Overview
- Anatel published the binding rules in the Diário Oficial da União on Wednesday, Nov. 4, 2026, formally requiring telecoms and other message‑chain actors to start compliance steps under set deadlines.
- Operators must build a centralized, public short‑code directory and block A2P SMS sent from short codes not listed in it within 90 days, with limited, justified extensions allowed.
- Carriers have 60 days, extendable with justification, to adopt internal SMS security policies and deploy automated monitoring that detects anomalous traffic, spoofing and fraudulent campaigns.
- Obligations extend to originators, aggregators, integrators and digital platforms, which must verify clients, keep records to trace message origins and cooperate with carriers to interrupt suspected fraud.
- Anatel requires industry alert‑sharing and public education before the directory opens and expects its Executive Superintendency to report implementation results to the Board within 180 days, which may lead to further actions or referrals.