1. Regulatory focus
On November 4, 2026, Anatel approved measures requiring enterprise messaging to move toward dedicated, standardized short codes rather than shared identifiers. A centralized directory will record the code, aggregator, and responsible brand, while mobile operators must be able to identify the effective user associated with each code. Operators must also implement automated A2P monitoring, fraud detection, incident handling, and controls against untrusted delivery channels.
2. Business impact
The impact extends beyond delivery rates. Brands must be able to prove message origin, campaign legitimacy, and accountability for each traffic path. Aggregators, integrators, and originators should retain customer identity data, authorization records, message logs, and incident evidence. OTP, account recovery, and payment-confirmation flows sent through unregistered codes or untrusted routes may face blocking, investigation, or forced rerouting. Anatel’s 180-day implementation report also leaves room for additional technical requirements.
3. Operating recommendations
Before expanding Brazilian traffic, map the accountability chain from brand to aggregator, short code, template, and terminating operator. Assign one identifiable sender to each OTP, transaction, and customer-service use case. Maintain an inventory of short codes and sender IDs, with KYC records, authorization documents, template versions, delivery logs, and blocking events. Connect anomaly alerts to an operational response queue. For critical authentication flows, prepare compliant backup routes, but do not substitute personal numbers or shared codes for registered enterprise identities.