Alias Registry

1. Purpose of the Alias Registry

The Alias Registry is an official database managed by the CNMC that contains the alphanumeric aliases that may be used as sender identifiers in SMS, MMS, and RCS messages addressed to Spanish numbers.

Its purpose is to prevent impersonation in mobile messaging. To do so, it allows three elements to be verified before a message is delivered to the end user:

• that the alias exists in the Registry;
• that the alias is associated with a legitimate holder;
• that the message has been originated, transmitted, and delivered by providers authorized to participate in the messaging chain.

The system is based on a simple rule: a message with an alias should circulate only if the alias is registered and if the technical chain carrying it respects the registered authorizations. Otherwise, the message must be blocked, except in the specific international roaming cases described in this document.

The Registry is not a numbering allocation mechanism, nor does it turn the alias into a public numbering resource. The alias remains an alphanumeric sender identifier, without the ability to receive replies as if it were a telephone number.

2. Scope of application

The Registry applies to SMS, MMS, and RCS messages identified by aliases and addressed to recipients with Spanish numbers.

The following are within scope:

• companies that use aliases for notifications, alerts, verification codes, informational communications, promotional communications, or equivalent messages;
• public authorities that use aliases as sender identifiers;
• messaging service providers that participate in the origination, transit, or termination of messages with aliases;
• third parties that manage, operate, or exploit aliases on behalf of a holder;
• foreign companies that send messages with aliases to customers with Spanish numbers.

The following are outside the scope:

• messages whose sender identifier is solely numeric and belongs to the applicable numbering plans;
• aliases used in messages whose recipients are not Spanish numbers;
• cases in which treatment of the identifier is subject exclusively to the regulations of the destination country.

3. Essential definitions

Alias

An alias is an alphanumeric string transmitted in the field intended for the calling line identifier in SMS, MMS, or RCS communications. It informs the recipient who sent the message, but it is not a telephone number and does not allow the recipient to return the message to the sender using that identifier.

Typical examples of use include verification codes, appointment notices, bank alerts, logistics notifications, communications from public authorities, security notices, and commercial campaigns.

Message with alias

A message with alias is an SMS, MMS, or RCS message originated by a company or public authority in which the sender is identified by an alias rather than a number. The user can receive and read the message, but cannot reply to the alias as if it were a telephone number.

Holder of an alias

The holder is the company or public authority that proves the right to use the alias and whose ownership must appear in the Registry before using it as the sender in messages addressed to Spanish numbers.

The concept of company should be understood broadly. It includes legal persons, natural persons engaged in economic activity, self-employed professionals, foundations, and equivalent entities acting in the market.

The holder may act directly, through a legal representative or, for foreign companies unable to use a valid digital certificate to act in Spain, through an authorized representative.

Foreign company

A foreign company is any entity, natural person, or legal person that carries out economic activity and whose registered office or place of incorporation is located outside Spain.

A foreign company must register its aliases when it wants to send SMS, MMS, or RCS messages with aliases to customers with Spanish numbers, except in the international roaming cases discussed later.

Messaging service provider

This is the provider that participates in message transmission and has the necessary infrastructure to block messages with unregistered aliases or messages with registered aliases that come from an unauthorized provider.

It includes:

• mobile network operators;
• full mobile virtual network operators;
• messaging aggregators;
• resellers of store-and-forward messaging services when they have the technical capacity to send and block messages in accordance with the applicable obligations.

Registered provider

A registered provider is a messaging service provider registered in the Alias Registry. Registration as a registered provider is a necessary condition to participate validly in the origination, transit, or termination of messages with aliases within the regulated system.

Registered originating provider

This is the first provider in the messaging chain that has been authorized by the holder to send and transmit messages using a specific alias.

The registered originating provider may be an aggregator, a reseller with sufficient technical capacity, or a mobile operator. It must be registered in the Operators Registry and in the Alias Registry. It must also be expressly authorized for each alias with which it originates messages.

Each alias must have at least one authorized registered originating provider. Without a registered originating provider, the alias cannot operate correctly within the system.

