See Full Document Text
URd qraar farrarre wit xeor a
TELECOM REGULATORY AUTHORITY OF INDIA —
UNd UHI / Government of India TRAI
August 20, 2024
DIRECTION
Subject: Direction under section 13, read with sub clauses (i) and (v) of clause (b) of sub-
section (1) of section 11, of the Telecom Regulatory Authority of India Act, 1997
(24 of 1997) regarding measures to curb misuse of Headers and Content
Templates under Telecom Commercial Communications Customer Preference
Regulations, 2018 (6 of 2018)
F.No. D-27/1/(2)/2024-QoS (E-13563) - Whereas the Telecom Regulatory Authority of India
(hereinafter referred as the “Authority”), established under sub-section (1) of section 3 of the
Telecom Regulatory Authority of India Act, 1997 (24 of 1997) (hereinafter referred to as
“TRAI Act’), has been entrusted with discharge of certain functions, inter alia, to regulate the
telecommunication services; ensure technical compatibility and effective inter-connection
between different service providers; lay-down the standards of quality of service to be provided
by the service providers and ensure the quality of service and conduct the periodical survey of
such services provided by the service providers so as to protect the interest of the consumers
of telecommunication service;
2. And whereas the Authority, in exercise of the powers conferred upon it under section
36, read with sub-clause (v) of clause (b) and clause (c) of sub-section (1) of section 11, of the
TRAI Act, made the Telecom Commercial Communications Customer Preference Regulations,
2018 (6 of 2018) dated the 19" July, 2018 (hereinafter referred to as the “regulations”), to
regulate unsolicited commercial communications;
2. And whereas regulation 17 of the regulations provides that the Authority may direct
Access Providers to make changes, at any time, in the Code of Practice (hereinafter referred to
as “CoPs”) and Access Providers shall incorporate such changes and submit revised CoPs
all within fifteen days from the date of direction issued in this regard;
Page 1 of5
acd os tex, crew (Ae 8 waa aa), Ait wR, aE fect-110029
World Trade Center, Tower-F, (4" to 7" Floors), Nauroji Nagar, New Delhi-110029
Tel. : 011-20907752 / www.trai.gov.in4, And whereas the Authority, vide Direction No. RG-25/(6)/2022-QoS dated 16"
February, 2023, directed the Access Providers to, infer alia, ensure re-verification of all
Headers registered on DLT platform within thirty days from the date of issue of the direction
and blocking of unverified headers; ensure re-verification of all Content Templates within sixty
days of issue of the direction and blocking of unverified templates; and comply with the
direction and forward updated status on actions taken, including updating of CoPs, within thirty
days from date of issue of the said direction;
5. And whereas the Authority, vide Direction No. RG-25/(6)/2022-QoS dated 12" May,
2023, in continuation of the direction dated 16" February 2023, referred to in para 4 above,
directed all the Access Providers to, inter alia, ensure the use of only whitelisted URLs/ Apks/
OTT links/ call back numbers in the content template; ensure that, in case of an URL containing
both fixed and variable parts, the fixed part of URL is whitelisted; to monitor the use of Content
Templates and stop their misuse; and update the Code of Practice accordingly within fifteen
days and furnish compliance report of the direction within forty five days from date of issue of
the said direction;
6. And whereas the Authority, vide another Direction No. RG-25/(6)/2022-QoS dated
16th February, 2023, directed all the Access Providers to, inter alia, ensure traceability of
messages from Principal Entity (PE) to the recipient at all times in all modes of transmission
by obtaining from the PE the complete chain of the telemarketers engaged by such PE,
including the registered telemarketers used in the chain between PE and OAP, for transmission
for each message; reject all messages where the chain of TMs is not defined or does not match:
and bar all telemarketers, who are not registered on Distributed Ledger Technologies
(hereinafter referred to as "DLT") platform from handling the content template, scrubbing and
delivery of messages to Access Provider:
7. And whereas the Authority, vide Direction No, M-5/11/(1)/2022-QoS dated 4" May
2024 directed all the Access Providers to, inter alia, implement Distributed Ledger Technology
(DLT) based Voice Solution for 140 level numbering series as per the regulations, including
migration of telemarketers from existing platform and updating Codes of Practice, within 60
days from the date of issue of the said direction;
wr
yer
Page 2 of 58. And whereas, to facilitate discussion and to ensure expeditious implementation/
compliance of the directions issued by the Authority —
(a) meetings were held between the Authority and the Access Providers on 15" June
2023, 034 July 2023, 21% July 2023, 26'" September 2023, 29" November 2023,
05" January 2024, 03" April 2024, 04'" May 2024, and 08" August 2024;
(b) the Authority, vide letter dated 22"! March 2024, directed the Access Providers to
resolve/ set right all cases of resembling/ look-alike Headers latest by 30" June
2024;
(c) six working groups were formed on 10" April 2024, comprising of technical team
members from each Access Providers, and meetings were convened by the
Authority on 18" April 2024, 19"" April 2024, 26" April 2024, 02" May 2024, 04%
May 2024, 16'" May 2024, 17"" May 2024, 29" May 2024, 08"" June 2024, 22"4 June
