You've built a clean integration. Your code fires the API call, the response says "success," and then nothing arrives. No OTP, no order update. Your customers are staring at blank screens, and you're staring at logs that don't explain anything.
Nine times out of ten, the problem isn't your code. It's SMS API compliance.
In India, every business SMS passes through a strict set of regulatory checks before it reaches a phone. Think of it like airport security: your message needs a valid ID, an approved boarding pass and nothing suspicious in its bag. Miss one step and it gets pulled out of the queue.
This guide covers everything you need to know in 2026: TRAI rules, DLT registration, the 2025 amendment, DPDP consent, and a checklist you can use today.
Why SMS Compliance in India Is Stricter Than Ever
A few years ago, spam SMS was everywhere. Important bank alerts were buried under fake lottery messages and loan offers. Regulators decided enough was enough.
Today, India runs one of the most tightly controlled commercial messaging systems in the world. Every commercial SMS is checked against registered records before delivery. And here's the part many businesses miss: responsibility sits with you, the sender, not just your SMS provider.
Your provider handles the technical routing. But your business registration, your templates and your customers' consent? Those are yours to manage.
The Rulebook: TRAI SMS Regulations 2026 at a Glance
Three frameworks work together here. Let's look at each one.
TCCCPR: The Foundation
The Telecom Commercial Communications Customer Preference Regulations (TCCCPR) were notified by TRAI in July 2018 and came fully into force in February 2019. They define what counts as commercial communication, how consent works and what happens to people who break the rules.
DLT: The Gatekeeper
DLT (Distributed Ledger Technology) is the system that enforces TCCCPR. Telecom operators run DLT platforms that store verified businesses, approved sender IDs and approved message templates. Every commercial SMS is checked against these records in real time. If there's no match, the message is blocked.
The good news? Register on one operator's DLT portal and it covers all networks, because the platforms sync with each other.
DPDP Act: The New Layer
The Digital Personal Data Protection (DPDP) Rules were notified on 14 November 2025. Phone numbers are personal data, so if you collect them for SMS, the DPDP Act applies to you. The rules are coming in stages: Consent Manager provisions start in November 2026, and core duties such as consent notices apply from May 2027.
DLT Registration for SMS API: Step by Step
Before your first API call goes live, you need three things registered. Skip any one of them and your messages won't be delivered.
Step 1: Register as a Principal Entity
Your business registers as a Principal Entity (PE) on an operator's DLT portal, such as Jio, Airtel, Vi or BSNL. You'll need documents like your PAN, GST certificate and business proof. Once approved, you get a unique PE ID. Keep it safe, because you'll need it in every API request.
Step 2: Register Your Header (Sender ID)
Your header is the name customers see, like "MYSHOP." It must relate to your brand. Generic or misleading headers are usually rejected.
Step 3: Register Your Content Templates
Every message you send needs a pre-approved template. Dynamic parts, like names, amounts or OTPs, are marked as variables. You also choose the right category for each template: promotional, service or transactional.
Want the full walkthrough with sample templates? Check out our DLT template approval guide.
What Happens If My SMS Template Doesn't Match DLT?
Your message gets blocked during scrubbing, even if your API returns a success response.
Common causes include:
- An extra space, a changed word or different punctuation compared to the registered text
- A variable value that's longer than allowed
- Sending a message through the wrong header or under the wrong category
- Including a link that wasn't part of the approved template
The fix? Copy your approved template exactly into your code, and only change the variable parts.
What Changed in the TCCCPR Amendment 2025
In February 2025, TRAI notified the Second Amendment to TCCCPR. It's the biggest update in years, and it affects every business that sends SMS.
What Do -P, -S, -T, -G Mean in SMS Headers?
Since 6 May 2025, every business SMS header shows a suffix that tells customers what kind of message it is:
Suffix | Message Type | Example |
|---|---|---|
-P | Promotional | VM-MYSHOP-P |
-S | Service | VM-MYSHOP-S |
-T | Transactional | VM-MYSHOP-T |
-G | Government | VM-GOVTIN-G |
You don't add these yourself. Operators add them automatically based on your template category. That's why choosing the right category matters so much: customers quickly learn to trust "-T" and "-S" messages more than "-P" ones.
Mixed Content Is Now Treated as Promotional
This one catches a lot of marketers. If you add an offer to a transactional message, for example "Your order has shipped! Use code SAVE10 on your next purchase," the whole message counts as promotional. That means promotional rules apply, including the requirement to include an opt-out option.
Keep your transactional messages focused on the transaction only.
Faster Complaints, Tougher Penalties
This is where things get serious:
- Customers can now report spam within 7 days of receiving it (previously 3 days).
- Action against a sender is triggered by 5 complaints in 10 days (previously 10 complaints in 7 days).
