The Developer's Guide to Phone Number Regulatory Compliance

The Developer's Guide to Phone Number Regulatory Compliance

Regulatory compliance (RC) requirements for phone number users have increased worldwide. Depending on the phone number and its features, your or your company's status in the country, and your intentions for the number, different laws and regulations apply while building Voice, Fax, or SMS-based applications.

While some of these regulations are new, many of these laws and rules have been in effect for some time. Countries are increasing enforcement for many reasons – including fraud, incidents of misuse and abuse and heightened national security concerns.

All your Twilio phone numbers on Twilio’s platform need to comply with individual country requirements or they are at risk of being suspended until you submit proper RC information.

Read on for what you need to know to bring an existing communications application into compliance or before starting a new application.

Here's a video overview explaining what's happening:

You can find the regulatory compliance training mentioned in the video here.

Type I Phone Number compliance: The quick summary

If your application currently uses a phone number in a country that requires Type 1 regulatory compliance, you’ll need to provide necessary documentation to:

1. Prove the existence of a business or personal identity
2. Affirm how you are using a number

This is true even if you have uploaded documentation for other countries in the past. Requirements are unique and specific to each phone number country and type. (We will publish Type 2 regulatory compliance guidelines – requiring you to understand illegal use cases – in a future post).

Twilio and our customers, end users, and providers all have the collective obligation to comply with these phone number regulations. Also, these requirements apply whether or not your application uses Twilio.

Our guidance for achieving compliance differs slightly for phone numbers you already own versus numbers you are planning to purchase.

Phone numbers you already own

Once everything is compliant, your numbers will receive the Approved label visible in the compliance indicators in both the Regulatory Tab and your Compliance Report.

If you have any further questions around these steps, we’ve written – and illustrated – the full details below.

Phone numbers you plan to purchase

We’ve also updated our process when you purchase new phone numbers.

For phone numbers in Australia, France, Germany, Hong Kong, Ireland, Italy, Mexico, Netherlands, Poland, and Spain, you will need to satisfy these regulations before we allow you to purchase a number. (For other countries, you can go through the provisioning process directly in Console).

If your documentation is approved, the Compliance Status will be shown as Approved in both the Regulatory Tab of the phone number instance page as well as your Compliance Report.

If you have any further questions or doubts about these steps, we’ve written out the full details (and included some instructive gifs) below.

Phone number regulatory compliance: Detailed steps

We’re quickly coming up on the deadlines countries have set for phone number regulatory compliance. If you don’t act, you risk your phone numbers being reclaimed – effectively, shut off.

If you lose your phone numbers, we can’t guarantee that we can recover them. Please work through this guide for each country where you hold a number – Twilio will be here to help.

Identifying phone number regulatory requirements per country

While all countries have phone number regulations and laws in place, every country approaches regulations differently.

Effectively, you’ll need to repeat this process for every country where you have – or are planning to have – a phone number. You can find all of the individual country requirements on the Phone Number Regulatory Compliance page.

Upload your documentation

Once you have noted the requirements for every country (and if necessary, number type) where you have or are planning to buy numbers, you’re ready to gather your documentation and upload it to the Twilio Console.

Finally, hit the Upload Identity Verification Documents button and we’ll start checking them for validity. Repeat for each country and number type you’ll need.

Create an Address

There are some countries where you are also required to add proof of address via a submitted document. This might include a utility bill showing your name and address in the country where you are buying (or already own) the number.

1. If you do not provide a document with a proof of address, you need to create an Address in the Addresses section of Console.
2. Visit our Phone Number Regulatory Compliance Page for the list of requirements
3. During provisioning (or in a phone number’s Regulatory tab), you can select which address to map as required by the particular regulatory requirements.

Wait for Identity approval

Once you submit your documentation, Twilio will begin checking if everything is in order. You can check the status of your submission in the Phone Number Identity page in the console.

We will either approve your documentation (and mark your Identity Passed), or ask you for additional documentation or clarification.  We will notify you if you have Passed or Failed via email and via the status callback webhook (if this has been configured on your account).

In the FAQ section below we’ve listed the most common reasons your Identity wouldn’t be approved.

Note that this is a manual process. We typically complete the review of all documents within 48 hours, but we’re currently experiencing high volumes of documentation submissions – thank you for your patience.

Map your Identity to phone numbers

Once your documentation is approved and marked Passed, you aren’t yet done. You now need to map your approved Identity to each relevant phone number in the Twilio Console.

1. Click on a non-compliant number
2. Inside the phone number detail page, click the ‘Regulatory Information’ tab
3. For each requirement listed, use the pull-down to associate a Passed Identity

Here’s a walk-through performing this mapping for a German number:

Wait for Phone Number mapping approval

Once you have mapped your Identity to all non-compliant numbers, we will again review everything is in order.

As before, this is a manual process. Generally we will ‘Approve’ your numbers or ask for additional information within 48 business hours, but with the high volume of submissions we appreciate your patience.

We will either approve your mapping (and mark your phone number as compliant), or ask you for additional documentation or clarification.  We will notify you if you have Passed or Failed via email and via the status callback webhook (if this has been configured on your account).

Once approved, that’s all you need – you’re now compliant and your phone numbers are ready to use!

