The TCCCPR 2018 are TRAI's rules for commercial SMS and voice calls in India. Telecom operators (Access Providers) must run a ledger-based system that checks each message or call against customer preference and consent, and only registered Senders, headers and templates may send. The Regulations set the complaint process, the action against spammers and the fines on operators who fail to act.
Free account needed to download. You come straight back to the file.
Who it is for. Telecom Access Providers (and virtual network operators through their network operators), businesses that send promotional, service or transactional SMS and calls (principal entities and other Senders), and telemarketers who scrub, aggregate or deliver traffic. Call management apps are bound by Regulation 34A.
What this list covers. TRAI's consolidated version dated 21 May 2026 (CA_21052026.pdf on trai.gov.in), which folds in the Regulations of 19 July 2018 (6 of 2018) and the amendments of 21 December 2018 and 12 February 2025 (1 of 2025), the 2025 amendment checked against its own Gazette text and the 2018 amendment not read separately; the Third Amendment Regulations, 2026 (5 of 2026), Gazette notification of 18 September 2026, read in by hand because they post-date the consolidation; and the Fourth Amendment Regulations, 2026 (9 of 2026), 4 November 2026, which holds Regulation 35A until TRAI notifies a start date. The Directions of 20 August, 30 August and 28 October 2024 and 18 November 2025 are listed at the end. Parts of the Third Amendment start 30, 60 or 90 days after Gazette publication. Check TRAI's site for later changes: 185 provisions. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| Reg. 2(bf) | Who counts as a Sender | Senders and principal entities: you are the Sender if you own the header or number used, caused or allowed the message, or are the business being promoted, even when an agency pushed the traffic. |
| Reg. 2(bp) | Who counts as a Telemarketer | Telemarketers: anyone who delivers commercial messages or calls, scrubs target lists or aggregates traffic for others is a Telemarketer and must be registered with the Access Provider (see Reg. 32). |
| Reg. 2(bw) | What counts as unsolicited communication | Senders: a commercial message or call that matches neither the recipient's consent nor their registered preference is unsolicited. So is anything from a sender not registered for the purpose, or sent to deceive. |
| Reg. 2(au) | Promotional messages and opt-out | Senders: promotional SMS needs an opt-out in the same message, in the form TRAI sets. Mixing promotion into a transactional or service message turns the whole message promotional, and it is then scrubbed as such. |
| Reg. 2(av) | Promotional voice calls | Senders and telemarketers: a voice call that carries any promotion is a promotional call, even if mixed with other content, and is delivered only to people who have not blocked it or who have given consent. |
| Reg. 2(bt) | Transactional messages and calls | Senders: use this class only for a message or call to your own customer, within thirty minutes of a transaction that customer started, such as a bank or e-commerce OTP, alert, confirmation or refund notice. It must not promote. |
| Reg. 2(bh) | Service messages and calls | Senders: service messages cover non-promotional information to your own customers (warranty, recall, delivery, balance, authentication OTPs). Transaction-linked service messages to others need explicit consent, valid for seven days. |
| Reg. 2(k) | What consent means under these rules | Senders: consent here is permission to reach the customer by commercial SMS or call, and revoking it ends that channel only. Third Amendment: it does not relieve you of duties under the DPDP Act, 2023. |
| Reg. 2(y) | Explicit consent and legacy consent | Senders: explicit consent is either checked directly with the recipient and recorded by the Consent Registrar, or obtained earlier by verifiable means and then registered in the Consent Register as TRAI specifies. Third Amendment. |
| Reg. 2(ah) | Inferred consent | Senders: permission may be inferred from the customer's conduct or your relationship with them. For messages it may be read from a registered content template. The Third Amendment removed the limit tying it to the contract. |
| Reg. 2(bb) | What counts as a relationship | Senders: a relationship rests on a business or commercial dealing, an enquiry made in the last seven days and kept in verifiable written or digital form, or an application made in the last three months. Third Amendment. |
| Reg. 2(ea) | Application-to-Person (A2P) calls | Senders: a call started by software without a person dialling, including autodialled, robo and recorded or synthetic voice calls, is an A2P call. These carry their own declaration duty under Regulation 4. Third Amendment. |
| Reg. 2(f) | Bulk communication thresholds | Senders: more than 20 messages or calls on the same or similar subject in 24 hours, 100 in seven days or 300 in thirty days counts as bulk. Bulk sending is the volume that the detection duties in Schedule IV target. |
| Reg. 2(za) | Government messages | Senders acting for government and TRAI-authorised agencies: government messages and calls need no consent and cannot be blocked by preference, but must be sent through the DLT platform. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 3(1) | Registered headers and number series only | Access Providers: allow commercial communication only from registered headers or from number series set aside for it. TRAI may sort Senders into classes with different criteria. Senders must send only from those resources. |
| Reg. 3(2) | No commercial traffic without registration | Senders: do not send commercial messages or calls unless registered with an Access Provider for it. Otherwise all your telecom resources can be suspended or disconnected under the Regulations. |
| Reg. 4 | Declare A2P calls in advance | Senders: tell your Originating Access Provider before you make A2P calls, with the CLI ranges you will use. It records the declaration on DLT. Undeclared A2P calls count as unsolicited. Access Providers act. From 60 days after Third Amendment publication. |