- First violation: all outgoing services are barred for 15 days.
- Repeat violations: telecom resources are disconnected across all operators for a year, and the sender is blacklisted.
Picture your OTPs stopping for two weeks because of one careless promotional campaign. That's the real risk.
Compliance Inside Your Code
Compliance isn't only paperwork. It also shows up in every API request you make.
How to Pass Template ID in SMS API?
Most Indian SMS APIs expect DLT details with each request. Field names differ between providers, but a typical request looks like this:
{
"sender": "MYSHOP",
"to": "91XXXXXXXXXX",
"message": "Your OTP for login is 482913. Valid for 10 minutes. - MYSHOP",
"dlt_entity_id": "1201XXXXXXXXXXXXXX",
"dlt_template_id": "1207XXXXXXXXXXXXXX"
}The template ID tells the DLT system which approved template to check your message against. If the ID is wrong or missing, the message is blocked.
Variable Rules Developers Often Miss
- Keep variable values within the length allowed for that template.
- Don't use a variable to insert text that wasn't in the approved template, such as a new link or a phone number.
- Store template IDs in configuration, not hardcoded in several places. When a template changes, you should only need to update it once.
SMS Consent Requirements Under DPDP
TCCCPR already requires customer consent for promotional messages. The DPDP Act adds a second layer on top.
Under the DPDP Rules, consent must be clear and specific. Pre-ticked boxes, bundled permissions and implied consent aren't allowed. Your consent notice should explain what data you're collecting, why you need it, and how customers can withdraw consent.
The smart approach is to build one consent record for every channel. For each customer, store:
- When and where they gave consent (checkout, app sign-up, website form)
- What they agreed to receive (promotions, updates, alerts)
- Any withdrawal of consent, and when it happened
When someone opts out of SMS marketing, that should update across every system automatically. It keeps you compliant with both TCCCPR and DPDP, and it protects your sender reputation.
Sending Abroad? A Quick Word on A2P SMS Compliance in the US
If your app also serves US users, the rules are different. The US has no DLT. Instead, businesses register for 10DLC and follow the TCPA (Telephone Consumer Protection Act).
The stakes are high: TCPA violations carry statutory damages of $500 to $1,500 per message. The FCC's proposed "one-to-one consent" rule was struck down by a US appeals court in January 2025. But the basics still apply: get clear consent, honour opt-outs quickly and keep records.
Your SMS API Compliance Checklist
Pin this somewhere your team will see it:
- ✅ Principal Entity registered on a DLT portal
- ✅ Header registered and matched to your brand
- ✅ Every template approved under the correct category
- ✅ PE ID and template ID sent with every API request
- ✅ No promotional content inside transactional messages
- ✅ Opt-out option included in every promotional message
- ✅ Consent recorded with timestamp and source
- ✅ Opt-outs synced across all channels
- ✅ Delivery reports monitored for DLT-related failures
- ✅ Consent notices updated for DPDP before May 2027
Comparing providers too? Our guide to SMS API pricing per message shows how compliance costs affect your final bill.
Conclusion
SMS API compliance can feel like a maze at first. But once you understand the three frameworks (TCCCPR sets the rules, DLT enforces them, and DPDP protects customer data), it becomes much more manageable. Register properly, keep your templates clean, respect consent, and your messages will keep reaching customers without surprises.
The rules will keep changing, so review your setup every few months. Compliance works better as a regular habit than a one-time project.
FAQs
1. Is DLT registration mandatory for SMS API in India?
Yes. Every business sending commercial SMS to Indian numbers must register its entity, header and templates on a DLT platform. Unregistered messages are blocked at the network level before they reach customers.
2. Does DPDP Act apply to SMS marketing?
Yes. Phone numbers count as personal data under the DPDP Act, so collecting and using them for SMS marketing is covered. Core obligations such as consent notices come into force in May 2027, so now is a good time to update your consent flows.
3. Does WhatsApp need DLT registration?
No. DLT and TCCCPR apply to telecom SMS and voice calls. WhatsApp Business messages run on Meta's platform and follow Meta's own template and opt-in rules instead. Learn more in our guide on SMS vs WhatsApp for business.
4. Who is responsible for SMS compliance: me or my SMS provider?
Both, in different ways. Your provider handles DLT scrubbing and routing, but your business is responsible for registration, template accuracy and customer consent. Complaint-based actions like suspension and blacklisting apply to the sender.
5. How often do SMS compliance rules change in India?
Fairly often. TRAI made major changes in 2025, a further amendment is in consultation, and DPDP obligations roll out through 2027. Check for updates at least every quarter.
Before publishing, replace the image URL and internal links with your real pages, and have your legal or compliance team review the article. It's general information, not legal advice. I can also turn this into a .docx or HTML file if you'd like.
