Kenya's communications regulator plans central database of recycled phone numbers for banks and SMS firms

The Communications Authority of Kenya (CA) plans a central database of deactivated and recycled mobile numbers that banks, fintechs and bulk-SMS firms would check before sending messages, according to its draft safeguards and a Business Daily report on 9 October.

The draft, numbered CA.G.520:2026 and marked Version 1.0, says telecom operators must send a list of all deactivated and recycled numbers to the central system every quarter. Third parties would use it to update their records before calling or texting a number about obligations tied to it. Only after the list is sent may the operator start recycling, meaning it can issue the number to a new subscriber.

Business Daily reported that operators such as Safaricom and Airtel Kenya would make the submissions. It quoted the CA as saying: "Querying the database will ensure that third-party value-added service providers only send messages to the rightful owner." The newspaper compared the plan with a US system, the Federal Communications Commission's Reassigned Numbers Database.

The draft says mobile numbers are used in financial services and in digital authentication for online services, and act as digital identities. Capital FM reported on 7 October that the CA said it developed the safeguards after a March 2026 High Court ruling that directed the Government to set up measures against arbitrary deactivation and reassignment of inactive numbers. TechTrendsKE reported on 10 October that a bank alert or one-time password sent to a recycled number could reach someone other than the original subscriber.

The draft lists the reasons a number may be recycled: the user abandons the SIM card, moves abroad or closes a business; someone stops using a number to evade debts; the CA reclaims a number used for illegal activities; or the registered owner is no longer available.

Under the draft, a number becomes liable for deactivation and recycling after three months with no revenue-generating activity. The draft lists a call, an SMS, data use, an airtime top-up or use of a value-added service as activity. The operator must then try to reach the owner through the contact details collected at registration, and the notification continues for a further three months unless the owner uses the line.

Thirty days before that second period ends, with the number still inactive, the operator must publish the list of numbers at risk. The draft requires a notice on the operator's website, in other media and in a nationwide daily newspaper each quarter. The notice must include the *106# option, which lets a subscriber check whether a number is suspended, active, under recycle or deactivated.

The draft also covers the previous owner's data. When the notice period lapses and the number is still inactive, the operator must delink and securely archive the previous owner's personal data, cached data and services, so that a new subscriber cannot access or inherit them. Records required by law are kept. Before recycling, the operator must also delink the number from any business-to-customer messages the previous owner opted into.

Newly issued and recycled numbers would receive no marketing messages by default. For any business message, the subscriber must have dialled a USSD code, a short code entered on the handset, that consents to messages from that specific business, according to the draft.

Business Daily reported that the CA rejected a proposal requiring subscribers to notify their contacts by SMS when a number changes hands. The CA said: "It is a violation of the Data Protection Act to access personal information without authorisation."

The draft exempts some numbers from recycling through "whitelisting". The Commissioner General of Prisons is to submit details of convicts jailed for more than six months who have exhausted their appeals, and to facilitate whitelisting for suspects denied bail who are likely to stay on remand for more than six months. Any person, including caregivers of people unable to use their numbers for more than six months, can also ask the operator to whitelist an inactive number, in person or by another means the operator sets up, with original identification documents. Whitelisting on such a request runs for one year and can be renewed.

Business Daily said the longer period before a number can be recycled, about six months under the draft, and the added reporting and notification duties are expected to raise telcos' compliance costs.

TechTrendsKE pointed to limits. The database would not automatically remove old numbers from customer profiles or unlink them from financial and online accounts, so businesses would still need reliable account-update and secure recovery processes. It also said quarterly reporting could leave gaps if a number is reassigned before the latest records are available.

The CA's public notice invited comments on the draft by 11 September 2026, by email to [email protected]. The document lists an effective date of 19 September 2026, except for provisions that need the central database, which take effect once the database is established. Capital FM reported on 7 October that the CA had finalised the framework after public consultation. Business Daily's report on 9 October called the safeguards the regulator's proposed rules.