Notice: The Australian government, through the Australian Communications and Media Authority (ACMA), is rolling out new regulations to crack down on phone scams and protect consumers, known as the Scam Prevention Framework. As part of this effort, Know Your Customer (KYC) requirements for purchasing Australian phone numbers will be updated. Because we are currently awaiting the final requirements from the regulator, these details are subject to change. This article outlines how you can prepare and will be continuously updated as new information becomes available.

Overview

If you have built an A2P communications solution, you will be familiar with Know Your Customer (KYC) data. Originating from the banking industry, KYC is essentially customer information that is required to identify and verify an individual or business that requests to use a service is who they say they are. 

Over the past decade, telecommunication service providers, carriers and regulators around the world have been working hard to create a trusted and verified messaging and voice ecosystem for businesses to engage with consumers. 

A step that the global communications industry is taking to protect consumers, is requiring that their customers submit more substantial KYC information  to become identified and verified as a legitimate user of telecommunication services. Industry is also taking this step in response to global legal and regulatory trends that are significantly strengthening KYC requirements applied to telecommunication providers.

What You Need To Know - Australian regulatory developments  

Under the  Scam Prevention Framework, Australian consumer, financial and telecommunication regulatory authorities are  rolling-out new laws and regulations to collectively crack-down on voice and messaging phone scams that are victimizing consumers.   

As part of Australia’s world-leading effort to reduce harmful financial scams from impacting consumers, new legal obligations will be placed on Australian telecommunication providers (like Twilio) to ensure that their customers meet updated KYC requirements for access to telecommunications services. That includes access to Twilio’s Australian local, mobile, and toll-free numbers.  

The goal of the authorities is for telecommunication service providers (like Twilio) to verify (to new standards) who is using every number.  This goal will help legitimate businesses maintain trust in the deliverability of their communications in Australia, whilst achieving the objective of making it more difficult for bad actors to operate and target consumers with harmful financial scams. 

Note on Timelines

Twilio is phasing in adjustments to its KYC policy for Australian phone numbers in anticipation of Australia's regulatory changes under the Scams Prevention Framework. Final guidelines from regulators have not yet been issued. We’ll update this article as soon as the final guidelines are published.

Twilio’s KYC verification policy for Australian phone numbers 

The document verification policy set-out below reflects our current expectations of KYC standards, but is subject to change when the regulations are settled by the relevant Australian authorities. 

Business Requirements

If you are submitting on behalf of a business, you will need:

• Business Name & Registration Number: As it appears on your commercial registry document. Australian businesses should provide ABN (e.g., 123 456 789) or ACN (e.g., 12 123 456 789) obtainable through the ASIC Portal.
• Proof of Business Identity: Australian businesses must provide the Current Company Extract or Record of Registration for Business which can be obtained through the ASIC Portal. All businesses must provide the long form extract, which includes the officer names and business address.
• Address:  
  • Local Numbers: Must be an address within Australia (not a PO Box).
  • Mobile/Toll-Free: May be located anywhere in the world. 
• Proof of Address: Commercial registry, Utility bill, tax notice, rent receipt, or title deed.
• Authorized Representative Details: Name, government-issued ID/passport, contact email.
• Proof of Authorization: If the Authorized Representative’s name is listed on the Extract as a Director/Officer, no LOA is required. Your extract serves as direct proof. If the Authorized Representative’s name is NOT listed on the Extract, you must upload a Letter of Authorization signed by one of the Directors named on your Extract (e.g., if "John Citizen" is the Director on the Registry document, John must sign the LOA authorizing the named Authorized Representative).
• Whether you’re registering as a Direct Customer or Independent Software Vendor (ISV)
  • If you’re an Independent Software Vendor (ISV), will you assign the Twilio phone numbers to your end customers? (Yes/No)

Individual Requirements

If you are submitting as an individual, you will need:

• Name & Government-issued ID: Passport or ID card for proof of identity.
• Address: 
  • Local & Mobile: Must be an Australian street address (no PO Boxes).
  • Toll-Free: May be located anywhere in the world.
• Proof of Address: Government ID showing the address, Utility bill, tax notice, or document showing the address.
• Website: A public-facing website or verified social media account
• Use Case: Description of use case for phone number
• Email Address: A valid email address

What do impacted customers need to do?

Once the new policy launches, this Twilio Guidelines Page  will be updated with the required KYC information. Once you’ve gathered your documentation, please take the following steps based on which submission method you use to submit an RC Bundle for approval, and assign your long codes to it:

API users:

• Submit the KYC information through the RC API.
  • Follow these instructions to get started with Regulatory Compliance Public Rest APIs
• Once you submit the RC bundles, Twilio will review the details and approve or reject the bundles.
  • If your bundle is rejected, Twilio will share the rejection reason. Review the rejection reason and resubmit your bundle with the appropriate information for approval.
• Once approved, assign your AU long codes to your approved RC Bundle if it is not already; if the phone number already has an approved bundle this step is not required. You’ll use the Update an Incoming Phone Number resource API endpoint and provide the BundleSid in your request.

Console users (Read detailed steps here)

• Submit the KYC information through the Twilio Console.
  • To create a Regulatory Bundle (RC Bundle), navigate to the Phone Numbers > Regulatory Compliance section, then select Bundles to enter and submit the form. This will give Twilio the necessary regulatory compliance details for a phone number. This information ensures the phone number meets the legal requirements of the country or region where it's used.
• Once you submit the RC bundles, Twilio will review the details and approve or reject the bundles.
  • If your bundle is rejected, Twilio will share the rejection reason. Review the rejectionreject reason and resubmit your bundle with the appropriate information for approval.
• Once your bundle is approved, you can assign it to any previously purchased local number that doesn’t already have one: 
  1. Go to the Active numbers page on Twilio Console (Phone Numbers -> Manage -> Active Numbers).
  2. Click on the number you want to update. 
  3. Open the Regulatory Information tab and select the bundle or address you’d like to assign.

 Learn more about assigning bundles to phone numbers.

For ISVs that want to collect information directly from their end customers with a Twilio managed UI, the Compliance Embeddable can help streamline compliance processes. 

Frequently Asked Questions

How long does the review process take?

The review can take up to five business days.

Can I bulk upload this information?

No, we do not have bulk upload capabilities for this information. We recommend you utilize the API for uploading large amounts of data. 

I am getting an error while submitting the KYC details via API or Console. How do I move forward?

Find the error code in Twilio’s Error Code list to resolve the error. If the error persists, reach out to Twilio’s Help Center.

My RC bundle is rejected. What should I do?

Your rejection email will contain the rejection reason. Please review the rejection reason and resubmit the bundle with updated details. We have a helpful guide to walk you through common bundle rejection reasons and how to correct them.