ACMA is enforcing, and the SMS Sender ID Register is coming

ACMA announced over AUD 5.4 million in combined spam and gambling self-exclusion penalties against the wagering companies below during 2025 and early 2026. The regulator is active, the penalties are substantial, and the violations are structural rather than sophisticated.

The cases that set the precedent

Tabcorp paid AUD 4,003,270 for spam breaches, including SMS and WhatsApp messages without an unsubscribe option, plus a separate AUD 112,680 penalty for BetStop breaches. Betfair paid AUD 871,660 after sending 148 messages without consent and six without an unsubscribe option. PointsBet paid AUD 500,800 for spam breaches, including misclassifying promotional emails as non-commercial. Its separate BetStop investigation found 508 messages sent to self-excluded people, not more than 500 individual recipients; that investigation resulted in an enforceable undertaking rather than the spam fine.

The common thread is that none of these are sophisticated violations. They are failures in consent management, opt-out functionality, and message classification. ACMA is enforcing against the basics, which should worry any team that has not stress-tested its own.

SMS Sender ID Register, mandatory from 1 July 2026

From 1 July 2026, businesses need to register alphanumeric SMS sender IDs through a participating provider to retain their branded sender name. Unregistered sender IDs will be labelled Unverified. The register is designed to combat impersonation scams (a real and growing problem) and it directly affects SMS marketing operations.

If your organisation sends marketing SMS with a branded sender ID and that ID is not registered by July 2026, the sender name will be replaced with ‘Unverified’. Messages carried by non-participating providers are blocked. These are different consequences under the ACMA rules.

What needs to happen

Four operational tasks before July 2026.

Audit consent records. Can you demonstrate, for every person in your SMS and email marketing database, that valid consent was obtained? If not, the risk is direct.

Test opt-out mechanisms across every channel, including WhatsApp. Functional means the unsubscribe actually unsubscribes the user, not just acknowledges the request. The Tabcorp case turned on this point.

Review message classification. If any marketing messages are classified as “non-commercial” or “transactional” to avoid opt-out requirements, the classification has to be defensible. The PointsBet case shows that ACMA will challenge it (and IMO the bar is higher than most internal compliance teams assume).

Register SMS sender IDs before July 2026. This is an operational task with a hard deadline. Missing it means losing the verified branded sender name; also confirm the provider participates. Assign this to a single team before April 2026 to leave runway for issues.