Mexico SMS Guide: Sender IDs & REPEP

At a glance

A quick operational read on Mexico. Anything marked route-dependent is set by the supplier and operator path your traffic uses, and is confirmed during route assessment.

SMS to mobile: Supported
National number format: Ten digits nationally; E.164 as +52 followed by the ten national digits, with no extra 1
SenderID presentation: Depends on sender type and route
Registered / pre-arranged alphanumeric senderID: Can be preserved on selected routes and major MNO coverage; unsupported networks or MVNO paths may fall back to a shared shortcode
Dynamic / unregistered alphanumeric senderID: Commonly rewritten to a shared shortcode, or on some paths a local longcode
Domestic and international longcodes: Not reliably preserved on common A2P routes; may be rewritten or rotated
Dedicated shortcode: Available on selected routes; presentation and reply support are route-dependent
Two-way SMS: Available on selected sender types or services; not universal
Number portability: Available — never infer the current operator from the original prefix
Concatenation: Generally supported but senderID- and route-dependent
Marketing: Demonstrable permission as the Flowstates standard, REPEP suppression, opt-out and route validation required
Last reviewed: 1 August 2026

Route-dependent: “Route-dependent” means the behaviour is decided by the supplier and operator path your traffic takes, not by Mexican statute. Two providers can behave differently on the same day, and a route can change its policy. Confirm before launch.

Law, route policy and recommendation

Mexican data and consumer rules, supplier route behaviour and our own operating standard are three different things. Every statement on this page is labelled so the right team can act on it.

Law / regulation
Law and regulation
Binding obligations from Mexican federal legislation and public registries, including the current federal private-sector data law, the federal consumer-protection law, REPEP (Profeco) and REUS (CONDUSEF) for financial-sector marketing. These apply whichever supplier you use.
Carrier or route policy
Carrier or route policy
Rules applied by operators, aggregators or your provider on the specific A2P path your traffic takes — senderID preservation or rewriting, shortcode fallback, two-way availability and concatenation behaviour. Route-dependent and subject to change.
Flowstates recommendation
Flowstates operational recommendation
What we ask customers to do because it protects deliverability and keeps you comfortably inside both the law and route policy. Deliberately stricter than the legal minimum.

Numbering and networks

The basics your validation layer and templates need to get right before the first send.

Law / regulationNumber format
Mexico uses a unified ten-digit national numbering scheme for both fixed and mobile lines. Numbers are written in E.164 as the country code followed by the ten national digits, with no additional prefix digit.
Law / regulationDialling code
Country dialling code +52. Mobile country code 334.
Flowstates recommendationDo not use the former mobile format
The former extra “1” inserted for mobile numbers (the old +521XXXXXXXXXX pattern) must not be used. The correct format is the country code plus the ten national digits, with nothing else inserted.
Law / regulationNumber portability
Mobile number portability has been available in Mexico since 2008, per official IFT/CRT material. Never infer the current operator from the original number prefix.
Carrier or route policyNetworks
The mobile ecosystem to plan for includes Telcel, AT&T/Unefon/WIM, Movistar and a large MVNO ecosystem built on the Altán wholesale network (including brands such as Bait, CFE and OXXO Cel). Operator mapping is resolved at send time against live route data rather than inferred from brand or prefix, and we make no market-share or route-coverage claims here.
Flowstates recommendationValidation
Validate to E.164 and run mobile validation or lookup before sending. Standard A2P SMS routes target mobile numbers and validate out fixed lines, and because fixed and mobile share the same ten-digit national numbering, a format check alone cannot tell you which is which.
Flowstates recommendationPortability handling
Because portability has been active since 2008, resolve the current operator at send time instead of caching an operator against a contact record.

E.164 example

+52 55 1234 5678

Country code 52, then the ten national digits. Do not use the former +52 1 mobile-prefixed format.

SenderID options

Alphanumeric senderIDs are supported in Mexico, but what the recipient actually sees depends on sender type and the selected operator route. Design the message body so it still identifies your brand if the sender is rewritten.

Carrier or route policy

This whole comparison — best for, what the recipient sees and replies — describes carrier or route behaviour on current A2P paths in Mexico, not Mexican statute. It varies by supplier and operator and is confirmed before launch rather than guaranteed universally.

