SMS with unregistered aliases: blocking delayed until September 2026

Key data

Companies using aliases to send SMS to their customers have an unexpected extension, but also a clear warning: the deadline is final. The Order TDF/558/2026, published on June 5, 2026, modifies the schedule set by Order TDF/149/2025 and moves to September 15, 2026 the obligation to block messages sent with aliases not registered in the system managed by the CNMC.

The reason for the delay is not a relaxation of the regulation, but quite the opposite: during the testing period, extraordinary technical and operational complexity was detected in the mass loading of aliases already in use. Applying the blocking before resolving those issues would have caused the interruption of legitimate communications, including health and administrative notifications.

What does this regulation establish?

Order TDF/149/2025, of February 12, established an SMS alias registration system managed by the CNMC with the aim of combating identity spoofing scams through text messages. The mechanism is simple: if a company wants to send SMS using an alias (an identifying name instead of a number), it must register that alias in the official registry. Telecommunications operators, in turn, are obligated to block messages that arrive with unregistered aliases.

The new Order TDF/558/2026 does not change the substance of the regulation, only modifies the schedule. The comparison between both regulations is as follows:

The alias registry is the key tool of the system. Each company using an alias to send SMS must ensure that the alias is correctly registered in the CNMC registry. Without that registration, from September 15, 2026 onwards, their messages will be blocked by operators before reaching the recipient.

Economic and operational impact

The direct impact for companies is not a fine or a fee: it is the total interruption of their SMS communications if they do not complete the registration in time. This can translate into:

• Loss of commercial communications with customers (promotions, order confirmations, shipping alerts).
• Failures in two-factor authentication systems (2FA) if own aliases are used.
• Interruption of customer service notifications sent through mass SMS platforms.
• Reputational damage if customers stop receiving expected communications without explanation.

For telecommunications operators, the impact is operational: they must adapt their technical systems to execute automatic blocking of unregistered aliases before September 15, 2026. The extension gives them additional margin to complete that adaptation without risk of blocking legitimate communications during the process.

The cost of inaction is asymmetric: registering an alias in the CNMC system is an administrative procedure, while failing to do so means that all SMS sent under that alias will no longer reach their recipients from the deadline onwards.

Who does it affect?

• Companies sending commercial SMS with aliases: any business that uses an identifying name (instead of a phone number) to send marketing messages, promotions or commercial communications.
• Companies with SMS customer service systems: appointment confirmations, order tracking, service alerts.
• Companies with SMS authentication (2FA): if the sending is carried out under their own alias.
• Mass SMS platforms and agencies: that manage aliases on behalf of third parties and must ensure that all their clients' aliases are registered.
• Telecommunications operators: obligated to implement technical blocking before September 15, 2026.
• Public administrations and health entities: expressly mentioned as examples of legitimate communication senders whose improper blocking was to be avoided with the extension.

Practical example

A pharmacy chain sends medication pickup reminders to its customers via SMS. In the sender field, instead of a phone number, the alias "PharmacyHealth" appears. This alias identifies the company to the message recipient.

If the chain does not register the alias "PharmacyHealth" in the CNMC registry before September 15, 2026, from that date onwards telecommunications operators will automatically block all SMS sent under that alias. Patients will stop receiving reminders without the pharmacy receiving any error notice: the messages simply will not arrive.

To avoid this, the pharmacy must access the CNMC alias registry, register the alias "PharmacyHealth" proving it is the legitimate sender, and confirm with its mass SMS provider that sending is carried out correctly under the registered alias.

What should companies do now?

1. Identify all SMS aliases in use: review what aliases your company uses to send messages to customers, both in commercial campaigns and in operational communications (confirmations, alerts, 2FA).
2. Verify registration status in the CNMC: check if those aliases are already registered in the official registry managed by the CNMC. If you use a mass sending platform, request confirmation from your provider.
3. Complete the registration of unregistered aliases: process the registration of all pending aliases in the CNMC registry before September 15, 2026.
4. Coordinate with your SMS provider: ensure that the platform or agency managing the shipments is aligned with the registration process and that aliases are used correctly once registered.
5. Establish internal control: document the registered aliases and set a process so that any new alias you want to use in the future first goes through the CNMC registry before being activated.

Official source

View complete regulation in official source

Notice: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-12045