| Reg. 5(1) | Facility for customer preferences | Access Providers: build and run a facility where subscribers register preferences on commercial communication, and keep complete, accurate records of those preferences. |
| Reg. 5(2) | Register ecosystem entities and roles | Access Providers: register the entities that take part in the ecosystem and set out their roles and responsibilities, so that commercial communication can be controlled efficiently. |
| Reg. 5(3) | Facility to record consent | Access Providers: provide a way to record consent that Senders collect from subscribers, and keep complete, accurate consent records. |
| Reg. 5(4) | Facility to revoke consent | Access Providers: let subscribers withdraw consent and update the consent records to match. |
| Reg. 5(5) | Register and verify Senders | Access Providers: register Senders, verify who they are and set the process they must follow to send commercial communication. Senders must go through this verification. |
| Reg. 5(6) | Pre-delivery checks | Access Providers: define the process and the entity responsible for each pre-delivery check, so compliance is tested before commercial communication is sent. |
| Reg. 5(7) | Facility for complaints | Access Providers: let subscribers complain about Senders, and keep complete, accurate records of how each complaint was resolved. |
| Reg. 5(8) | Investigate and act on complaints | Access Providers: examine and investigate complaints, act against those at fault and take remedial steps to restore compliance. |
| Reg. 5(9) | Find and act on unregistered Senders | Access Providers: detect and identify Senders of commercial communication who are not registered with you, and take action against them. |
| Reg. 5(10) | Follow TRAI instructions | Access Providers: comply with any other directions, guidelines and instructions that TRAI issues for this purpose. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 6(1) | Preference choices, round the clock | Access Providers: let customers record or withdraw consent and choose preferences from the Schedule II lists (content category, mode, time band, day type), at any hour, every day of the year. |
| Reg. 6(2) | Free ways to set preferences | Access Providers: offer free routes to register, change or remove a preference: SMS or call to 1909, IVRS, USSD, an approved app, an OTP-protected web portal, or others TRAI names. Customers pick the route. |
| Reg. 6(3) | Acknowledge within fifteen minutes | Access Providers: acknowledge each preference request within fifteen minutes, quoting a unique reference number. |
| Reg. 7 | Give effect to preferences quickly | Access Providers: apply a new or changed preference in near real time, so nothing is delivered or blocked against it after twenty-four hours, or the period TRAI sets. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 8(1) | Write the five Codes of Practice | Access Providers: before allowing commercial communication, draw up Codes of Practice for entities (Sch. I), preferences and consent (Sch. II), complaints (Sch. III), UCC detection (Sch. IV) and monthly reports (Sch. V). |
| Reg. 8(2) | Register ecosystem entities | Access Providers: register the entities described in the Codes of Practice for entities before commercial traffic is allowed through your network. |
| Reg. 8(3) | Register Senders and assign headers | Access Providers: register Senders and assign headers and header roots to them. Senders apply through this process and hold only the headers they are given. |
| Reg. 8(4) | Register content templates | Access Providers: register the content templates for transactional, service and promotional messages. Senders must send only content that matches a registered template. |
| Reg. 8(5) | Register consent templates | Access Providers: register consent templates, the text shown to customers when a Sender collects consent, which names the purpose and the Sender. Senders register theirs here. |
| Reg. 9 | Deliver only per preference or consent | Access Providers: let no commercial communication reach a recipient except as their registered preference or digitally registered consent permits. |
| Reg. 10 | Only assigned headers may be used | Access Providers: carry commercial communication only under headers assigned to registered Senders for that purpose. Senders must not send from any other header. |
| Reg. 11(1)-(3) | Publicise customer facilities | Access Providers: keep customers informed about how to register preferences, register or withdraw consent, and report or complain about unsolicited communication. TRAI may set content, medium and frequency. |
| Reg. 11(4) | Tell new customers not to send commercial traffic | Access Providers: when you give a customer telecom resources, tell them not to use them for commercial communication, on pain of disconnection. The usage-cap wording was removed by the Third Amendment. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 12(1)-(2) | Records and checks that cannot be altered | Access Providers: run a system that records preferences, consents, revocations and complaints, and performs pre-checks and post-checks on communication offered for delivery, in a non-repudiable, immutable way. |
| Reg. 12(3)-(4) | Know and trace every party | Access Providers: register every person or business that originates, transmits or delivers commercial communication, with documents proving identity, and make each party's actions identifiable and recorded. |
| Reg. 12(5)-(6) | Secure data, limited access | Access Providers: store and share the data securely, make it available only to entities that need it, and keep it out of clear text, even for operators and scrubbers, unless the rules allow. |
| Reg. 12(7) | Detect breaches and act at once | Access Providers: detect non-compliance with the Regulations and act immediately to bring it to an end. |
| Reg. 12(8) | Hold auto-dialler users to their limits | Access Providers: check that Senders who declared auto-dialler use stay within the silent and abandoned call limits, and act against those who do not. |
| Reg. 13 | Run the system on private DLT with smart contracts | Access Providers: use permissioned, private distributed ledger technology, with smart contracts between entities, so every required pre-check runs before commercial communication is delivered. |