Transit provider

This is the registered provider that receives messages with aliases from another registered provider and forwards them to another registered provider. It does not deliver the message directly to the final recipient, but acts as a technical intermediary within the transmission chain.

Termination provider

This is the registered provider responsible for finally delivering the message to the recipient's mobile phone. This function corresponds exclusively to mobile operators.

Third party

This is any natural or legal person other than the registered originating provider that participates in the management, use, or operational exploitation of an alias on behalf of the holder and with the holder's express authorization.

Third parties may include, among others:

• SaaS, CRM, or ERP platforms that integrate SMS or RCS channels;
• commercial or functional intermediaries that do not assume the functions of a registered originating provider;
• subsidiaries or companies in the same corporate group;
• franchises, branches, or establishments linked to the holder;
• marketing, communications, advertising, or campaign management agencies;
• entities that functionally operate the messaging channel on behalf of the holder.

The third-party figure allows the holder to delegate messaging operations without losing ownership or responsibility for the legitimate use of the alias.

Legal representative

This is the natural or legal person empowered to act on behalf of the holder in accordance with their powers of representation. In the Registry, the legal representative authorizes actions carried out on behalf of the holder, including alias registration, modification, suspension, reactivation, and cancellation.

The legal representative must have a valid digital certificate to act before the corresponding electronic office.

Authorized representative

This is the natural or legal person who has a valid letter of authorization granted by the holder, in accordance with the model published by the CNMC, enabling them to carry out actions before the Alias Registry on behalf of the holder.

This figure is especially relevant for foreign companies whose legal representatives cannot obtain a valid digital certificate to act in Spain.

The authorized representative must have a valid digital certificate to act in Spain. All interactions with the Registry must be carried out or approved by that representative, who is responsible for the truthfulness, integrity, and validity of the authorization provided, as well as for the actions carried out on behalf of the foreign company.

Improper use of an alias

Improper use exists when the alias does not meet the legitimate-link or format criteria, when it is used through providers that are not registered or not authorized, or when its use may lead to fraud, confusion, impersonation, infringement of third-party rights, or harm to end users.

4. Functional model of the Registry

The Registry must allow each alias to be traceably linked to:

• a holder;
• a justification of legitimate linkage;
• one or more authorized registered originating providers;
• authorized third parties, where applicable;
• the corresponding legal representatives or authorized representatives;
• the operational status of the alias;
• the information required for registered providers to apply blocking.

The functional logic of the system is as follows:

1. The holder, its registered originating provider, or an authorized third party requests registration of the alias.
2. If the request is not submitted directly by the holder, the action remains pending authorization by the holder, its legal representative, or its authorized representative.
3. The CNMC reviews the request.
4. If the alias meets the requirements, it is registered and may be activated in accordance with the applicable rules.
5. Registered providers download the Registry information through the enabled technical mechanisms.
6. Each provider in the chain verifies whether it must allow or block the message.
7. Providers retain statistical and traceability information for supervision.

5. Who must register an alias

Aliases must be registered before use when they are to be used as sender identifiers in SMS, MMS, or RCS messages addressed to Spanish numbers.

Registration may be requested by:

• the holder of the alias;
• the registered originating provider acting on behalf of the holder;
• a third party authorized by the holder;
• an authorized representative, in the cases applicable to foreign companies.

When the request is submitted by the registered originating provider or a third party, the holder must expressly approve the action. If authorization is not granted within the established period, the action is deemed not to have been carried out and the alias is not registered through that route.

There is no general limit on the number of aliases that the same holder may register, provided each alias meets the format and legitimate-link requirements.

Several aliases belonging to the same holder may also be registered in a single procedure. Each alias must have its own specific information, although the holder's general data and the data of its representatives may be shared.

6. Substantive alias requirements

Registration requires two cumulative conditions:

• that the alias have a legitimate link with the holder;
• that the alias comply with the format rules and not fall into any grounds for rejection.

Legitimate linkage

The holder must prove that the alias legitimately corresponds to one of the following elements:

• registered trademark;
• registered trade name;
• corporate name;
• internet domain;
• name registered in a national or international public registry;
• legitimate and habitual use within the holder's professional or commercial activity, when there is no official registry through which the link can be proven by the previous means.

