ACMA SMS Registration 2025: What Australian Businesses Must Do

Why Australia Changed Its SMS Rules

Scam SMS messages cost Australians hundreds of millions of dollars each year. In 2023, the Australian Competition and Consumer Commission (ACCC) reported that Australians lost over $2.74 billion to scams across all channels, with SMS remaining one of the most-used delivery vectors for phishing and impersonation attacks. Criminals were spoofing well-known sender IDs — impersonating myGov, the ATO, banks, and logistics companies — to trick recipients into clicking malicious links.

The Australian Communications and Media Authority (ACMA) responded by mandating a Sender ID Registry as part of the Reducing Scam Calls and Scam SMS Industry Code (C661), developed by the Communications Alliance. The code requires Australian carriers to block messages using unregistered sender IDs that match patterns commonly used in scams. Phase one of the registry went live in July 2024, with full carrier enforcement active across Telstra, Optus, and TPG Telecom networks from that date.

Who Wrote the Rules and Who Enforces Them

The Communications Alliance, the peak body for Australian telecommunications carriers, wrote the C661 code in consultation with the ACMA, major telcos, and industry stakeholders. The ACMA registered the code, giving it regulatory force. The ACMA retains enforcement powers under the Telecommunications Act 1997 (Cth) and can issue formal warnings, remedial directions, or civil penalty proceedings for serious or repeated non-compliance. You can review the ACMA's scam and spam enforcement activity on their official website.

What an Alphanumeric Sender ID Actually Is

An alphanumeric sender ID is the name that appears at the top of an SMS thread instead of a phone number. If you receive a text that says it is from "CommBank" or "AusPost", that word is the sender ID. These are only visible on devices that support them, and they cannot receive replies — they are outbound-only identifiers. Any Australian business using one of these must now register it before sending messages to Australian mobile numbers.

What the Registry Covers and What It Does Not

It is important to understand the precise scope of the sender ID rules before assuming you are or are not affected. The registry targets alphanumeric sender IDs used by organisations that send at scale. It does not currently mandate registration for messages sent from standard long-form mobile numbers or short codes, though separate obligations around spam and unsolicited communications still apply under the Spam Act 2003 (Cth).

Scope of Registration by SMS Type

Protected Categories That Cannot Be Registered by Businesses

The registry also prevents businesses from registering sender IDs that impersonate government agencies, major financial institutions, health providers, or other trusted entities. If you attempt to register "Medicare", "ATO", "NAB", or "Westpac" as your sender ID and you are not that organisation, your application will be rejected. Existing legitimate owners of those names were given priority registration periods when the registry launched in July 2024. As of mid-2025, all priority registrations have been processed and the registry is open for general business applicants only.

How to Register Your SMS Sender ID: Step-by-Step

Registration is centralised. You do not need to contact Telstra, Optus, or TPG separately. All participating carriers draw from the same Communications Alliance database. Here is the process as it stands in 2025.

Step 1 — Gather Your Business Information

Before you open the portal, prepare the following. Missing information is the most common cause of registration delays.

• Your Australian Business Number (ABN)
• Legal business name and any trading names
• Primary contact name, email address, and Australian phone number
• A complete list of every alphanumeric sender ID you want to register
• A brief description of the purpose of each sender ID (e.g. appointment reminders, order notifications, two-factor authentication)
• Name and contact details of your SMS aggregator or gateway provider if applicable

Step 2 — Submit Through the Communications Alliance Portal

Navigate to commsalliance.com.au and locate the Sender ID Registry section. As of mid-2025, the portal allows businesses to self-register using their ABN for identity verification. Complete the online form, list each sender ID, describe its intended use, and submit. You will receive an acknowledgement email with a reference number.

The Communications Alliance team reviews each application manually. Approvals typically take 2 to 5 business days for straightforward applications. If your sender ID resembles a protected name or if your business cannot be verified against ABN Lookup records, you may be contacted for additional documentation.

