The SIM Registration Act Is About to Become Law: What It Will Require and How SMEs Prepare

One Signature Away: The SIM Registration Act Lands on the President's Desk

If your phone has been buzzing since September with texts that greet you by your full name before steering you to a link, you have met the exact problem the SIM Registration Act is written to solve. Congress has ratified the bill, and it now sits on the President's desk here in the Philippines, awaiting a signature expected within days. Once it takes effect, every company SIM you own will need registering.

On October 4, Senate President Juan Miguel Zubiri and House Speaker Ferdinand Martin Romualdez transmitted the enrolled bill to Malacañang, one of the 19th Congress's first two approved measures. Not a law yet — a bill waiting for a pen.

That buys a small business a little time, nothing more. Your operations run on SMS: the one-time passwords (OTPs) customers type to confirm a payment, rider coordination, the number on your tarpaulin. We explained how scammers got your name in the first place in August; this bill is the reply.

What the SIM Registration Act Will Require Once Signed: Deactivated SIMs and a 180-Day Window

GMA News reported the mechanics of the ratified measure at final reading. Three matter to business owners.

Registration before activation. End-users must register a SIM with their telco — the public telecommunications entity — before it can be switched on. The anonymous prepaid from the sari-sari store stops being something you can just buy and use.

180 days for existing subscribers. Active SIMs must be registered within 180 days of the law's effectivity, roughly six months, and the Department of Information and Communications Technology (DICT) may extend that period by no longer than 120 days.

Your data stays locked. Telcos must keep end-user information secured at all times, and registration data may be disclosed only upon a subpoena from a competent authority, pursuant to an investigation on a sworn complaint. That sits on top of the Data Privacy Act of 2012 (RA 10173).

What nobody can tell you is when. The implementing rules and regulations — the IRR, the procedures agencies write after a law passes — follow within 60 days of effectivity. No registration window is open, no telco has published a procedure, and anyone saying otherwise is guessing or scamming you.

Laws set a floor; they do not watch your network on a Tuesday night. That is what our cybersecurity services that protect your business today, not after an IRR are for.

What we still don't know

• When the 180-day clock starts — that waits on signing, publication, and the IRR.
• How each telco will handle it — Globe, Smart, and DITO can publish procedures only after the IRR sets the requirements.

Vetoed Once: Why the First SIM Card Registration Law Died in April

Round two, because round one died. On April 15, 2022, then-President Rodrigo Duterte vetoed the earlier version over an added provision requiring social media accounts to be registered under real names, which raised free-speech and state-intrusion objections. Congress refiled and re-passed the measure this year without it.

Scope matters here. The bill on the desk targets anonymous SIMs, not anonymous accounts. A scam that lives entirely inside a Marketplace chat never touches a SIM registry.

The Smishing Numbers That Pushed the SIM Card Registration Law Over the Line

Smishing — SMS phishing, a text engineered to make you tap a link or surrender a code — is now an industrial operation. Globe Telecom blocked roughly 784 million spam and scam texts from January to end-July 2022, deactivated 14,058 scam-linked SIMs, blacklisted 8,973 more, and blocked 610 domains and URLs. One telco, seven months.

The September wave felt personal because it was. Initial findings from the National Privacy Commission, reported by Philstar, were that the texts came phone-to-phone from numbers registered to texting services over regular telco networks, with names likely harvested from messaging and payment apps rather than a breach of data aggregators. The NPC probed telcos, a bank, and payment platforms in September 2022, and an inter-agency body with the National Telecommunications Commission and the DICT formed to chase the scammers.

Registration attacks one layer: the disposable SIM. It does nothing about the email pretending to be your supplier. Make sure your team can spot the phishing red flags before they cost you — that channel needs no SIM at all.

How Philippine SMEs Should Prepare Before SIM Registration Opens

Inventory every company SIM now. Staff phones, riders' handsets, pocket WiFi, the SMS gateway in your server cabinet, the number on your tarpaulin. Note who holds each one and what breaks if it goes dark. When telco procedures arrive, you will be filling in forms instead of hunting for hardware.

Warn your staff before the fake links do. Scammers ride news cycles. Expect messages telling people to "register your SIM here" through a link that is not your telco. Nobody registers anything until Globe, Smart, or DITO publishes a procedure on its own channels.

Do not wait for a law to be careful. Holiday e-commerce, remittances, and 13th-month pay make the ber-months the richest season for scammers. If you are already getting your online store ready for the holiday rush, add a security pass to that checklist. October is Cybersecurity Awareness Month internationally, themed "See Yourself in Cyber" — a reminder that the weak point is usually a person.

A SIM registry shrinks the pool of anonymous numbers. It will not patch your server, retire a password four people share, or notice a mailbox rule forwarding your invoices. That is the work behind our managed IT services that keep watch while you run the business.

Scam texts are the symptom; unguarded systems are the disease. If you want a second pair of eyes on your business's defenses before the holiday rush, book a free call with our team — we'll tell you honestly what needs fixing and what doesn't.