1. Regulatory focus
The UK’s July 2026 guidance shifts enforcement from message content alone to the underlying hardware chain. Under sections 151 to 153 of the Crime and Policing Act 2026, both possession and supply are captured: a device can qualify as a SIM farm if it can use five or more physical SIM cards simultaneously or interchangeably to make calls or send or receive messages tied to national or international numbering plans. The Act received Royal Assent on 29 April 2026, and the six-month transition means the offences move into live operational relevance on 29 October 2026.
2. Business impact
The real impact is on how companies document legitimacy across procurement, testing, and operations. Hardware sellers, distributors, labs, and communications network operators may still have lawful use cases, but multi-SIM devices can no longer be handled like ordinary stock. Suppliers must be able to show the reasonable steps taken to verify the recipient’s intended use and must keep records including the date of supply, device description, recipient identity, address, and verification steps. For teams using local SIM pools for OTP delivery, route testing, failover, or diagnostics, informal arrangements and undocumented deployments become materially riskier.
3. Operating recommendations
Do not wait until October to retrofit evidence. Create an inventory of all UK-linked multi-SIM devices and map each one to a documented lawful purpose such as broadcasting, transport monitoring, or operation of an electronic communications network. Update reseller contracts, customer due diligence forms, shipment approvals, and asset return workflows so they capture recipient identity, use case, install location, number source, and retention periods. If your UK stack still relies on SIM pools, SMS gateways, or local OTP backup hardware, start designing an alternative architecture now so one device class does not become a service continuity bottleneck when enforcement begins.