Notes from the wire.
Engineering write-ups, regulatory deep-dives, industry analysis, and product notes from the team that operates BroadNet. Written in-house — no ghostwriters, no AI slop, no recycled vendor talking points.
Featured essay
The latest from the team.
A2P messaging regulation timeline 2024–2027: every dated change, with sources
Business messaging rules changed more between 2024 and 2026 than in the previous decade. This tracker lists every dated change we could verify, from India's link whitelisting to the UAE's move away from bank SMS OTP and WhatsApp's new pricing, with what each one means for senders and where the official text lives.
More from the journal
Recent essays.
Long-form on the things we actually wrestle with in production — regulatory regimes, protocol choices, firewall economics, channel orchestration.
SMPP window size: why your bind is slower than the rate you pay for
An operator agrees 100 messages per second, the bind delivers twelve, and everyone blames the network. Nine times out of ten the cause is a window left at its default. Here is what windowing really does on an SMPP session, and how to size it.
Holiday SMS marketing for Q4 2026: Halloween, 11.11, White Friday and year-end, a sending playbook
Q4 offers live for hours, not weeks. This playbook lists the 2026 dates from Halloween to New Year's Eve, the promotional send windows regulators publish, how to write a one-segment holiday SMS, how to keep OTPs flowing on peak days and how to measure what worked.
Business messaging statistics 2026: verified figures on SMS, WhatsApp, RCS and OTP
The numbers people quote about business messaging are often old, rounded or from a vendor blog. This page collects 2025–2026 figures from their primary sources, with the scope and date of each, on mobile reach, A2P SMS, WhatsApp, RCS, OTP fraud, passkeys, the Middle East and AI agents.
SMS OTP security standards 2026: what NIST, PSD2, PCI DSS and central banks actually require
Is SMS OTP still allowed? Mostly yes, under conditions. NIST classes it as restricted, PSD2 accepts it as a possession factor, PCI DSS does not name it, and India's RBI kept it. Some regulators in Asia and the Gulf moved bank logins to bound devices. Here is what each standard actually says, with the clause and the source.
SMS sending hours by country 2026: the verified quiet-hours list for marketing messages
Many countries limit when promotional SMS may reach a phone, and a message sent at the wrong hour can mean a fine or a blocked sender ID. This list covers only the markets where we found the window in an official text, with the local-time window, what it applies to and the source.
WhatsApp service-message pricing from 1 October 2026: what changes, what it costs, and how to cut it
From 1 October 2026 Meta charges for WhatsApp service messages, the free-form replies sent inside the 24-hour customer service window, per delivered message after a free tier of 1,000 per business phone number each month. Here is what changes, what stays free, what it will cost and how to keep the bill down.
Is SMS OTP banned? What the UAE, India and Philippine bank rules actually require in 2026
No — SMS OTP is not banned. UAE banks were told to phase SMS and e-mail OTPs out of customer authentication, India's RBI kept SMS OTP as a permitted factor, and the Philippines' BSP requires larger banks to limit it. Here is who is in scope, the dates, and what replaces the code.
Turkey SMS rules 2026: international SMS with links are blocked — plus İYS and e-signature explained
Since 1 April 2026, Turkish operators do not carry or terminate A2P SMS from abroad that contains a URL. Here is what BTK decisions 399, 398 and 412 actually say, how İYS consent works, and how to keep your Türkiye traffic delivering.
UAE PDPL for SMS and WhatsApp marketing in 2026: consent, cross-border transfers and what is actually in force
The UAE's Personal Data Protection Law has been in force since 2 January 2022, but its executive regulations were still not on the federal legislation portal when we checked in September 2026. Here is what that means for SMS and WhatsApp marketing: consent, opt-out, cross-border transfers, the DIFC and ADGM carve-outs, OTP traffic and a practical checklist.
MCP for messaging: how AI agents can send SMS and WhatsApp safely
An MCP server turns a messaging API into tools an AI agent can call. That is powerful and risky: an agent with a send tool can message real customers. Here is how MCP works for SMS and WhatsApp, how to connect to BroadNet's server, and the guardrails to put in place first.
Signalling firewalls in 2026: what SS7 and Diameter attacks look like from inside a network
SS7 was designed when every network on it was trusted. That assumption is long gone, but the protocol is still carrying traffic — and the attacks that exploit it are unglamorous, well documented, and still working.
US A2P SMS compliance in 2026: 10DLC registration and the TCPA, explained
Two separate systems govern US A2P SMS and they are constantly confused. 10DLC is carrier registration and decides whether your traffic is delivered. The TCPA is federal law and decides whether sending it was lawful at all.
One essay a month.
Nothing else.
Subscribe and we'll send the next piece — engineering, regulation, or industry — the day it ships. No drip campaigns, no product pitches, no third-party sharing. Unsubscribe in one click.
- Long-form, not link baitSix to eleven minutes of focused writing on a single topic. No clickbait.
- Written by operatorsThe engineers, regulatory team, and product leads who run the platform.
- Region-awareMENA-grounded perspective on regulators, operators, and channel mix.
- Once a month, maximumNo drip. No sales sequence. One essay when there is one to share.
Most of what we write
we learned in production.
If a post made you nod, we should probably talk. Bring the use case, the volumes, the markets — we'll come back with routing, pricing, and a reference customer you can call.