1. Regulatory focus
In Ofcom’s mobile messaging scams consultation, updated in April 2026, the regulator continued to push a unified rule set for mobile operators and business messaging aggregators. The design is not a narrow blocking mandate; it links onboarding controls, traffic monitoring, and incident response into one compliance chain. For A2P messaging, the proposed baseline includes KYC at onboarding, high-confidence validation of alphanumeric sender IDs, ongoing Know Your Traffic monitoring, prompt investigation and blocking where scam activity is identified, and recordkeeping. Ofcom’s guidance also ties implementation to UK GDPR, the Data Protection Act 2018, and PECR, and states that a final decision is planned for summer 2026.
2. Business impact
For enterprise senders, UK A2P messaging is moving beyond routing and template management into an auditable customer-admission model. Aggregators and brands that still rely on “activate first, document later,” broad generic sender IDs, cross-use of brand names across unrelated message types, or weak traffic baselines should expect more friction in onboarding, scaling, rerouting, and dispute handling. The practical risk is not only isolated message rejection. If account profile, sender ID entitlement, and traffic purpose do not align, providers may treat the traffic as higher risk, which can reduce delivery confidence across OTP, payment verification, collections reminders, and other sensitive notification flows.
3. Operating recommendations
Teams sending into the UK should start packaging legal entity details, use cases, sender ID entitlement, URL domains, callback numbers, and sample templates into a single onboarding file, then require upstream aggregators to define ownership for KYC, KYT, and evidence retention. In multi-brand or multi-market setups, split OTP, marketing, collections, and support traffic into separate risk profiles instead of mixing them under one alphanumeric sender. It is also prudent to formalize unblock and appeal procedures, retention periods for fraud-control logs, and cross-border data handling notes, so anti-scam controls do not create avoidable data protection exposure.