Pre-arranged alphanumeric senderID

Best for: Branded one-way OTP, transactional and approved promotional traffic where the selected routes preserve it
What the recipient sees: The approved brand on supported operator paths, or a shared shortcode on unsupported MNO/MVNO paths
Replies: No

Dynamic or unregistered alphanumeric senderID

Best for: Not a dependable branding option; limited one-way traffic where rewriting is accepted
What the recipient sees: Normally a shared shortcode, and on some paths a local longcode
Replies: No

Domestic or international longcode

Best for: Selected route-specific OTP or local service use cases, not general branded A2P marketing
What the recipient sees: Commonly a rewritten shortcode or a rotated/local longcode rather than the submitted number
Replies: Not assumed — only where the selected service explicitly supports inbound SMS

Dedicated shortcode

Best for: Scale, consistent numeric identity and possible two-way programmes
What the recipient sees: The supported shortcode where preserved by the selected operator path
Replies: Potentially available when explicitly configured

SenderID options
Option	Best for	What the recipient sees	Replies
Pre-arranged alphanumeric senderID	Branded one-way OTP, transactional and approved promotional traffic where the selected routes preserve it	The approved brand on supported operator paths, or a shared shortcode on unsupported MNO/MVNO paths	No
Dynamic or unregistered alphanumeric senderID	Not a dependable branding option; limited one-way traffic where rewriting is accepted	Normally a shared shortcode, and on some paths a local longcode	No
Domestic or international longcode	Selected route-specific OTP or local service use cases, not general branded A2P marketing	Commonly a rewritten shortcode or a rotated/local longcode rather than the submitted number	Not assumed — only where the selected service explicitly supports inbound SMS
Dedicated shortcode	Scale, consistent numeric identity and possible two-way programmes	The supported shortcode where preserved by the selected operator path	Potentially available when explicitly configured

Put the brand and purpose in the message body, because fallback routes may rewrite the sender. Sender presentation is route- and operator-dependent.

What changes by traffic type

Mexico is not one rulebook. The same destination behaves differently depending on the category you send and the route it takes.

OTP / authentication

Suitable on validated high-quality routes.

Flowstates recommendation
Keep the copy purely transactional and short, ideally a single segment — no marketing, no offers, no upsell in a verification message.
Flowstates recommendation
Identify the brand in the message body, because fallback routes may rewrite the senderID.
Flowstates recommendation
No promotional copy in OTP templates.
Flowstates recommendation
Use a branded link domain for any link and avoid ambiguous link text.
Flowstates recommendation
Monitor delivery, latency, completed-verification conversion and per-operator performance, not submitted-versus-delivered counts alone.
Flowstates recommendation
Configure route failover so a degraded path does not become a failed login queue.
Carrier or route policy
Some domestic-longcode routes are limited to OTP traffic. That is route policy, not a statement that every local number can carry general A2P traffic.

Transactional / service

Suitable for alerts, confirmations and account or service updates.

Flowstates recommendation
Identify the brand and state the purpose of the message clearly.
Flowstates recommendation
Use a branded domain for links rather than a public or shared shortener.
Flowstates recommendation
Keep promotional copy out of transactional templates.
Flowstates recommendation
Prefer a single segment where practical, and test concatenation on the chosen senderID and route.
Carrier or route policy
Enable replies only on an explicitly configured two-way service. Inbound handling is not a default on Mexican A2P paths.

Marketing / promotional

Demonstrable opt-in or permission as the Flowstates launch standard, plus REPEP and REUS suppression checks before launch.