| Reg. 13 (provisos) | Digital interface for VNOs | Network service operators: give a virtual network operator a real-time digital interface to the DLT platform and other systems so it can meet its duties. TRAI may set the method. From 60 days after Third Amendment publication. |
| Reg. 14 | Appoint DLT network operators | Access Providers: may authorise one or more DLT network operators to supply the technology for all entities' functions under the Regulations. |
| Reg. 15 | Work together on Codes of Practice | Access Providers: draw up the Codes of Practice, jointly with other Access Providers and relevant stakeholders where needed. |
| Reg. 16 | File Codes of Practice within three months | Access Providers: submit the Codes of Practice to TRAI within three months of the Regulations coming into force. |
| Reg. 17 | Revise Codes within fifteen days | Access Providers: when TRAI directs a change to a Code of Practice, include it and file the revised Code within fifteen days of the direction. |
| Reg. 18 | Implement the Codes on time | Access Providers: implement the filed Codes of Practice to their timelines. A Code term that conflicts with the Regulations has no effect. |
| Reg. 19-20 | Standard Codes of Practice | Access Providers: follow any standard Code of Practice TRAI sets where the Codes you filed fall short of the purpose of the Regulations. |
| Reg. 21 | Financial disincentive for missing Code timelines | Access Providers: missing a Code of Practice timeline can cost up to Rs 5,000 a day for the first thirty days and up to Rs 20,000 a day after, capped at Rs 10 lakh in total. TRAI hears the provider first. |
| Reg. 21A(1) | Flag suspected high-probability spam numbers | Terminating Access Providers: use the AI/ML detection system to flag CLIs very likely to be sending spam and share them with originating providers on DLT within two hours. Reserved number series are not flagged. |
| Reg. 21A(2)-(3) | Notify the Sender and find all its resources | Originating Access Providers: tell the Sender by SMS or email its CLI is flagged, find its KYC identifiers within one business day, and share them so other providers list its resources within a day. |
| Reg. 21A(4)-(5) | Graded action on five flagged CLIs | Originating Access Providers: if five or more of one Sender's CLIs are flagged in ten days, re-verify KYC (first time), physically verify and bar for fifteen days on mismatch or misuse (second), then act under Reg. 25(6)(b). |
| Reg. 21A (provisos) | Let Senders contest a flag | Access Providers: give Senders a way to dispute a spam flag on their CLI and remove it where the reasons stand up. TRAI may set the unflagging method. |
| Reg. 22(1)(a)(i) | Suspend misused headers and templates fast | Originating Access Providers: suspend a misused header or content template across all providers within six hours of noticing, and notify the Sender within forty-eight hours. Suspension stays until the Sender meets the remedial steps. |
| Reg. 22(1)(a)(ii)(A)-(B) | Sender: reset credentials and report to police | Senders: after a misuse notice, reset all access credentials (passwords, API keys, permissions) within three business days and file a police complaint within three, giving the cause and a copy to the provider within two. |
| Reg. 22(1)(a)(ii) (proviso) | Telemarketer complicit in misuse | Senders and Access Providers: if a Telemarketer misused or helped misuse headers or templates, the Sender complains to the police and the provider bars it. It can be disconnected everywhere and blacklisted for a year. |
| Reg. 22(1)(a)(ii)(C) | Re-register headers and templates after a credential leak | Registrar Access Providers: where misuse stems from leaked or cloned credentials, de-register all of the Sender's headers and templates within five business days and let it re-register under new IDs. |
| Reg. 22(1)(a)(ii)(D) | Sender: review all registrations | Senders: within ten business days of the provider's notice, review every registered header, content template and consent template, and tell the provider whether credentials leaked, systems were compromised or another cause applies. |
| Reg. 22(1)(a)(iii) | Suspend all traffic if Sender does not comply | Access Providers: if the Sender does not complete the remedial steps on time, or gives incomplete or false information, suspend all its commercial traffic across providers until compliance is shown. |
| Reg. 22(1)(b) | Honour suspension and blacklisting across providers | Access Providers: once one provider suspends or blacklists a Sender or Telemarketer on DLT, the others stop its traffic within twenty-four hours and refuse re-registration during the period. |
| Reg. 22(1)(c) | Annual self-certification | Senders and registered telemarketers: certify yearly that your registration details, headers, content templates and consent templates are current. Anything not certified is suspended automatically. |
| Reg. 22(1)(d) | Authenticate transmissions | Access Providers: make sure each commercial transmission is authenticated by the Sender in whose name the header or special-series number is issued, in the manner TRAI specifies. |
| Reg. 22(1)(e)(i) | At most two telemarketers in the chain | Access Providers: allow no more than two telemarketers between Sender and network, one aggregator and one delivery telemarketer, unless TRAI directs otherwise. Senders must keep their chain within this. |
| Reg. 22(1)(e)(ii) | Telemarketers use tracing platforms | Registered telemarketers: use digital platforms that record a trace as messages pass through. Access Providers must write this into their agreement with each telemarketer. |
| Reg. 22(1)(e)(iii) | Delivery telemarketers keep traffic traceable | Delivery telemarketers: make sure the commercial communication you handle can be traced. The agreement with the Access Provider must include this duty. |
| Reg. 22(1)(f) | Registration fees and deposits | Access Providers: may set fees for registering Senders, telemarketers, headers and templates, and may ask for security deposits against spam. TRAI may fix these fees or direct providers to. |
