etween August 2024 and January 2027, at least 19 dated rule changes reshaped business SMS, OTP and WhatsApp messaging. The biggest: India blocks commercial SMS carrying non-whitelisted links (from 1 October 2024), WhatsApp bills per delivered message (from 1 July 2025) and charges service messages again (from 1 October 2026), UAE banks phased out SMS OTP for in-app authentication (by 31 March 2026), Turkey blocks international SMS that contain links (from 1 April 2026), the Philippines ended SMS OTP for high-risk transactions at large institutions (June 2026), and the EU AI Act requires AI chatbots to disclose themselves (from 2 August 2026). The table below lists every change with its date, its impact and its source.
Checked 22 October 2026. Dates marked "reported" come from reputable news or legal summaries because the official text was not publicly reachable; all others were read in the regulator's or platform's own text. This page is not legal advice, so confirm requirements with your counsel before you act.
The timeline at a glance
| Date | Market | What changed | What senders must do |
|---|---|---|---|
| 27 Aug 2024 (reported) | UAE | Cabinet Resolutions 56 and 57 of 2024 regulate telemarketing: TDRA approval, 09:00–18:00 calling hours, Do Not Call Register, consent, penalties | Check the DNCR and hold consent before marketing to UAE numbers |
| 1 Sep 2024 (reported) | Malaysia | Short codes lose their exemption from the ban on links and phone numbers in SMS | Remove URLs and phone numbers from Malaysian SMS |
| 1 Oct 2024 | India | TRAI: commercial SMS with non-whitelisted URLs, APKs or OTT links is blocked | Whitelist every link on DLT before sending |
| 11 Dec 2024 (reported) | India | TRAI: SMS without a declared sender-to-telemarketer delivery chain is rejected | Register the full delivery chain on DLT |
| 24 Jan 2025 (reported) | United States | Court vacates the FCC one-to-one consent rule before it takes effect | Keep following general TCPA consent rules |
| 11 Apr 2025 | United States | FCC TCPA revocation rules: honour any reasonable opt-out within 10 business days | Recognise STOP in any wording; process opt-outs fast |
| 6 May 2025 (reported) | India | Header suffixes -P, -S, -T and -G show the message category | Categorise templates correctly on DLT |
| 1 Jul 2025 | Global (WhatsApp) | Per-delivered-message pricing by category and market; volume tiers for utility and authentication | Budget WhatsApp per delivered message |
| 8 Jul 2025 (reported) | Nigeria | NCC licensing framework for international A2P aggregators | Route international traffic via licensed aggregators |
| 25 Jul 2025 – 31 Mar 2026 (reported) | UAE | Banks move customers from SMS and email OTP to in-app authentication | Expect far less bank OTP over SMS to UAE numbers |
| 1 Apr 2026 | India | RBI authentication directions: two factors, one dynamic; SMS OTP stays allowed | Keep SMS OTP; banks may add alternatives |
| 1 Apr 2026 | Turkey | BTK Board Decision 2025/DK-YED/399: SMS and MMS from abroad containing a link is not delivered | Remove links or use local licensed routes |
| June 2026 | Philippines | BSP Circular 1213: large institutions stop SMS and email OTP for high-risk transactions; no clickable links in bank SMS | Move high-risk authentication to stronger factors |
| 29 Jun 2026 | Global (WhatsApp) | Businesses can reserve usernames; BSUIDs in webhooks | Store BSUIDs as well as phone numbers |
| 1 Jul 2026 (reported) | Indonesia | New SIM registrations need facial biometric checks | Expect fewer throwaway numbers |
| 2 Aug 2026 | European Union | AI Act Article 50 transparency duties apply | AI chatbots on SMS, WhatsApp or RCS must say they are AI |
| 1 Oct 2026 | Global (WhatsApp) | Service messages billable after 1,000 free per number a month; in-window utility charged | Re-budget WhatsApp customer support |
| 31 Dec 2026 | India (WhatsApp) | Indian WhatsApp Business accounts must bill in INR | Switch billing to INR before 1 January 2027 |
| 31 Jan 2027 | United States | FCC 'revoke-all' rule: one opt-out revokes consent for unrelated robotexts | Apply opt-outs across all your message programmes |
2024: links, delivery chains and telemarketing
**UAE, 27 August 2024 (reported).** Cabinet Resolution No. 56 of 2024 regulates telemarketing: companies, including free-zone firms, need TDRA approval, may call only between 09:00 and 18:00, must respect the Do Not Call Register and need consent; Resolution No. 57 sets the penalties. Legal summaries say marketing SMS is covered too. Source: UAE legislation portal. Our explainer: Cabinet Decision 56 explained.
