Section 3(7) of the Telecommunications Act, 2023 Is Now in Force: What Telecom Businesses Need to Review

The Department of Telecommunications (DoT), under the Ministry of Communications, has brought Section 3(7) of the Telecommunications Act, 2023 into force from 21 August 2026.

The change has been made through Notification S.O. 4616(E). The Central Government issued the notification using its powers under Section 1(3) of the Telecommunications Act, 2023. The Gazette clearly appoints 21 August 2026 as the date on which Section 3(7) becomes operational.

That sounds straightforward, but there is an important distinction. S.O. 4616(E) is mainly a commencement notification. It does not contain a complete telecom KYC process, prescribe a new application form, or create a separate biometric licence.

What it does is activate the statutory provision dealing with identification of users through verifiable biometric-based identification. The detailed position has to be understood by reading Section 3(7) together with the applicable User Identification Rules and DoT directions.

For telecom operators, the change deserves attention because user identification is now tied directly to the framework of the Telecommunications Act, 2023. Businesses holding corporate telecom connections also need to understand their role, particularly where individual employees or other persons are using connections issued in the name of an organisation.

Notification at a Glance

There is no gap between the date of this notification and the commencement date mentioned in it. Section 3(7) became effective on 21 August 2026 itself.

What Does Section 3(7) Actually Say?

Section 3(7) is fairly short, but its wording matters.

Under the provision, an authorised entity providing a telecommunication service notified by the Central Government must identify the person receiving that service through a prescribed form of verifiable biometric-based identification.

There are three parts to understand here.

• First, the provision places the responsibility on an authorised entity providing the relevant telecommunication service.
• Second, the provision refers to telecommunication services notified by the Central Government. This means the existence of Section 3(7) alone should not be read as proof that every type of telecom service is covered in the same manner.
• Third, Section 3(7) says that the biometric-based identification will operate as may be prescribed. In legal terms, that means the Act creates the requirement, while more detailed rules are needed to explain how the system operates.

Section 56 of the Telecommunications Act also specifically gives the Central Government rule-making power regarding the verifiable biometric-based identification to be used under Section 3(7).

That is why the Gazette notification cannot be read on its own.

Why Does 21 August 2026 Matter?

The Telecommunications Act was enacted earlier, but individual provisions of a law do not always become operational on the same date.

Section 1(3) allows the Central Government to appoint commencement dates for provisions of the Act. S.O. 4616(E) uses that power specifically for Section 3(7).

In practical terms, the position is:

This distinction matters because describing S.O. 4616(E) itself as a fresh "biometric KYC rule" would not be legally precise.

The notification activates the section. It does not reproduce the entire operating framework.

How Does the Wider User Identification Framework Fit In?

DoT's Telecom e-Service Portal now specifically refers to the Telecommunications (User Identification) Rules, 2026 and states that the Rules have been made live on the portal.

DoT has also published separate instructions relating to the implementation of the User Identification Rules. The Department's official resources page lists both the User Identification instructions and a consolidated list of earlier identification/KYC notifications.

This creates a layered framework.

• The Telecommunications Act, 2023 provides the statutory basis.
• Section 3(7) creates the requirement for prescribed verifiable biometric-based identification for notified services.
• S.O. 4616(E) brings that provision into force.
• The User Identification Rules, 2026 provide a more detailed regulatory structure.

Finally, DoT instructions deal with practical matters such as e-KYC, D-KYC, reverification, and business connections.

For a compliance team, the real job is therefore not simply to read the two-page Gazette. The documents have to be read together.

Who Is Expected to Follow the User Identification Requirements?

The DoT instructions explain the categories of authorised entities to which the Rules may apply.

These include entities holding an authorisation under Section 3(1)(a) of the Telecommunications Act, 2023, as well as certain entities continuing under licences granted under the Indian Telegraph Act, 1885 or migrating to the new authorisation framework in accordance with Section 3(6).

This distinction is useful because not every company connected with the telecom industry is automatically an "authorised entity" for this purpose.

A software vendor working for a telecom operator, for instance, does not become the authorised entity simply because it supports a KYC system. The applicable authorisation or continuing licence position has to be checked.

That is the first compliance question telecom businesses should answer: what is the regulatory status of the entity providing the service?

What Does Verifiable Biometric-Based Identification Mean for Businesses?

The expression is important because Section 3(7) does not simply refer to ordinary document verification.

The provision specifically requires a form of identification that is both biometric-based and verifiable, with the detailed method governed through the prescribed framework.

