o send SMS OTPs in Indonesia reliably you need a registered alphanumeric sender name — known locally as SMS masking — on each mobile operator's route, templates that work in Bahasa Indonesia, and a verification flow built for a market where the regulator is actively fighting number fraud. Since January 2026, Ministry of Communication and Digital Affairs (Komdigi) Regulation No. 7 of 2026 requires face-recognition checks against population data for new SIM registrations and caps prepaid numbers at three per identity per operator.
This guide covers sender-ID registration, what the new SIM rules mean for OTP risk, the data-protection law that governs your subscriber data, and how to keep the cost per verified user under control. Last reviewed: 26 September 2026.
Key takeaways
- Sender names (SMS masking) for A2P traffic are registered through the operators' routes; allow five to ten business days.
- Komdigi Regulation No. 7 of 2026, signed on 19 January 2026, requires NIK plus face-recognition validation for mobile subscriber registration.
- Operators may register no more than three prepaid numbers per identity, per operator, with narrow exceptions for IoT, testing and certain organisations.
- Subscribers can report numbers misused for crime through the Ministry's complaint portal; operators must revoke numbers proven to be misused.
- Personal data in your messaging stack is governed by Law No. 27 of 2022 (UU PDP), whose two-year adjustment period ended in October 2024.
- The cheapest OTP is the one that arrives first time: registered sender names, short templates and a fallback channel cut retries.
How do I register an SMS sender ID (masking) in Indonesia?
In Indonesia a branded alphanumeric sender is usually called a "masking" sender, as opposed to a numeric long number. For A2P traffic the sender name is registered through the operators' routes — Telkomsel, Indosat Ooredoo Hutchison, XL Axiata and Smartfren (merged as XLSMART in April 2025) on BroadNet's network — rather than chosen freely per message. The practical steps:
- Pick a sender name that clearly identifies your brand and check it in our sender ID validator.
- Describe the use case — OTP, transactional notifications or promotions — because operators review what the name will be used for.
- Provide company documents that tie the brand to your organisation; the exact list varies by operator, so confirm it at onboarding.
- Submit the same name on every operator you need to reach; a name approved on one network does not carry over to another.
- Allow five to ten business days, as listed on the Indonesia coverage page, and test on each operator before launch.
We advise against generic names such as INFO, OTP or VERIFY. They cannot be tied to a brand, they are exactly what scammers imitate, and they make it harder for a customer to trust the code. For the wider picture of sender types, see what a sender ID is and sender ID spoofing.
What does Komdigi Regulation No. 7 of 2026 change?
Regulation of the Minister of Communication and Digital Affairs No. 7 of 2026 on Registration of Telecommunication Service Customers via Mobile Cellular Networks replaced the registration articles of the 2021 telecommunications regulation. It was signed in Jakarta on 19 January 2026 and takes effect on promulgation. Its stated aims are valid population data for SIM registration and a know-your-customer principle for mobile subscribers.
| Rule | Who it applies to | Effective | Source |
|---|---|---|---|
| Registration validated with NIK and biometric population data (face recognition) | Mobile operators and new subscribers | On promulgation, January 2026 | Permen Komdigi 7/2026 |
| Self-registration via the operator's app or website must prove the number with an authorisation code, which may be an OTP, sent by SMS, e-mail or USSD | Prepaid self-registration | On promulgation | Art. 7 |
| No more than 3 prepaid numbers per identity per operator (exceptions: M2M/IoT, testing, certain organisations — through operator outlets) | Mobile operators | On promulgation | Art. 14 |
| Numbers misused for crime can be reported via the Ministry's portal; operators must revoke numbers proven misused | Subscribers and operators | On promulgation | Art. 17 |
| Operators must hold at least ISO 27001 certification for subscriber data | Mobile operators | On promulgation | Art. 13(5) |
| Operators adapt self-registration within 6 months; numbers registered earlier stay valid | Mobile operators and existing subscribers | Transition to mid-2026 | Art. 32 |
| Personal data processed lawfully, with consent as a main basis; controllers had 2 years to comply | Every business holding Indonesian subscriber data | Enacted 17 Oct 2022 | UU No. 27 of 2022 (PDP), Art. 74 |
What does biometric SIM registration mean for OTP?
SMS OTP proves that someone controls a phone number. Its weak point has always been how easily that number could be obtained or taken over: a SIM registered with someone else's identity, or a new SIM bought in bulk for a scam campaign. Face-recognition validation, a three-number cap per identity per operator and a formal route to revoke misused numbers all make that harder.
It does not make SMS OTP risk-free. SIM swap and social engineering target the person, not the registration. Keep OTP messages short and explicit ("Do not share this code"), bind codes to a session, limit resend attempts, and pair high-value actions with a signal that does not depend on the SMS alone. Our OTP best practices and the post on SIM-swap defence go deeper.
What is Komdigi doing about SMS scams?
The regulator's clearest instrument so far is Regulation No. 7 of 2026 itself: identity-verified registration, fewer throwaway numbers, and an obligation on operators to revoke numbers that are proven to be used for crime once subscribers report them through the Ministry's complaint portal. For senders the consequence is practical: operators have every reason to scrutinise unregistered, generic or look-alike sender names, so a clean, registered brand name is part of deliverability, not just compliance.
Why are OTPs to Indonesia expensive, and how do you cut the cost?