Frequently Asked Questions on phone number compliance

You and other developers have asked some excellent questions about phone number regulations. We wanted to highlight some of your developer-focused questions and answers which have come up over the last few months.

You can also find our complete Phone Number Regulations FAQ here.

Can I avoid this by porting numbers away from Twilio?

All of these requirements are based on previously existing regulations and laws in countries around the world.

Every communications company – not only Twilio – is subject to these regulations when operating in these countries. Other platforms that haven’t yet put compliance processes in place will either soon do so or risk losing your numbers.

If I’m only testing phone numbers in a country do I need to be in compliance?

Yes. If you use a number for any purpose, you need to be in compliance with the regulatory requirements of that country

If you need to test or demo with a number:

• If possible, test and demo with a number from the US or another country that has different regulatory requirements.
• If you must use a non-US number, you will need to upload documentation and associate (map) the identity to the number well in advance of your presentation. Instructions on how to do this, are located here.

What are some reasons my Identity documentation would be rejected?

During the manual verification steps in this process, Twilio needs to ensure all of your documentation is valid, contemporary, and legible.

Here are the most common reasons we reject Identity or Address verification documentation:

• The document uploaded is not legible.
• The document uploaded is not an acceptable proof of identification.
• The document uploaded is expired.
• The address on the document uploaded does not match an address on your account.
• The name on the document does not match the information you have entered in the identity record.
• The government office you selected in the identity record does not match what is on the document you uploaded.
• Information is missing – please make sure you provide all the information required for the numbers you are purchasing.
• There is no ID to match the name listed on the Business Registration.
• The identity document must show both the front and back of the identification.
• The identity document shows that the user is younger than 18.

If my numbers are forfeited, can I recover them?

Unfortunately, if your numbers are reclaimed by countries we cannot guarantee they can be recovered.

Countries reserve the right to reclaim your non-compliant numbers immediately and without warning.

How do I find out the relevant regulations for a country?

The most up-to-date copy of individual country regulatory requirements is on our Phone Number Regulatory Requirements page. We’ll also continue to update the FAQ as more questions come in or there are widely applicable changes to the process.

How long does the compliance approval process take?

We are generally able to review either your identity documentation or phone number mapping individually within 48 business hours, but we are currently dealing with a high volume of submissions. We greatly appreciate your patience while we validate your documentation and information and review your phone number mapping. You can check the status of your numbers in the Compliance Report section in the console.

To give your documentation the best chance of approval, please be sure to gather everything and upload it through the console. Fill out as many optional fields as possible. This will help us review your documents as quickly as possible, and hopefully minimize the risk we’ll need additional documentation.

How can I keep up-to-date about changes to regulations?

Our regulatory team is actively publishing documentation requirements for phone numbers in all countries. You can always find the current state of regulatory requirements on our Phone Number Regulatory Compliance page and view our Regulatory Changelog to view the history of the updates.

We also send regular email updates regarding regulatory compliance. To ensure you receive these updates, please make sure your email address is correct in the console. Go to the User Settings page in Console and click on Update Contact Info to confirm or update your information as necessary.

I'm confused about what documents I need to provide. How can I get help?

All of the requirements for various countries are posted on our Phone Number Regulatory Compliance page. If you still have questions, we have a more extensive FAQ on phone number compliance here.

For any additional issues, please reach out to support through the site or at help@twilio.com.

Why are countries increasing Regulatory Compliance requirements?

In most countries, phone numbers are considered a national resource. Countries reserve the right to manage these resources as they see fit.

Twilio respects these national rights, and helps you and our other customers work with these regulations and operate in a way that’s supported by governments and regulators worldwide. This ensures we build and grow on a solid, global foundation.

I see that my Identity documents have been approved, does that mean I am in compliance?

No.

Identity document approval is just the first step in the process. Once your identity or address has been approved, you must connect it (“map” it) to the relevant phone numbers. If you have a Passed Identity but do not map it to relevant phone numbers, you will still be out of compliance.

Please scroll up to the “Map your Identity to phone numbers” section above to see how to map Passed Identities to phone numbers.

You and Twilio: partners in phone number regulatory compliance

As our world grows more connected and platforms like Twilio make it easier to communicate with friends, families, and customers, we’ll unfortunately also see more and more bad actors.

To be abundantly clear: we do not allow unwanted callers, spammers, and fraudsters on our platform. (Find our Acceptable Use Policy here, or check if an unwanted caller used Twilio).

As the number of bad actors has increased, countries are taking important steps to protect their citizens from fraud, spam, and general communications annoyance. We support these smart and thoughtful efforts by regulators. Not only do these efforts protect individuals from annoying and harmful communications, they also preserve SMS and voice as useful channels for customers with good intentions.

We are your partner as you navigate the regulatory requirements for all of the countries where you own a phone number.

And countries and regulatory agencies are also our partners. As we work with you on your compliance, we’re working with countries on these needs as well. Where possible, we’re working to enable new number types, advocating for smart changes in requirements that preserve value for you without harming the communications ecosystem, and exploring possible solutions that would make it easier for you to comply.

We’re eager to help you get your numbers into compliance. Please don’t hesitate to reach out to support for any issues with the process.

And, as always – thank you for being our partner and customer!

Paul Kamp is the Technical Editor-in-Chief of the Twilio Blog.