The link may be proven by a responsible declaration from the holder. The CNMC may at any time require documentation proving the truthfulness of what has been declared.

When the holder does not have a trademark, trade name, corporate name, domain, or registered name, it may declare that the alias is used legitimately and habitually in its professional activity. This route is subsidiary and should be reserved for cases in which the link cannot be justified through official registries.

Documentation that should be retained

Although registration may be based on a responsible declaration, the holder must be able to provide supporting documentation if required. Depending on the case, it is advisable to keep:

• certificates or titles for trademarks or trade names;
• official publications granting the trademark;
• registry certificates;
• deeds, bylaws, or commercial registry certificates;
• documentation proving ownership or transfer of domains;
• contracts, authorizations, or equivalent documents proving the right of use;
• evidence of legitimate and habitual use of the alias in professional or commercial activity.

Priority when several holders claim the same alias

If two or more holders prove a legitimate link with the same alias, an order of preference applies:

1. coincidence with the holder's registered trademark or trade name prevails;
2. failing that, coincidence with the holder's internet domain is considered;
3. in the absence of the foregoing, coincidence with the corporate name is considered;
4. if none of those criteria applies, the request submitted first prevails.

If an entity detects that an alias is registered by another holder and considers that it has a better right, it may request CNMC intervention so that the right to use the alias is resolved through the corresponding procedure.

7. Format rules for SMS and MMS

Aliases used in SMS and MMS must comply with the technical format applicable to these services.

Main rules:

• minimum length of 3 characters;
• maximum length of 11 characters;
• letters from a to z, letters from A to Z, ñ, Ñ, ç, Ç, digits, spaces, and combinations of uppercase and lowercase letters are allowed;
• the special characters @, &, -, _, ., and + are allowed;
• abbreviations of public authorities are allowed;
• for companies, abbreviations are only admissible if they satisfy the legitimate-link rule;
• consecutive spaces are not allowed;
• spaces at the beginning or end are not allowed;
• accented characters are not allowed;
• aliases made up exclusively of numbers are not allowed.

Characters not allowed include, among others:

• exclamation marks;
• hash sign;
• percent sign;
• parentheses;
• asterisk;
• comma;
• slash;
• colon;
• semicolon;
• greater-than and less-than signs;
• equals sign;
• question marks;
• square brackets;
• currency symbols.

8. Format rules for RCS

Aliases used in RCS must clearly and directly identify a link with the holder's registered trademark, trade name, corporate name, or internet domain.

Main rules:

• consecutive spaces are not allowed;
• spaces at the beginning or end are not allowed;
• exclusively numeric aliases are not allowed;
• the alias must sufficiently identify the holder;
• any form that could lead to error, confusion, or impersonation must be avoided.

The RCS regime has specific information requirements, but it is integrated into the same general principle: the alias must be linked to the holder and providers must be able to verify its legitimacy in order to correctly apply blocking.

9. Prohibited or rejectable aliases

The CNMC may reject alias applications when the alias could facilitate fraud, generate confusion, cause impersonation, cause offense, or infringe third-party rights.

The following should not be admitted:

• generic aliases that do not identify the sender;
• terms such as Message, Bank, Flight, Urgent, or other equivalents without identifying context;
• aliases that reproduce names of official bodies, companies, brands, or third-party services;
• aliases of persons or places, unless they are associated with the holder or match a registered trademark or trade name of the holder;
• offensive or discriminatory expressions, expressions contrary to public order, or expressions that incite hatred;
• unrecognizable or generic abbreviations without context;
• aliases that infringe industrial property rights, intellectual property rights, corporate names, or other third-party rights;
• variants of the registered alias that alter uppercase letters, lowercase letters, spaces, or characters in an unregistered manner.

A registered alias cannot be freely altered. If the registered alias is Company, variants such as COMPANY, company, or other alterations must be treated as different aliases and, if they are not registered, must be blocked.