DoT's implementation instructions also make clear that the User Identification Rules work with processes such as e-KYC, D-KYC, and user reverification.

Businesses should avoid oversimplifying this into a statement such as "all users must now complete Aadhaar KYC."

That would go beyond what S.O. 4616(E) itself says.

The correct method depends on the applicable Rules, the user's circumstances, and the relevant DoT instructions.

For telecom operators, this means existing subscriber-verification systems should be checked against the current framework rather than assuming that an older KYC process continues unchanged.

What Happens to Earlier Telecom KYC Instructions?

Telecom KYC did not begin in 2026.

DoT has issued subscriber-verification instructions for many years. Its current User Identification notification list refers to earlier directions covering matters such as:

• verification of new prepaid and postpaid mobile subscribers;
• Digital KYC;
• Self-KYC;
• Aadhaar-based e-KYC;
• reverification of existing mobile connections;
• additional KYC requirements for business connections;
• KYC requirements for Internet Telephony Services; and
• SIM replacement involving end users of business connections.

For example, DoT's list records Digital KYC instructions from 2019, Self-KYC and Aadhaar-based e-KYC instructions from 2021, business-connection KYC instructions from 2024, and Internet Telephony KYC requirements from 2025.

The 2026 framework therefore does not begin from an empty regulatory position.

The better approach for operators is to identify which earlier instructions continue to apply, which have been absorbed into the new framework, and whether any newer direction changes the way an existing process must operate.

Simply deleting every old KYC SOP would be as risky as assuming that nothing has changed.

What Do the New Rules Mean for Existing Connections?

One question businesses are likely to ask is whether every existing telecom user now needs immediate fresh biometric verification.

S.O. 4616(E) itself does not say that.

The commencement notification only brings Section 3(7) into force. It does not contain an instruction requiring every existing subscriber to report for fresh verification on 21 August 2026.

DoT separately maintains instructions dealing with reverification of existing mobile connections. Its current consolidated list refers to reverification directions issued in December 2021 and February 2022.

Any fresh verification requirement should therefore be linked to the applicable Rules or a specific DoT direction rather than assumed merely from the commencement notification.

For operators, that means existing connections and new connections should not automatically be treated as the same compliance situation.

Business Connections Need Special Attention

Corporate connections deserve a closer look because there can be more than one person involved.

The connection may be taken in the name of a company, LLP, partnership, government body, or another organisation. In contrast, the SIM or telecom connection is actually used by an employee or another individual.

This creates three different roles that compliance teams may have to distinguish:

• The business user is the organisation in whose business context the connection is being used.
• The authorised representative is the person authorised to act for that organisation.
• The end user is the person actually using the relevant business connection.

This becomes particularly important where connections are regularly reassigned between employees.

DoT's implementation instructions specifically deal with changes in the end user of a business connection.

What Happens When a Business SIM Is Given to a New End User?

This is one of the areas where the DoT instructions provide a clear timeline.

According to the instructions published on the Department's portal, the authorised representative of a business user must inform the authorised entity about a change in the end user of a business connection within three working days from the date of the change.

The instructions also state that the authorised representative must ensure that the new end user undergoes biometric-based identification within seven working days from the date of the change.

This has a very practical consequence for employers.

A company that reallocates corporate SIMs between employees cannot treat the change as purely an internal administrative matter. HR, administration, IT and whoever manages the telecom account may need a process for notifying the telecom provider and completing the required identification.

A simple employee-exit checklist may therefore need to connect with the company's telecom-connection records.

What Should Telecom Operators Review?

For telecom operators, the regulatory change is less about creating one new form and more about checking whether the existing user-identification system still matches the law.

A sensible review would start with the services being provided and the company's authorisation position.

After that, the compliance team can look at the actual customer journey.

• Subscriber Onboarding

Check how a new user is identified before a connection is provided. Existing e-KYC or D-KYC processes should be mapped against the current Rules and portal instructions.

• Business Accounts

Enterprise connections often remain active for long periods while the individual end user changes. These accounts deserve separate controls because the person using the connection can be different from the company that originally obtained it.

• Reverification

Teams should know what event or direction triggers reverification rather than treating it as an automatic requirement for every subscriber.

• Internal Records

Subscriber records, authorised-representative information and end-user changes should remain consistent across customer, billing, KYC and enterprise-account systems.

• Staff and Channel Instructions

A regulatory process can fail even when the written policy is correct if retail staff, enterprise teams or customer-support personnel follow an outdated procedure.

That makes training and SOP review a practical part of implementation.

What Should Companies Using Corporate Connections Do?

