On 23 September 2019, Mexico’s Federal Institute of Telecommunications (IFT) issued a supplementary statement relating to public concession registration. The document establishes quantitative technical thresholds for assessing risks in SMS traffic. It specifies that more than 10 identical SMS messages sent by the same originator within one minute may be classified as spam, and more than 100 SMS messages within one minute may be deemed a flooding attack. The thresholds provide operators with regulatory criteria to detect and block abnormal SMS traffic and apply to all SMS interconnection scenarios including P2P and A2P services.
This document constitutes a technical regulation under Mexico’s telecommunications concession regime and applies to all operators and A2P aggregators holding a single telecommunications concession issued by the CRT. The stated thresholds serve only as reference benchmarks for risk identification and are not direct grounds for sanctions. Operators may monitor traffic using these metrics; upon hitting the relevant thresholds, they are entitled to conduct traffic audits and trace message sources. Once traffic is confirmed as spam or flooding attacks, operators may implement measures such as traffic throttling and interconnection port blocking.
The regulation also emphasises that thresholds are not absolute prohibitions. High-volume legitimate A2P traffic such as OTP verification codes and transaction alerts in normal business operations will not be deemed non-compliant solely based on numerical thresholds. Operators must conduct comprehensive assessments combining message content, registered information of senders and user complaints to prevent wrongful blocking of legitimate enterprise traffic.
This technical standard has been cited in numerous subsequent IFT rulings on interconnection disputes and serves as a key reference for the Annex Agreement on Detection and Prevention of Prohibited Conduct attached to Mexican SMS interconnection agreements. Aggregators providing A2P services must control transmission rates to avoid triggering thresholds that trigger risk-control channel blocking. Enterprises shall maintain traffic monitoring and complete log retention for business operations.
