On 15 July 2026, Ofcom published a statement setting out its decision to introduce a new Condition C9 into the General Conditions of Entitlement which sets out how Ofcom will require mobile operators and business messaging aggregators to protect mobile users from scam mobile messages (“New General Condition“) and a new guidance document “Scam mobile messages: guidance on protecting people and businesses” (“New Guidance“) to assist operators with understanding how to comply with these new regulatory obligations.
The New General Condition will come into effect from 2027; the requirements applicable to person-to-person (P2P) messaging will come into effect on 18 January 2027, and those that apply to application-to-person (A2P) messaging will come into effect on 15 July 2027.
It is important to note that the New General Condition will apply to messaging services that are regulated under the Communications Act 2003 (Communications Act), which encompasses “number-based” interpersonal communications services, covering SMS and MMS messaging carried over UK telecommunications networks. The New General Condition will not apply to “over the top” messaging services such as WhatsApp and other online mobile messaging services which are not regulated under the Communications Act. This means that different regulatory frameworks will be applied to “number-based” communications services and “over the top” messaging services respectively.
In this article, we set out the background to the New General Condition and New Guidance, and provide an overview of the changes proposed by Ofcom.
UK efforts to protect mobile users from scams and fraud
The introduction of the New General Condition follows a long line of broader efforts by the UK government and Ofcom over the last several years to protect users from scams and fraud.
- The UK government in 2025 imposed a ban on the possession and supply of SIM farms. Additionally, mobile operators have made commitments under the Fraud Sector Charter to secure trust in mobile messaging and prevent fraud.
- Ofcom has issued guidance setting out measures it expects operators to take to comply with its rules, which make it harder for scammers to use UK telecom facilities, this includes:
- Guidance to help operators identify and block numbers that are associated with trusted organisations, such as banks and public bodies, which are never intended to make outbound calls;
- A good practice guide to help prevent misuse of sub-allocated and assigned numbers, which contains due diligence that UK operators should carry out when suballocating numbers to other providers;
- Guidance on the provision of Calling Line Identification (CLI) facilities and other related services; and
- Setting out the steps that operators are expected to take to identify calls from abroad that spoof UK landline Network Numbers and block them (where scammers ‘spoof’ their telephone number to disguise the origin of the call, or to make their call appear to be from a trusted person or organisation).
Background to the New General Condition and New Guidance
Ofcom published a call for input in 2024 to understand the effectiveness of industry developed methods to stop scam mobile messages, and to understand whether regulatory intervention would be necessary.
Ofcom subsequently consulted in 2025 on proposed new rules and guidance to combat mobile messaging scams.
Ofcom has now implemented rules as the New General Condition.
New General Condition
Ofcom notes that the New General Condition applies to two different mobile messaging channels:
- Person-to-person (P2P) messages – which would be traditional messages sent between end users of mobile services, between two SIMs and between mobile networks.
- Application-to-person (A2P) messages – which Ofcom regard as messages sent by A2P providers on behalf of other businesses. For example, appointment reminders, service updates or promotional messages.
Obligations applicable to P2P messaging providers
In relation to P2P messaging, the New General Condition will require mobile operators to:
- Set volume limits for pay-as-you-go (PAYG) SIMs.
- Block numbers that have been detected as being responsible for scams.
- Have processes, policies and systems in place to receive scam reports from customers and third parties in relation to telephone numbers and web links (URLs) that are being used for scams.
- Block scam messages in transit on their networks by identifying scam URLs and telephone numbers, taking into account the relevant scam reports they have received.
Obligations applicable to A2P messaging providers
In relation to A2P messaging, the New General Condition will require mobile operators and aggregators to:
- Conduct due diligence and effective Know Your Customer (KYC) checks.
- Prevent the use of fake alphanumeric sender IDs, including by verifying Sender IDs against information gathered through KYC checks and maintaining a policy on restricting the use of protected sender IDs.
- Conduct ongoing Know Your Traffic (KYT) checks, including checking for indicators of scam activity and monitoring and reviewing data on volume patterns.
- Apply incident management processes where scam activity is identified, to prevent scammers from sending messages and address any non-compliance by other providers.
- Block scam messages in transit on their networks by detecting scam URLs and telephone numbers.
- Have processes, policies and systems in place to receive scam reports from customers and third parties in relation to telephone numbers and URLs that have been used for scams (as required for P2P messaging).
- Implement and maintain clear and unambiguous terms for the party from which they receive the A2P messages to either undertake the KYC, alphanumeric Sender ID and KYT checks or ensure these checks have been conducted.
Safeguard requirements applicable to P2P and A2P messaging providers
The New General Condition also imposes requirements on mobile operators and aggregators to ensure that the above requirements are effective and to minimise the risk that messages which are not scams are blocked, including requiring mobile operators and aggregators to:
- Implement polices, systems and processes for mobile users to challenge a decision to block a number or message and ensure these are well publicised and readily available for mobile users to access;
- Implement polices, systems and processes to identify, monitor and take appropriate action where messages have been wrongly blocked, where the provider had previously incorrectly believed, a message was intended to scam the relevant recipient;
- Regularly review policies, systems and processes implemented to ensure their effectiveness and that they are operating as intended;
- Train the appropriate staff on the relevant policies, systems and processes;
- Implement and maintain appropriate record keeping policies, systems and processes; and
- Ensure compliance with relevant data protection legislation in their activities in complying with the New General Condition.
Summary and next steps
- Coming into force: The New General Condition will come into effect from 2027; the requirements applicable to P2P messaging providers will come into effect on 18 January 2027, and those that apply to A2P messaging providers will come into effect on 15 July 2027.
Many of the new General Conditions will require proactive compliance activity to be taken and technical processes to be put into place, to enable compliance. As such, mobile operators and A2P aggregators should assess Ofcom’s New General Condition closely, to ensure they are able to comply once the various requirements come into effect. - Application: It is important to note that the obligations summarised above generally applies to Communications Providers who terminate/transfer P2P and A2P messages, with certain exceptions, including:
- Certain obligations applicable to A2P messaging providers exclude lower tier aggregators (i.e aggregators who do not contract directly with a mobile service provider that directly terminates A2P messages to recipients).
- Certain obligations in respect of P2P messaging providers, only apply to those who have assigned mobile numbers.
As such, mobile operators and A2P aggregators should review the New General Condition carefully to see which new obligations apply to their specific activities.