Summary

  • From 2 November, a business message entering a Finnish operator through an application interface with an unverified Finnish phone number must be blocked. An unverified alphabetic sender name may be blocked or replaced with “Roskaposti”.
  • Traficom says even a real restaurant booking confirmation from abroad can arrive under that Spam name. The operator may delegate checks to a contracted messaging provider, but must be able to intervene when that provider fails to authorize senders properly.

You book a table abroad. The confirmation arrives in Finland from “Roskaposti”, the Finnish word for Spam. The restaurant may have done its job; the name in the inbox describes a failed rights check, not a finding that the booking is fake. Traficom gave that exact restaurant example when it announced the stricter phase of its sender-identity rule.

Regulation 28 L/2025 makes the fork explicit. At an operator's application interface, the operator must know who sends SMS, multimedia and RCS messages; verify a sender's right to use a Finnish phone number; and ensure an alphabetic name is neither misleading nor unrelated to the sender's activity. Since 2 November, a message with an unverified Finnish phone number must be stopped. For an unverified alphabetic ID, the operator may stop it or substitute “Roskaposti” for the displayed name. The earlier phase, effective 4 May, allowed the less pointed “Tuntematon”, or Unknown.

This is the handoff that matters. The operator may put verification duties on a direct contractual partner, such as a messaging service provider. It must still have effective procedures when that partner cannot run the authorization process. The regulation also requires counts of authorized names for customers and partners, and monthly counts of blocked and renamed messages. A contract can move the work; it does not make the operator's intervention duty disappear.

The rule takes a harder line at the public international interface, where messages carrying Finnish numbers or alphabetic IDs are blocked. Traficom's restaurant example concerns a different route and an ID that has not been authorized in Finland. Ordinary one-to-one SMS from a single subscription is outside this change. Those distinctions decide whether a message is lost, relabeled or left alone.

The inbox now carries an institutional judgment with a blunt name. “Roskaposti” tells a reader that the right to use the original identity was not established. It cannot tell the reader whether the restaurant exists, whether the booking is valid or whether the message is a scam. Traficom says many IDs were authorized during the transition, but has not published the count of legitimate messages renamed or blocked. That breakdown would show the price paid for a cleaner sender field.