DoT Mandates SIM Binding For WhatsApp, Telegram

SUMMARY

Under the new rules, online messaging platforms must ensure users can only access services on devices with the SIM card originally used for registration

These platforms have 90 days to implement technical changes, with compliance reporting due within four months

The initiative is positioned as a response to rising telecom-related cyber frauds

The Department of Telecommunications (DoT) has directed online messaging platforms to enforce mandatory SIM binding for all users, a move which will affect Meta-owned WhatsApp, Telegram, Signal, ShareChat, Snapchat, JioChat, Josh, and Zoho’s Arattai.

Under the new Telecommunication Cybersecurity Amendment Rules, 2025, which became effective in October, platforms must ensure users can only access services on devices with the SIM card originally used for registration.

According to a report by The Indian Express, companies have 90 days to implement technical changes, with compliance reporting due within four months.

“… it has come to the notice of the Central Government that some of the app-based communication services that are utilising mobile numbers for identification of its customers… allow users to consume their services without availability of the underlying SIM within the device… posing challenge to telecom cyber security as it is being misused from outside the country to commit cyber-frauds,” the DoT said in a notice to companies such as WhatsApp, Telegram, Signal, Arattai, Snapchat, Sharechat, JioChat, and Josh.

The sweeping directive also mandates that companion web or desktop versions of these platforms, such as WhatsApp Web, must log users out at intervals not exceeding six hours. This measure specifically curbs the ability to maintain persistent sessions across multiple devices or geographies, a key convenience feature for consumers and businesses alike.

The DoT recently amended the Telecommunication Cyber Security (TCS) Rules to add ‘Telecommunication Identifier User Entity’ (TIUE) category, expanding telecom regulations to include messaging and social platforms that identify users via mobile numbers.

The initiative is positioned as a response to rising telecom-related cyber frauds, where bad actors exploit number portability, cross-border SIM swaps, and weak multi-device authentication.

This comes almost a year after telecom operators demanded bringing call and messaging apps like WhatsApp, Signal and Telegram under the new Telecommunication Act’s licencing framework.

However, enforcing SIM binding may disrupt legitimate usage patterns, particularly for users traveling abroad or accessing messaging platforms across several devices. The six-hour logout rule for web-based access is expected to introduce friction, especially for professional or enterprise communication workflows.

The change in directives will impact India’s messaging app ecosystem which is ruled by WhatsApp, which has about 500 Mn users in India.