Overview
- Anatel published the rule in the Diário Oficial on Wednesday and put it in force, triggering phased deadlines that require action from operators and message providers within 60 to 90 days.
- Telecom operators must build and maintain a public, centralized short‑code directory within 90 days and block delivery of A2P SMS sent from short codes not listed in that registry.
- The agency requires operators to adopt internal SMS security policies and automated monitoring within 60 days, including systems to detect abnormal traffic patterns and identity spoofing plus a sector alert channel.
- Originators, aggregators, integrators and platform owners have 90 days to update identifications, verify clients, preserve sender records and cooperate in stopping campaigns that show signs of fraud.
- Anatel’s executive office must report implementation results to the regulator’s board within 180 days, a step that could lead to further enforcement or referrals while operators face operational and verification challenges ahead.