Flowstates recommendation
Demonstrable opt-in or permission, timestamped and source-attributed, is the Flowstates standard for every promotional send.
Law / regulation
Mexico's current federal personal-data law requires legitimate, controlled and informed processing, a privacy notice and mechanisms to exercise or revoke applicable rights. This does not mean every processing activity always needs express consent — it depends on the data and context.
Law / regulation
Federal consumer-protection law and REPEP require respecting consumers who object to marketing contact or who are registered in REPEP. REPEP is a registry to consult and suppress against, not an automatic network-level block, so you must ingest it and operationalise suppression yourself.
Flowstates recommendation
Provide a simple, free opt-out and suppress promptly once a recipient asks to stop.
Flowstates recommendation
Support natural Spanish requests such as BAJA, SALIR or CANCELAR. We do not claim any of these is a statutory universal keyword.
Flowstates recommendation
Schedule in recipient-local daytime as our operating recommendation, not an invented statutory sending-hours window.
Flowstates recommendation
Do not use purchased lists.
Law / regulation
Financial-services marketing has a separate CONDUSEF REUS registry regime. Checking REPEP is not sufficient for financial-sector marketing — it needs its own sector-specific review.
Carrier or route policy
Use the agreed promotional route for the campaign; category acceptance is confirmed privately for the selected route rather than published as a general list.

Mexican data law, REPEP and the right to object

Mexico is often summarised as “you need consent”. The actual framework is layered across a federal data law, a federal consumer law, the Profeco REPEP registry and, for financial services, the CONDUSEF REUS registry — and the nuance decides whether a campaign is compliant.

Law / regulation
The current Ley Federal de Protección de Datos Personales en Posesión de los Particulares was issued on 20 March 2025 and took effect on 21 March 2025, replacing the 2010 law, with a further reform in November 2025. This is the current federal private-sector data law.
Law / regulation
It requires legitimate, controlled and informed processing of personal data, and a privacy notice disclosing the relevant purposes and the mechanisms available to exercise or revoke rights. Consent requirements can vary by the type of data and context, and consent can be revoked through the mechanisms the controller sets out. This is not a blanket rule that every transactional SMS needs prior express consent.
Flowstates recommendation
Regardless of what the data law strictly requires for a given case, Flowstates requires timestamped, source-attributed, purpose-specific permission for every promotional SMS send.
Law / regulation
The current Ley Federal de Protección al Consumidor gives consumers the right to demand that providers stop sending them marketing contact, and restricts advertising directed at consumers who have objected or who are listed in the public registry.
Law / regulation
REPEP (Registro Público para Evitar Publicidad) is administered by Profeco for unwanted marketing by telephone calls and text messages. It is a registry that organisations query and suppress against — it is not an automatic carrier-level block, so you must ingest it and operationalise suppression on your own systems.
Law / regulation
Profeco material indicates REPEP registration generally takes effect after 30 calendar days. Flowstates does not treat that as a grace period: we suppress a record as soon as it is ingested rather than waiting out the 30 days.
Flowstates recommendation
A direct opt-out from a recipient must be honoured immediately regardless of whether that recipient also appears in REPEP.
Law / regulation
Profeco's REPEP material also indicates that consent can affect whether marketing to a given consumer is allowed, so REPEP should not be oversimplified into an absolute ban detached from consent and the current consumer relationship. Operationally, require clear evidence before treating any send as an exception to suppression, and get legal review before relying on such an exception.
Law / regulation
Financial institutions face a separate CONDUSEF Registro Público de Usuarios (REUS). Financial-sector marketing must check REUS obligations in addition to the general REPEP and consent rules — REPEP alone is not sufficient for that sector.
Flowstates recommendation
No particular stop keyword is presented here as mandated by Mexican statute, and there is no fixed statutory marketing-hours window in this guide. We support Spanish-language requests such as BAJA, SALIR or CANCELAR because recipients use them, and we recommend recipient-local daytime scheduling as our own operating standard.
Flowstates recommendation
REPEP and REUS are legal registries, not network-level filters. Neither blocks a message automatically at the carrier — suppression is an operational responsibility we and our customers carry out.
Carrier or route policy
Some content or use-case categories require route validation and can be restricted on a given path. That is route policy confirmed per campaign, not a published Mexican statutory category list.
Carrier or route policy
M2M delivery may be best effort on some provider paths. Confirm expectations before you build a machine-to-machine flow on a Mexican A2P route.

Operational compliance checklist

What we expect to see in place before a Mexico route goes live.