**India, 1 October 2024.** TRAI directed operators to block commercial SMS containing URLs, APKs or OTT links that are not whitelisted on the DLT platform (directed 20 August 2024, start moved from 1 September). Source: TRAI press release 80/2024. On 11 December 2024 (reported) messages without a declared sender-to-telemarketer delivery chain began to be rejected. See India DLT registration guide and India regulations.
**Malaysia, 1 September 2024 (reported).** The temporary exemption that let business short codes include links, phone numbers or requests for personal details ended; SMS carrying them is blocked.
2025: consent, pricing and the end of bank SMS OTP in the UAE
**United States.** The FCC's one-to-one consent rule for lead generation was vacated by the Eleventh Circuit on 24 January 2025 (reported) and never took effect. The TCPA revocation-of-consent rules did take effect on 11 April 2025: an opt-out sent by any reasonable means must be honoured, within 10 business days. Source: FCC order DA 26-12. See US 10DLC and TCPA compliance.
**India, around 6 May 2025.** Under TRAI's TCCCPR Second Amendment Regulations (notified 12 February 2025), operators append -P (promotional), -S (service), -T (transactional) or -G (government) to sender headers, so recipients see each message's category. Source: TRAI regulation of 12 February 2025.
**WhatsApp, 1 July 2025.** Meta moved from per-conversation to per-delivered-message pricing, by category and recipient market, made utility templates inside the customer-service window free and introduced volume tiers for utility and authentication. Source: Meta pricing documentation. See WhatsApp Business Platform guide.
**Nigeria, 8 July 2025 (reported).** The NCC began licensing international A2P messaging aggregators; mobile operators are not eligible. See Nigeria A2P SMS guide.
**UAE, 25 July 2025 to 31 March 2026 (reported).** Banks began moving customers from SMS and email OTP to in-app authentication, with the phase-out due by 31 March 2026; several moved card-payment OTP to app approval from 6 January 2026. See SMS OTP after the bank bans.
2026: links blocked, stronger authentication, AI disclosure
**India, 1 April 2026.** The RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025 (issued 25 September 2025) require two factors for every domestic digital payment, one of them dynamic for card-not-present payments. They do not ban SMS OTP, which remains an allowed factor; issuers bear the loss when they do not comply. Source: RBI directions.
**Turkey, 1 April 2026.** Under BTK Board Decision 2025/DK-YED/399 of 16 December 2025, A2P SMS and MMS sent from abroad that contain a URL or link are not carried or terminated by Turkish operators. Messages without links, including most one-time passwords, still deliver. See Turkey SMS rules 2026 and Turkey regulations.
**Philippines, June 2026.** BSP Circular 1213 (approved 22 May 2025, with a one-year compliance window) requires large institutions to replace interceptable SMS and email OTP with stronger authentication for high-risk transactions, and bars clickable links and QR codes in their SMS. Lower-risk activity can still use SMS OTP. Source: BSP Circular 1213. See Philippines regulations.
**WhatsApp, 29 June 2026.** Businesses can reserve usernames. Business-scoped user IDs (BSUIDs) have appeared in webhooks since April 2026, and when a user adopts a username, webhooks may omit the phone number. Source: Meta BSUID documentation. See WhatsApp usernames and BSUIDs.
**Indonesia, 1 July 2026 (reported).** New SIM registrations require facial biometric verification under Komdigi Regulation 7/2026, and prepaid registrations are capped at three numbers per ID. See Indonesia SMS OTP and sender ID guide.
