DoT mandates KYC for internet telephony services using mobile numbers

The Department of Telecommunications (DoT) has issued a directive making it mandatory for all telecom licensees offering internet telephony services using mobile numbering series to conduct Know Your Customer (KYC) verification, similar to the process followed for regular cellular mobile services.

In a circular dated June 16, 2025, the DoT noted that some licensees with Access Service Authorization have been providing internet telephony under the "Business Connection" category without carrying out proper KYC, arguing that existing guidelines apply only to cellular mobile service providers.

"It has come to the notice of the Department that some of the licensee having Access Service authorization are providing Internet Telephony services under the "Business Connection" category using mobile numbering series but without conducting end-user KYC as per the existing instructions dated 31.08.2023. These licensees are claiming that the existing KYC instructions are applicable only to those licensees who are providing Cellular Mobile Services.

Read more: DoT mandates telcos to implement inclusive digital KYC processes following SC judgement

In this regard, the matter has been examined and the competent authority has directed to convey that the extant KYC instructions, issued for Cellular Mobile Services from time to time, are applicable mutatis mutandis on all licensees holding Access Service authorization and providing Internet Telephony services using mobile numbering series. Terminology such as SIM Card, IMSI, etc., as mentioned mandatory in the extant instructions may be applied wherever relevant. Relevant license conditions related to business (bulk) connections shall also be followed scrupulously," the advisory said.

Clarifying this ambiguity, the department has stated that the extant KYC instructions issued for cellular mobile services are mutatis mutandis applicable to all licensees providing internet telephony services using mobile numbers. This means that telecom players must implement customer verification protocols, including terminology such as SIM card and IMSI, wherever relevant, even in internet-based voice services.

The circular emphasizes that any violation of this directive will be treated as a breach of license terms, attracting penal consequences. All such internet telephony connections must be brought into compliance within 90 days of the notification.

"Any non-compliance observed after issuance of this letter will be treated as breach of the terms and conditions of the license agreement and shall attract penal actions. All Internet Telephony connections must be brought into compliance with the existing instructions within 90 days from the date of issuance of this letter," it said.

The move comes amid growing concerns over unverified users accessing telecom services via internet platforms, which poses both security and regulatory risks.