10. Data required to register an alias

The application must include, at a minimum:

• requested alias;
• type of message for which it is intended: SMS/MMS or RCS;
• type of legitimate link between alias and holder;
• specific description of the link;
• corporate name or identification of the holder;
• tax identification or applicable equivalent of the holder;
• registered office of the holder;
• data of the legal representative or authorized representative;
• authorized registered originating provider or providers;
• activation date indicated by the applicant, without the alias being usable before it is registered and operational;
• end-of-use date, only if the holder wants the alias to have limited duration;
• third-party data, if any;
• responsible declaration of legitimate linkage.

When several aliases of the same holder are registered in a single procedure, the general data of the holder and its representatives may be reused, but each alias must have its own specific information.

11. Registration procedure

The procedure is carried out through the CNMC electronic office, using the Alias Registry management procedure.

Ordinary flow:

1. The applicant accesses the system with a valid digital certificate.
2. The applicant selects the type of alias registration request.
3. The applicant indicates whether they act on their own behalf or on behalf of an entity.
4. The applicant completes the applicant's contact details.
5. The applicant adds the holder's representatives.
6. The applicant adds one or more aliases.
7. The applicant indicates the type of message associated with each alias.
8. The applicant declares the legitimate link and specifies its basis.
9. The applicant selects the registered originating provider or providers.
10. The applicant adds third parties, if any.
11. The applicant provides or accepts the corresponding responsible declaration.
12. The applicant reviews and submits the request.
13. If the action is carried out by an applicant on behalf of the holder, the holder or its representative must expressly authorize it.
14. The CNMC reviews the request.
15. If it meets the requirements, the alias is registered and may operate in accordance with the applicable rules.

The alias cannot be used until registration has been completed and the alias appears as active in the Registry. The date indicated by the applicant expresses the intended activation date, but does not replace the need for registration and validation.

12. Holder authorization

Any action carried out by a registered originating provider or by a third party on behalf of the holder requires the holder's express authorization.

The action remains pending authorization until the holder, its legal representative, or its authorized representative approves it. If it is not approved within the established period, the action is deemed not to have been carried out.

This rule applies to:

• registration of aliases;
• authorization of new registered originating providers;
• modification of data;
• suspension requested on behalf of the holder;
• reactivation;
• cancellation.

Holder authorization is a central element of the system because it prevents a provider or intermediary from operationally appropriating an alias without the consent of the legitimate holder.

13. Authorization of registered originating providers

Each alias must have at least one registered originating provider authorized by the holder.

An alias may have several registered originating providers. This allows the holder to work with several aggregators, operators, or platforms, provided all are registered and authorized.

If the holder wants to add a new registered originating provider to an already registered alias, it must process a modification of the alias.

If the request for authorization is submitted by the new registered originating provider or by a third party, the request is submitted as if it were a new registration in relation to the already existing alias. In that case it is not necessary to prove again the link or the format of the alias, but express authorization from the holder is required.

The registered originating provider cannot authorize or deauthorize other registered originating providers unless it acts through the appropriate procedure and with the holder's corresponding authorization.

14. Authorized third parties

Third parties may participate in the registration, management, or operational use of the alias on behalf of the holder, provided they are authorized.

Their participation must be reflected in the information associated with the alias. Their data and the data of their representatives, where applicable, must be identified.

The third party does not replace the holder. The holder retains responsibility for the legitimacy of the alias, and the third party acts by operational delegation.

The practical use of the third-party figure allows:

• a technology platform to manage the SMS or RCS channel on behalf of the holder;
• a marketing agency to launch campaigns using the holder's alias;
• subsidiaries, franchises, or branches to use a common alias;
• a functional intermediary to manage communications without necessarily becoming a registered originating provider.

A message should not be considered valid if it is sent by a third party not authorized by the holder when the chain requires that authorization.

15. Alias statuses

The alias may be in different operational statuses:

Pending authorization

Status applicable when the request is submitted by a registered originating provider, a third party, or any applicant acting on behalf of the holder. The holder must approve or reject the action.

Pending review

Status applicable when the request has already been submitted or authorized and is being reviewed by the CNMC.

Registered and active

Status in which the alias appears in the Registry and may be used in accordance with its authorizations, provided the registered providers and other applicable rules are respected.

Suspended

Temporary status in which the alias no longer appears as usable. Messages sent with the suspended alias must be blocked.