| Reg. 22(1)(g) | Penalise Senders and Telemarketers | Access Providers: may fine, forfeit the deposit of, suspend or blacklist registered Senders and Telemarketers whose failure to perform their role caused a breach. TRAI can direct stronger measures. |
| Reg. 22(1)(h) | Grievance route for Senders and telemarketers | Access Providers: let registered Senders and telemarketers lodge grievances and have them resolved. |
| Reg. 22(1)(i)(i) | Sender agreements | Access Providers and Senders: the agreement sets out the Sender's duties and the actions for breach, makes the Sender solely responsible for using only registered headers, allows suit against a misusing telemarketer and requires yearly self-certification. |
| Reg. 22(1)(i)(ii) | Telemarketer agreements | Access Providers and telemarketers: the agreement sets out the telemarketer's duties and the actions for breach, and requires yearly self-certification, failing which it is suspended automatically. |
| Reg. 22(1)(i) (proviso) | Essential agreement conditions set by TRAI | Access Providers: TRAI may prescribe essential conditions for agreements with Senders and telemarketers to stop misuse of telecom resources, and these must be part of every such agreement. Third Amendment. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 23(1)(a)-(b) | Let customers complain and report | Access Providers: let customers complain about unsolicited communication and report violations. Complaints against registered Senders need a registered preference. Complaints against unregistered Senders need none. |
| Reg. 23(1)(c) | Appeal against the outcome | Access Providers: let complainants appeal to the Appellate Authority within fifteen days, by any complaint mode, and pass the appeal on within one business day. From 90 days after Third Amendment publication. |
| Reg. 23(2) | Free complaint modes, seven-day window | Access Providers: offer free ways to complain: SMS or call to 1909, IVRS, approved app, OTP web portal, email or others TRAI names. A complaint must be made within seven days of the communication. |
| Reg. 23(3)-(4) | Acknowledge and point to the app | Access Providers: acknowledge each complaint within fifteen minutes with a reference number, and give subscribers the details of the complaint app. |
| Reg. 23(5) | Valid complaint and invalid-complaint guidance | Access Providers: treat a complaint as valid if it names the sender number, complainant number, date and a brief description, and tell the customer the correct format if it was rejected. |
| Reg. 24(1)-(2) | Record complaints on DL-Complaints | Access Providers: record each complaint and report on the complaints ledger immutably, with the sender number or header, complainant number, referred number or brand, date and time, reference number and status. |
| Reg. 24(3)-(4) | Two years of complaint history | Access Providers: keep two years of history per complainant and per Sender, including appeals and the supporting papers. For unregistered Senders, also record their name, category, address and identifying details. |
| Reg. 24(5)-(6) | Exchange data safely | Access Providers: let the complaints ledger exchange information securely with other entities and support other functions the Regulations need. |
| Reg. 25(1) | Terminating provider records and forwards | Terminating Access Providers: record each complaint and report on the complaints ledger, immutably, and tell the originating provider the details in real time, unless Reg. 25(2) applies. |
| Reg. 25 (opening words) | Match complaints with AI-flagged senders | Access Providers: when resolving complaints, corroborate the complaint data with data on Senders that AI/ML systems across all providers flag as likely spammers. From 90 days after Third Amendment publication. |
| Reg. 25(2)-(3) | Close incomplete or late complaints | Terminating Access Providers: close a complaint that lacks a full sender number or header, or came after seven days, telling the customer why. Late complaints are logged as reports, and kept by both providers. |
| Reg. 25(4)(a)-(c) | Registered Sender: tell it and check records | Originating Access Providers: for a registered Sender or telemarketer, tell it of the complaint at once and check call or message records within two business days. Close the complaint if nothing was sent. |
| Reg. 25(4)(d) | Registered Sender: SMS pre-check review | Originating Access Providers: where an SMS went out, check within three business days that all pre-checks ran. If not, act against the defaulter. Wrong-category templates are blacklisted; five in ninety days halts the Sender. |
| Reg. 25(4)(e) | Registered Sender: promotional voice call review | Originating Access Providers: for complaints about promotional voice calls from the promotional series, check pre-checks within three business days, close the complaint or act against the offender, and apply remedies. |
| Reg. 25(4)(f) | Promotional calls on transactional series | Access Providers: where promotional calls came from a series for transactional and service calls, act as TRAI directs from time to time. |
| Reg. 25(5) | Unregistered Sender: intake and checks | Originating Access Providers: for a complaint against an unregistered Sender, tell it at once and check call records within two business days. Close the complaint if nothing was sent, otherwise look for similar complaints. |
| Reg. 25(5)(d) | Unregistered Sender: when to suspend | Originating Access Providers: suspend the Sender's outgoing services on three or more complaints from unique recipients in ten days where a CLI is AI-flagged, or on five or more, and open an investigation. |
| Reg. 25(6) | Notice, investigation and penalty ladder | Originating Access Providers: give the Sender five business days to answer, then decide within five more. First breach bars all its resources for fifteen days. Repeats mean one-year disconnection, blacklisting and device blocks. |
| Reg. 25(7) | Sender's representation to the provider | Senders: you may contest action taken under Reg. 25(4) or 25(6) with the Originating Access Provider, who decides within seven business days and records reasons, or go to TRAI under Reg. 29. |
