Despacho Decisório nº 26/2026/COGE/SCO amends Determination No.978/2025. Issued by Brazil’s Anatel, this key regulatory document on number spoofing is an upgrade based on Determination 2024‑262. It establishes an end-to-end traceability and penalty framework for telecom operators, A2P-SMS aggregators and cloud communications providers, and also applies to violations involving SMS Sender-ID spoofing.
The new rules require telecom service providers to deploy technical measures to block illegal calls and traffic with spoofed origins. Regulators may access detailed CDR call records and complete traffic routing logs at any time, and providers must submit such data unconditionally. For enterprises that facilitate number spoofing, the regulator may impose preventive interconnection blocking: up to one month for the first offence, and a maximum of three months for repeat offenders. The document explicitly prohibits unauthorised subleasing and resale of number resources. Call centres and SMS aggregators must obtain number resources directly via contracts with operators; multi-layered number resale is banned.
Service providers must add compliance liability clauses into business contracts. If downstream clients commit violations such as number spoofing or Sender-ID forgery, providers may suspend or terminate services, while the violating parties shall bear civil, administrative and even criminal liabilities. Access codes that fail to meet numbering standards cannot be used to originate business traffic. Due to administrative appeals, enforcement of some clauses of this determination has been suspended; however, core obligations including traceability, traffic blocking and ban on number trafficking remain in force.
Aggregators must strictly control Sender-ID usage of downstream customers and prohibit impersonation or forgery of sender identifiers, with full traffic log retention. Aggregators themselves face the risk of interconnection port blocking if downstream parties commit spoofing violations.