Cancelled

Final deregistration status. The alias is no longer authorized. It may be subject to a period of disqualification before it can be requested again, unless a justified exception applies.

16. Modification of data

The holder may modify the data associated with its registered aliases. An applicant acting on its behalf may also do so, with the holder's express authorization.

The registered data may be modified, except for the alias itself. If the alias is to be changed, a new registration must be processed.

The holder's data may also be updated when there are structural changes to the company, such as universal succession, merger, spin-off, or asset transfer. In these cases, the update does not necessarily invalidate the alias if the corresponding legal continuity is proven.

If the modification affects the validity of the use of the alias or its legitimate link, it may be necessary to cancel the current registration and submit a new request.

17. Suspension of aliases

A registered alias may be temporarily suspended. During suspension, it must not appear as an operational alias and messages using it must be blocked.

Main grounds for suspension:

• end of the period of use communicated by the holder;
• lack of use during the established inactivity period;
• request by the holder;
• request by a third party or provider acting on behalf of the holder, with express authorization;
• reasoned decision by the CNMC based on indications of improper use, exceptional circumstances, protection of the market, protection of third parties, or protection of end users.

In ordinary cases, the alias may be reactivated within the established period. When the suspension derives from a CNMC decision, reactivation requires a decision by the CNMC itself.

18. Cancellation of aliases

Cancellation means deregistration of the alias from the Registry.

Main grounds for cancellation:

• request by the holder;
• request by someone acting on behalf of the holder, with express authorization;
• failure to reactivate after a suspension within the established period;
• loss of the only registered originating provider without appointment of a replacement within the applicable period;
• reasoned decision by the CNMC due to improper use or exceptional circumstances.

After cancellation, the alias is disqualified from reuse for the established period. That disqualification may not apply to the former holder when adequately justified, or in other exceptionally justified cases.

19. Cancellation of registered providers

A registered provider may be cancelled from the Alias Registry if it:

• reports cessation of activity;
• stops providing the service of sending messages with aliases during the established inactivity period;
• has been cancelled from the Operators Registry;
• fails to comply with blocking obligations;
• blocks outside the cases provided for;
• incurs breaches that justify deregistration after the corresponding procedure.

Cancellation of a registered provider means that it cannot participate in the origination, transit, or termination of messages with aliases.

If a registered originating provider stops serving a holder, it must inform the affected holders and the CNMC with the required advance notice so that another registered originating provider may be authorized. If the alias is left without a registered originating provider and no replacement is appointed, the alias may be cancelled.

20. Obligations of registered providers

Registered providers must apply blocking according to their role within the messaging chain.

Obligations of the registered originating provider

It must block:

• messages with unregistered aliases;
• messages with registered aliases that do not correspond to the registered holder;
• messages with registered aliases for which it is not authorized as registered originating provider;
• messages not sent from a third party authorized by the holder when a third party is involved;
• messages intended to be sent to unregistered providers.

It must also send messages with registered aliases only to other registered providers acting in transit or termination.

Obligations of the transit provider

It must block:

• messages with unregistered aliases;
• messages with registered aliases received from unregistered providers;
• messages with registered aliases that have a single authorized registered originating provider when that registered originating provider receives them in transit from another registered provider;
• messages that cannot continue through a chain made up of registered providers.

It must also send messages with registered aliases only to other registered providers acting in transit or termination.

Obligations of the termination provider

It must block:

• messages with unregistered aliases;
• messages with registered aliases received from unregistered providers;
• messages with registered aliases that have a single authorized registered originating provider when that registered originating provider receives them in termination from another registered provider;
• messages from foreign companies with an unregistered alias received through an international interface, except in applicable roaming cases.

The termination provider must deliver messages with aliases only when the Registry information and the technical chain allow the traffic to be considered valid.

21. Messages from abroad

Messages with aliases received from abroad through an international interface are subject to specific rules.

A message received from abroad with a Spanish alias must be blocked, unless an international roaming case applies.

A message received from abroad with an unregistered foreign-company alias must be blocked when addressed to a Spanish number, except when the mobile operator can validate that the recipient subscriber is roaming.

