Introduction

The Nigerian Communications Commission (NCC) recently unveiled its Draft Licensing Framework (the “Framework”) for International Application-to-Person (A2P) Messaging. This development underscores Nigeria’s commitment to establishing a regulated ecosystem for digital communications in line with global trends.

A2P messaging enables Over-The-Top (OTT) service providers communicate directly with their customers via Short Message Service (SMS) transmitted over mobile networks and reaching recipients via their cellular connection. Unlike Person-to-Person (P2P) messaging, which facilitates communication between individuals, A2P messaging is largely used for automated business communications such as OTPs (one-time passwords), alerts, notifications, and promotional & marketing messages. An example is an OTP received as an added layer of security when you need to login to your Netflix or Facebook account.

Given the increasing reliance on OTT services provided by service providers domiciled outside Nigeria, particularly in the banking, social media and e-commerce spaces, international A2P messaging has become important for seamless business operations and security purposes.

However, the absence of a regulatory framework in Nigeria has raised concerns in recent times, including the use of unknown or unsecured technologies used by Local Mobile Network Operators (MNOs) to independently monetise international A2P SMS traffic, inconsistent termination rates set by individual operators, spam messages, fraud, and revenue leakage due to its unregulated nature has prompted the need for the NCC to regulate the ecosystem.

This article provides an overview of the NCC’s draft Framework and recommendations to be considered.

Overview of the Draft Licencing Framework

Licence Centralisation and Limitation

The Framework aims to centralise the A2P ecosystem by establishing a single A2P messaging platform through which all A2P messaging traffic in Nigeria will be routed. Additionally, the NCC proposes the introduction of an International SMS Aggregator Licence (the “Licence”) at a fee of N10, 000, 000 (Ten Million Naira) for a five (5) year tenure, renewable upon expiration.

In response to this some stakeholders have called for the introduction of a regulatory levy on A2P SMS instead of the creation of a central aggregator, together with a transparent reporting framework to ensure the NCC achieves visibility, these concerns mostly stem from the monopolistic tendencies that could be fostered by the utilisation of a single platform. Whilst this could be a valid concern, the Framework indicates that, International A2P messaging services will operate within a competitive market and that the NCC will also have the prerogative to issue additional licences if it is determined that the level of competition in the market is insufficient to promote fair practices and ensure optimal service delivery.

Some of the limitations imposed on the use of the licence include:

• Licencees will not provide telecommunication services such as transmission networks, switches, external fibre links;
• Licensees are restricted to offering only services within scope of the Licence, excluding activities that contradict its conditions or provisions of the Act; and
• The Licence does not qualify the licencee for the assignment of International Signalling Point Code (ISPC) and National Numbering Code[1].

Partnerships and Compliance Obligation

The Framework mandates local MNOs to integrate their systems to the unified A2P platform to enable the NCC’s oversight and consequently curb fraudulent practices within the ecosystem. Another key highlight of the Framework is the obligation placed on licencees to comply with the specific conditions listed in the Framework[2], Nigerian Data Protection Act, consumer protection laws and other relevant NCC regulations. This highlights the NCC’s focus on safeguarding consumer privacy and ensuring regulatory compliance.

Security Protocol

The NCC’s intention to develop the Framework and regulate the A2P ecosystem is laudable as, the Framework incorporates robust security measures to protect consumers from spam messages, fraudulent schemes and data breaches that have plagued the space. To tackle unauthorised system access and spam messages on consumers, Licensees are required to implement systems for fraud detection, data protection, encryption protocols and continuous security monitoring. For instance, in Libya, Vox Limited, an international A2P Service Provider implemented a security protocol that identifies, predict and mitigates fraud across a single omnichannel system.

Standardised Tariff and Revenue Generation

To ensure fairness and address the inconsistencies in the termination rates, the NCC proposes a standardised termination rate for international A2P SMS traffic. Specifically, the framework intends to introduce and enforce a structured rate to govern the pricing of International A2P SMS services. In addition, the Framework creates a new revenue stream for the Federal Government of Nigeria through the collection of levies and remittance of taxes on International A2P SMS traffic.

Recommendations

Notwithstanding the above and while the Framework is commendable, we have highlighted below certain recommendations to be considered.

Definition of Key Stakeholders

Although the Framework defines some terminologies, it lacks a comprehensive section that lists and defines the roles and responsibilities of key stakeholders such as Service Provider, Message Provider etc. We recommend a section in the Framework that lists, defines and highlights the roles and responsibilities of key stakeholders.

Also, the Framework appeared to have missed out on provisions for audits or mandatory reports to ensure compliance and accountability among licensees. We recommend the expansion of the NCC’s role in auditing compliance, monitoring quality of service and ensuring international operators comply with local laws.

Access Management

Given the requirement for service providers to route their A2P SMS traffic through a central hub, there is a need for a role-based authorisation, such that only authorised personnel can access the sensitive parts of the system. We recommend that the Framework should clarify and specify whether role-based access control will be enforced or if operators will develop their own security protocols.

Industry stakeholders have also expressed concerns around the utilisation of a central hub, particularly as routing through a centralized platform may introduce additional latency, impacting time-sensitive messages such as OTPs and transactional alerts and ultimately could lead to poor user experiences and dissatisfaction.

There are also concerns around the increased exposure to data breaches and non-compliance with privacy requirements where A2P messaging will be required to be routed through the central hub.

Implementation Timeline

The mandatory routing of A2P traffic through a central hub in crucial, however, a phased implementation timeline might be more practical and would allow operators to adapt to their systems accordingly. This would certainly provide clarity on the approach brands and Over-The-Top (OTT) service providers route their A2P SMS traffic particularly for operators who may need to re-engineer their systems.

Conclusion

It is crucial for enterprises and the broader industry to understand the evolving A2P messaging market. From a qualitative perspective, the Framework for International A2P messaging marks a progressive step in Nigeria’s telecommunications sector, offering a balance between consumer protection and industry growth. Evaluating how enterprises currently utilize A2P SMS to engage with customers and employees is vital.

While the Framework presents areas for improvement, it provides an invaluable opportunity for stakeholders to review and offer comprehensive feedback during the consultation period. By doing so, they can contribute to shaping a robust and progressive standard for the industry. The NCC is currently engaging the general public on the Framework and has encouraged critical stakeholders to submit comments and feedback.

[1] International Signalling Point Code and National Numbering Plan are used to identify specific points within the network for routing and signalling purposes.

[2] Section 4.6 of the Framework.