We see more and more new applications emerging where phonenumbers are decoupled from SIM cards and/or fixed lines. They are dynamicallyassigned for short periods of time and or used for applications where there isno longer a strict relationship with a fixed/mobile phone line. Differentterminologies such as virtual numbers or cloud numbers, are used to describethis phenomenon.

These innovations have been made possible by using the cloudto provide electronic communications services.

There are many regulatory requirements in place in relationto the use of different types of number resources, in particular those designedto protect the interests of end-users, to facilitate competition and to ensurethe effective and efficient use of numbering resources. Are all of theseregulatory requirements reasonable and proportionate for those newapplications? In some circumstances they can even be contra-productive andhamper innovation.

The report will first of all describe these evolutions ofthe network and the new services based on those networks, will bring forward adefinition, make an assessment of the different regulatory requirements (e.g.number portability, CLI issues, emergency calls, relation of the identificationof calls with misuse or fraud) and other aspects (e.g. sub- assignment,security of communication) and their relevance to this new numbering usage andfinally make recommendations for the CEPT countries on numbering policy.

Special attention will be given to the question of whoexactly are the end-user and provider of the telephone numbers and theirtypical extraterritorial use.

The ECC Recommendation will contain policy rules on how to handle the SMS SenderID in order to maintain trust in the SenderID

The WG NaN has already developed detailed policies on how to handle the CLI in voice communications in order to maintain trust in the CLI.

SMS SenderID is the equivalent identifier as CLI for voice calls but for SMS. SMS is used for person-to-person (P2P) communications, but also more and more for application-to-person (A2P) communications. In this last category, we can distinguish between premium rate SMS, where the receiver of the SMS pays for the premium rate service and business messaging as one-time passwords, alerts for appointments which are not charged for the receiver. While the premium rate SMS- service is in decline, business messaging including the use of SMS as an extra security layer are getting more and more popular (2-factor authorisation as defined in Payment Services Directive - PSD2).

The work item will be limited to A2P-  communications.

While for voice communication the CLI is always a telephone number, for SMS it is possible to use alphanumeric characters in SenderIDs. It is not common that CEPT Administrations regulate their use. This creates additional risks as people are more likely to be mis leaded in case of spoofing by an alphanumeric identifier (e.g. well-known brands) than a numeric one. From a technical point of view it is easy to modify the SenderID in a number or alphanumeric characters. SenderID spoofing for SMS is seen by many administrations more and more as a problem with a very negative impact for end-users, since often it is used for frauds. Moreover, in case of provisioning of business messaging via SMS typically a long chain of subjects is involved and this increases the complexity in identifying the real sender of the messaging.

Although the scope of the ECC Report 338 on CLI spoofing adopted 7^th June 2022 and the following ECC Recommendation in preparation is limited to voice communications, some principles (e.g. with A/B handshaking and the respect of international Recommendation E.157 for international communications) described can be used in this new Recommendation.

This ECC Recommendation aims to increase the trust in SenderID proposing rules and good polices on how to handle SMS SenderID. Special attention will be given  to maximise the commercial benefit for the stakeholders of SMS while minimising the risk of fraud and or abuse where SenderID plays a role. It will draw on the good practices currently applied in several countries.

The ambition of the ECC Recommendation is to move as far as possible towards a common approach in the CEPT countries.

NaN3 can also explore other sides of the topic, if found useful in the NaN3 discussions or during the questionnaire. When further progress is made, and NaN3 finds it beneficial, NaN3 can choose to split the work into two work streams, e.g. one for AML-SMS and one for SMS generally.