When the mobile operator validates that its subscriber is roaming and receives an unregistered alias through an international interface, it must replace the alias with NO VALIDADO.

The rule seeks to balance two objectives:

• prevent international traffic from being used to circumvent the Registry;
• avoid improperly blocking legitimate roaming messaging.

22. Aliases of foreign companies

Foreign companies that want to send SMS, MMS, or RCS messages with aliases to customers with Spanish numbers must register those aliases when the recipients are not roaming outside Spain.

General rule

The foreign company must register the alias under the same general regime applicable to all other holders:

• it must prove a legitimate link with the alias;
• it must comply with the format rules;
• it must designate at least one registered originating provider;
• it must identify representatives and, where applicable, third parties;
• it must be subject to the rules on modification, suspension, and cancellation;
• it must use a transmission chain made up of registered providers.

Transmission chain

The transmission of messages with aliases from foreign companies must be carried out exclusively through providers registered in the Alias Registry, including origination, transit, and termination, so that the messages may be validly delivered to recipients with Spanish numbers.

If the foreign company uses unregistered or unauthorized providers, the messages must be blocked.

Authorized representative

When the legal representatives of a foreign company cannot obtain a valid digital certificate to act in Spain, the company may grant a letter of authorization in favor of an authorized representative.

The authorization must be duly signed, either by handwritten signature or by other signature methods accepted in the foreign company's country of origin, and must follow the model published by the CNMC.

The authorized representative must have a valid digital certificate to act in Spain.

In this case:

• all interactions with the Registry must be carried out or approved by the authorized representative;
• the authorized representative is responsible for the truthfulness of the authorization;
• the authorized representative is responsible for the integrity of the authorization;
• the authorized representative is responsible for the validity of the authorization;
• the authorized representative is responsible for the actions carried out on behalf of the foreign company.

Foreign companies without economic activity in Spain

The system must allow foreign companies with no economic activity in Spain, but with customers with Spanish numbers, to register aliases without being blocked by an impossible or disproportionate formal requirement.

The functional solution is to allow action through an authorized representative with a valid digital certificate for Spain, while maintaining equivalent guarantees of security and traceability.

International recognition

The CNMC may enter into bilateral agreements recognizing aliases registered in equivalent registries in other countries. Until an applicable recognition mechanism exists, the foreign company must follow the Spanish Registry registration procedure to send messages with aliases to Spanish numbers within the regulated scope.

Expected operational outcome

For a foreign company, the correct outcome is as follows:

1. alias registered in the Spanish Registry or recognized by an applicable bilateral mechanism;
2. foreign holder correctly identified;
3. legal representative or authorized representative operational;
4. legitimate linkage proven;
5. registered originating provider authorized;
6. third parties identified and authorized, if any;
7. transmission chain made up of registered providers;
8. possibility of automatic blocking when traffic does not meet the previous conditions.

23. Access to the Registry database

The Registry must have a public portal allowing consultation of active aliases, their holders, and basic activation information.

Registered providers access the information necessary to comply with their obligations through an authenticated API using credentials provided by the CNMC.

Registered originating providers must be able to consult:

• all registered and active aliases;
• the aliases for which they are authorized;
• whether, for a specific alias, they are the only registered originating provider or whether there are several;
• all registered providers entered in the Registry.

Other registered providers must be able to consult:

• all registered and active aliases;
• all registered providers entered in the Registry.

This information is necessary for each provider to decide whether to allow or block the message according to its position in the chain.

24. Bulk alias upload

The system provides for the possibility of bulk uploading aliases in use by registered originating providers.

Bulk upload allows multiple aliases to be submitted through a structured file, which is especially useful when a provider manages large volumes of existing aliases.

Key rules:

• only registered originating providers authorized to do so may carry it out;
• the included aliases must comply with the format rules;
• the CNMC may automatically exclude aliases contrary to the format rules;
• the provider performing the upload is responsible for the accuracy, integrity, and truthfulness of the information submitted;
• holders must confirm the link with the alias and their relationship with the provider that pre-registered them;
• after holder confirmation and CNMC validation, the alias is registered;
• the CNMC may enable new bulk upload periods when it considers this necessary through the corresponding decision.

