On January 14, 2026, the Telecom Regulatory Authority of India (TRAI) officially implemented a mandatory regulation requiring all variable fields in SMS content templates registered on the DLT platform to have their data types and intended use pre-marked. This measure aims to curb criminals from exploiting unmarked variable fields to insert malicious links into approved templates for SMS phishing and fraud. Previously, senders could freely fill in any content in the variable positions of a template (for example, filling a malicious URL into the {#var#} position originally intended for OTPs), making it difficult for operators to identify and block such content at the gateway level.
Under the new regulation, senders must explicitly assign a predefined data label to each variable when registering a template. TRAI has approved six standard labels: {numeric} (for numeric content such as OTPs and transaction amounts), {alphanumeric} (for alphanumeric content such as order numbers and ticket numbers), {url} (for website links), {urlott} (for OTT or app download links), {cbn} (for callback numbers), and {email} (for email addresses). When a message is submitted, only data matching the label type may be filled in. For example, a variable position marked {#numeric#} can only be filled with pure numbers; entering a URL will be rejected by the system.
New templates must comply with this requirement starting from January 14, 2026. Existing templates registered before the effective date are granted a 60-day grace period for updates, and templates not updated by the deadline will be rejected for delivery. This regulation extends SMS compliance requirements from "template content review" to "granular control at the variable level", significantly raising the barrier for fraudsters to smuggle malicious content through approved templates, and marks the entry of India's A2P SMS regulation into a stage of field-level precise control.
