Questions to ask a UK SMS provider, and how to check them

Most of what an SMS provider tells you can be checked, and the checks cost nothing. Before you sign, look the company up on Companies House, which shows its registered address, date of incorporation, officers, filed documents and any insolvency free of charge; search the ICO's register of data protection fee payers; and read the processor terms it offers against Article 28 of the UK GDPR. Then ask how it checks the businesses and sender names on its platform, how a long text is billed, what happens to texts that fail, and how you'd leave. One date is worth knowing: Ofcom's rules, finalised on 15 July 2026, will require every mobile operator and aggregator carrying business texts to run Know Your Customer checks and corroborate sender names from 15 July 2027.

Each question below comes with a way to check the answer, because a sales page will say yes to nearly all of them.

Is it a real, active company?

Search the name on Companies House. GOV.UK's page lists what you can see for free: "company information, for example registered address and date of incorporation", "current and resigned officers", "document images", "mortgage charge data", "previous company names" and "insolvency information". You can also set up free email alerts for changes such as a new director or a new address.

Check that the name on the provider's website and terms matches a registered company, that the company is active with its accounts and confirmation statements filed on time, and that the stated nature of business roughly fits what it sells. A mismatch proves nothing on its own, but regulators notice them. In its September 2023 penalty notice against MCP Online Ltd, a firm that made 20,939 marketing calls to TPS-registered numbers and delivered 92,265 unlawful texts, the ICO recorded that its nature of business at Companies House was "retail sale of mobile telephones", and listed among the aggravating features a registered address that was "a mail drop address" and accounts that had never been filed. (Our post on whether the TPS covers text messages has the rest of that case.)

Does it pay the ICO data protection fee?

People and organisations that process personal information have to pay the ICO a data protection fee unless they're exempt. A business that holds your customers' numbers and message history is very likely to need to. According to the ICO's annual report for 2025/26, the fee is £52 a year for charities and organisations with no more than 10 staff or turnover up to £632,000, £78 for those with up to 250 staff or turnover up to £36m, and £3,763 for everyone else. The ICO can fine up to £4,350 for not paying.

The register lets you "Search for organisations and people registered with the Information Commissioner's Office (ICO) under the Data Protection Act 2018", by name, postcode or registration reference. Ask the provider for its reference and look it up. The MCP notice is useful here too: it says plainly that "MCP is not registered as a data controller with the ICO".

Will it sign processor terms that meet Article 28?

When a provider sends texts on your instructions it's acting as your processor, and Article 28(3) of the UK GDPR lists what the contract must cover: processing only on your documented instructions, confidentiality, security, the rules for using sub-processors, help with people's rights requests and with breaches, deletion or return of the data at the end, and information for audits. Our post on whether your SMS provider is a data processor goes through those clauses one by one.

For a quick check, two things tell you most. The terms should exist in writing before you pay, since Article 28(9) says the contract "shall be in writing, including in electronic form". And there should be a list of sub-processors, because Article 28(2) says a processor can't bring in another without the controller's "prior specific or general written authorisation", and must tell you about changes so you have the chance to object.

Where is the data held, and does any of it leave the UK?

Ask where the servers are, which sub-processors see message content or phone numbers, and in which countries. The ICO's brief guide to international transfers, published on 15 January 2026, calls sending personal information to a separate organisation outside the UK a "restricted transfer", and says every one "must be covered by" UK adequacy regulations, appropriate safeguards or an exception. A provider that keeps data abroad should be able to name the mechanism without having to go and find out.

What checks does it run on the businesses that use it?

Ofcom's statement on combatting mobile messaging scams, published on 15 July 2026, describes the chain a business text travels through. Messaging service providers sell to businesses, often through an API, and pass messages to aggregators, which arrange delivery with the mobile operators. In May 2024 more than thirty aggregators had a direct connection to at least one UK mobile operator, and in February 2025 there were at least 500 aggregators or messaging service providers passing messages to those tier 1 services. Ofcom also notes that a messaging service provider which isn't providing an electronic communications service or network is "not a regulated communications provider" for the purposes of its General Conditions.

