Australia's 1 July 2026 SMS sender ID rules reshape AWS OTP delivery choices

Australia's communications regulator is rolling out an SMS Sender ID Register with a hard start date of 1 July 2026, and the change lands directly on teams sending one-time passcodes over SMS. A detailed walkthrough on dev.to, written by a developer who built OTP delivery on AWS just as the rules were taking shape, lays out what changes and how it affects the decision between AWS's two main delivery paths.

What Australia's rules change

According to the dev.to post, the register is run by the ACMA and targets scammers who spoof trusted brand names in text messages. From 1 July 2026, any branded sender ID — the name displayed at the top of a text instead of a phone number — has to be registered, and telcos are required to check registrations before carrying that traffic.

Unregistered sender IDs get labelled "Unverified" on the recipient's phone, grouped alongside other unverified traffic, including scam texts. The author notes that ACMA has urged businesses to apply early, since last-minute applications may not be processed by telcos in time. Separately, telcos and message providers that do not participate in the register at all will not be permitted to carry branded SMS traffic from the same date — meaning messages can be blocked outright, not merely relabelled.

The AWS delivery options

The post breaks the OTP flow into four jobs — generate, store, deliver, verify — and points out that only delivery is AWS-specific. The options it maps out:

Amazon SNS remains the familiar route for plain SMS via its Publish API, but since late 2024 its SMS sending routes through AWS's newer messaging backend, making it more of a thin pub/sub wrapper than a separate delivery engine. AWS End User Messaging (SMS) is the direct, current API, with full control over origination identities, configuration sets and two-way messaging. AWS End User Messaging Notify is a newer managed layer on top that removes the setup friction of registering your own number. There is also an OTP-specific API pair where AWS generates and verifies the code for a fee per successful verification — which the author suggests most teams can skip, because they already have their own generate and verify logic.

That leaves the real decision: register your own number, or use Notify's shared, managed identity.

Own number versus Notify

Registering your own number brings lower per-message cost and full branding control, at the price of a carrier registration that takes real time to clear plus a monthly lease fee. Notify skips that registration wait using a pre-approved shared identity with fraud protection built in, at a premium per message.

The author's rough comparison, based on standard SMS pricing to Australian numbers plus a typical long code lease, shows the two nearly identical at 500 messages a month (around $42 for an owned number versus $43 for Notify). The gap widens quickly with volume: at 1,000 messages it is roughly $62 against $85, and by 3,000 messages roughly $142 against $255 — a difference of more than $100 a month. The author cautions that teams should run their own numbers, but that is the shape of the trade-off.

Where the deadline bites

The compliance angle is where the two paths genuinely diverge, per the post. If you register your own number and send under your brand's sender ID, that sender ID is exactly what the ACMA rules cover. Skip registration, and your OTP arrives labelled "Unverified" — at the precise moment you want the customer to trust the message, sitting alongside traffic they have been warned about.

Notify behaves differently. The identity the recipient sees is not your brand but AWS's own shared "AWSNOTIFY" identity; your brand name is configured to appear inside the message body via one of a handful of pre-approved templates, not in the sender field itself. Because you are not presenting your own brand as the sender, the author argues, the branded-sender-ID registration question does not really apply, and Notify sidesteps the "Unverified" risk entirely. The cost is that customers see "AWSNOTIFY" rather than your business's name at the top of the text.

For the own-number route, the post adds a practical warning: check with whoever actually carries your SMS traffic rather than assuming registration is someone else's problem, because a non-participating provider means blocked messages.

A console quirk worth knowing

The author also hit an ACCESS_DENIED_CONTACT_SUPPORT error when creating a Notify configuration through the AWS console, with no clear reason. Creating the same configuration through the CLI went active immediately. Without a confirmed explanation for the discrepancy, the advice is simply to try the CLI or API directly before opening a support case.

Why it matters

OTP delivery is often treated as a solved problem until regulation or branding makes it visible. Australia's register turns the sender line into a trust signal with a compliance deadline attached, and on AWS the choice between an owned number and Notify is no longer a pure cost calculation. It now determines whether verification codes arrive branded and registered, generically delivered under AWS's identity, or flagged as unverified — and, in the worst case with a non-participating carrier, blocked entirely. Teams with Australian users have a concrete date to plan against: 1 July 2026.