Step 3 — Notify Your SMS Gateway or Aggregator

Once your sender ID is approved and listed in the registry, notify your SMS platform or aggregator. Carriers validate messages in near-real time, but your gateway also needs to be configured to send using your registered sender ID string exactly as it appears in the registry. A single character difference — a space, different capitalisation, or a punctuation mark — will result in a mismatch and the message may be blocked.

Step 4 — Test Across Australian Networks Before Going Live

After your sender ID is approved, test message delivery across at least one Telstra SIM, one Optus SIM, and one TPG/Vodafone SIM before relying on the channel for critical communications. Propagation of new registry entries to all carrier filtering nodes can take up to 48 hours after approval. Testing across networks is the only reliable way to confirm delivery is working end-to-end.

Penalties, Enforcement, and Key Deadlines

Understanding the consequences of non-compliance matters as much as understanding the registration process itself. The ACMA has progressively tightened its enforcement posture on scam SMS since the C661 code took effect in July 2024.

What Happens When Messages Are Blocked

When a carrier detects an unregistered alphanumeric sender ID matching a known scam pattern, the message is silently dropped. Your customer receives nothing. There is no delivery failure notification sent back to your SMS platform in most cases, which means businesses can unknowingly send thousands of messages that never arrive. This makes proactive registration and post-registration testing essential rather than optional.

ACMA Enforcement Powers and Penalty Exposure

The ACMA can take enforcement action under the Telecommunications Act 1997 (Cth) and the Spam Act 2003 (Cth) for breaches of the C661 code and related obligations. Enforcement tools available to the ACMA include formal warnings, remedial directions, enforceable undertakings, and civil penalty proceedings. For Spam Act breaches specifically, penalties can reach into the hundreds of thousands of dollars for serious or repeated contraventions. The ACMA publishes details of enforcement actions on its website, and these are increasingly cited in industry compliance programmes as deterrent examples. As of mid-2025, the ACMA has signalled that enforcement of sender ID obligations will intensify through the second half of 2025 as the registry matures.

Common Mistakes Businesses and Aggregators Make

Based on the structure of the registration framework and the most frequently cited implementation issues as of mid-2025, the following mistakes are the most likely to cause delivery failures or compliance exposure.

Mistakes Made by Businesses

• Assuming the aggregator handles registration: No SMS gateway or aggregator automatically registers your sender ID on your behalf. The obligation is yours as the business whose name appears in the message.
• Using inconsistent capitalisation: Registering "Mybusiness" but configuring your platform to send as "MyBusiness" will cause a mismatch. The registered string must match exactly.
• Registering without notifying the gateway: Approval from the Communications Alliance does not automatically configure your SMS platform. You must update your gateway settings manually.
• Skipping cross-network testing: A sender ID that delivers correctly on Telstra may still be blocked on Optus or TPG if registry propagation has not completed.
• Ignoring Spam Act obligations: Sender ID registration satisfies C661 code obligations only. Consent, identification, and unsubscribe requirements under the Spam Act 2003 remain separate obligations that must also be met.

Common Issues for SMS Aggregators

• Not prompting clients to register: Aggregators are not legally required to register on behalf of clients, but failing to educate clients about the obligation creates delivery failures that reflect poorly on the platform.
• Routing messages before propagation completes: Launching campaigns within hours of registration approval risks messages being blocked if carrier filtering nodes have not yet received the updated registry data.
• Failing to validate sender ID strings at submission: Aggregators that accept sender ID strings without validating them against the registry introduce unnecessary delivery risk for their clients.

Carrier-Specific Considerations

While registration is centralised, individual carriers have their own technical implementation timelines and additional terms of service for bulk SMS senders. The following table summarises the position of the three major Australian carriers as of June 2025.