| Reg. 25A | Differentiated enforcement by Sender class | Senders: TRAI may class Senders by importance, criticality, scale, resource use and the impact on consumers, apply different action thresholds and measures to each class, and publish the names of violators. Third Amendment. |
| Reg. 26(1)-(2A) | Daily complaint records | Access Providers: keep daily records, per service area, of complaints against registered and unregistered Senders, including every alleged violation reported to you and by other terminating providers, and report to TRAI on request. |
| Reg. 26(3)-(4A) | Compliance reports and audits | Access Providers: file compliance reports on the schedule TRAI sets, and open your complaint handling, registrations, scrubbing and consent processes to audit. Give TRAI the information it asks for, including CDRs. |
| Reg. 26(5)-(6) | Real-time access and public lists | Access Providers: give TRAI real-time access to the processes and databases, and publish in searchable form the complete list of message headers with their Senders and a monthly summary of complaints and action. |
| Reg. 27(1)(a)-(b) | Disincentives: registered Senders, complaints and registrations | Access Providers: pay Rs 1,000 per valid complaint wrongly declared invalid (or lost through failed scrubbing) and Rs 5,000 per header or template registration that breaks the Regulations. The registering provider pays if it caused the spam. |
| Reg. 27(1)(c)-(d) | Disincentives: wrong decisions and misreporting | Access Providers: a first wrong decision on a Sender's representation earns a warning, later ones cost Rs 10,000 each. Misreporting spam counts for registered Senders costs Rs 2 lakh, rising to Rs 5 lakh and Rs 10 lakh if repeated monthly. |
| Reg. 27(2)-(3) | Payment and review of disincentives | Access Providers: pay disincentives into the head TRAI specifies. TRAI may waive or reduce them on good reasons and, before ordering any, must give the provider a chance to explain. |
| Reg. 28 | Financial disincentives: unregistered Senders | Access Providers: Rs 5,000 per instance of failing to act on an unregistered Sender, Rs 1,000 per complaint closed as invalid without good ground, Rs 10,000 per repeat wrong representation decision, and Rs 2 lakh for misreporting. |
| Reg. 28A | Cap on monthly disincentives | Access Providers: the total of disincentives under Regulations 27 and 28 is capped at Rs 50 lakh per calendar month per licensed service area. |
| Reg. 29 | Appeal to TRAI against provider action | Senders and telemarketers: ask TRAI within sixty days to review an Access Provider's action. TRAI can order restoration of resources on payment of Rs 5,000 per resource, capped at Rs 5 lakh, with partial restoration costing at least half. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 30 | Plan the migration to the new system | Access Providers: prepare a migration plan for moving existing data, processes and roles to the data, processes and entities the Regulations define. |
| Reg. 31 | Use the Schedule VI activity list | Access Providers: build the migration plan from the key activities in Schedule VI, which is a starting list and not an exhaustive one. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 32 | Unregistered entities must not send | Businesses and legal entities: do not send commercial messages or calls, cause them to be sent, or authorise them, unless registered with an Access Provider for the purpose. |
| Reg. 33 | TRAI can order action against Senders and telemarketers | Access Providers: TRAI may order or direct you to act against a Sender or telemarketer you have not acted on, after hearing you. The Sender or telemarketer may then make a representation under Reg. 29. |
| Reg. 34 | Smartphones must support the apps | Access Providers: make sure smartphones on your network support the permissions that the preference and complaint apps need, within six months, and de-recognise devices that do not, on TRAI's order. |
| Reg. 34A | No blanket blocking of commercial series | Call management apps: do not tag, block or filter calls from number series set aside for commercial or government communication, or offer a spam report that does not go to the DLT platform. Users may filter privately. Third Amendment text. |
| Reg. 35 | Terminating charge for SMS | Access Providers: the terminating provider may charge up to Rs 0.05 per promotional, service or transactional SMS, but never above its lowest tariff to Senders. No service SMS charge on government or TRAI messages. |
| Reg. 35A | Terminating charge for A2P calls | Access Providers: up to Rs 0.05 a minute for A2P calls, with exemptions for reserved series and TRAI traffic. The Fourth Amendment (4 November 2026) holds this until a date TRAI notifies, so check whether it has started. |
| Reg. 36 | Regulatory sandbox | Access Providers and technology firms: TRAI may set up or allow a regulatory sandbox for testing regulatory checks using DLT and other technology, and will set the process by order or direction. |
| Reg. 37 | No foreign SMS posing as Indian senders | Access Providers and international long distance operators: deliver no incoming international SMS that carries an alphanumeric header or an originating +91 country code. TRAI may add directions on bulk international messages. |
| Ref | Control | What it requires |
|---|---|---|
| Sch. I, 1(1)-(3) | Declare entities, keep functions separate, give IDs | Access Providers: publish the entities that perform each function, keep each function's records and execution separate even if one firm does several, and give every functional entity a unique identity. |
| Sch. I, 1(4) | Verify Senders and telemarketers at registration | Access Providers: registering a Sender or telemarketer includes physical verification, biometric authentication of the authorised person and linking to a unique mobile number. TRAI may set other methods. |
| Sch. I, 2(1) | SMS header format | Access Providers and Senders: headers are up to 11 characters not allocated for other uses, suffixed -P, -S, -T or -G for promotional, service, transactional and government messages so recipients can tell them apart. |
| Sch. I, 2(2) | Voice calling identity | Access Providers and Senders: promotional, transactional and service voice calls go out on the 140-level numbering series, or another series TRAI or DoT directs. |