Law / regulation
Record the data source, the lawful purpose and the permitted use for every recipient record.
Law / regulation
Provide the applicable privacy notice and retain the version shown to the recipient.
Flowstates recommendation
For promotional sends, retain recipient, timestamp, source, wording or version, purpose and channel permission, and keep that evidence retrievable.
Law / regulation
Check and ingest REPEP before promotional campaigns, refresh suppression on an operationally appropriate cadence, and suppress as soon as a record is ingested.
Flowstates recommendation
Maintain an internal suppression and do-not-disturb list alongside the public registries.
Law / regulation
For financial-services marketing, name the REUS compliance owner and validate that sector-specific workflow separately from the general rules.
Flowstates recommendation
Identify the brand and the purpose of the message in the body.
Flowstates recommendation
Provide an easy, free opt-out supporting BAJA, SALIR and CANCELAR, without claiming any of these is a statutory universal keyword.
Flowstates recommendation
Schedule by recipient-local daytime.
Flowstates recommendation
Do not use purchased lists.
Flowstates recommendation
Classify OTP, transactional and marketing templates before launch, and keep promotional copy out of OTP and transactional messages.
Flowstates recommendation
Use a branded short domain rather than a public or shared URL shortener.
Carrier or route policy
Validate the exact senderID, use case and route before launch.
Carrier or route policy
Confirm category acceptance privately for the selected route before launch, rather than relying on a published national category list.
Flowstates recommendation
Keep template, consent, REPEP/REUS, campaign, suppression and route-approval records.

Encoding and delivery

Spanish copy makes encoding a real cost and delivery question in Mexico, and concatenation support varies by senderID type and route. Test it rather than trusting a generic table.

GSM-7, single segment: 160 characters
GSM-7, concatenated: 153 characters per segment
Unicode / UCS-2, single segment: 70 characters
Unicode / UCS-2, concatenated: 67 characters per segment

Flowstates recommendation
Spanish accents, smart punctuation and formatting copied from a document can change the encoding, which shortens the segment and changes the segment count. Check the encoding your template actually produces.
Carrier or route policy
Concatenation is generally supported in Mexico, but it depends on senderID type and the selected route, so test the actual path before relying on it.
Flowstates recommendation
Recommend single-segment OTP templates and run end-to-end testing across the selected operator routes.
Flowstates recommendation
Normalise to E.164 as +52 55 1234 5678 and validate mobile numbers with lookup before sending — fixed and mobile share the same ten national digits, and portability has been active since 2008, so the original prefix tells you nothing reliable about the current operator. Never use the former +52 1 mobile-prefixed format.

A country guide is only useful when the route follows it.

Knowing Mexico's rules is the easy half. Keeping every send inside them, on supplier routes that change their policy, is the operational half — that is the part we run.

Per-country and per-category routing
OTP, transactional and marketing traffic take different Mexico routes, with the right policy applied to each category.
SenderID management
We manage sender presentation where a route supports it, and design templates for cases where the senderID is rewritten or falls back to a shortcode.
Carrier-grade failover
When a Mexico route degrades, traffic moves before your verification funnel does.
Per-route visibility
Delivery, latency and OTP conversion measured per route and per operator, so a route policy change shows up as data rather than complaints.
24/7 vendor escalation
We chase the supplier and the carrier. You get the update, not the ticket queue.
BYOV / BYOG
Keep your existing supplier and contracts and let us operate the routing, or use ours.
Branded short links
Links on your own domain instead of a shared shortener, which route filters treat very differently.

Developer docs Branded short links

What we need to validate your Mexico route

Send us these and we will come back with the route options, the sender behaviour you should expect and the policy that applies to your category.

Company or legal entity and website
Traffic category and use case
Spanish and English sample templates
Expected monthly volume and peak sending rate
Promotional opt-in or permission journey and evidence
Privacy-notice version and purpose covering the traffic
REPEP suppression process and owner
REUS process and owner, if financial marketing is involved
SenderID preference
Link domains you intend to use
Whether you need replies or two-way messaging
Target launch date

Validate my Mexico route Book a messaging review

Frequently asked questions about SMS in Mexico

Can I send SMS to mobile numbers in Mexico?

