Other A2P SMS regulations

Colombia Targets A2P Traffic Masquerading as P2P

For CPaaS providers, aggregators, and brands sending OTPs, transaction alerts, or customer-service messages to Colombia, the compliance risk now extends beyond template approval. Resolution CRC 8308 requires operators to detect A2P traffic disguised as P2P, including unusual volume, recipient dispersion, mechanical sending patterns, and SIM-farm indicators. The new short-code, Sender ID, and approved-template framework will be introduced through a transition period of up to 12 months, beginning after CRC defines the applicable A2P remuneration.

Published:10/27/2026 Updated:10/27/2026

1. Regulatory focus

On July 30, 2026, CRC Resolution 8308 brought bulk A2P activity carried over E.164 personal numbers into the operator fraud-monitoring framework. Operators must be able to detect unusual outbound volume, highly dispersed recipients, mechanical periodicity, lack of correlated inbound traffic, and geographic or network concentration. Where a line repeatedly exhibits these patterns, the operator may restrict messaging, report the case to CRC, and evaluate contract termination under applicable user-protection procedures.

2. Business impact

For international messaging teams, relying on local long numbers or P2P-priced routes is becoming an unstable cost strategy. OTPs, order notifications, or support callbacks may be classified as disguised A2P when they show fixed-interval bursts, one-way volume, or shared-number behavior across multiple accounts. The future operating model requires A2P traffic to use the appropriate short code, Sender ID, and approved content template, which may affect routing design, pricing, delivery monitoring, and dispute handling.

3. Operating recommendations

Segment Colombia traffic by country, customer, number, and use case, then establish baselines for volume, recipient dispersion, timing intervals, inbound correlation, and shared-number behavior. Do not mix OTP, marketing, and support traffic on the same P2P resources. Confirm the implementation phase, A2P remuneration, and short-code onboarding path with the local operator or aggregator. Preserve routing evidence, template versions, Sender ID ownership records, and documentation used to challenge false positives.

Frequently Asked Questions

Will OTP traffic sent from a local long number automatically be treated as non-compliant?
Not automatically. The key issue is whether the traffic shows automated, bulk behavior rather than the number type alone. Businesses should document the use case, user-trigger relationship, and number ownership, while avoiding predictable bursts, highly dispersed recipients, and shared numbers across customers. Stable application-originated traffic should be migrated to an approved A2P route as the new framework becomes operational.
What signals may operators use to identify disguised A2P traffic?
CRC lists unusual outbound volume, recipient dispersion, mechanical periodicity, lack of correlated inbound traffic, and geographic or network concentration as minimum detection dimensions. Businesses should therefore monitor more than daily volume: maintain rolling trend data, analyze per-number behavior, map account relationships, and track retry activity so potentially risky combinations can be identified before service restrictions occur.
Can businesses postpone channel changes during the 12-month transition?
The transition is not a blanket exemption. The maximum 12-month period starts after the official publication of CRC’s A2P remuneration decision. Existing short codes may continue operating during the transition, but businesses should use the time to complete validator onboarding, Sender ID registration, template preparation, and technical testing. After the transition expires, A2P traffic must use the new short-code framework.
This article is for informational purposes only and does not constitute legal advice.

Related products

Need compliance guidance?

Contact us for guidance on target markets, message scenarios, and sending routes.

Get in Touch
Privacy Policy