The Acts, ACMA standards, industry codes and membership schemes, with what each one requires, who enforces it, and the maximum penalty.
Supplying SMS to the public under your own brand makes you a carriage service provider under the Telecommunications Act 1997. No licence, no registration, so nothing tells you. This page sets out what applies from that point, written for anyone considering an SMS reseller or white-label business. Treat it as a starting point and get professional legal advice to confirm your own obligations.
Four tiers so you can place yourself. Penalties are the company maximum at the $364 penalty unit in force from 1 July 2026. Each entry links to its source. Use it as a starting point and confirm your obligations with a lawyer.
These have no minimum revenue, message-volume or customer threshold. A provider with one customer can still be subject to them.
The Act that makes you a carriage service provider (s87) and an electronic messaging service provider (s108A), and then attaches the duties that come with both.
The single most operationally demanding instrument on this page. It applies to carriers, carriage service providers and electronic messaging service providers with no size threshold.
The code that defines a carriage service provider to include an SMS aggregator, and the one the ACMA has used against every well-known SMS provider in the country.
Consent, sender identification and a functional unsubscribe for every commercial message. It binds your own messages directly, and section 16(9) extends liability to anyone who aids, authorises or is knowingly concerned in a customer's breach. The carve-out in section 16(10) protects a party only because it merely supplies a carriage service, which a branded reseller is not.
The telecommunications sector was designated a regulated sector on 29 May 2026. Digital platforms were given a $1 billion revenue test and a 200,000 user test. Telecommunications was given no threshold at all. Any provider supplying a message service to the public is a regulated entity from its first message.
The Australian Financial Complaints Authority is the external dispute resolution scheme for the Scams Prevention Framework. Regulated telecommunications providers must be members, in addition to any TIO membership, and AFCA will hear scam complaints about conduct from 31 March 2027.
The word carrier in most of this Act includes a carriage service provider. That brings a reseller inside the interception and access regime.
Multi-factor authentication before any high-risk customer interaction, such as changing account details, porting a number or accessing personal information, where the service falls within the determination.
Expressly binds electronic messaging service providers. You must be able to act when a recipient reports threatening or unwelcome messages sent through your platform.
Your customer terms are a standard form contract, and most of your customers are small businesses, so the unfair contract terms regime applies to every clause you write.
A messaging platform holds phone numbers, names and message content for every customer's contacts. The small business exemption helps less than most people assume.
Since 4 April 2025 the telecommunications security obligations live here rather than in the Telecommunications Act. A CSP's platform is a critical telecommunications asset regardless of size, and the CSP is its responsible entity.
Each of these applies to residential customers, and also treats a business or not-for-profit as a consumer if it is on terms it had no genuine opportunity to negotiate and spends no more than $40,000 a year with you. A self-serve platform with published pricing and click-through terms meets that test for almost every customer it has. Selling only to businesses does not take you out.
The consumer code for sales, contracts, billing and credit. The ACMA refused to register the 2025 rewrite and announced in March 2026 that it will replace the code with an ACMA industry standard, which will be directly enforceable the day it commences.
A written complaints process with fixed clocks, and the standard whose definition of consumer (acquiring a service not for resale) confirms that a reseller's customers are the reseller's problem.
Applies to residential, small business and not-for-profit customers, with financial hardship defined broadly and largely self-assessed by the customer.
The newest consumer standard, and one that most new providers have never heard of. Several obligations sit at provider level and apply whether or not any customer has disclosed anything.
Written for network outages, but the 2026 variation added a duty that reaches every CSP.
Every carrier and eligible carriage service provider must join the Telecommunications Industry Ombudsman scheme. A provider of a public mobile telecommunications service is eligible with no customer-type qualifier, so a reseller supplying two-way SMS on mobile numbers should expect to join. The ACMA can also direct any CSP to join (s130).
Dedicated virtual numbers are the feature every reseller wants to offer, and any message sent from a number, whether one you supply or one the customer already holds, needs rights of use behind it. Together they bring the number management regime, and the largest single penalty on this page.
Every public number you supply, including mobile and virtual numbers, must have its customer's name and address lodged in the IPND for emergency services and law enforcement. Unlisted means not published in directories. It does not mean not lodged. The statutory duty sits in Schedule 2 of the Act, which is why it carries the top penalty.
Who holds the rights to a number, what you must tell the customer, and what happens to the number when they leave.
The rules for how Australian numbers are allocated, held, transferred and used. A reseller normally receives numbers from its wholesaler rather than holding them directly, but the rules on how they may be used apply either way.
Every CSP must let customers port their mobile numbers away, and must verify identity with an additional factor before any port out. Number porting fraud is a named ACMA enforcement priority.
