Everything worth knowing, nothing that isn't.
What they actually do
When an MSC sends a MAP-MT-FORWARD-SHORT-MESSAGE to deliver an SMS, it stamps its own Point Code as OPC and the recipient SMSC's Point Code as DPC. STPs (Signalling Transfer Points) examine the DPC and route the message toward the next hop. Inside a single country an operator uses national Point Codes (typically 14-bit ITU or 24-bit ANSI); cross-border SS7 traffic uses International Point Codes (ITU 14-bit, globally coordinated by ITU-T Q.708). A misconfigured OPC or a spoofed OPC is the single most common SS7 misrouting cause.
Why they matter commercially and for security
Point Codes are a static commercial asset — an operator's IPC is assigned by national regulators (and internationally by ITU), reflects its network position, and is rented through interconnect agreements. From a security standpoint, OPC is also the first signal an SS7 firewall examines: an inbound message claiming to come from an operator's own internal OPC range, but arriving from a foreign peer, is a Category 1 attack under GSMA FS.07 and is dropped on sight. BroadNet's SS7 firewall (/operators/ss7-firewall) maintains an OPC reputation database per peer to catch these spoof attempts.
Operational angle
Operators publish their IPCs to interconnect partners through GSMA IR.21 documents. Misalignment between IR.21 and live traffic is a chronic operational pain — partners change OPCs without notifying, peers send via stale Point Codes, and traffic dead-letters into STP routing tables. Reconciling IR.21 against live OPC observations is part of what a mature signalling intelligence platform (/platforms/signaling-cdr) automates.
Privacy and compliance considerations
Point Code data itself is operator-network metadata, not personal data, and is not in PDPL/GDPR scope. But the per-message OPC/DPC pair is part of the SS7 PDU and lives inside CDRs and firewall event logs — which are in scope when correlated with MSISDN. Aggregate OPC-traffic statistics for fraud analysis are fine to share across operators; per-message logs need access control.