The Finnish Transport and Communications Agency Traficom’s revised Regulation obliges telecommunications operators to ensure the accuracy of message sender information and to reliably identify senders. The obligations are intended to reduce the risk of citizens becoming victims of crime. The revised Regulation will enter into force on 4 May 2026.
Reliable messaging requires that the recipient can trust the sender information as confidently as the message content itself. At present, the spoofing of text message originating numbers and the use of misleading sender IDs are techniques widely exploited by criminals and remain a significant societal problem.
To recipients, a text message may have appeared entirely genuine, for example as a message from a public authority or a bank, which has increased the likelihood of scams succeeding. “The new requirements address this phenomenon by breaking the chain of misuse already at the sending stage. In future, telecommunications operators must know the sender of a message and ensure that the sender has the right to use the Finnish telephone number or alphanumeric sender ID they are using,” explains Chief Specialist Klaus Nieminen.
Confidence in the sender strengthens trust in communications services
When message senders are identified using uniform procedures, recipients can trust that a message genuinely originates from the party indicated as the sender.
“The new measures set out in the Regulation make the use of Finnish telephone numbers and alphanumeric sender IDs for fraud attempts very difficult, while at the same time increasing the risk of criminals being caught. The objective is to significantly reduce the risk of citizens becoming victims of crime,” Nieminen emphasises.
The Regulation has been drafted in close cooperation with the sector. The more detailed common practices will be agreed through industry self-regulation to ensure that the solutions are effective and consistent across Finland.
Organisations must authorise the numbers and identifiers they use well in advance – preferably in early 2026
The Regulation requires changes to the arrangements by which organisations send messages to their customers. In order for messaging sent using a Finnish telephone number or an alphanumeric sender ID to continue, organisations must authorise the numbers and identifiers they use.
Nieminen therefore reminds message senders to take care of this authorisation with their own operator or service provider well in advance, preferably at the beginning of 2026.
New obligations enter into force on 4 May 2026
The obligations will enter into force on 4 May 2026. After that date, all unauthorised messages will either be blocked or their sender ID will be changed as follows:
- from 4 May 2026, the sender ID will be changed to “Tuntematon” (Unknown)
- from 2 November 2026, the sender ID will be changed to “Roskaposti” (Spam).
“The above sender IDs indicate to the recipient that the sender of the message has not been identified and that the right of use has not been verified. Such messages should be treated with caution, as they are very likely to be scam attempts,” Nieminen emphasises.
Traficom’s new Regulation 28 L/2025 M will enter into force on 4 May 2026.
Enquiries and further information
Regulation 28 L/2025 M on the interoperability of communications networks and services (External link) (in Finnish/Swedish, will be coming soon in English)
Klaus Nieminen, Chief Specialist, tel. +358 29 534 0528, klaus.nieminen@traficom.fi
What does the new Regulation mean?
Key changes
- Applies not only to text messages but also to multimedia messages and RCS messages.
- Telecommunications operators must ensure that the sender information of messages originating from their network is valid and unambiguous.
- Messages with an alphanumeric sender ID are not accepted from the public international interface.
- In application programming interfaces, telecommunications operators must ensure that they know the sender of the message, that the sender has the right to use the Finnish telephone number used and that any alphanumeric sender ID conveyed is not misleading and is clearly related to the activity carried out by the sender.
- If the above cannot be verified, the telecommunications operator must either block the message or change the sender ID.
- A telecommunications operator may agree that an SMS service provider with which it has a contractual relationship takes care of these identification and verification obligations, in which case the traffic may be allowed. The telecommunications operator must have effective and appropriate procedures to intervene if the contractual partner fails to meet its obligations.
- In addition, statistical obligations have been added to the Regulation in order to create situational awareness.
When do the obligations enter into force?
- The Regulation enters into force on 4 May 2026.
- The procedures relating to application programming interfaces will become more stringent on 2 November 2026.