On 27 March 2026, Spain’s National Commission for Markets and Competition (CNMC) published Circular 1/2026 to implement Orden TDF/149/2025. A national Aliases sender‑alias registration database has gone live to combat smishing phishing impersonating organisations. Alphabet‑based brand Sender‑IDs used for SMS, MMS and RCS fall under mandatory registration. Full‑network operator‑level blocking for unregistered aliases was originally scheduled for 7 June 2026, yet following industry consultations enforcement was postponed to 15 September 2026. Foreign‑based enterprises are not permitted to submit registrations directly to CNMC’s system; filings must be completed by qualified Spanish PRO (Proveedor de origen) origin‑service entities.
The framework aims to mitigate SMS spoofing fraud. Previously enterprises could freely set alphabetic sender‑IDs, enabling criminals to impersonate banks, public administrations and logistics services for phishing and financial harm. Under the new rule, every alphabetic Sender‑ID targeting Spanish numbers must be pre‑registered with proof of legal ownership over the brand, trade‑name or domain. Poor‑format entries, confusing homonymous names and generic vague labels will be rejected.
Three stakeholder categories exist: alias‑owning undertakings, PRO origin providers and authorised third‑parties. PRO (Proveedor de origen) is the core role. Initial PRO holders are Movistar, MasOrange and Vodafone; Digi Spain later obtained equivalent PRO accreditation. Aggregators and overseas companies do not hold PRO qualification and must submit applications via accredited PRO entities. Terminating‑side operators interconnect with the CNMC registry and automatically discard incoming messages bearing alphabetic sender‑IDs that are unregistered or originate from non‑authorised PROs. Applications must include trademarks, trade‑name documents, domain ownership proof together with entity details and designated PRO information. CNMC’s maximum review turnaround is one calendar month.
