What It Means for International Messaging
From 2 November 2026, SMS messages sent to consumers in Finland under sender IDs that have not been authorised can be blocked or delivered with a visible spam label. The rules aim to prevent sender impersonation. They also raise important operational questions for international A2P messaging providers and the businesses they serve.
Finland has introduced a new approach to SMS sender identification that changes how businesses and messaging providers need to manage traffic sent to the country.
The Finnish Transport and Communications Agency (Traficom) has set out the requirements in its Regulation 28 L/2025 M. Under these rules, telecommunications operators must either block messages whose sender’s right to use the sender ID has not been verified, or replace the displayed sender name with “Roskaposti” or “Skräppost”, meaning “spam” in Finnish and Swedish.
The relevant obligations took effect on 2 November 2026. Organisations have been able to obtain authorisation for their sender IDs since May 2026.
The aim is to make it harder for fraudsters to impersonate banks, public authorities, businesses and other trusted organisations through SMS. The change also affects legitimate traffic, especially when international organisations use sender IDs that have not been authorised under the Finnish requirements.
What exactly has changed in Finland?
If the sender’s right to use the sender ID displayed in an SMS has not been verified, the operator must do one of two things:
- block the message, or
- deliver it with the sender ID replaced by “Roskaposti” or “Skräppost”.
The spam label appears in place of the original sender name. It warns recipients that the sender’s right to use the identifier has not been verified.
Organisations sending SMS to consumers in Finland must obtain authorisation for the sender IDs they use, through their SMS service providers. This covers alphanumeric sender IDs, such as a company or authority name, and Finnish telephone numbers.
The change does not affect text messages between individuals, even when a company holds the mobile subscription.
Why does this matter for international A2P messaging?
For international A2P messaging providers, the most significant implication is that a technically valid SMS may no longer reach the recipient under its intended sender identity.
A message can come from a legitimate business, contain legitimate information and follow a working delivery route. It can still be blocked or shown as spam if its sender ID has not been properly authorised.
Traficom explicitly acknowledges this possibility. Foreign organisations can continue to use local sender IDs, but some of these are not authorised under Traficom’s regulation, so their messages may also carry the spam label.
Consider a business sending an appointment confirmation, a payment notification or a customer service update to someone in Finland. If the sender ID is not authorised, the recipient may see a spam label instead of the expected brand name.
This highlights the difference between three aspects of successful A2P messaging: technical delivery, regulatory compliance and recipient trust. A message being accepted into the network does not necessarily mean the recipient will see the intended sender identity.
What should messaging providers and enterprises review?
The new requirements make sender ID governance an operational issue for everyone involved in delivering SMS traffic to Finland. Providers and enterprises should check whether the sender IDs used for Finnish destinations are properly authorised, including those used by international customers and across different services.
Several areas deserve particular attention:
Sender ID inventory and authorisation. Providers need an accurate view of which customers use which sender IDs, where those identifiers are used and whether the required authorisations are in place.
Customer onboarding and verification. Sender ID authorisation should be part of activating new customers, brands or messaging services for the Finnish market, not something addressed only after delivery problems appear.
Routing and destination-specific requirements. International SMS operations increasingly need to account for local regulatory conditions alongside traditional routing factors such as cost, quality and connectivity.
Monitoring and troubleshooting. A message delivered with a modified sender name creates a different customer experience from one delivered as intended. Providers should establish how such cases can be identified, investigated and communicated.
Customer communication. Enterprises sending legitimate traffic need to understand the consequences of using unauthorised sender IDs, especially for time-sensitive notifications and messages where brand recognition matters.
These are operational considerations arising from the new rules, not additional technical requirements set by Traficom.
Does a spam label always mean the message is fraudulent?
No. This is one of the key distinctions in Traficom’s announcement.
The label shows that the sender’s right to use the displayed sender ID has not been verified. It does not necessarily mean the message itself is fraudulent.
Traficom gives the example of a restaurant abroad asking a customer to confirm a table booking. That legitimate message could still arrive with a spam label if its sender ID has not been authorised.
For recipients, the label is a warning to verify the sender. They should be especially cautious with messages that ask them to open links, act urgently or share personal or banking details.
For businesses, the consequences go beyond compliance. A legitimate message carrying a spam label can create uncertainty, reduce customer confidence or disrupt an expected communication.
Is sender ID management becoming part of messaging security?
Finland’s new rules highlight the growing link between messaging operations and cybersecurity.
Sender ID spoofing has long been used to make fraudulent messages appear to come from trusted organisations. By requiring authorisation and introducing visible relabelling, Finland is addressing that risk at network level.
This does not eliminate SMS fraud or remove the need for recipients to check suspicious requests. It does add another mechanism that makes unauthorised impersonation more difficult. The development is particularly relevant as AI-generated phishing and increasingly convincing social engineering make it harder for businesses and consumers to tell legitimate communication from fraud.
What happens next?
The immediate priority for messaging providers serving Finland is to ensure that the sender IDs their customers use meet the new authorisation requirements.
Beyond Finland, the development raises a question for the international messaging industry: will more markets introduce similar approaches to sender verification, visible relabelling or blocking?
It is too early to conclude that Finland’s model will become a wider regulatory standard. It does show why sender identity, country-specific compliance and accurate customer information are becoming central to international A2P messaging operations.
Managing traffic successfully is no longer only about getting a message from one network to another. It also means making sure the message arrives under the intended identity, in line with local rules, with the recipient’s trust intact.
Key takeaways
- Organisations sending SMS to consumers in Finland need authorised sender IDs. They obtain authorisation through their SMS service providers.
- Messages with unauthorised sender IDs are blocked or delivered with the sender name replaced by “Roskaposti” or “Skräppost”. This happens even when the sender is legitimate.
- For international A2P traffic, a message being technically delivered no longer guarantees that the recipient sees the intended sender name.