The burden on an ordinary corporate user is different from the burden on the telecom operator.

A company does not become responsible for operating the telecom provider's KYC system. It does, however, need control over the information it provides to the telecom company.

Businesses with a sizeable pool of corporate connections should be able to answer a few basic questions without searching through several departments.

• Who is the authorised representative for the telecom account?
• Which employee or person is using each connection?
• When was a SIM last reassigned?
• Was the provider informed after the end user changed?
• Was the new user's required identification completed?

These sound like small administrative details, but the three-working-day and seven-working-day requirements make them much more important for business connections.

A useful internal arrangement is to connect telecom allocation with employee onboarding, transfers and exits. That reduces the chance of a company-owned connection continuing in the name of an old end user.

Operator and Business User Responsibilities Are Not the Same

This distinction matters because articles on telecom KYC often speak about "business compliance" without explaining whether the obligation belongs to the telecom provider or to its customer.

The two may have connected responsibilities, but they are not interchangeable.

What About Misrepresentation of User Information?

DoT's 2026 implementation instruction also refers to Rule 8 of the User Identification Rules and provides a format through which an authorised entity can inform the Central Government about specified misrepresentation.

The format records the telecommunication identifier, the nature of the misrepresentation, and the steps taken by the authorised entity.

This shows that user identification is not being treated merely as a one-time onboarding exercise.

Accuracy of subscriber information remains relevant after the connection has been issued.

For telecom operators, this means suspected identity misuse should be connected with the appropriate internal escalation and regulatory process.

For businesses, it reinforces a simpler point: information relating to the actual user of a business connection should remain accurate.

What S.O. 4616(E) Does Not Do

Because the Gazette is so short, there is a risk of reading much more into it than it actually contains.

S.O. 4616(E) does not, by itself:

• create a new telecom licence;
• ask operators to file a fresh registration application;
• provide a new application form;
• prescribe a government filing fee;
• list KYC documents;
• explain an e-KYC procedure;
• explain a D-KYC procedure;
• specify a separate compliance portal;
• create a periodic return;
• set a new audit frequency;
• provide a new inspection schedule; or
• contain its own penalty table.

Its legal function is much narrower: it brings Section 3(7) into force from 21 August 2026.

Operational details should therefore be taken from the applicable Rules and DoT instructions, not inserted into the commencement notification.

Does This Notification Require a Fresh Telecom Licence?

No. S.O. 4616(E) does not create a separate licence or registration simply for biometric user identification.

Section 3(7) operates within the larger authorisation framework of the Telecommunications Act, 2023. Section 3(1) separately deals with the requirement to obtain Central Government authorisation for specified telecom activities.

Existing and new authorisation matters therefore need to be assessed under the relevant authorisation provisions and rules.

They should not be mixed with the commencement of Section 3(7).

This distinction is particularly relevant for businesses researching compliance online because phrases such as "biometric telecom registration" or "Section 3(7) licence" can easily create the impression that a separate application has been introduced. The attached Gazette does not support that conclusion.

Where Could the Real Compliance Difficulty Arise?

The biggest challenge is unlikely to be understanding the two-page notification. The harder part is translating the wider framework into day-to-day operations.

For a large telecom operator, user identification can touch several teams at once: legal, regulatory affairs, customer onboarding, enterprise sales, KYC operations, IT, fraud control, and customer support.

A change that looks minor from a legal perspective may therefore require several systems to communicate correctly.

Business accounts present another practical issue. A company may own hundreds or thousands of active connections spread across offices and employees. The telecom provider may have one record, while HR has another and IT asset management has a third.

If those records are not aligned, identifying the actual end user can become difficult.

The new framework makes that gap worth examining.

What Should Telecom Businesses Do Now?

Rather than redesigning every process immediately, businesses can start with a focused compliance review.

The purpose of this exercise is not to create paperwork for its own sake.

It is to find out whether what the business actually does matches the rules it is now expected to follow.

Will the New Framework Increase Compliance Costs?

Possibly, but the impact will not be the same for every operator.

S.O. 4616(E) itself does not prescribe an implementation fee.

The practical cost is more likely to arise from internal changes: updating technology, adjusting onboarding systems, training customer-facing teams, managing corporate-user records, and reviewing existing processes.

Large operators may already have much of this infrastructure because DoT had KYC, Digital KYC, Aadhaar-based e-KYC, business-connection and reverification instructions before 2026.

For such businesses, the work may be more about aligning existing systems with the new statutory framework.

Smaller organisations may find the process heavier if user-identification controls have historically been spread across different systems or teams.

