications and platforms used to authenticate users, recover credentials and authorise transactions. They have 90 days to ensure sender identification, integrity and traceability, with security outcomes equivalent to those required of A2P SMS, without mandating a specific technology. The order clarifies that operators are not given a general duty to police third parties, and platforms are not treated as telecoms providers. The Superintend\u00eancia Executiva will report back within 180 days and open a call for input (tomada de subs\u00eddios).<\/p>\n<h2>Our view at CEA Digital Law<\/h2>\n<p>The Euro-American Committee of Digital Law &#8211; CEA Digital Law welcomes the layered approach: verifiable sender registration, traceability and responsibility allocated according to each actor&rsquo;s real control. It is a useful model for other countries in Latin America and the Caribbean and in Africa, where SMS is even more central to financial inclusion and sender registries are still emerging. In Europe, sender spoofing and payment fraud are being tackled through different routes, so the Brazilian experience offers a comparable case.<\/p>\n<p>Open questions deserve follow-up: how blocking will be balanced against legitimate messages, how the directory will be governed, how security \u00ab\u00a0equivalence\u00a0\u00bb will be measured for alternative channels, and how personal data will be protected in monitoring. The planned consultation is a good opportunity for academia and industry to contribute evidence.<\/p>\n<h2>Sources<\/h2>\n<ul class=\"cea-blog-fuentes\">\n<li><a href=\"https:\/\/telesintese.com.br\/operadoras-deverao-bloquear-quem-dispara-sms-irregular\/\" target=\"_blank\" rel=\"noopener\">TeleS\u00edntese: Operadoras dever\u00e3o bloquear quem dispara SMS irregular<\/a><\/li>\n<\/ul>\n<p class=\"cea-blog-firma\"><em>CEA Digital Law<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Anatel has told mobile operators to build a public short-code directory and block irregular SMS within 90 days. We look at the scope and the lessons.<\/p>\n","protected":false},"author":2,"featured_media":125243,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"wds_primary_category":0,"wds_primary_cea_women":0,"footnotes":""},"categories":[1119],"tags":[],"cea_women":[],"class_list":["post-125241","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ciberseguridad-fr"],"acf":[],"_links":{"self":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts\/125241","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/comments?post=125241"}],"version-history":[{"count":1,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts\/125241\/revisions"}],"predecessor-version":[{"id":125261,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts\/125241\/revisions\/125261"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/media\/125243"}],"wp:attachment":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/media?parent=125241"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/categories?post=125241"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/tags?post=125241"},{"taxonomy":"cea_women","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/cea_women?post=125241"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}