Other A2P SMS regulations

Colombia Adds A2P Template Controls

For CPaaS providers, aggregators, and brands sending OTPs, transactional alerts, or customer-service messages to Colombia, A2P compliance now extends beyond Sender ID registration. CRC Resolution 8308, issued on July 30, 2026, and Circular 181, published on September 14, establish a centralized validator, mandatory content templates, KYC checks, and platform integration requirements. Businesses have a phased twelve-month transition to align identifiers, URLs, dynamic fields, and routing controls before the new A2P regime becomes fully operational.

Published:10/26/2026 Updated:10/26/2026

1. Regulatory focus

CRC Resolution 8308 places Sender IDs, A2P short codes, and message templates inside Colombia’s regulated identification framework. Every A2P SMS must be tied to an assigned and implemented Sender ID, a valid short code, and a template approved by the centralized validator. The template must declare the content category, consent basis, fixed message text, permitted dynamic fields, and any destination URLs or domains. Circular 181, published on September 14, 2026, adds implementation guidance for fraud-prevention education and user interaction.

2. Business impact

The framework changes how international messaging is launched and operated. A brand can no longer submit only corporate documents and a Sender ID; it must make OTP parameters, order references, tracking links, and localized templates auditable as separate fields. Short-code assignees must query identifier and template status through APIs and report detected misuse within 24 hours. Misuse can lead to recovery of the Sender ID or short code, while traffic without a valid template may be rejected before it reaches the mobile network.

3. Operating recommendations

During the transition, create a Colombia-specific template register that links every Sender ID and short code to its message category, consent basis, variable fields, destination domains, and triggering event. Do not reuse one template across transactional, authentication, and promotional purposes. Engineering should support validator-API status checks, pre-send blocking, and version rollback. Compliance should review KYC records, corporate registration data, template validity, and the 24-hour incident-notification workflow each month.

Frequently Asked Questions

Must OTP codes and order references be declared?
Yes. OTP values, order references, and transaction IDs should be declared as permitted dynamic fields with a defined type and purpose. Do not submit real customer data for approval. Before sending, enforce field length, character-set, and source restrictions so dynamic content cannot change the approved message purpose or introduce an unapproved link.
Must existing international routes switch to short codes immediately?
Do not shut down existing routes without a migration plan. Use the twelve-month transition to inventory Colombia traffic, Sender IDs, short-code ownership, and templates, then confirm milestones with the local carrier or aggregator. Track delivery failures, template rejections, and fallback routing so authentication traffic remains measurable during the migration.
Does template misuse affect the brand or the messaging provider?
Both may face consequences. The brand is responsible for keeping the Sender ID, declared purpose, and actual content aligned. The short-code holder and provider must validate resource status, block traffic lacking a valid template, and report misuse within 24 hours. Contracts should define audit rights, suspension triggers, log retention, and incident ownership.
This article is for informational purposes only and does not constitute legal advice.

Related products

Need compliance guidance?

Contact us for guidance on target markets, message scenarios, and sending routes.

Get in Touch
Privacy Policy