No single implementation-cost figure should therefore be treated as applicable to the whole industry.

What Are the Possible Benefits?

There is a clear policy logic behind stronger identification of telecom users.

A connection linked more reliably with its actual user can make subscriber records more dependable.

It may also make it harder to maintain connections using false or outdated identities.

For business connections, accurate end-user records can help answer a basic question that can otherwise become surprisingly difficult: who was actually using this connection at a particular time?

Other possible benefits include:

• better traceability of telecom connections;
• more reliable subscriber information;
• clearer accountability for corporate SIMs;
• stronger controls when a business connection changes hands;
• better handling of suspected identity misuse; and

greater consistency between user-identification systems and the new Telecommunications Act framework.

These should be viewed as expected regulatory benefits, not guarantees that identity fraud will disappear.

Is Biometric User Identification a Right Decision or an Additional Burden?

It is both a stronger control and an additional operational responsibility.

From the regulator's side, there is a reasonable case for improving the quality of subscriber identification. Telecom connections can be misused when identity information is false, outdated, or disconnected from the person actually using the service.

From the business side, stronger controls do not come without effort.

The biggest burden is likely to fall on organisations handling very large numbers of users or corporate connections. Updating a single connection is straightforward. Keeping thousands of employee connections correctly mapped while people join, leave or move roles is a different exercise.

The policy therefore looks less like a completely new KYC system and more like an attempt to place a firmer statutory structure around user identification.

Its success will depend on how workable the prescribed processes remain for both operators and genuine users.

A Small but Important Issue in the DoT Implementation Circular

There is also an unusual drafting point business should be aware of.

The DoT PDF currently available on the official portal for instructions under the User Identification Rules contains blank placeholders in parts of its header. The displayed document shows an incomplete date and circular number, and the reference to the notified services is also left incomplete in the text.

At the same time, the same document contains substantive directions, including the three-working-day and seven-working-day requirements for changes in business-connection end users.

This does not justify ignoring the document, but it does mean compliance teams should keep watching the DoT portal for a corrected, replaced, or clarified version.

Where a document itself contains a visible drafting gap, businesses should not fill it with assumptions.

How Corpseed Can Help

Telecom user identification is no longer something that can be checked by looking at one KYC circular.

Depending on the business, the answer may involve the Telecommunications Act, the User Identification Rules, earlier DoT instructions, the company's existing licence or authorisation position, business-connection controls and the way end-user changes are handled internally.

This is where a telecom compliance consultant can help a business turn the legal framework into a practical review of its existing processes.

Corpseed can support relevant telecom operators and businesses with:

• Section 3(7) applicability assessment: reviewing whether the provision and related user-identification requirements apply to the entity and service concerned;
• Telecom regulatory compliance services: examining the wider DoT framework connected with the business activity;
• Telecom KYC compliance assessment: comparing existing e-KYC, D-KYC and reverification processes with applicable requirements;
• Business-connection compliance review: checking authorised-representative and end-user management processes;
• Compliance gap assessment: identifying differences between written procedures and the actual operating process;
• SOP and regulatory-document review: helping teams organise internal user-identification and escalation procedures;
• Telecom authorisation compliance support: where separate authorisation requirements under the Telecommunications Act are relevant; and
• Ongoing regulatory monitoring: tracking relevant DoT notifications, instructions and clarifications.

The purpose of professional support is not to replace the Department of Telecommunications or to guarantee a regulatory outcome. It is to help businesses identify the correct rules, understand what applies to their operations and reduce avoidable gaps between regulatory requirements and day-to-day practice.

Businesses that need help reviewing their user-identification, corporate connection or DoT compliance processes can work with a telecom compliance consultant for a focused assessment instead of treating every telecom notification as a separate filing requirement.

Key Takeaways

Section 3(7) of the Telecommunications Act, 2023 became operational on 21 August 2026 through S.O. 4616(E).

The provision requires an authorised entity providing a notified telecommunication service to identify the user through prescribed verifiable biometric-based identification.

The Gazette itself does not explain the complete KYC process. Detailed implementation has to be read with the Telecommunications (User Identification) Rules, 2026 and applicable DoT directions.

DoT's current implementation instructions expressly refer to e-KYC, D-KYC, and user reverification.

For business connections, an end-user change is particularly important. DoT's portal instructions require intimation within three working days and biometric-based identification of the new end user within seven working days from the change.

Businesses should therefore focus less on creating unnecessary new filings and more on checking whether existing telecom KYC, corporate connection and user-management processes match the current framework.