A quick operational read on Mexico. Anything marked route-dependent is set by the supplier and operator path your traffic uses, and is confirmed during route assessment. SMS to mobile: Supported. National number format: Ten digits nationally; E.164 as +52 followed by the ten national digits, with no extra 1. SenderID presentation: Depends on sender type and route. Registered / pre-arranged alphanumeric senderID: Can be preserved on selected routes and major MNO coverage; unsupported networks or MVNO paths may fall back to a shared shortcode.

Which sender ID options work for SMS in Mexico?

Alphanumeric senderIDs are supported in Mexico, but what the recipient actually sees depends on sender type and the selected operator route. Pre-arranged alphanumeric senderID — Best for: Branded one-way OTP, transactional and approved promotional traffic where the selected routes preserve it. Dynamic or unregistered alphanumeric senderID — Best for: Not a dependable branding option; limited one-way traffic where rewriting is accepted. Domestic or international longcode — Best for: Selected route-specific OTP or local service use cases, not general branded A2P marketing. Dedicated shortcode — Best for: Scale, consistent numeric identity and possible two-way programmes.

What are the consent and opt-out requirements for SMS in Mexico?

Mexico is often summarised as “you need consent”. The current Ley Federal de Protección de Datos Personales en Posesión de los Particulares was issued on 20 March 2025 and took effect on 21 March 2025, replacing the 2010 law, with a further reform in November 2025. This is the current federal private-sector data law. It requires legitimate, controlled and informed processing of personal data, and a privacy notice disclosing the relevant purposes and the mechanisms available to exercise or revoke rights. Consent requirements can vary by the type of data and context, and consent can be revoked through the mechanisms the controller sets out. This is not a blanket rule that every transactional SMS needs prior express consent. Regardless of what the data law strictly requires for a given case, Flowstates requires timestamped, source-attributed, purpose-specific permission for every promotional SMS send.

How many characters fit in an SMS to Mexico?

Spanish copy makes encoding a real cost and delivery question in Mexico, and concatenation support varies by senderID type and route. GSM-7, single segment: 160 characters. GSM-7, concatenated: 153 characters per segment. Unicode / UCS-2, single segment: 70 characters. Unicode / UCS-2, concatenated: 67 characters per segment.

Sources and change control

Regulator, statute and provider references behind this guide. Provider documentation reflects a supplier's current route policy, not Mexican law — and the regulator prevails where the two conflict.

Provider documentation
Twilio — Mexico SMS guidance
One supplier's current route policy on senderID rewriting, shortcode fallback and reply support.
Regulator (archive)
IFT — ten-digit dialling scheme (archive)
Official material behind the unified ten-digit national numbering scheme, still official for the rules it established even though the material is now archived.
Regulator (archive)
IFT — mobile number portability (archive)
Official portability material confirming portability has been available since 2008.
Statute
Cámara de Diputados — LFPDPPP
Current federal private-sector personal-data law text and reform history.
Statute
Cámara de Diputados — LFPC
Current federal consumer-protection law, including the right to demand cessation of marketing contact.
Regulator
Profeco — REPEP general information
Scope and purpose of the public registry to avoid unwanted advertising by phone and text.
Regulator
Profeco — REPEP frequently asked questions
Source for the approximately 30-calendar-day period after which REPEP registration generally takes effect.
Regulator
Profeco — REPEP privacy and scope
Further scope and privacy detail on how REPEP registration and consultation works.
Regulator
CONDUSEF — REUS overview
Public registry for financial-sector users who do not wish to receive marketing from financial institutions.
Regulation
SIDOF / CONDUSEF — REUS consultation obligations
Obligations on financial institutions to consult REUS before marketing contact.
Regulator
CRT — company lookup platforms
Current regulator platform for looking up telecom companies operating in Mexico.
Statute
Cámara de Diputados — Ley en Materia de Telecomunicaciones y Radiodifusión
Current 2025 telecommunications and broadcasting framework, including the institutional context for the Comisión Reguladora de Telecomunicaciones.

Change log

1 August 2026 — Initial draft; separated Mexican data and consumer-law obligations, REPEP/REUS suppression and live senderID route behaviour.

Last reviewed 1 August 2026

Disclaimer

This is operational guidance, not legal advice. Applicable requirements vary by operator, route, senderID, traffic category, sector and customer configuration. Flowstates confirms the live path during onboarding.

Mexico SMS guide