The price of a single SMS is only part of the cost. What you really pay is the cost per verified user: the price of each message multiplied by the number of messages it takes to get one successful login. Every undelivered code, every resend and every user who gives up adds to it. That is why the biggest savings usually come from delivery and design, not from shaving the per-message rate.
| Lever | Why it matters | What to do |
|---|---|---|
| Registered sender name | Unregistered or generic senders are more likely to be filtered or distrusted | Register one brand name per use case on every operator |
| Template length and encoding | Non-GSM characters force UCS-2 and can double the segments | Keep OTPs short; check them in the GSM-7 / Unicode checker |
| Resend policy | Aggressive resends multiply cost and fraud exposure | Wait before the first resend; cap attempts per session |
| Channel mix | Users who have WhatsApp can verify there; voice OTP helps where SMS fails | Route per user with automatic fallback to SMS |
| Measurement | Cost per verified user, not per message, is what you pay | Model it in the OTP cost estimator |
Current per-message rates are on the Indonesia SMS pricing page and the WhatsApp pricing page. MyOTP handles the routing, fallback and fraud checks in one API, so moving part of your volume to another channel does not mean rebuilding your login flow.
Is WhatsApp authentication cheaper than SMS OTP in Indonesia?
Sometimes, and only for users who have WhatsApp. Authentication-template prices are set by Meta per market and change over time, so compare the current rate cards rather than a figure from last year. The bigger win is usually conversion: a code that arrives in an app the user already has open tends to be entered faster. Keep SMS as the universal fallback, because not every user will have WhatsApp installed on the phone they are verifying.
What does UU PDP require for SMS data?
Law No. 27 of 2022 on Personal Data Protection (UU PDP) was enacted on 17 October 2022 and gave controllers two years to adjust. It governs how you collect and process the phone numbers, names and message logs in your messaging stack. Consent is a main lawful basis, data subjects have rights over their data, and there are rules on transfers and breach handling. Keep only the data you need for verification, set retention periods for message logs, and make sure your provider contracts cover processing on your behalf.
Compliance checklist for OTP and SMS to Indonesia
- Register a brand-specific sender name on every operator you need, separately for OTP and promotional use.
- Write OTP templates in Bahasa Indonesia and English, short enough for a single segment.
- Never add promotional content to an OTP or transactional message.
- Set a resend policy with a wait before the first retry and a per-session cap.
- Add a fallback channel (WhatsApp authentication or voice OTP) and measure cost per verified user.
- Map your personal-data processing against UU PDP: lawful basis, retention, processor contracts.
- Review high-risk flows for SIM-swap exposure; do not rely on SMS alone for account recovery or large transfers.
How BroadNet handles Indonesia traffic
BroadNet terminates directly into Telkomsel, Indosat Ooredoo Hutchison, XL Axiata and Smartfren (merged as XLSMART in April 2025) with sender-ID registration through the operator routes, and supports Bahasa Indonesia and English at parity. The Indonesia regulation guide covers the wider rule set.
Frequently asked questions
How do I register an SMS sender ID (masking) in Indonesia?
Through the mobile operators' routes. You choose a brand-specific name, describe the use case, supply company documents and submit the same name on each operator you need to reach. Allow five to ten business days and test on every network before launch.
Why are OTPs to Indonesia expensive?
Because what you pay is the cost per verified user, not per message. Undelivered codes, resends and abandoned logins multiply the cost. Registered sender names, short single-segment templates, a sensible resend policy and a fallback channel usually save more than negotiating the per-message rate.
Is WhatsApp authentication cheaper than SMS OTP in Indonesia?
It can be for users who have WhatsApp, but Meta sets authentication prices per market and changes them, so compare current rate cards. Keep SMS as the fallback, because not every user will have WhatsApp on the number they are verifying.
Are generic sender names allowed in Indonesia?
Operators review sender names against the brand and use case, and we advise against generic names such as INFO or OTP. They cannot be tied to a brand, they are what scammers imitate, and they reduce customer trust in the code.
Does each brand or use case need its own sender registration?
Register each brand name separately, and keep OTP and promotional traffic on separate registrations. Separation protects your verification traffic if a marketing campaign draws complaints, and it matches how operators review use cases.
What is Komdigi Regulation No. 7 of 2026?
It is the Ministry of Communication and Digital Affairs regulation on mobile subscriber registration, signed on 19 January 2026. It requires NIK plus face-recognition validation, caps prepaid numbers at three per identity per operator, and obliges operators to revoke numbers proven to be misused for crime.
What does biometric SIM registration mean for SMS OTP?
It makes it harder to obtain numbers under someone else's identity or in bulk, which strengthens the link between a number and a real person. It does not stop SIM swap or social engineering, so keep do-not-share warnings, session binding and resend limits in place.
What does UU PDP require for SMS data?
Law No. 27 of 2022 requires a lawful basis, usually consent, for processing personal data such as phone numbers, gives individuals rights over their data, and sets rules on transfers and breaches. The two-year adjustment period ended in October 2024, so the law applies in full.
Sources
- Peraturan Menteri Komunikasi dan Digital Nomor 7 Tahun 2026 — JDIH Kemkomdigi — accessed 26 Sep 2026
- Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi — JDIH Kemkomdigi — accessed 26 Sep 2026
- Kementerian Komunikasi dan Digital (Komdigi) — accessed 26 Sep 2026