Where dedicated mobile numbers are supplied on a prepaid basis, the customer's identity must be verified against approved documents or data sources before the service is activated.
Thresholds that switch on more obligations, and instruments already announced but not yet made.
Any ransomware or cyber extortion payment must be reported to the Department of Home Affairs within 72 hours, with details of the incident, the demand and the payment.
Record complaint volumes and service counts, retain them for two years, and report complaints to the ACMA every quarter.
A written telecommunications security and risk management program covering cyber, personnel, supply chain and physical hazards, entry on the asset register, annual board attestation and mandatory cyber incident reporting within 12 and 72 hours.
Would require every carriage service provider to register with the ACMA before supplying services, with the ACMA able to refuse or cancel registration. If enacted, it removes the one thing that currently makes starting easy, and gives the ACMA a list of everyone it should be checking on.
When it commences, the 2019 code is automatically deregistered and every obligation in it becomes a direct civil penalty with no warning step. The ACMA has said it will use the move to strengthen responsible selling, credit assessment and disconnection rules.
The draft already names message aggregators as high-risk. The final code is expected to replace C661:2022 and set the customer verification, filtering and response obligations above in binding form.
Left off the list because they do not reach an SMS provider are the Do Not Call Register Act (calls and faxes only), the Customer Service Guarantee (standard telephone services), eligible revenue returns and the industry levy (carriers and declared providers only), the carrier licence charge (carriers only), and the Mobile Premium Services Code (deregistered).
The Australian Government costed one regime on this page when it introduced the SMS Sender ID Register. The analysis, prepared by Deloitte Access Economics for the Office of Impact Analysis, put the cost of participating at the same figure for an SMS aggregator as for a mobile network operator.
initial cost per aggregator to participate in the Sender ID Register
every year after that, for one regime out of the thirty above
Source: SMS Sender ID Register Cost-Benefit Analysis, Table 3.5, Office of Impact Analysis, December 2024. The same analysis assumes there are about 30 Tier 1 SMS aggregators in Australia.
| Fixed cost | Amount | Note |
|---|---|---|
| TIO membership | $400 a year minimum, plus case fees | Case fees are charged per complaint at four escalation levels and invoiced monthly. |
| AFCA membership | $415.57 a year | 2026-27 registration fee, plus complaint fees under AFCA's SPF rules. |
| IPND connection | At your own cost | Secure connection, encrypted signed file transfer, test environment certification, and a monitored contact address. |
| Communications Compliance attestation | Annual | Signed by the CEO or a senior manager under the TCP Code. |
| Wholesale minimums | Set by your carrier or aggregator | Wholesale agreements typically require volume commitments, identity verification of the reseller, Sender ID Register participation and indemnities for downstream misuse. |
The ACMA's compliance priorities for 2026-27 name branded SMS scams, sender ID compliance, mobile number fraud and financial hardship safeguards. Its record shows that the size of the provider does not matter.
Sinch MessageMedia, SMS Broadcast, Esendex, DirectSMS and MessageBird were all directed to comply with the scam code and the IPND code on the same day. SMS Broadcast alone was found to have an estimated 4,588,941 contraventions of one clause. ACMA release
A free trial let new customers send ten messages a day before sender ID checks were completed. Scammers used it to send 108 impersonation messages in a month. The ACMA directed the company to comply. A feature you would build on day one was the breach. ACMA release
In ACMA v Limni Enterprises [2022] FCA 795 the Federal Court ordered $450,000 against a small telco for ignoring TIO determinations, and $115,125 against its sole director personally. ACMA investigations
Four small providers were formally warned on one day for not being TIO members. Ten more were warned in a single sweep in July 2024 under the Financial Hardship Standard, and seven were directed to comply over TCP Code compliance statements. ACMA investigations
168 failed pre-porting identity checks. A routine process at a small regional telco, a $2.5 million penalty and a 36-month enforceable undertaking. ACMA release
2,378,987 SMS without proper sender identification and 344,416 without a working unsubscribe. A repeat offender, so the per-message maximum was five times higher than the first time. ACMA release
Also directed to comply with the scam code between 2023 and 2025: Twilio, Vonage, Sinch Australia, Infobip, Modica, SMSGlobal, Telnyx, TeleSign and Symbio. Telnyx received infringement notices, an enforceable undertaking and two directions at once. ACMA telco investigations register
Every reseller plan rests on the assumption that the provider you buy from is the telco, and you are just their customer. Australian law does not draw the line there. It draws it at the customer relationship, and you hold one.
The Consumer Complaints Handling Standard defines a consumer as a business that acquires a service not for resale. Your wholesaler's consumer is you. Your consumers are the businesses you sell to, and every complaints, hardship, billing and domestic violence obligation runs to them from you.
