OFFICIAL · UK regulatory framework

Ofcom in practice: CLI authentication, Sender ID and shortcodes for SMS into the United Kingdom

Ofcom (the Office of Communications, the UK regulator for the communications industries) maintains the General Conditions of Entitlement, the Numbering Plan and the Calling Line Identification authentication standard introduced by Statement of 18 December 2024 — applied to A2P SMS traffic from 1 March 2025. The Mobile Ecosystem Forum UK operates the Sender ID Whitelist Registry and the Do Not Originate list that the four mobile network operators enforce at ingress. 4notify routes through tier-1 direct interconnects on BT/EE, Virgin Media O2, Vodafone UK and Three (CK Hutchison) with the MEF UK Code of Practice v2.3 attestation in place.

The four British mobile networks

BT / EE

Market share: ~35% · OTP P50: 2.6 s

Largest UK mobile carrier (post-2016 BT acquisition of EE); strongest direct interconnect throughput at the London ingress.

Virgin Media O2

Market share: ~27% · OTP P50: 3.0 s

Telefónica Group joint venture with Liberty Global; second-largest by subscriber count; supports MMS alongside SMS.

Vodafone UK

Market share: ~21% · OTP P50: 3.1 s

Vodafone Group plc; agreed merger with Three approved by CMA in December 2024 — completion timeline 2025-2026.

Three (CK Hutchison)

Market share: ~14% · OTP P50: 3.4 s

Hutchison 3G UK Ltd; merger with Vodafone UK in progress; existing direct interconnect remains available.

Ofcom Numbering Plan

+44 7xxx xxxxxxMobile numbers (all four MNOs and MVNOs); requires Ofcom CLI authentication chain.
+44 3xx xxxx xxxxNon-geographic 03 numbers (charged at national rate); often used by HMRC, NHS, councils.
5-digit shortcodes (e.g. 67888)Two-way SMS shortcodes; brand owner registered with MEF UK; dedicated or shared allocations available.
70xx (premium / personal)07000-07099 personal-number range; 70xxx revenue-sharing premium rate.
Alphanumeric Sender ID (≤11 chars)Registered in the MEF UK Whitelist Registry; reserved across all four MNOs simultaneously; trade-mark evidence required.

The six-step Ofcom + MEF UK compliance chain

  1. 01

    MEF UK Code of Practice v2.3 attestation

    4notify registers with the Mobile Ecosystem Forum UK as a Tier 1 Aggregator. The attestation chain links every dispatch back to the brand owner's Companies House identifier; the chain refreshes quarterly.

  2. 02

    Alphanumeric Sender ID registration

    Brand owners register their Sender ID (up to 11 alphanumeric characters — e.g. "Boots", "NHS-UK", "NatWest") in the MEF UK Whitelist Registry. Required: registered trade mark (UK IPO or EUIPO), sample message, declaration of use. Activation: 3-7 working days across all four MNOs.

  3. 03

    Ofcom CLI source authentication

    Since 1 March 2025 every outbound SMS carries an authentication token tying the originating number back to the MEF UK Whitelist entry. Non-authenticated traffic is blocked at the MNO ingress before reaching the handset.

  4. 04

    Do Not Originate (DNO) list enforcement

    MEF UK maintains the DNO list of numbers that must never appear as the source of unsolicited contact — HMRC, NHS 111, the four clearing banks and the major government helplines. 4notify mirrors the list at the API edge and rejects matching dispatches before they reach the operator.

  5. 05

    STOP / opt-out keyword handling

    Per PECR Regulation 22 and the ICO Direct Marketing Code, every marketing dispatch carries a STOP keyword. 4notify processes STOP, UNSUBSCRIBE and ENDquote within the operator's 24-hour SLA and propagates the suppression list across all dispatch channels.

  6. 06

    5-digit shortcode allocation

    Two-way SMS shortcodes (e.g. 67888) are provisioned on the four MNOs simultaneously through 4notify's MNO contracts. Dedicated shortcodes available from £750/month; shared shortcodes available at no provisioning fee.

The MEF UK Do Not Originate list — representative entries

  • 0300 series — HMRC general enquiries, DVLA, Universal Credit, Companies House
  • 0345 series — HMRC VAT helpline, NHS appointment lines, council services
  • 111 — NHS 111 (England)
  • Barclays, HSBC, Lloyds, NatWest fraud reporting numbers
  • Monzo, Starling, Revolut UK official support lines
  • Action Fraud (the City of London Police reporting line)
  • 0808 series — registered freephone numbers operated by charities

The MEF UK DNO list refreshes on a 5-minute interval; 4notify mirrors the live list at the API edge.

Frequently Asked Questions

Do I need a UK legal entity to dispatch SMS through 4notify into the United Kingdom?

No. 4notify operates tier-1 direct interconnects on BT/EE, O2, Vodafone and Three from European infrastructure. The brand owner provides Companies House identifier (or equivalent foreign-registry identifier) for the MEF UK attestation chain; no UK legal entity is required.

What are the Ofcom fines for non-compliance with the CLI authentication standard?

Ofcom may impose penalties up to 10% of UK turnover under the Communications Act 2003. Separately, the ICO may impose PECR penalties up to £500,000 (legacy) or UK GDPR penalties up to £17.5m or 4% of global turnover (whichever is higher).

How long does Sender ID activation take across all four MNOs?

Typically 3-7 working days. BT/EE and Vodafone activate fastest; O2 and Three may take an extra 1-2 days. 4notify provides a single MEF UK Whitelist registration that propagates to all four operators in parallel.

Does Ofcom CLI authentication block international roaming SMS?

No. The CLI authentication applies to A2P (application-to-person) traffic originating at an aggregator. P2P (person-to-person) traffic and international roaming SMS continue to use the standard SS7 / Diameter CLI signalling chain.

Can I use the same Sender ID for multiple brands?

No. The MEF UK Whitelist Registry enforces one-Sender-ID-per-trade-mark; multiple brands within a group require separate registrations. Group-level umbrella Sender IDs (e.g. "Tesco") cover the registered trade mark only — sub-brands need their own registrations.

What happens if a customer replies STOP?

PECR Regulation 22 requires the suppression to take effect immediately for that channel; UK GDPR Article 21 requires propagation across all dispatch channels (email, SMS, push) within 30 days. 4notify suppresses within 24 hours operator-side and within 1 hour platform-side.

Start free

Full Ofcom + MEF UK compliance. Sender ID approved in 3-7 working days. UK-based support through the working week.