In July 2026, Norma Solano, President of CRT, revealed in an interview with Punto por punto that the regulator will soon launch a special legislative draft targeting nuisance calls, spam SMS and SMS phishing scams. The draft is open for public consultation. It requires major Mexican mobile operators to upgrade traffic identification and risk control systems and strengthen detection and filtering capabilities for bulk A2P SMS originating overseas. Telcel, AT&T and Movistar are carrying out iterative upgrades to their anti-fraud platforms in parallel.
The CRT legislative draft focuses on preventing SMS phishing, SMS fraud and unauthorised A2P traffic. Drawing on mature regulatory practices from India, Singapore and other jurisdictions, it shifts Mexico’s previous complaint-based reactive model to proactive preventive regulation. Key restrictions include: prohibiting tampering with the original sender ID of overseas A2P SMS to impersonate local Mexican numbers; banning the use of P2P interconnection links to carry A2P traffic; mandating operators to retain full end-to-end traceability records for SMS; granting mobile operators authority to restrict or suspend A2P interconnection with upstream fixed-line operators upon obtaining evidence of spam or fraudulent traffic.
The draft introduces specific rules for cross-border OTP verification traffic: overseas OTP SMS terminated via fixed-line operators must comply with security and identity verification standards issued by mobile operators. Violating companies may face fines ranging from 2.01% to 6% of annual revenue; repeated serious offenders risk revocation of their telecommunications concessions.
The draft remains under public consultation and has not yet been formally enacted. Nevertheless, it sends a clear regulatory signal: Mexico will continuously tighten compliance standards, traffic traceability and sender ID registration requirements for outbound-originated A2P SMS. Overseas enterprises providing SMS services to Mexican end users are recommended to prioritise primary interconnection routes via locally licensed aggregators, complete Sender ID registration and maintain comprehensive traffic logs.
