Regulator Closes Loophole – Mandates eSIM Providers Must Have a MVNO License

Brazil’s telecom regulator Anatel has ruled that provisioning eSIM profiles is a core telecommunications function, not a value-added service.

The decision requires companies to obtain a Mobile Virtual Network Operator (MVNO) license, reinforcing the distinction between connectivity and value-added services, and ensuring accountability and security in a rapidly changing market.

A recent ruling by Brazil’s telecom regulator, Anatel, has clarified the regulatory landscape for eSIM technology, establishing it as a core telecommunications function rather than an unregulated value-added service.

The decision has significant implications, mandating that any company seeking to provision eSIM profiles must do so as a Mobile Virtual Network Operator (MVNO).

This ruling sets a crucial precedent, highlighting a key technical distinction between physical SIM cards and their digital counterparts.

While a physical SIM is a piece of hardware, an eSIM profile is a software-based component that gives a provider a high degree of control over a device’s connection to the mobile network.

Anatel views this direct access as a “technical and regulatory risk” if not managed by an authorized entity.

The decision explicitly states that companies wanting to provision eSIMs must be authorized by the agency, at least as an MVNO.

An MVNO is a mobile service provider that, while lacking its own physical network infrastructure, is licensed by the regulator to offer services by leasing network capacity from a traditional operator.

This requirement ensures that all companies with direct control over mobile connections are held to the same standards of regulation, accountability, and security as the large carriers.

It eliminates a regulatory loophole, preventing companies from using eSIM technology to bypass licensing and enter the telecommunications market without proper oversight.

For the telecom industry, the ruling reinforces the integrity of the regulatory framework.

It solidifies the position of MVNOs as a legitimate and necessary part of the ecosystem, particularly for companies that want to offer innovative, connectivity-based services.

“This decision consolidates the separation between telecommunications and VAS, and makes it clear that the VAS, whose solution brings telecommunication, needs to be at least an MVNO,” said Olinto Santana, president of Abratual, an association of Brazilian MVNOs.

By connecting eSIM provisioning to the MVNO model, Anatel has charted a clear path for the future of mobile services in Brazil. The decision underscores that as technology evolves, the regulatory framework must adapt to ensure fair competition, network security, and consumer protection.

The case involved Base Mobile, a company providing value-added services (VAS), which sought direct access to over 650,000 eSIM profiles from Telefônica Brazil.

Base Mobile argued these profiles were essential “inputs” for its educational platform. However, Anatel sided with Telefônica, rejecting the idea that Base could provision these profiles without the proper telecom license.

The key takeaway is that Anatel views eSIM profiles not as simple data inputs, but as a critical part of the network’s infrastructure.

The agency deemed giving an unauthorized company direct control over these profiles as a “technical and regulatory risk.”

This decision establishes a clear line: managing the provisioning of mobile connectivity, whether through traditional SIM cards or eSIMs, requires a Personal Mobile Service (SMP) authorization.

eSIM marketplaces and eSIM providers do not own or operate mobile services in Brazil, and most of them are not present locally in the country.

Instead, they buy from licensed local carriers (like Vivo, Claro, and TIM) to resell data packages to international travelers. Their service is built on the premise of being a hassle-free, digital alternative to a physical SIM card, allowing users to connect instantly upon arrival without dealing with local SIM registration.

Anatel’s decision directly challenges the “VAS provider” status that the companies have likely used to operate in Brazil.

The implications are:

Licensing Requirement: These eSIM providers will likely be required to obtain a formal MVNO license from Anatel. This is a process that involves appointing a local legal representative.

Operational Changes: As licensed MVNOs, they will have to adhere to the same regulatory standards as mobile network operators, which include requirements for network security, quality of service, and consumer protection.

Compliance Risk: If the eSIM providers continue to operate in Brazil without an MVNO license, they risk being sanctioned by Anatel. This could include fines, service disruptions, or being blocked from providing services in the country, similar to what has happened in other markets like Turkey.

In short, Anatel’s decision forces these global eSIM providers to shift from a simple VAS reseller model to a telecommunications provider and adhere to regulations on such, if they want to continue serving the Brazilian market.

Anatel is not the only regulator working with this issue. Other regulators are looking at the same solution for eSIM and some OTT services.

I does not come as a surprise, several eSIM providers expected that this would happen at one point, and have already made plans to become MVNOs. In addition it gives them the opportunity to offer other services as well e.g. voice call and SMS.

The decision also seems to be a strategic move to prevent “permanent roaming” loopholes, where companies (e.g. IoT/M2M) could use foreign-based services to provide what is essentially a domestic connection in Brazil, thus bypassing local laws and oversight.

Regulators and MNOs often have rules or commercial agreements that place a time limit on roaming, typically 30-90 days. After this period, the MNO must disconnect.

The new ruling is also significant on this.

Before the ruling: A company could use eSIM to provision a profile from an MNO outside of Brazil (or even a profile from a “VAS” provider) to a device that is physically located and permanently operating in Brazil.

This would allow the device to connect to a Brazilian network via a roaming agreement, but the service would be controlled by a foreign entity that is not subject to Anatel’s direct oversight.

With the new ruling: Anatel is now saying, “No. If a company is provisioning an eSIM profile to provide a connection to a device that is permanently located in Brazil, that is not temporary international roaming. That is providing a domestic telecommunications service.”

Turkey: Turkey’s telecommunications authority (BTK) has decided to bloc access to the websites and apps of many international eSIM providers for users physically present within the country.

This means a traveler cannot download, purchase, or top up a new eSIM plan after arriving in Turkey.

The rationale behind this is a combination of data localization requirements, national security concerns, and a desire to encourage the use of licensed domestic operators.

This effectively forces international eSIM providers to either partner with a local, licensed entity or have the customer activate the eSIM before entering the country.

India: India’s Telecom Regulatory Authority (TRAI) has a complex regulatory framework that requires all telecom services to be properly licensed and adhere to strict Know Your Customer (KYC) norms.

While the rules are particularly focused on Machine-to-Machine (M2M) and IoT devices, they also impact consumer eSIMs.

Foreign-issued SIMs (including eSIMs) on international roaming must be converted to an Indian service provider’s profile within six months.

This requirement, along with strict identity verification rules, pushes international providers to have a strong local presence or partnership to maintain service for long-term visitors.

South Africa: South Africa’s Regulation of Interception of Communications and Provision of Communication-Related Information Act (RICA) requires the in-person registration of all SIM cards with a valid ID and proof of address.

While there is a legal exemption for foreign travelers, the law was not originally drafted with eSIMs in mind.

This has created a “legal loophole” where a local South African could technically use a global eSIM to bypass RICA registration, a practice the regulatory authority is now seeking to address.