Bulk upload does not eliminate the substantive registration requirements. It is a simplified operational mechanism, not an exception to legitimate linkage, format, or holder authorization.

25. Test environment and technical adaptation

Registered providers must adapt their systems to interact with the Alias Registry, download applicable information, and execute the corresponding blocking.

The test environment allows verification of:

• download of active aliases;
• download of registered providers;
• download of aliases authorized for a registered originating provider;
• authentication through credentials;
• integration with internal routing, filtering, and blocking systems;
• traceability of blocking decisions;
• generation of statistical data.

The CNMC may extend or enable new test periods when necessary to guarantee orderly technical implementation.

26. Rules applicable to RCS

RCS aliases must be reported with the information necessary to identify:

• holder;
• tax identification or equivalent;
• legal or authorized representatives;
• contact details;
• registered originating provider, where applicable;
• legitimate linkage;
• format and use conditions.

Registered providers must have access to the Registry database in order to comply with blocking obligations also for RCS.

For matters not specific to RCS, the general Registry rules apply.

27. Information retention and statistics

Registered providers must retain daily information on blocked and unblocked messages with aliases, together with the source of the traffic and the reasons for blocking.

The information must identify, at a minimum:

• covered period;
• registered provider;
• provider identification;
• message source;
• alias;
• message type;
• blocking reason;
• volume of blocked messages;
• volume of unblocked messages;
• relevant observations.

Blocking reasons that must be recordable:

• unregistered alias;
• registered alias that does not correspond to the registered holder;
• registered originating provider not authorized;
• sending from an unauthorized third party;
• receipt from an unregistered provider;
• traffic incompatible with the applicable rule when only one registered originating provider is authorized;
• unregistered foreign-company alias received through an international interface without an applicable roaming case.

Statistics are submitted annually and in accordance with the technical format determined by the CNMC.

28. Registry communications

The CNMC must notify the affected parties of the results of actions carried out in the Registry.

Communications may refer to:

• alias registration;
• modification;
• suspension;
• reactivation;
• cancellation;
• registration or removal of authorized providers;
• pending authorizations;
• registration or cancellation of registered providers;
• changes affecting holders, providers, or third parties.

When a request is submitted on behalf of the holder, the communication must be addressed both to the holder and to the applicant acting on the holder's behalf.

29. Costs

The maintenance and system adaptation costs of messaging service providers that must interact with the Registry are borne by the registered providers required to block.

The costs of establishing, maintaining, and managing the Registry's technical solution are borne by the CNMC.

30. Disputes and supervision

Alias holders have the status of interested parties in dispute-resolution procedures that affect them.

They may request CNMC intervention when they consider their rights to have been infringed or obligations to have been breached by messaging service providers.

Failure to comply with Registry obligations may give rise to the sanctioning measures provided for in sectoral telecommunications regulations.

31. Data protection

The processing of personal data associated with the Registry must be carried out in accordance with the applicable data protection regulations.

This especially affects:

• data of legal representatives;
• data of authorized representatives;
• data of self-employed persons or natural-person holders;
• third-party data;
• contact details used for notifications;
• activity records linked to administrative actions.

The system must guarantee lawfulness, minimization, traceability, security, confidentiality, and the exercise of rights by data subjects.

32. Final outcome to be achieved

The final operational objective is to have an ecosystem in which no message with an alias addressed to Spanish numbers can circulate opaquely.

To that end, the Registry must allow:

• each alias to be identified;
• each alias to have a legitimate holder;
• each holder to have declared or proven its right of use;
• each alias to comply with the format rules;
• each registered originating provider to be authorized;
• each third party to be authorized;
• each foreign company to have a practicable registration route;
• each registered provider to download the necessary information;
• each provider to automatically block irregular traffic;
• each block to be statistically justifiable;
• each dispute to be escalated to the CNMC;
• each improper use to be capable of triggering suspension, cancellation, or sanction.

