Anti-fraud and trust
Less impersonation of banks, public bodies, and brands in message sender fields.
Informational guide · Circular 1/2026 · Order TDF/149/2025
Official document and regulatory context
Legal basis, purpose, and relationship to messaging fraud prevention.
Important notice: This page is an informational guide prepared by TelecomRegistration.com (402T Labs, S.L.U.) to help companies, public administrations, and messaging providers. It does not replace legal advice. The binding source is applicable law and, in particular, Circular 1/2026 and Order TDF/149/2025, plus any updates published by the CNMC on its electronic office.
Full text (PDF) — Circular 1/2026, of 18 March, of the CNMC, regulating the Alias Register (internal file reference: CIR/DTSA/010/25; CNMC file: 6486580.pdf).
1. Legal framework: Order TDF/149/2025 and Circular 1/2026
On 15 February 2025, Order TDF/149/2025, of 12 February, was published in the Boletín Oficial del Estado. It establishes measures against identity-impersonation fraud in calls and messages, and regulates numbering identification for customer service and unsolicited commercial calls.
For messaging, Chapter III of the Order — specifically articles 8.1 and 8.2 — requires prior registration of aliases used by companies and public administrations in the Alias Register, including identification of enabled messaging service providers for sending and transmitting messages with each registered alias.
Articles 7.2 and 8.3 of the Order require involved operators and providers to block SMS/MMS/RCS messages whose alias is not in the Register or, even if registered, when the message is not received from an enabled provider under the chain rules developed by the Circular.
Circular 1/2026, of 18 March, approved by the CNMC Plenary, develops article 8.4 of the Order: it sets out obliged parties, procedure, requirements, and timelines for the Register. The full text is available in the official PDF: Circular 1/2026 (CNMC PDF).
2. What is an alias and what the Register covers
Under Order TDF/149/2025 and the Circular, an alias is the alphanumeric character string transmitted in the field intended for the CLI (calling line identification) in SMS, MMS, or RCS communications. It informs the recipient of the sender but is not a public resource to which the message can be returned.
The Register does not replace other obligations (data protection, commercial consents, exclusion lists, etc.), but it is a necessary condition for the network chain to deliver messages with alphanumeric senders to recipients with a Spanish number, except where the Circular expressly excludes them (for example, an exclusively numeric identifier subject to numbering plans under numbering rules and ITU-T E.164, or messages whose recipients are not Spanish numbers).
3. Key dates and deployment calendar
- 15 September 2026: under the third final provision of Order TDF/149/2025, this is the date from which articles 7.2 and 8 take effect (including blocking of unregistered or improperly originated aliases). It is the key reference for product, operations, and provider teams.
- Circular entry into force: the day after its publication in the BOE (sole final provision of the Circular).
- Test environment: the Circular provides a test environment from the Circular's entry into force until 14 September 2026, so registered providers can adapt systems and download Register data.
- Blocking statistics: annually, before 1 February, obliged parties must submit data for the previous calendar year; the first special submission covers 15 September to 31 December 2026, due before 1 February 2027 (second additional provision).
4. Obliged parties: holders, third parties, and foreign companies
The alias must be registered before use by:
- The company or public administration that holds the alias; or
- The origin provider (PRO) acting on behalf of the holder for sending and transmission.
Third parties designated by the holder may also complete registration. The Circular defines who qualifies as a third party (for example, API integrators, SaaS/CRM platforms channelling sends, agencies, subsidiaries, or franchises, per Annex I).
Foreign companies that need to send messages with aliases to customers with a Spanish number (where roaming exclusions in the Circular and Order do not apply) must register the alias and transmit through registered providers (PR) in the Alias Register (article twelve).
5. Messaging providers: Operator Register, PR, and the sending chain
All messaging service providers involved in transmitting messages with aliases to Spanish numbers must comply with the Order's blocking obligations. To operate in the Register ecosystem they must be enrolled in the Register of Operators, registered in the Alias Register as registered providers (PR), and sign the sworn statement in Annex II of the Circular.
The Circular distinguishes roles:
- Origin provider (PRO): first provider enabled by the holder to originate messages with the alias (may be an aggregator, reseller, or mobile operator, depending on the case).
- Transit provider: passes the message between registered providers.
- Termination provider: final delivery to the subscriber; exclusively mobile operators (OMR and OMVC).
PRs must apply blocking rules at origin, transit, and termination (for example, block unregistered aliases, messages that bypass the PR chain, or prohibited patterns such as a single PRO receiving a message in transit or termination from another PR where that breaches the intended chain model). They must also keep a daily history of blocks and non-blocked volumes for statistics submissions.
Looking for an already registered PRO? 402T Labs offers SMS/MMS/RCS origination as a provider admitted early to the CNMC Alias Register. Request a preliminary assessment.
6. Registration procedure (electronic office and digital certificate)
Applications are submitted via a web form on the CNMC electronic office, with an electronic certificate valid on the @firma public-administration platform. Named legal representatives must also hold a certificate meeting those requirements.
Information the Circular requires for each alias (article four.4) includes: the requested alias; linkage type with brand, domain, or company name; holder company name and NIF or VAT number; registered office; representative details; activation date and, if applicable, end-of-use date; selection of one or more PROs from the Register list; and third-party data where applicable.
Actual use of the alias: unless a later date is agreed, the alias may not be used until the day after registration in the Register, regardless of the activation date stated by the applicant.
Applications on behalf of the holder: remain pending authorisation; the holder has ten working days to approve or reject; silence means the act is not deemed completed.
CNMC decision: maximum one month to review the application (with a transitional six-month regime from the Circular's entry into force where the decision period may reach three months under the common administrative procedure, per third transitional provision).