**European Union, 2 August 2026.** Article 50 of the AI Act (Regulation (EU) 2024/1689) applies: people must be told when they are interacting with an AI system, and AI-generated content must be labelled. Regulation (EU) 2026/1744 gives generative systems already on the market until 2 December 2026 for machine-readable marking. Source: EUR-Lex. See AI voice agent calling regulations.
**WhatsApp, 1 October 2026.** Service messages are charged again, after 1,000 free delivered service messages per business phone number each month, and utility templates inside the customer-service window are charged again. Source: Meta pricing documentation. See WhatsApp service-message pricing from October 2026.
Coming next: late 2026 and 2027
- **2 December 2026, EU:** end of the grace period for machine-readable marking of AI-generated content by systems already on the market.
- **31 December 2026, India:** Indian WhatsApp Business accounts must switch to INR billing; non-INR accounts stop delivering on 1 January 2027 (Meta).
- **31 January 2027, United States:** the FCC's 'revoke-all' rule takes effect unless changed first: opting out of one informational message revokes consent for unrelated robotexts and robocalls (FCC DA 26-12).
What the trend means for senders
- **Links are the new risk.** India, Malaysia, Turkey and the Philippines all block or restrict links in SMS. Keep transactional messages link-free where you can, and register every link where registration exists.
- **Bank OTP is moving in-app in some markets, not everywhere.** The UAE and the Philippines (for high-risk transactions) moved away from SMS OTP, while India's RBI kept it as an allowed factor. SMS remains the universal fallback.
- **Registration is the norm.** Sender IDs, templates, delivery chains and aggregators are registered in India, Nigeria and across the Gulf; unregistered traffic is dropped.
- **AI must say it is AI.** In the EU, chatbots on any messaging channel must disclose that they are AI.
- **WhatsApp costs are now per message.** Budget authentication, utility and service messages separately.
BroadNet tracks these rules on its country regulation pages and routes traffic over 1,000+ direct operator connections with sender-ID registration handled per market. To check a market before you launch, use the launch planner or talk to our team.
Frequently asked questions
When did India start blocking links in SMS?
On 1 October 2024. TRAI directed operators to block commercial SMS containing URLs, APKs or OTT links that are not whitelisted on the DLT platform. The start was moved from 1 September 2024.
Did the UAE ban SMS OTP?
Not for all senders. UAE banks moved customers from SMS and email OTP to in-app authentication between 25 July 2025 and 31 March 2026, according to reports of the Central Bank's notice. SMS OTP is still used by other businesses and as a fallback.
Does India's RBI still allow SMS OTP?
Yes. The RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025, which apply from 1 April 2026, require two factors with one dynamic for card-not-present payments, and SMS OTP remains an allowed factor.
Since when does Turkey block international SMS with links?
Since 1 April 2026, under BTK Board Decision 2025/DK-YED/399 of 16 December 2025. A2P SMS and MMS sent from abroad that contain a URL or link are not delivered; messages without links, including most one-time passwords, still are.
What changed in WhatsApp pricing in 2025 and 2026?
From 1 July 2025 WhatsApp charges per delivered message by category and market. From 1 October 2026 service messages are billable after 1,000 free per business phone number each month, and utility templates inside the customer-service window are charged again.
Do AI chatbots on WhatsApp or SMS have to disclose they are AI?
In the EU, yes, from 2 August 2026. Article 50 of the AI Act requires that people be told when they are interacting with an AI system, on any channel, including SMS, WhatsApp and RCS.
What is the Philippines' BSP Circular 1213?
A central-bank rule that requires large financial institutions to replace SMS and email OTP with stronger authentication for high-risk transactions and bars clickable links and QR codes in their SMS. It was approved in May 2025 with a one-year compliance window ending in June 2026.
What US messaging rule changes in January 2027?
The FCC's 'revoke-all' rule takes effect on 31 January 2027 unless the FCC changes it first: a consumer who opts out of one informational robotext or robocall revokes consent for unrelated ones from the same sender.