33. Checklist for holders

Before sending messages with an alias, the holder must verify that:

• the alias complies with the format rules;
• the alias is not generic, offensive, confusing, or impersonating;
• there is a legitimate link with a trademark, trade name, corporate name, domain, public registry, or habitual professional use;
• supporting documentation is retained;
• the corresponding responsible declaration has been signed or accepted;
• at least one registered originating provider has been designated;
• third parties, if any, have been identified;
• legal or authorized representatives can approve actions;
• the alias appears registered and active;
• any relevant change is communicated through a modification;
• the alias is not used outside the registered conditions.

34. Checklist for registered originating providers

Before originating messages with an alias, the registered originating provider must verify that it:

• is registered as a registered provider;
• appears authorized for the specific alias;
• the alias is active;
• the alias corresponds to the registered holder;
• the third party involved, if any, is authorized;
• the next provider in the chain is registered;
• its systems consult the Registry database;
• its systems block unregistered or improperly authorized aliases;
• it retains daily traceability of blocks and allowed traffic;
• it can submit statistics in the required format.

35. Checklist for transit providers

Before forwarding messages with an alias, the transit provider must verify that:

• it is registered as a registered provider;
• the alias is active;
• the message comes from a registered provider;
• the applicable rule for aliases with a single authorized registered originating provider is not breached;
• the next provider in the chain is registered;
• the message is blocked if any of those conditions fails;
• the block is recorded with an identifiable reason.

36. Checklist for termination providers

Before delivering messages with an alias, the termination provider must verify that:

• it is registered as a registered provider;
• the alias is active;
• the message comes from a registered provider;
• the chain does not breach the applicable rule for aliases with a single authorized registered originating provider;
• the message does not improperly come from an international interface;
• in international traffic, roaming is validated when relevant;
• if the roaming exception with an unregistered alias applies, the sender is replaced with NO VALIDADO;
• if the exception does not apply, the message is blocked;
• the block or delivery is traceable.

37. Checklist for foreign companies

A foreign company that wants to send SMS, MMS, or RCS messages with an alias to Spanish numbers must verify that:

• the alias is registered in the Spanish Registry or is covered by an applicable bilateral recognition;
• the company can prove legitimate linkage with the alias;
• the alias complies with the format rules;
• a registered originating provider is designated;
• the entire messaging chain uses registered providers;
• a legal representative with a valid certificate or an authorized representative is identified;
• if an authorized representative is used, there is a signed letter of authorization in accordance with the CNMC model;
• the authorized representative has a valid digital certificate to act in Spain;
• all actions before the Registry are carried out or approved by the authorized representative;
• operational third parties are identified and authorized;
• traffic is not sent through international routes to circumvent the Registry;
• the handling of roaming cases has been planned.

38. Recommended design principle for technical implementation

A provider's internal system should treat the Registry as the source of truth for deciding whether a message with an alias may circulate.

The routing decision should evaluate, at a minimum:

1. whether the sender is an alias or a number;
2. whether the recipient is a Spanish number;
3. whether the alias is registered and active;
4. whether the originating provider is authorized;
5. whether the previous provider is registered;
6. whether the next provider is registered;
7. whether an authorized third party is involved;
8. whether the message comes from an international interface;
9. whether the recipient is roaming when the exception is relevant;
10. whether delivery, blocking, or replacement with NO VALIDADO is appropriate.

Each decision must produce a traceable result: allowed, blocked, or delivered with the alias replaced in the applicable exceptional case.

39. Conclusion

The Alias Registry creates a trust model for business and administrative messaging based on aliases. Its function is not only to store sender names, but to link each alias to a legitimate holder, a chain of authorized providers, and technical blocking rules.

The final operational version must address the following in an integrated manner:

• prior registration of aliases;
• validation of legitimate linkage;
• strict format rules;
• express authorization of registered originating providers;
• control of third parties;
• technical access by providers to the Registry;
• blocking of irregular traffic;
• specific handling of foreign companies;
• authorized representative for foreign holders that cannot operate with a Spanish digital certificate;
• bulk upload capacity and test environments when necessary;
• supervision, statistics, and dispute resolution.

The desired result is verifiable, traceable, and impersonation-resistant messaging with aliases, without preventing legitimate traffic from companies, public authorities, and foreign entities that comply with the Registry rules.