Multiple aliases in one filing: permitted for the same holder, repeating the form per alias except for common data specified in the Circular.
7. Legitimate linkage between alias and holder (article five and Annexes IV and V)
The CNMC will only register aliases when legitimate linkage between the alias and the holder is evidenced, per Annex III (format and suitability rules) and Annex IV documentation.
Linkage elements include:
- Registered trademark with the Spanish OEPM or EUIPO, or trade name registered with the OEPM.
- Company name entered in the Commercial Register.
- Internet domain registered with Red.es or ICANN-accredited registrars.
- Other names in national or international public registers.
The holder evidences linkage via a sworn statement (Annex V templates). The CNMC may require supporting documentation at any time. Where there is no ownership of typical registration elements, an alternative sworn statement of legitimate habitual use in professional activity may apply, also subject to possible documentary requests.
If two holders evidence rights over the same alias, the Circular sets an order of precedence (priority to match with registered trade name or trademark, then domain, then company name, and lastly the earlier application). There is a route to challenge and request CNMC resolution in an administrative procedure.
8. SMS/MMS and RCS alias format (Annex III)
Annex III of the official PDF is the technical reference marketing, brand, and operations teams should review before proposing a sender. In summary:
SMS and MMS (based on 3GPP TS 23.038 / TP-OA length)
- Between 3 and 11 characters in length.
- Latin letters (including ñ, Ñ, ç, Ç), digits, space, and mixed case.
- Allowed special characters: @ & - _ . + (as stated in the official text).
- No consecutive spaces or leading/trailing spaces.
- Certain symbols are not permitted (among others expressly cited in the Circular: €, hash, percent, parentheses, asterisk, comma, slash, colon, semicolon, question or exclamation marks, brackets, etc.).
- Purely numeric aliases are prohibited.
RCS
Follow the GSMA framework (e.g. RCC.07 v14.0, Universal Profile v3.1, and Business Messaging Guidelines): the alias must clearly identify the holder's brand, trade name, company name, or domain; no leading/trailing spaces, consecutive duplicates, or numeric-only aliases.
Content best practices
Generic aliases that do not identify the sender or cause confusion with official bodies or companies will be rejected; personal names are not allowed unless they have legitimate linkage with the holder; offensive or public-order content is not permitted; and any variation intended to circumvent a registered alias (for example case changes) must be blocked by providers.
9. Modification, suspension, cancellation, and reuse
- Modification: the holder may update alias data but never the registered alias text. Corporate changes by universal succession may be updated with supporting documentation.
- PRO withdrawal: if the only enabled PRO is removed, the holder has one month to designate another; otherwise the alias may be cancelled.
- Suspension: for end of use period, prolonged inactivity (12 months without use, with notice), at the holder's request, or by motivated CNMC resolution for misuse or exceptional circumstances.
- Cancellation: at the holder's request, failure to reactivate after suspension, lack of PRO after disabling, or CNMC resolution for misuse or exceptional cause.
- Reuse: after cancellation, the alias is disabled for six months for new registration, except where exceptions apply (e.g. the holder who already held it).
10. Public portal, API, communications, and statistics
The CNMC will provide a public web portal to consult active aliases, their holders, and activation dates.
PRs will receive OAuth credentials to authenticate on an API and perform daily downloads of the Register; technical specifications will be published on the electronic office.
PROs and PRs will have differentiated access to data sets (active aliases, authorisations, PRO uniqueness indicators, PR listings, etc.) per article eleven.
The Circular regulates communications to holders, PROs, third parties, and PRs on registrations, withdrawals, modifications, and pending authorisations.
On costs, providers bear adaptation and operation of their systems; the CNMC bears costs of the Register's technical solution (article thirteen).
11. Foreign companies, roaming, and international traffic
Order TDF/149/2025 already set rules for blocking inbound messages from abroad with a Spanish alias or from an unregistered foreign company, with nuances for users in roaming. The Circular develops foreign-company aliases and termination-operator action, including replacing the sender with the «NOT VALIDATED» label when the user is roaming and verification applies under article twelve and the Order.
The CNMC may also enter bilateral agreements to recognise equivalent registers in other States.
12. Transitional provisions: bulk load, testing, and first submissions
- SMS/MMS bulk load: for one month from the Circular's entry into force, PROs may submit a file of aliases already in use; holders must confirm within ten working days linkage and relationship with the PRO; the CNMC validates and registers. Analogous process for RCS per the first additional provision.
- Test environment until 14 September 2026 for technical integration and data download.
- CNMC decision period temporarily extended to up to three months during the first six months of the Circular (third transitional provision).
13. Frequently asked questions
Does this rule stop smishing on its own?
Not entirely: it significantly reduces abuse of unauthorised alphabetic senders to Spain, but companies should still combine filtering, user education, link controls, and security best practices.
Does it affect SMS with short-code numeric senders?
The Circular excludes the scope when the identifier is exclusively numeric and fits regulated numbering and short-code plans (article one.4). The PDF details exclusions.
Who resolves disputes between my company and an operator?
Article fourteen refers disputes to the CNMC under article 28 of the General Telecommunications Law (Law 11/2022). Alias holders are recognised as interested parties.
What if I breach the Circular?
Non-compliance may be sanctioned under the General Telecommunications Law and applicable sanctioning rules (article fifteen).
Can 402T Labs be my origin provider (PRO) in the Alias Register?
Yes. 402T Labs is among the first sector companies admitted as a provider in the CNMC Alias Register. You register your alias and select us as PRO on the electronic office form; we originate traffic in line with the rules. Request a preliminary assessment for next steps.