The Department of Telecommunications (DoT) has introduced SIM-binding rules for messaging applications in India, with mandatory compliance from 1 January 2027. The rules require an active physical SIM linked to an account to remain in the device for the messaging application to function.
SIM-Binding Requirements and Timeline
SIM-binding links a messaging account to the active SIM used during registration. Under the new requirements, platforms must integrate accounts with the live SIM used for registration by 31 December 2026. From 1 January 2027, the physical SIM must remain present in the user’s device while the application is in use. The rules cover WhatsApp, Telegram, Signal, Arattai, ShareChat, Josh and JioChat. Snapchat is exempt from the requirements. Apple released an iOS software patch in September 2026 to help detect when an iPhone operates without a physical SIM card.
Platforms, Devices and Sessions
The requirements affect users who use messaging applications over Wi-Fi without a registered SIM in the device, use multiple devices or frequently change SIM cards. Messaging applications can also provide web-based sessions that allow account access through a browser. The earlier requirement for mandatory logout of web-based sessions every six hours was replaced by a risk-based logout approach on 22 October 2026. As of that date, Signal had not responded to government notices concerning the new requirements.
Cybersecurity and Telecom Context
The stated objective of SIM-binding is to curb cross-border cyber fraud, phishing and digital arrest scams, and to strengthen telecom cybersecurity in India. A SIM card identifies a subscriber to a mobile network and supports network authentication. Phishing is a form of online fraud in which deceptive messages or websites are used to obtain sensitive information.
Important Facts for Exams
- The Department of Telecommunications is a department of the Ministry of Communications.
- A SIM card enables a mobile device to connect to a cellular network using subscriber credentials.
- Phishing commonly uses deceptive emails, messages or websites to collect personal or financial information.
- WhatsApp, Telegram and Signal are internet-based messaging applications.
The compliance deadline for messaging platforms is 31 December 2026, and the rules become mandatory on 1 January 2027. The six-hour mandatory logout requirement for web sessions was replaced by a risk-based approach on 22 October 2026.