| Sch. I, 3(1) | Entities the Code must cover | Access Providers: the Code of Practice must name header, consent, consent template and content template registrars, a content template verifier, a telemarketer functional entity registrar, timelines and other matters TRAI adds. |
| Sch. I, 3(2) | Ledger nodes the Code must cover | Access Providers: the Code must set up ledger nodes for headers, consent, consent templates, content templates, the template verifier, complaints, preferences, and telemarketer scrubbing and message and voice delivery. |
| Sch. I, 3(3) | Implementation detail in the Code | Access Providers: set out how every functional entity will work, extra safeguards, minimum technical standards against unsolicited messages, and how each entity gets current, reliable data. |
| Sch. I, 4(1)(a)-(c) | Header registration: assign, verify, bind | Access Providers: assign headers under set principles, pre-verify the applicant's documents and credentials, and tie the header assignee to a mobile device and number used to log in at regular intervals. |
| Sch. I, 4(1)(d)-(f) | Header registration: extra checks | Access Providers: add checks for SEBI-registered brokers, government bodies, corporates and well-known brands, and screen for look-alike headers that could mislead recipients, including swaps of parts of a name. |
| Sch. I, 4(1)(g) | Separate executive approves headers | Access Providers: have a dedicated executive approve each header after scrutinising the Sender's justification against the headers it already holds and how many of its headers were blacklisted. |
| Sch. I, 4(1)(h) | Deactivate unused headers | Access Providers: automatically deactivate headers unused with any provider for ninety days, or the period TRAI sets, and reactivate them on the Sender's request. |
| Sch. I, 4(1)(i) | Suspend a Sender whose header is blacklisted | Access Providers: suspend a Sender's traffic when one of its headers is blacklisted. Traffic resumes after the registrars review its headers and templates, or after seven days if sooner. Repeat breaches mean blacklisting everywhere for a year or more. |
| Sch. I, 4(2)(a)-(d) | Consent registration: template and OTP | Access Providers: record consent on the register only after the customer is shown the consent template, agrees to the purpose and Sender, and is authenticated by OTP, in an immutable, non-repudiable way. |
| Sch. I, 4(2)(e)-(g) | Consent revocation and re-asking | Access Providers: record revocations immutably, give recipients contact details valid for at least thirty days to revoke, and let a Sender seek consent again from a customer who revoked only after ninety days. |
| Sch. I, 4(2)(h)-(k) | Consent-seeking messages | Access Providers: send consent messages from short code 127xxx or another code or header TRAI names, name the Sender or brand and scope, add revocation details to the confirmation, and let customers opt out of consent requests. |
| Sch. I, 4(3)(a)-(c) | Template registration: fixed and variable parts | Access Providers: check transactional and service templates, identify the fixed and variable parts with the type of each variable, and estimate the length of the variable portion against a typical message. |
| Sch. I, 4(3)(d)-(g) | Template registration: hash, category, ID | Access Providers: be able to deregister or suspend a template, hash its fixed part to check actual messages, check promotional templates for content category, and give each template a unique ID. |
| Sch. I, 4(3)(h)-(i) | Template approval and unused templates | Access Providers: have a separate executive approve templates after weighing how many the Sender holds and how many were blacklisted, and deactivate templates unused for ninety days, or the period TRAI sets. |
| Sch. I, 4(3)(j)-(k) | Limits on variables in templates | Access Providers: allow more than three variables only on recorded justification by a second authority, with each variable pre-tagged and at least thirty percent of the template fixed. Contiguous variables need justification. |
| Sch. I, 4(3)(l) | One template, one header | Access Providers: do not link one content template to more than one header. Senders must register separate templates for each header. |
| Sch. I, 4(4)(a)-(b) | Scrubbing: preferences, consent, time slots | Telemarketers and Access Providers: scrub securely against customer preference, consent and content category, and honour the preferred delivery time slots and day types. |
| Sch. I, 4(4)(c)-(d) | Scrubbing: protect register data | Telemarketers: shield register data during scrubbing, for example with virtual identities and tokens, reveal real identities only to those authorised, and give originating and terminating providers the scrubbed list for reverse mapping. |
| Sch. I, 4(4)(e)-(f) | Scrubbing: harvesting and URL checks | Telemarketers: report requests that look like harvested numbers or dictionary attacks, and scrub messages with links, APKs, OTT links or callback numbers only against the Sender's whitelist, backed by its undertaking that they are not malicious. |
| Sch. I, 4(5) | Content verification function | Access Providers: use an automated tool to identify the content type and category of messages to be delivered or already delivered. |
| Sch. I, 4(6)-(7) | Message delivery and aggregation functions | Telemarketers: deliver messages to the originating provider securely during the time slots and days the customer chose, choose the provider through the scrubber, or aggregate for another telemarketer. |
| Sch. I, 4(8) | Voice calling function | Telemarketers: deliver voice calls to the originating provider securely within the customer's chosen time slots and days, and select the provider through the scrubber. |
| Sch. I, 5(1) | Header Registrar role | Access Providers: set up a header registrar that keeps the header register as a ledger, tracks each header's lifecycle, records reserved headers and syncs records in real time. |
| Sch. I, 5(2) | Consent Registrar role | Access Providers: set up a consent registrar that keeps the consent register, runs the acquisition and verification facilities, protects each acquirer's client data and records revocations immutably. |