Carrier Participation Summary (as of June 2025)

Telstra

Telstra, as Australia's largest carrier, was an early mover in blocking unregistered sender IDs from July 2024. Businesses sending high volumes of SMS through Telstra's network should also review their Telstra Messaging API terms, which include separate conditions around acceptable use, data residency, and throughput limits. If you are using an aggregator like MessageMedia, Vonage, or Twilio to route messages across Australian networks, your aggregator manages the carrier relationship — but the sender ID registration obligation remains yours.

Optus and TPG Telecom

Optus and TPG Telecom both participate in the centralised registry. For most businesses, registering through the Communications Alliance portal is sufficient. If your organisation sends more than approximately 100,000 SMS messages per month through either network, it is worth contacting their business teams directly to discuss dedicated throughput arrangements and to confirm your sender IDs are propagated correctly across their filtering systems.

Impact on AI-Powered SMS Automation

For Australian businesses using AI automation for customer communications — appointment reminders, lead nurturing sequences, transactional notifications, or AI chatbot follow-ups — the sender ID rules are not optional. If your automation platform dispatches SMS using a branded alphanumeric name, that name must be registered before messages go out.

Platforms commonly used by Australian SMEs for AI-powered SMS automation include ActiveCampaign, HubSpot, Klaviyo, Make (formerly Integromat), Zapier with Twilio, and custom n8n workflows. None of these platforms automatically register your sender ID on your behalf. The obligation is yours as the business sending the communication.

If you are building or reviewing an AI automation stack for your business, the DomainGuard AI Automation services team can audit your current SMS delivery configuration and confirm whether your sender IDs are correctly registered and routed.

Testing Your SMS Setup After Registration

After your sender ID is approved, test message delivery across at least one Telstra SIM, one Optus SIM, and one TPG/Vodafone SIM before relying on the channel for critical communications. Propagation of new registry entries to all carrier filtering nodes can take up to 48 hours after approval. Testing across networks is the only reliable way to confirm delivery is working end-to-end.

SMS Compliance Beyond Sender ID: The Spam Act 2003

Registering your sender ID resolves your C661 code obligations, but it does not cover all of your SMS compliance requirements. The Spam Act 2003 (Cth), enforced by the ACMA, still applies to all commercial electronic messages including SMS. Key requirements include:

• Consent — you must have express or inferred consent from the recipient before sending marketing SMS
• Identification — your message must clearly identify your business
• Unsubscribe — every marketing SMS must include a functional opt-out mechanism

The ACMA has taken enforcement action against Australian businesses for Spam Act breaches resulting in penalties reaching into the hundreds of thousands of dollars. Review the ACMA's spam compliance resources to ensure your full SMS programme is lawful, not just your sender ID registration. For a deeper overview of how Spam Act obligations interact with your broader digital communications strategy, see our DomainGuard resource library, which covers SMS compliance, email authentication, and domain security in detail.

What to Do Next

The SMS sender ID rules are part of a broader shift in how Australian regulators are approaching digital communications security. The same instinct that drove the sender ID registry — preventing impersonation and protecting consumers — also applies to domain security, email authentication, and website integrity.

If your business relies on automated SMS as part of its customer communications or lead management workflows, take these steps now:

• Audit every alphanumeric sender ID your business currently uses or plans to use
• Register each one through the Communications Alliance portal before sending further messages
• Update your SMS gateway or aggregator configuration to use the registered string exactly
• Test across Telstra, Optus, and TPG networks after registration completes
• Review your Spam Act obligations for consent, identification, and unsubscribe compliance

If you are building AI-powered customer communication workflows and need help ensuring your SMS, email, and web channels are compliant and properly configured, contact the DomainGuard team for a compliance and automation audit. We also work with businesses on broader cyber-security to ensure staff understand how digital impersonation risks affect your brand and your customers.

For businesses whose broader digital presence — including domain security, DNS configuration, and email authentication — needs review alongside their SMS compliance, our resource library covers DMARC, SPF, DKIM, and domain hijacking prevention in depth. Businesses looking to strengthen their overall digital security posture can also explore our SEO and digital visibility services to ensure your legitimate communications reach customers through every channel.