ID and KYC Requirement for UK Phone Numbers

Privacy
1

Twilio, MySudo and other companies have started requiring identity and address documents and “know your customer” (KYC) checks in order for anyone to obtain and retain access to a UK phone number.

They are claiming that the UK regulator (Ofcom) has introduced new regulations requiring KYC checks for access to a UK phone number. However, it seems pretty clear that Ofcom’s new KYC guidelines apply only to businesses and not to consumers.

Whether this new policy is at the direction of Ofcom or actually a violation of Ofcom’s guidelines, anyone who cares about privacy must make their voice heard. If people don’t object and complain (see below for how), more and more companies might adopt this policy and it may become the accepted norm in the UK and may even spread to the US.

WHICH COMPANIES ARE DOING THIS?

The following companies are forcing ID and KYC checks on anyone who wishes to obtain or retain access to a UK phone number: Twilio, MySudo JustCall, AirCall, SalesMate, GoHighLevel. There may be more and others may soon start.

It is important to note that many, if not all, of the other companies use Twilio for providing their own customers with a UK phone number, and those other companies seem to be claiming that Twilio is forcing them to apply KYC checks on their own consumer customers.

IS OFCOM REALLY REQUIRING KYC FOR UK PHONE NUMBERS?

Twilio and the other companies are claiming that the UK regulator (Ofcom) has introduced new regulations that require KYC checks for access to a UK phone number, including for consumers. However, it seems clear that Ofcom’s new KYC guidelines that they are citing (Good Practice Guide, 15 November 2022) do NOT apply to consumers:

  • “Our new guide sets out clear expectations for providers to make sure they run ‘know your customer’ checks on business customers." (Ofcom website)

  • “The Guide is specifically aimed at business customers…” (Ofcom Statement, section 3.32)

  • “…the Guide does not apply when [UK] numbers are assigned to ‘consumers’…” (Ofcom Guide, page 4, footnote 8).

  • “…it is important that the Guide does not impose unnecessary burdens on individual consumers in gaining access to a [UK] phone number…” (Ofcom Statement, section 3.23).

  • “For the avoidance of doubt…the Guide applies when [UK] numbers are sub-allocated or assigned to business customers.” (Ofcom Statement, section 3.21)

Furthermore, Ofcom suggests which information should be collected from businesses and checked, including a business’s registration details, the nature of the business, contact details of the relevant senior manager, the services provided by the business, details of the owners and directors, details of any holding companies of the business, and much more (Ofcom Guide, sections 3.5 and 3.8). Needless to say, none of these things apply to individual consumers and nowhere in the guidelines does Ofcom suggest collecting copies of consumers’ passports, rent receipts, title deeds or tax notices, as the companies are requiring.

As anyone can see, it’s quite clear that Ofcom’s new KYC guidelines do not apply to individual consumers. The companies that are applying them to consumers are violating and abusing Ofcom’s guidelines and are in fact imposing unjustified burdens on individual consumers in gaining access to a UK phone number. Furthermore, by collecting their sensitive personal data, the companies are exposing consumers to dangerous data breaches and leaks which can lead to cases of account hacking, identity theft, and other crimes.

COMPLAIN TO THE UK REGULATOR (OFCOM)

Ofcom’s online complaints/monitoring form: Monitoring form | Ofcom

Ofcom’s Consumer Contact Team’s email address: OCCtelecoms@ofcom.org.uk

OTHER LINKS

Ofcom Good Practice Guide (15 November 2022):

Ofcom Statement (15 November 2022): https://www.ofcom.org.uk/siteassets/resources/documents/consultations/category-2-6-weeks/232890-good-practice-guide-on-sub-allocated-and-assigned-numbers/associated-documents/statement-good-practice-guide.pdf?v=328766

Twilio - UK KYC webpage: United Kingdom: Regulatory Guidelines | Twilio

MySudo - UK KYC webpage: https://support.mysudo.com/hc/en-us/articles/25412059758747-Why-are-you-asking-for-my-personal-information-when-creating-a-phone-number

JustCall - UK KYC webpage: Documents Required for Purchasing UK Phone Numbers | JustCall Help Center

AirCall - UK KYC webpage: https://support.aircall.io/hc/en-gb/articles/19045329463197-UK-KYC-Regulatory-Requirements

SalesMate - UK KYC webpage: https://support.salesmate.io/hc/en-us/articles/28210866628249-Know-Your-Customer-KYC-in-the-United-Kingdom

GoHighLevel - UK KYC webpage: Know Your Customer (KYC) in the United Kingdom : HighLevel Support Portal

1 Like
2
  1. Responding to incidents of misuse
    5.1 Despite a provider’s commitment to compliance, incidents of misuse of numbers may still occur. Providers should respond proactively to any such incidents. This will help to ensure that where issues do arise, action is taken quickly and the potential for consumer harm is reduced. Where relevant, the guidance in this section applies to incidents of misuse where the number is being used by consumers as well as business customers.

From https://www.ofcom.org.uk/siteassets/resources/documents/consultations/category-2-6-weeks/232890-good-practice-guide-on-sub-allocated-and-assigned-numbers/associated-documents/annex2-good-practice-guide.pdf?v=328768

3

What it basically means is that if a service is being used for abuse, then they can decide to subject every customer to KYC. Twilio and most of the other services you mentioned are primarily aimed at businesses. But also the origin of a lot of spam (look through the consultation documents). So they’ve decided it’s easier for them to subject everyone to KYC.

An actual consumer in the UK won’t be impacted by this.

4

Thanks for the reply.

The part you quote is about investigating and responding to incidents of misuse of a phone number ALREADY IN USE by a specific customer. The rest of that section explains what actions the provider should take against that SPECIFIC CUSTOMER, such as blocking the phone number or suspending the customer’s account, whether it is a business or a consumer.

The sections about requiring KYC checks for OBTAINING ACCESS to a phone number clearly state that they only apply to businesses and not to consumers, as you can see in lines that I quote in my post.

And this is absolutely affecting consumers, albeit a small proportion for now. And as I said, if people don’t object and complain, I suspect that more and more companies will require ID and KYC checks from consumers.

1 Like
5

Thanks, that does seem that way.

But I suggest you read through the consultation documents and responses prior to the publication of the guidelines. You’ll see that the intention is that where a provider is facilitating abuse they bring in measures to stop it. And as these are only guidelines the intention matters more than the wording (thank you common law legal system).

What Twilio et al are in effect now saying, is that they only serve business customers. Meaning everyone is subject to KYC. This is their way of side stepping the issue.

A UK consumer can get a number without KYC very easily, this change doesn’t affect that. It only affects those outside the UK. Who aren’t UK consumers.

6

It’s not only consumers outside the UK that are affected by this right now. There are also UK consumers using Twilio or MySudo for UK phone numbers.

And anyway, if people ignore or tolerate privacy or regulation violations by one or two companies because they currently only affect a small number of people, pretty soon many more companies might adopt the same policies and everyone will be affected.

And if people ignore or tolerate new privacy violating regulatory guidelines because they don’t yet affect themselves, those guidelines may pretty soon expand and become mandatory and affect everyone.

I urge everyone to complain to Ofcom about this ID and KYC requirement for UK phone numbers so that we can nip this in the bud before it spreads to all UK consumers and even to the US.

1 Like