| Sch. I, 5(3)-(4) | Template registrar and verifier roles | Access Providers: set up a content template registrar that keeps template records immutably, and content format and type verifiers that verify content and keep records for later reference. |
| Sch. I, 5(5) | Scrubbing telemarketer role | Telemarketers for scrubbing: scrub lists and keep a record of every number scrubbed, to resolve complaints, within the minimum performance requirements specified. |
| Sch. I, 5(6)-(7) | Delivery and aggregation telemarketer roles | Delivery and aggregation telemarketers: deliver or aggregate traffic, authenticate each message's source, put your own identity in the message for traceability and keep records of numbers handled. |
| Sch. I, 5(8) | Voice calling telemarketer role | Voice telemarketers: protect register data on calls, for example with virtual identities over a private IP network, work towards calling name display (CNAM, eCNAM) and keep the records needed for checks. |
| Sch. I, 6(1) | Registered templates and revocation text | Access Providers: allow commercial communication only with registered templates, give each a unique ID recorded immutably on the template ledger, and add consent revocation details to promotional messages. |
| Sch. I, 6(2)-(3) | Scrub the target list before sending | Access Providers: send only after scrubbing the Sender's target list against preference, consent, time band and day type. A positive consent match overrides preference but not the time band or day type choice. |
| Sch. I, 7 | Message sequence and flow charts | Access Providers: prepare message sequence charts and flow charts showing the process and actions between each pair of entities. |
| Ref | Control | What it requires |
|---|---|---|
| Sch. II, 1(1) | Opting out of promotional categories | Access Providers: let customers block all promotional communication (BLOCK PROMO) or eight content categories by IVRS, SMS or USSD. FULLY BLOCK was withdrawn by the Third Amendment and existing blocks move to BLOCK PROMO within fifteen days. |
| Sch. II, 1(2) | Opting back in | Access Providers: let customers unblock all promotional categories or specific ones by IVRS, SMS or USSD. The UNBLOCK 51 option is deleted from the sixteenth day after the Third Amendment commences. |
| Sch. II, 2 | Mode preferences | Access Providers: let customers block or unblock modes: voice call, SMS, auto-dialler with recorded message, auto-dialler with live agent and robo calls. Transactional and service communication stays unblocked. |
| Sch. II, 3 | Time band preferences | Access Providers: let customers block or allow nine time bands. Midnight to 10 and 21:00 to midnight are off by default, and transactional and service messages are never blocked in any band. |
| Sch. II, 4 | Day type preferences | Access Providers: let customers block or allow each weekday, Saturday, Sunday and public holidays. Transactional and service communication is not blocked on any day type. |
| Sch. II, 5 | Record preferences within fifteen minutes | Access Providers: build APIs to the preference ledger, record requests from every mode within fifteen minutes, and give scrubbers the changes in real time. |
| Sch. II, 6 | Preference ledger contents | Access Providers: record each customer's number, serving network (updated within twenty-four hours of porting), full dated history of choices, subscription changes and reference numbers, and reset preferences when a resource is closed. |
| Sch. II, 7(1)-(2) | Facility to revoke consent | Access Providers: accept revocation requests from customers, free of cost, by SMS or call to 1909 or the Sender's number, customer care, IVRS, app or OTP web portal, or other means TRAI notifies. |
| Sch. II, 7(3)-(6) | Handle revocations properly | Access Providers: delete the recipient's number from that Sender's consent records within one business day, acknowledge with a reference number, keep the customer's data private and be able to fetch consent details. |
| Sch. II, 8 | Consent ledger contents | Access Providers: record each consent with the customer's number, the Sender's header, date and time, validity, type and purpose. Record revocations too, and revoke all consents when a resource is closed. |
| Sch. II, 9 | OTP generation and verification | Access Providers: specify which entity generates OTPs for each purpose and how long they stay valid, and which entity verifies OTPs from customers or from entities performing functions under the Code. |
| Sch. II, 10 | Message sequence and flow charts | Access Providers: prepare message sequence charts and flow charts for the preference, consent and revocation processes. |
| Ref | Control | What it requires |
|---|---|---|
| Sch. III, 1 | Roles in complaint handling | Access Providers: write the Code of Practice for complaints and assign roles and responsibilities to every entity that examines, investigates and resolves them. |
| Sch. III, 2(1)-(2) | Complaints by voice call and SMS | Access Providers: set the call-to-1909 procedure, with the care executive taking the sender, date, time and brief of the unwanted call or message, and the SMS complaint format and the details complainants provide. |
| Sch. III, 2(3) | Complaints through the mobile app | Access Providers: design apps that help customers spot and report spam, show complaint and preference links on the first screen, capture call logs and SMS with permission, and accept screenshots the user can edit. |
| Sch. III, 2(4) | Complaints through the web portal | Access Providers: let customers complain by web form with authentication, receive a reference number, track status, see complaint and preference links at the top of the home page and upload screenshots. |
| Sch. III, 2(5) | Complaints by email | Access Providers: publish an email address and format for complaints, and return the prescribed format to the complainant at once if a complaint arrives in the wrong form. |
| Sch. III, 3 | Message sequence and flow charts | Access Providers: prepare message sequence charts and flow charts for the complaint handling process. |
| Ref | Control | What it requires |
|---|---|---|
| Sch. IV, 1(1)(a)-(f) | Detection system capabilities | Access Providers: run a system that identifies senders by signature, uses honeypots, learns new signatures, shares detection data with other providers over DLT, and draws on complaint ledger data and other network inputs. |
