Kenya’s Communications Authority (CA) has proposed a central recycled-number database to help service providers verify whether a mobile number has changed ownership before sending messages to it. The measure aims to close a gap between telecommunications operators, which manage number reassignment, and banks, fintech firms and messaging services that may continue using outdated contact records.
How the recycled-number database will work
The proposal would allow third-party value-added service providers to query a central register to check whether a number has been recycled. Telecommunications operators would submit lists of deactivated and recycled numbers to the regulator every three months to support that verification process. The CA said querying the database would help ensure messages reach the rightful owner when businesses still rely on contact details that were valid at the time of customer registration but have since changed hands.
The mechanism is intended to reduce risks beyond promotional messaging: banks could otherwise send transaction alerts to a number now held by another person, and services that use one-time passwords or SMS-based account recovery might expose authentication messages to unrelated recipients. The database would not automatically remove old numbers from customer profiles or unlink them from financial and online accounts; businesses would still need account-update procedures, secure recovery processes and accurate customer records.
The proposal resembles the United States Federal Communications Commission’s Reassigned Numbers Database and would require clear rules on access, data accuracy and required actions when a number is flagged as recycled.
New safeguards for inactive SIM cards
The recycled-number database is part of broader proposed changes to the management of inactive mobile lines. Under the CA’s plans, a number could become eligible for deactivation after three months without revenue-generating activity, and the subscriber would then have a further three months to reactivate the line before it could be recycled. Operators would be required to give advance notice: 30 days before the relevant period expires they must publish lists of numbers due for deactivation via their websites, national newspapers and other media.
These measures follow a court ruling that raised concerns about recycling inactive numbers without sufficient safeguards, including cases where subscribers cannot maintain activity for reasons beyond their control. The proposals include provisions to address people in custody: the Commissioner-General of Prisons would facilitate exemptions for eligible inmates, including remand prisoners whose circumstances could prevent them from using their SIM cards for extended periods.
Data-handling requirements in the draft rules would expect operators, before reassignment, to delink or archive the previous subscriber’s personal data so a new holder does not inherit access to information associated with the old account. Final rules will need to specify procedures for notifying subscribers, handling exceptions and confirming that information linked to a previous number holder is no longer accessible to the next subscriber.
Implications for banks, fintechs and messaging services
The CA’s proposal affects banks, savings and credit cooperative organisations, mobile money providers, fintech firms and companies that send bulk messages on behalf of businesses. The regulator has proposed that newly issued and recycled numbers be excluded from marketing messages by default, and that operators remove recycled numbers from existing business-to-consumer messaging services where the previous subscriber had opted in.
The CA rejected a proposal for subscribers to notify their contacts by SMS when their numbers change ownership, citing privacy concerns. A central verification mechanism offers an alternative that avoids asking former owners to disclose personal details to contacts or service providers. However, its practical value depends on whether providers check the database before sending sensitive communications and on rules defining what they must do when a number is identified as reassigned.
Organisations may face technical and operational costs to integrate verification checks into messaging, authentication and customer-management systems. Telecommunications operators must maintain accurate reassignment records, and banks and other service providers must decide how often to query the database, which message types require verification, and how to handle numbers identified as recycled. Quarterly reporting, for example, may leave a gap if a number is reassigned before the latest records are available.
What the changes mean for subscribers
For mobile subscribers, longer deactivation periods and advance notices could provide more time to retain or reactivate a number. Restrictions on marketing messages for newly issued and recycled numbers could reduce promotional communications received by people who acquire recycled numbers. Nevertheless, customers must still update contact details with banks, mobile money providers and other services when they stop using a number, because a number may remain linked to an account after an operator has reassigned it.
Mobile numbers are a finite resource and operators must manage inactive lines so they can be returned to circulation. Kenya’s proposed recycled-number database addresses one part of that challenge by connecting reassignment records with organisations that use mobile numbers to communicate with customers. Whether it provides meaningful protection will depend on implementation, data quality and the safeguards businesses maintain around their own accounts and messaging systems.
