Anatel adopts anti-fraud rules for Brazil's business SMS

Anatel adopts anti-fraud rules for Brazil's business SMS

4 November 2026: Brazil's telecoms regulator, Anatel, has published a unanimous board decision that changes how companies send application-to-person (A2P) text messages: each business gets its own dedicated, standardised short code instead of sharing one, a central directory will show who sends from every code, and operators, aggregators and messaging platforms take on duties to identify senders and check what they send.

Not yet independently verified. Anatel's notice gives no compliance deadlines, and we have not read the text of the decision itself; reports that unregistered senders will be blocked come from the press, not from Anatel's page. We will update this when it can be confirmed, and remove this note.

Shared codes and spoofed senders

The decision builds on Anatel's earlier ruling of 14 August 2025 and targets the fraud that rides on business SMS, where a message that appears to come from a bank or a retailer is sent through a short code several companies share. The measures listed on Anatel's page are:

• dedicated, standardised short codes, so that companies no longer share an identifier;
• a central short-code directory with free public lookup and full access for Anatel;
• mobile operators with significant market power answerable to Anatel for identifying the real user behind each code;
• automated monitoring of A2P traffic and fraud policies at the operators;
• a cooperation channel between operators and message brokers;
• duties for originators, aggregators and integrators to identify who is responsible, check that campaigns are legitimate, keep records and cooperate with the authorities.

The decision singles out critical digital messages, those used for authentication, credential recovery, identity confirmation and transaction approval, for extra safety measures.

What happens next, and when

Anatel's page sets no compliance date for companies. Its executive superintendence must report back within 180 days and run a call for input (tomada de subsídios) before the detailed rules are settled. The rapporteur was board member Octavio Penna Pieranti.

Tecnoblog's report of the decision says operators will have to block SMS from companies that are not registered; Anatel's own announcement does not say that in so many words, so the final shape of enforcement will come with the detailed rules.

What senders should prepare

Any company that sends one-time passwords, delivery updates or payment confirmations to Brazilian numbers through an SMS provider is affected, even though the duties fall first on operators and aggregators. Three things are worth doing before the detailed rules arrive:

• ask the SMS provider whether traffic runs over a dedicated or a shared short code, and what it will take to move to a dedicated one;
• make sure the company's legal name and registration details match what the provider holds, since the directory will publish who sends from each code;
• separate authentication and payment messages from marketing traffic, because the critical-message category will carry stricter controls.

Our catalogue lists 16 SMS marketing software products, the category most exposed to the change.

Sources

• Anatel: Anatel aprova medidas para reforçar segurança de mensagens SMS e prevenir fraudes (Portuguese), 4 November 2026
• Tecnoblog: Anatel decide que operadoras deverão bloquear o SMS de empresas sem cadastro (Portuguese), 4 November 2026