Ofcom’s New Messaging Rules Are Now Live: What UK Businesses Need to Know

Ofcom finalised a significant set of new mobile messaging rules earlier this summer, and they have been in force since July 2026. For UK businesses that send text messages to customers, employees, or suppliers, these rules change what is expected of the messaging services and channels you use. If your business sends customer texts through personal phones, unregistered services, or informal WhatsApp arrangements, you are operating in territory that Ofcom is now actively scrutinising.

The context matters: Ofcom found that 40% of UK mobile users received at least one suspicious message in the previous three months. That scale of fraud is happening because business messaging infrastructure in the UK is fragmented and largely unverified. The new rules are designed to fix that, raising the bar for every business that sends texts to customers.

What Ofcom’s New Rules Actually Require

The rules are directed at mobile operators and aggregators: the platforms and networks that carry business messages. They require:

• Upfront and ongoing due diligence on businesses sending messages through their platforms
• Verification of alphanumeric sender IDs, the company names that appear instead of a phone number in text messages
• Incident management and active blocking of malicious sender IDs, links, and phone numbers
• Investigation and disruption of fraudulent messaging activity at source

The guidance published 15 July 2026 makes clear that both person-to-person and application-to-person (A2P) business messaging services are in scope. This is not a rule about spam. It is a rule about the infrastructure that business messaging runs through, and whether that infrastructure can be trusted.

Why This Matters for Businesses Sending Customer Texts

For businesses working through a registered, verified aggregator, these rules mostly apply at the platform level: the aggregator carries the compliance obligation. But they create an important downstream effect: platforms that cannot meet the due diligence requirements will face pressure to clean up their customer base. Businesses that want reliable, verified messaging need to work with platforms that meet the standard.

For businesses sending texts through personal phones, the situation is different. There is no aggregator, no sender ID registration, and no compliance infrastructure. Messages sent this way sit outside the framework entirely, which means no verified audit trail, no registered business identity, and no systematic process for managing misuse.

That is not technically a direct rule violation in itself. But it signals clearly that the way business messaging is handled in the UK is changing, and informal channels are being left behind.

The Problem With Personal Phone Texting in 2026

Most UK small businesses still have employees texting customers from personal phones. Beyond the regulatory picture, this creates operational problems that matter regardless of compliance:

• Conversation history belongs to the employee, not the business; when they leave, it goes with them
• No shared inbox: other team members cannot step in, and no one has visibility across conversations
• No consistent business identity: customers texting different employees reach different numbers
• No audit trail: for regulated sectors (healthcare, finance, legal, property management), there is no record of business communications conducted on personal devices

Business communication records belong to the business. Personal phone texting is a structural gap in that principle, and Ofcom’s new framework makes the cost of that gap more visible.

What a Compliant Business Messaging Setup Looks Like

Under Ofcom’s new framework, the direction of travel is clear: business messaging should run through a registered, verified platform, one where the aggregator has completed the due diligence the rules now require.

Mobex SMS is a registered business messaging platform. When your business sends texts through Mobex, you have:

• A verified business number, not a personal mobile
• A registered sender identity within the Mobex platform
• Full message history retained in your business account
• A shared team inbox so conversations are not siloed to individual devices

This is the structure Ofcom’s rules are designed to encourage. It is also what makes business messaging operationally sound, regardless of which specific regulations apply to your sector.

WhatsApp, Microsoft Teams, and Mobex: Managing All Your Channels

For UK businesses using WhatsApp with customers, Ofcom’s rules add a further consideration. Personal WhatsApp accounts used for business carry none of the sender verification or audit trail that the new rules require at the aggregator level. And with Meta’s WhatsApp Business API service message pricing set to change again in October 2026, cost pressure is increasing alongside the compliance gap.

The practical alternative is keeping WhatsApp usage within a managed channel. For UK businesses already on Microsoft Teams, that means:

• WhatsApp via Teams integration: managed inside Teams with full conversation records and business-account control
• Mobex SMS alongside Teams: for SMS conversations that need a verified business number and a shared inbox

Combining Microsoft Teams calling (via Operator Connect), Mobex SMS, and managed WhatsApp within Teams gives UK businesses a communications stack that is both operationally effective and aligned with where Ofcom is taking the regulatory framework.

Frequently Asked Questions

Do Ofcom’s new messaging rules apply directly to businesses, or only to mobile operators?

The rules are formally directed at mobile operators and aggregators: the platforms that carry your messages. In practice, businesses that want reliable, verified message delivery need to work through a registered aggregator. Using unregistered services or personal phones bypasses the compliance layer entirely.

Does using WhatsApp for business violate Ofcom’s rules?

Using personal WhatsApp for business communication is not itself a direct rule violation. However, it puts your business outside the verified messaging framework Ofcom is building, with no sender ID registration, no audit trail, and no aggregator-level due diligence. Managed WhatsApp via Microsoft Teams integration or Mobex SMS keeps WhatsApp usage within a verifiable, business-controlled channel.

What is the difference between Mobex SMS and Mobex text messaging?

Mobex SMS is the specific Mobex app for business text messaging. Mobex text messaging refers to the broader service capability. Both give your business a registered number, shared inbox, and full message history; Mobex SMS is the product name; Mobex text messaging is how the service is described more generally.

Can Mobex SMS work alongside our existing Microsoft Teams setup?

Yes. Mobex SMS operates alongside Teams Phone (via Operator Connect or Direct Routing) without replacing it. You keep your existing Teams calling and add business text messaging on the same business numbers; the two work independently and complement each other.

‍

Ofcom’s new rules are a prompt to review how your business handles customer messaging. If personal phones and unregistered WhatsApp are part of your current setup, now is the time to move to a verified platform.

‍