Your bank's text messages play by new rules: Spain's SMS sender ID registry explained

If you have a Spanish phone number, something changed on 15 September 2026. A text showing a company name as the sender now only reaches you if that name is listed in an official registry run by the CNMC, Spain's markets and competition regulator. If it isn't, your mobile operator blocks it.

Good news — with limits worth understanding.

What changed

A sender ID (or "alias") is the name you see instead of a phone number. Until now, anyone with access to a bulk SMS platform could type whatever name they liked. That's why smishing worked so well: a fake "bank" text landed in the same thread as your bank's real alerts.

Operators must now block messages with unregistered sender IDs, and also registered ones sent through a non-authorised provider. The legal basis is Ministerial Order TDF/149/2025, and the registry procedure is set by CNMC Circular 1/2026.

What it fixes — and what it doesn't

It checks who signs the message and how it's routed. It does not read what the message says. Fraud that no longer fits into a branded SMS moves elsewhere: WhatsApp, email, calls, or texts from plain numbers.

There's also a side effect: if a company hasn't registered its sender ID properly, its genuine alerts may start arriving from an unfamiliar number instead of its name.

Three quick checks

1. Notice whether your bank's alerts still arrive as before. If not, contact your bank through its app or official phone line — never by replying to the text.
2. Check whether your bank's app can send alerts as push notifications, which don't depend on SMS.
3. Don't trust a message just because the sender name looks right.

The registry answers one question: who sent this. Whether it's telling the truth is still up to you to judge.