2024, 27" June 2024, and 12" July 2024;
o. And whereas, the Authority has observed that —
(a) the directions referred to in para 4, 5, and 6 above have not been implemented, in
entirety, till date;
(b) many instances of misuse of headers and templates have been reported, however,
Access Providers have not taken effective steps to prevent such misuse and trace
the origination of the traffic when such incidences are reported;
(c) Indian Cyber Crime Coordination Centre (hereinafter referred to as “T4C”) through
its various reports, has brought to the notice of the Authority many cases of misuse
of Entity ID, Header ID, and Content Template ID, and indicated the need to trace
the Telemarketer who had sent messages using the compromised Headers, and
further, I4C has also suggested to ensure traceability of messages by implementing
the Telemarketers and Principal Entities chain binding:
(d) in some cases, there is no correlation among the Entity Name, Headers and Content
Templates, in many instances words like ‘disconnection’, ‘lottery’, ‘OTP’, etc. are
used in the Content Templates which are not related to the business of the Senders
and malicious APKs and URLs have also been found in some messages;
(e) one Content Template has been linked to multiple headers and many similar or
identical Content Templates are registered by the Access Providers;
(f) registration of promotional Content Templates has been carried out in the service/
Ye transactional category;
.
w\ Page 3 of 5(g) some Senders have registered a large number of Headers and Content Templates
and many Content Templates contain a large number of variables,
(h) in some cases, the Sender registers Headers with other Access Provider if any or
all of its Headers are backlisted by an Access Provider;
(i) Access Providers had temporarily blocked Headers which remained unused for a
period of thirty (30) days in the month of October-2023 and November-2023, and
citing technical challenges with DLT platform, sought relaxation for a period of
three months; however, this activity has not been re-started till date; and
(j) Access Providers have not fully implemented Distributed Ledger Technology
(DLT) based voice solution for 140-level numbering series as per the regulations;
10. Now, therefore, the Authority, in exercise of the powers conferred upon it under section
13, read with sub-clauses (i) and (v) of clause (b) of sub-section (1) of section 11, of the
Telecom Regulatory Authority of India Act, 1997 (24 of 1997) and the provisions of the
Telecom Commercial Communications Customer Preference Regulations, 2018 (6 of 2018),
hereby directs all the Access Providers to ensure that —
(a) end-to-end implementation of 140xxx numbering series on DLT platform,
including migration of existing telemarketers and scrubbing of calls as per
regulations, is completed latest by 30" September 2024;
(b) traffic containing URLs/ APKs/ OTT links/ Call back numbers, which are not
whitelisted, is not permitted with effect from 015 September, 2024;
(c) the messages from Principal Entities to the recipients are traceable and, with effect
from 01 November 2024, all messages, where the chain of Telemarketers is not
defined or does not match, are rejected;
(d) whenever misuse of Headers and/ or Content Templates is noticed or reported -
1. traffic from concerned Sender is suspended by all the Access Providers
immediately, till such time the Sender files a complaint/ FIR with the Law
Enforcement Agency for such misuse of its Headers and Content Templates
under the law of land, and the Sender reviews all its Headers and Content
Templates and takes corrective measures as per the regulations to prevent
misuse of its Headers and other credentials;
il. Delivery-Telemarketer identifies the entity that has pushed traffic from such
Headers or Content Templates into the network and files a complaint/ FIR for
ye misusing Headers and Content Templates of other entity with the Law
) a Page 4 of 5Enforcement Agency (LEA), under the law of the land, against such entity
within two business days, failing which the Originating Access Provider
(OAP) files a complaint/ FIR against the concerned Delivery-Telemarketer
and traffic from concerned Delivery-Telemarketer is suspended by all the
Access Providers immediately, till such time a complaint/ FIR is made by the
Delivery-Telemarketer; and the entity that pushed the traffic is blacklisted by
Originating Access Provider as well as all other Access Providers for a period
of one year;
(e) when a complaint is registered due to registration of Content Template in wrong
category, the Content Template is blacklisted by the OAP; and if five Content
Templates of such Sender are blacklisted for registration under wrong category, the
OAP suspends the services of the Sender, for one month or till such time all the
Content Templates of the Sender are reverified, whichever is later;
(f) one Content Template is not linked with more than one Header;
(g) all the Headers and Content Templates registered on DLT comply with the
regulations and directions issued thereunder latest within 30 days of the issue of
this direction;
11. All the Access Providers are directed to comply with the above directions and furnish
to the Authority an updated status on action taken, including updating of CoPs, within fifteen
days from the date of issue of this direction.
Jn td As stshunt
(Jaipal Singh Toma
Advisor (QoS-II)
To
All Access Providers
Page 5 of5