1. Regulatory focus
On October 20, 2026, AGCOM placed amendments to Resolution 86/21/CIR on the agenda of its electronic communications committee. The review follows technical work on how the wider adoption of SIM and eSIM technologies affects replacement and mobile number portability security. The existing framework generally requires the SIM holder to request a replacement, including virtual eSIM changes, and relies on identity checks and user notifications. The agenda signals a regulatory review, not a final rule or immediate compliance deadline.
2. Business impact
Businesses that treat an Italian mobile number as the sole OTP or account-recovery factor may face verification failures during a SIM or eSIM change. Travel connectivity, digital banking, fintech, gaming, and cross-border support flows are especially exposed because eSIM activation, number portability, and SMS delivery are operationally linked. A failed identity check can trigger account lockouts, missed fraud alerts, and higher support volumes. Providers that cannot produce swap events, operator identities, timestamps, and notification records may also create evidence gaps during incident reviews or customer disputes.
3. Operating recommendations
Teams should obtain a current SIM-swap control matrix from Italian carriers, MVNOs, eSIM distributors, and messaging aggregators. Document the differences between online replacement, retail replacement, eSIM re-download, and number portability verification. Feed swap, recent porting, and number-change signals into the OTP risk engine, and impose a temporary hold on high-value actions during a high-risk window. Provide authenticator-based, device-bound, or manual-review alternatives. Preserve user notices, approval decisions, failure reasons, timestamps, and vendor acknowledgements rather than logging delivery status alone.