From 15 July 2027 the new rules put duties on operators and aggregators. Ofcom's announcement says they must "conduct upfront and ongoing due diligence checks", run "Know Your Customer" checks on new business senders, and "corroborate business message senders' Sender IDs" against what they know about the business, so that a sender claiming to be a hairdresser isn't sending parcel delivery texts. Until those rules apply, each provider decides for itself. So ask what it checks about a new account before that account can send, and what would make it suspend one. The businesses it lets onto the platform share its routes to the networks with you.

How does it check sender names?

A sender name (an alphanumeric sender ID such as "CrownDental") is the first thing your customer sees. Ask how the provider confirms you're entitled to the name you ask for, whether it checks names against the MEF SenderID Protection Registry, and which names it refuses. From July 2027 Ofcom's rules also require operators and aggregators to keep a policy on protected sender IDs and on generic ones such as "customer service". Our post on sender ID spoofing and the MEF registry has the numbers behind that, and the UK sender ID guide explains why a sender name can't receive replies.

How exactly is a long text billed?

Every per-text price is really a price per part. GOV.UK Notify's pricing page, updated on 1 April 2026, sets out the usual rule: a message of up to 160 characters counts as one text, up to 306 as two, up to 459 as three and up to 612 as four. Include a non-standard character (Notify names Welsh, Arabic and Mandarin as languages that use them) and the limits drop to 70, 134, 201 and 268. A few standard symbols count as two characters each: the square and curly brackets, the caret, backslash, pipe, tilde and the euro sign.

So ask whether the price is per part, whether VAT goes on top, whether replies cost anything, whether unused credit expires, and whether you see the part count before you send. Our character counter shows the count as you type, and the character limit guide explains why the parts after the first are shorter.

What happens to texts that fail?

A text can be refused by the provider, rejected by a network, or never reach the phone. Ask whether you get a delivery report for every message, what the statuses mean, and which failures you're charged for. The answer to the last one belongs in the written terms, so ask where. Our post on what "delivered" means explains how far a delivery report can be trusted.

How are opt-outs handled?

Regulation 23 of PECR bans marketing by electronic mail, which includes texts, "where a valid address to which the recipient of the communication may send a request that such communications cease has not been provided". Ask which reply words opt a number out, whether the opt-out list is checked on every send, and whether you can import the list you already have. The ICO's direct marketing guidance says that when someone objects you "should put their details onto a suppression or 'do not contact' list, instead of deleting them", so later lists can be checked against it. Ask, then, whether you can export that list too. An opt-out list that stays behind when you leave turns into marketing texts to people who said no, sent through your next provider. The STOP replies guide covers the mechanics.

Can you test without sending real texts?

If you're connecting a booking system, shop or app to the provider's API, ask for test keys that accept requests and return realistic responses without sending anything, a way to retry a request safely (an idempotency key), and signed webhooks for delivery reports and replies. No law requires any of these. They're what stops a bug in your code turning into 2,000 duplicate texts.

What is the notice period, and how do you leave?

Read the term and notice clauses, then ask what you can take with you: contacts, opt-outs, consent records and message history. Article 28(3)(g) says the processor must, "at the choice of the controller", delete or return "all the personal data to the controller after the end of the provision of services". A self-service CSV export is the easy answer. Providers do close. Textlocal's notice set out the timetable: sales stopped on 31 May 2026, all messaging and APIs stopped on 31 July 2026, and customers were told to "Download any reports or records you may need before your Textlocal account closes." Our Textlocal alternatives guide lists what people needed to bring with them.

If you're putting these questions to CaptiFi Connect: it sends to UK mobiles only, and sender names are reviewed by staff before use. One credit is one part, replies are free, refused texts are never charged and credits never expire. STOP and the other opt-out words are handled automatically, the REST API has test keys, idempotency keys and signed webhooks, and contacts go in and out by CSV. The security page and pricing page have the detail.