1. Regulatory focus
Finland requires organisations sending SMS to Finnish recipients to obtain prior authorisation for every Finnish telephone number and alphanumeric sender ID they use. Unauthorised identifiers may no longer be able to deliver messages to Finnish numbers. Traficom introduced the framework to address spoofing and impersonation of trusted institutions across OTP, notification, marketing, and customer-service traffic. Stricter procedures for messaging APIs took effect on November 2, 2026.
2. Business impact
For cross-border CPaaS providers and SMS aggregators, the risk is not limited to a sender name being replaced. A Finnish route may be interrupted when the authorisation status is unclear, especially if traffic is sent through a foreign operator that does not support the authorisation model. OTP login, payment verification, delivery alerts, and account recovery flows are particularly exposed because even short delays can trigger retries, support tickets, or fallback-channel costs. Telephone-number authorisation and alphanumeric sender-ID authorisation must be tracked separately.
3. Operating recommendations
Create a Finland-specific sender inventory covering the legal entity, message purpose, provider, route, authorisation status, and change history for every number and sender ID. Ask each provider to confirm that its API procedures support the stricter requirements effective November 2, 2026. For OTP and transactional traffic, maintain at least one tested fallback route and monitor delivery rate, displayed sender, rejection codes, and retry volume. New brands and numbers should be authorised before production traffic is released.