| Sch. IV, 1(1)(g) | Signals that mark a suspected UTM | Access Providers: flag senders as suspected unregistered telemarketers on volume plus signals: recipient diversity, short calls, low incoming to outgoing ratios, or four or more numbers on one device in a month. |
| Sch. IV, 1(1)(h)-(i) | Detect robo calls, SIM boxes and use AI/ML | Access Providers: detect misuse of robotic and auto-dialled calls, recordings and SIM farms, and use reliable AI and machine learning for proactive detection and monitoring of unsolicited communication. |
| Sch. IV, 1(2) | Share sender numbers to resolve complaints | Access Providers: share information about the sender's telephone number across providers so that complaints can be resolved. |
| Sch. IV, 1(3) | Honeypots | Access Providers: deploy one honeypot per licensed service area for every 500 complaints in the previous year, at least ten, analyse the recorded messages and calls every month and list suspected unregistered telemarketers. |
| Sch. IV, 1(4) | Warn suspected senders | Access Providers: by SMS or email tell senders detected as likely spammers that they have been flagged and must stop, or face action under the Regulations. Substituted by the Third Amendment. |
| Sch. IV, 2 | What the UCC_Detect Code must cover | Access Providers: the Code sets out signature-based detection, honeypots, intelligence-sharing standards, spotting senders who split traffic across numbers, dictionary-attack sources and timelines. |
| Sch. IV, 3 | Report silent and abandoned call offenders | Access Providers: report entities whose abandoned calls exceed 3% or silent calls exceed 1% of attempts in 24 hours using auto-dialling, and bar entities that use number harvesting software. |
| Sch. IV, 4 | Secure the detection data and systems | Access Providers: use detection data only as the Regulations allow, restrict access to authorised parties with approval and logs, keep logs two years, certify and audit systems and control AI/ML use. |
| Ref | Control | What it requires |
|---|---|---|
| Sch. V, 1 | Daily records: registered Senders | Access Providers: keep daily, per service area, counts of complaints received, transferred, rejected for missing details, resolved and found valid, and of Senders found non-compliant, with Sender-wise records for TRAI. |
| Sch. V, 2 | Daily records: unregistered Senders | Access Providers: keep the same daily counts for complaints against unregistered Senders, with action taken under Regulation 25 and the Sender's name, category, address and identifying details. |
| Ref | Control | What it requires |
|---|---|---|
| Sch. VI | Activities for the migration plan | Access Providers: plan entity and header registration with verification, consent and complaint ledgers, separate scrubbing and delivery telemarketers, and the move of NCPR and registration data with TRAI observer nodes. |
| Ref | Control | What it requires |
|---|---|---|
| Dir. 20.08.2024, 10(b) | Whitelisted links only | Access Providers: let through no traffic with URLs, APKs, OTT links or callback numbers that are not whitelisted. TRAI moved the date for links to 1 October 2024 (Dir. 30.08.2024) and reserved callback numbers. Senders must whitelist. |
| Dir. 20.08.2024, 10(c) | Bind the Sender-to-telemarketer chain | Access Providers: make messages traceable from Principal Entity to recipient and reject messages whose telemarketer chain is undefined or mismatched. Dir. 28.10.2024 set rejection from 1 December 2024. Senders declare the chain. |
| Dir. 20.08.2024, 10(d)-(g) | Misuse, wrong category and one-header rules | Access Providers: on misuse, suspend the Sender until a police complaint is filed. Blacklist wrong-category templates, link each template to one header, and bring all headers and templates into compliance. |
| Dir. 18.11.2025, 4 (recital) | Template variable limits, as recited | Access Providers: this direction recites TRAI's February 2023 direction capping SMS template variables at two (a third only for recorded exigency), non-contiguous and not split by spaces or commas. Senders design templates to fit. |
| Dir. 18.11.2025, 8(a)-(f) | Pre-tag variables in SMS templates | Access Providers: tag every variable in an SMS template with its type, purpose and validation, check tagged links and numbers against the whitelist and reject failing messages after a sixty-day logging phase. Senders update templates. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
Mainly Access Providers, who must build the registers, run scrubbing and act on complaints. They pass the duties to Senders (principal entities) and telemarketers through registration and agreements. Senders answer for their own headers and templates, and anyone unregistered may not send commercial traffic.
The 2018 text with the 2025 amendment is in force. The Third Amendment (18 September 2026) starts 30 days after Gazette publication, with A2P declaration, VNO interfaces, the misuse rules and Reg. 35A after 60 days and the appeal and complaint corroboration changes after 90. The Fourth Amendment holds Reg. 35A until TRAI notifies a date.
Transactional means a message to your own customer within thirty minutes of a transaction they started. Service covers non-promotional information to your customers, with explicit consent for ongoing transactions. Promotional means any promotion, and it is scrubbed against preference or consent.
After enough complaints, the provider suspends the Sender's outgoing services. A first breach bars all its telecom resources for fifteen days. Repeat breaches mean one-year disconnection, blacklisting and device blocks. Senders can contest this with the provider and then TRAI under Regulation 29.
No. Under Regulation 2(k), as amended in 2026, it is permission to be contacted by commercial SMS or call, and revoking it stops only that channel. It does not relieve a Sender of duties under the DPDP Act, 2023.
No. It is a plain-English summary in our own words, using TRAI's regulation and schedule numbers. The Gazette notifications and TRAI's directions are the authority, so read them before relying on any entry.