CNMC Circular 1/2026: the new SMS alias registry, explained

On 18 March 2026 Spain's telecom regulator, the CNMC, adopted Circular 1/2026, the technical regulation that implements the Sender ID registry set out by Orden TDF/149/2025 to fight identity-spoofing fraud in calls and text messages.

From 7 June 2026, any SMS, MMS or RCS sent to a Spanish number with an alphanumeric sender ID — "SANTANDER", "AEAT", "MyShop" — must be registered with the CNMC to be delivered. Anything else gets blocked by law.

If you send messages to customers in Spain, here's what you need to know.

Why this regulation exists

SMS spoofing — messages pretending to come from your bank, the tax office or a courier — has grown out of hand. Orden TDF/149/2025 mandated a central registry of aliases so that operators can validate every message. Circular 1/2026 is the technical rulebook that puts the registry into operation.

The rule is simple: if the sender ID is not in the registry, the message does not go through.

Who is affected

Three kinds of actors:

1. Alias holders — companies and public administrations that send messages with an alphanumeric sender to Spanish-numbered customers.
2. Origin providers (PRO) — the aggregator or carrier that first injects the message. This is where Instasent sits.
3. Transit and termination providers — every other operator the message crosses on its way to the recipient's handset.

Each has their own obligations. If you're a brand or a public body, your job is to get your aliases registered on time.

Key dates

Date	Milestone
15 Feb 2025	Orden TDF/149/2025 published
18 Mar 2026	CNMC approves Circular 1/2026
Mar–Jun 2026	Testing period + bulk upload of aliases in use
7 Jun 2026	Mandatory blocking goes live
1 Feb 2027	First annual statistics report to the CNMC

In practice, you have until early June to have everything in order.

What you need to do as a brand

1. Inventory your aliases

List every alphanumeric sender you use to message Spanish customers today: your main brand, country or business-line variants, order confirmations, shipping alerts, marketing, 2FA, you name it. Anything missing from the registry on 7 June will be blocked.

2. Prove legitimate ownership

The CNMC will only register aliases that you can tie to one of the following:

• A trademark registered at the Spanish patent office (OEPM) or the EU office (EUIPO).
• A commercial name at the OEPM.
• A legal business name in the Spanish Commercial Register.
• A registered internet domain (.es or otherwise).
• A name in another applicable national or international public register.

Proof is a sworn declaration (template is in Annex V of the Circular) and the CNMC can ask you for the supporting documents at any time.

If your alias doesn't map to any of the above (say, an unregistered sole-trader brand), you can declare legitimate and habitual business use in a different sworn declaration. It's a secondary path: if two parties claim the same alias, the formally registered one wins.

3. Respect the format rules

For SMS/MMS, aliases follow the 3GPP TS 23.038 spec:

• Length: 3–11 characters.
• Allowed: a-z, A-Z, ñ/Ñ, ç/Ç, 0-9, space, @ & - _ . +.
• Not allowed: consecutive spaces, leading or trailing spaces, accented characters, nor ¡! # % ( ) * , / : ; < > = ¿? [ ] €.
• No purely numeric aliases.
• No generic ones (message, Bank, Urgent) or proper names that aren't tied to the holder (Madrid no, AytoMadrid yes).

For RCS, the format follows GSMA RCC.07 v14.0. The alias must clearly and directly identify your brand, commercial name, legal name or domain.

4. Designate an origin provider (PRO)

As part of the registration you designate who will originate your messages. That provider has to be registered in the Alias Registry before you can pick them. If you switch providers, you amend the entry. If your sole PRO ceases activity and you don't name another within one month, the alias gets cancelled.

5. Keep the alias alive

• An alias with no use for 12 months is auto-suspended.
• A suspended alias not reactivated within 1 month is cancelled.
• A cancelled alias can't be reused for 6 months.

What Instasent does for you

As an origin provider we're registering in the Alias Registry and absorbing most of the technical heavy lifting:

• Bulk upload of aliases in use: in the month following Circular entry into force, the CNMC opens a bulk-load file to pre-register active aliases. We prepare the submission and you just confirm ownership.
• Format validation: we screen every alias against the rules before sending it to the CNMC, so none get rejected.
• Changes and new aliases: we can act as applicant on behalf of the holder, but each registration is authorised by you (the law gives you 10 business days to approve it).
• Transparent blocking: if you try to send with an unregistered alias, we block the message and warn you before it damages a live campaign.
• Annual reports: we file the statistics report with the CNMC. You don't have to do a thing.

What if you send from outside Spain

The Circular also applies to foreign companies sending SMS with an alias to Spanish numbers. You have two options:

1. Register your alias in Spain (the procedure is the same).
2. Operate through a provider already registered in Spain that files the registration on your behalf.

Without either, your messages get blocked at the border — unless the recipient is roaming outside Spain, in which case the mobile operator replaces the alias with NO VALIDADO ("not validated").

Next steps

If you're an Instasent customer, we'll be in touch over the coming weeks to prepare the bulk upload. If you're not yet a customer and you're weighing how to tackle this:

Expect follow-up CNMC resolutions (annex changes, automated verification mechanisms). We'll post updates here as meaningful changes land.