The SMS Sender ID Register Standard requires every provider that sends sender ID messages to hold its own ACMA approval. It places the duty to verify the customer's right to a sender ID, and to gate every account against the register, on the provider that holds the account. Under the draft Scams Prevention Framework code, your wholesaler must verify you before it will supply you, and you must verify each of your customers before you supply them.
The Spam Act's protection for intermediaries reaches only a party that merely supplies a carriage service. A branded platform that onboards senders, stores their contact lists and sets their pricing is not merely supplying carriage. The TIO's terms of reference allow it to hold a member responsible for the acts of its upstream provider, and never the other way around.
None of this is theoretical. The five providers directed to comply in February 2024 were all buying wholesale carriage from someone else.
The Mobile Message Partner Program pays 20% of every SMS credit purchase a referred customer makes, for 24 months from the day they sign up. Mobile Message holds the customer relationship, so the SMS-provider obligations described on this page sit with Mobile Message. You send the introduction and get paid.
| Running an SMS reseller business | Mobile Message partner | |
|---|---|---|
| Legal status | Carriage service provider and electronic messaging service provider | A business with a referral link |
| ACMA Sender ID Register | Your own approval, verification, over-stamping, traceback and quarterly reports | Handled by Mobile Message, a participating and certified provider |
| Ombudsman schemes | TIO and AFCA membership, case fees and binding determinations | Mobile Message is the member |
| Scam code and SPF | Monitoring, filtering, two-business-day reporting, customer verification, six-year records | Mobile Message's obligations |
| Numbers and IPND | Rights of use, next-business-day lodgement, reconciliation | Mobile Message is the IPND data provider |
| Customers | Support, billing, complaints, hardship, disputes, fraud losses | Mobile Message's 24/7 Australian support |
| Your income | The margin between wholesale and retail, less everything above | 20% of every SMS credit purchase for 24 months, with no costs |
| Time to start | Substantial compliance and operational setup | Minutes, with an ABN |
Yes. Under section 87 of the Telecommunications Act 1997, anyone who supplies a listed carriage service to the public using a carrier's network is a carriage service provider, whether or not they own any infrastructure. Section 108A separately makes anyone who supplies a text messaging service to the public an electronic messaging service provider. The ACMA states that CSPs include organisations that resell time on a carrier network, and the scam code C661:2022 says a carriage service provider includes an SMS aggregator.
No. The obligations attach to whoever holds the customer relationship. Your wholesaler may perform some operational tasks on your behalf, but the ombudsman memberships, complaints handling, ACMA reporting and customer verification remain yours.
Not on its own. Every provider that sends sender ID messages must hold its own ACMA approval under section 7 of the Sender ID Register Standard. A participating provider can carry out some operational tasks for you, but the approval itself cannot be borrowed.
No licence is required to be a carriage service provider, and that is the trap. There is nothing to apply for, so nothing warns you that the Telecommunications Act, the ACMA industry standards, the Scams Prevention Framework, the Spam Act and the ombudsman memberships apply from your first message. A CSP registration scheme is proposed under the Telecommunications Amendment (Enhancing Consumer Safeguards) Bill 2025, which passed the House of Representatives in May 2026.
Business-only does not remove the consumer protection rules. The TCP Code, the Consumer Complaints Handling Standard, the Financial Hardship Standard and the Domestic and Family Violence Standard all treat a business as a consumer if it is on non-negotiated terms and spends no more than $40,000 a year with you. A self-serve platform with published pricing and click-through terms meets that test for nearly every customer. The TIO membership rule for public mobile telecommunications services has no customer-type qualifier at all.
The telecommunications sector was designated on 29 May 2026 with no size, revenue or volume threshold. AFCA membership has been compulsory for regulated telecommunications providers since 1 September 2026, and the full obligations of Part IVF of the Competition and Consumer Act apply from 31 March 2027. The draft telecommunications sector code names message aggregators and classifies message aggregation as a high-risk service requiring identity verification, a rights-of-use check and a legitimate use case before contracting.
Refer the business instead of reselling to it. The Mobile Message Partner Program pays 20% of every SMS credit purchase a referred customer makes for 24 months. Mobile Message holds the customer relationship, so the ACMA approvals, ombudsman memberships, scam reporting, customer verification, support and billing all sit with Mobile Message, and you are paid to your bank account or in SMS credits. Partner Program details
This page is general information about Australian telecommunications regulation as it applies to SMS providers, current as at 22 September 2026. It is a starting point, not legal advice. Get professional legal advice to confirm the obligations that apply to your business. Instruments change, and the TCP Code replacement and the final Scams Prevention Framework telecommunications code are expected before 31 March 2027. Check the linked instruments for the current text.