Brands moved fast to comply with Spain’s new Sender ID rules: by the morning of 10 September, the CNMC had recorded 13,565 approved aliases, belonging to banks, insurers, retailers, transport operators and public administrations. Since 15 September 2026, Spanish mobile operators have been required to block SMS, MMS and RCS messages whose alphanumeric sender name (an “alias”) is not registered in the national Alias Registry managed by the National Markets and Competition Commission (CNMC). Messages can also be blocked if the alias is registered but the provider sending the traffic is not authorised for that alias.
The driver is fraud. The sender name is often the first thing a customer checks before trusting a one-time passcode or a payment alert, and research from the Mobile Ecosystem Forum (MEF) found that about half of consumers in Spain have received fraudulent SMS messages, many of them impersonating well-known brandsFor businesses sending messages to Spanish customers, registering the Sender IDs is no longer optional. If an alias is not registered, messages will be blocked.
What has changed with the central registry of Sender IDs
The CNMC now holds a central registry of approved alphanumeric Sender IDs for all SMS, MMS and RCS traffic sent to Spanish mobile numbers. The rules come from Ministerial Order TDF/149/2025 and CNMC Circular 1/2026, as amended by Circular 2/2026.The rules apply to both Spanish and international organisations sending messages to Spanish mobile numbers. Operators must block messages when any of the following is true:
- The alias is not registered in the CNMC database.
- A registered alias can only be used by approved providers. Messages sent through an unauthorised provider will be blocked.
- The sending party isn’t authorised by the brand/organisation (alias holder). Agencies, CRM platforms, subsidiaries and other third parties must be expressly authorised by the brand/organisation (alias holder) to send under its name.
Numeric senders (long codes) are not covered by the registry. But moving to a number means your customers see an unfamiliar string of digits instead of your name, right when they have been taught to look for a trusted sender.
Why the Sender ID Registry matters for customer-facing brands
For B2C brands, a blocked alias is more than a technical problemIt can affect some of the most important customer communications:.
- Authentication and security: OTPs and login codes that don’t arrive mean abandoned sign-ups, failed payments and more calls to your contact centre.
- Transactional updates: Delivery notices, appointment reminders, booking confirmations and fraud alerts lose their value when they are late or missing.
- Marketing and engagement: Campaigns sent under an unregistered name simply won’t reach customers, and your budget and timing go with them.
- Brand trust: Customers who receive a message from an unknown number may reasonably suspect a scam.
Registration protects your brand name: Once your alias is registered to your organisation and your authorized providers, your brand is protected against impersonation and Sender ID spoofing. The CNMC also offers a public lookup where anyone can check which aliases are registered and who holds them. This adds a layer of transparency that helps customers and brands alike.
How registration in the Sender ID Registry works
Alias holder. This is your organisation: the company, public body or individual whose name the alias represents. You must show a legitimate link between the alias and your identity. Accepted evidence includes a registered trademark, trade name, company name, internet domain, a listing in another public registry or, where none of these apply, documented legitimate and habitual use.
Origin Provider (PRO). This is the company, organisation or individual that owns or has the legitimate right to use the alias. In most B2C cases, this will be the brand whose name appears as the sender.Each alias can be linked to one or more named PROs.. Traffic that comes from a provider not linked to the alias can be blocked, even if the alias itself is registered.
Applicant. Registration can be submitted by the alias holder, by the Origin Provider on the holder’s behalf, or by an authorised third party such as a marketing agency or CRM platform. If someone else applies for you, your organisation must confirm the authorisation through the CNMC portal within 10 business days.
Accessing the CNMC portal: Access requires a digital certificate valid in Spain. If the alias holder does not have one, it can appoint an authorised representative to act on its behalf using the CNMC’s official Letter of Authorisation (LOA). The authorized representative must have a valid digital certificate to access the portal.
The CNMC provides LOA templates for Spanish and foreign companies and individuals. Registration is free of charge.
Alias format essentials
Before you submit, check that each sender name meets the registry’s format rules:
- Length: SMS aliases must be 3 to 11 characters. RCS aliases can be up to 40 characters.
- Characters: Letters (including ñ and ç), numbers and a small set of symbols are allowed. Purely numeric aliases, leading or trailing spaces and double spaces are not.
- Case sensitivity: Aliases are case-sensitive. “MyBrand” and “MYBRAND” are separate aliases, and each one you use needs its own registration.
- Generic names: Names that don’t identify the holder, such as “Info” or “Alerts”, are not accepted.
A practical checklist for brands
Before sending SMS, MMS or RCS messages to customers in Spain, check the following:
- List the Sender IDs you actually use: Review the aliases used across your brands, business units, messaging platforms and agencies. Don’t assume that because one Sender ID is registered, the others are covered.
- Make sure you can prove the link to your brand: Have the relevant trademark, trade name, company name or domain information ready for each alias.
- Know who is in your messaging chain: Identify any Third Parties involved, such as messaging platforms, CRM providers, agencies or resellers, and confirm which messaging providers will actually originate the traffic.
- Check your Origin Providers (PROs): Each alias must have at least one authorised PRO. If you use more than one messaging provider, make sure all the providers that need to originate traffic with that alias are properly registered and authorised.
- Decide who will manage the registration: You can register the alias directly or have an authorised PRO or Third Party handle the process on your behalf. Make sure the right representative and authorisations are in place before you start.
- Check your registration before you send: An alias cannot be used until its registration is effective. Allow time for the CNMC review and respond promptly to any authorisation or information requests.
- Treat registration as an ongoing process: Recheck your registration whenever you introduce a new Sender ID, launch a new RCS agent, change messaging providers or add a new route to Spain. A registered alias can still be blocked if the traffic comes through a provider that is not authorised for it.
Already missed the deadline?
Aliases can still be registered after 15 September, but they should not be used for traffic to Spain until registration is approved. If your messages are currently failing, act quickly. Register the affected aliases, confirm your Origin Provider is correctly linked, and check with your messaging partner which fallback options, such as numeric senders, suit critical traffic like OTPs while approval is pending.
Spain’s Sender ID Registry – Part of a global shift
Ireland, the Netherlands, Singapore and other markets have introduced similar Sender ID frameworks. Across markets, verified sender identity is becoming a baseline requirement for reaching mobile users. Brands that manage sender registration centrally now will be better prepared as more countries follow.
How iBASIS helps as a participating aggregator
iBASIS is a participating aggregator in Spain’s CNMC Sender ID ecosystem. When registering aliases through the CNMC portal, organisations can select iBASIS Netherlands as their Origin Provider. This makes iBASIS an authorised route for their messaging traffic to Spanish subscribers.
Beyond compliance, iBASIS helps enterprises, operators and messaging providers keep customer communications secure and reliable. It draws on one of the telecom industry’s largest threat intelligence databases to monitor traffic, detect suspicious activity and stop SMS fraud before it reaches networks or end users. Capabilities include:
- Global A2P and P2P messaging connectivity
- A2P messaging monetisation
- SMS fraud prevention and traffic integrity
- Revenue assurance and traffic intelligence
- Multi-protocol firewall and DDoS protection
- Managed services for secure messaging ecosystems
Now that Spain’s registry is in force, iBASIS can help make sure your brand’s messages reach Spanish customers in a way that is compliant, secure and trusted.