Ofcom number misuse: what General Condition B1 requires of providers
In short: In Ofcom number misuse investigations opened on 24 September 2026 into Vonage Business Limited and Voxbone SA, Ofcom is examining whether each provider took all reasonably practicable steps to secure that its business customers, in using telephone numbers, complied with Ofcom’s numbering rules (General Condition B1.8), and met the duties on effective and efficient use in B1.6 and B1.9(c). The steps Ofcom expects are in its good practice guide of November 2022.
A Communications Provider that sub-allocates or assigns telephone numbers to business customers must take all reasonably practicable steps to secure that those customers, in using the numbers, comply with Ofcom’s numbering rules. Ofcom is now investigating two providers on that basis, as part of its programme against phone and text scams. The steps Ofcom expects are in guidance it published in 2022, and Ofcom has not yet decided a case under the programme that applies that guidance.
What General Condition B1 requires of a provider that sub-allocates or assigns numbers
A range holder (a Communications Provider that Ofcom has allocated a block of telephone numbers to) must secure that those numbers are “Adopted or otherwise used effectively and efficiently” (General Condition (GC) B1.6). Any Communications Provider must take all reasonably practicable steps to secure that its customers, in using telephone numbers, comply (where applicable) with Condition B1, the National Telephone Numbering Plan and the Non-provider Numbering Condition (GC B1.8). And a provider must not transfer use of numbers from the Numbering Plan unless, among other things, the numbers are Adopted or otherwise used effectively and efficiently (GC B1.9(c)). The text is in Ofcom’s General Conditions of Entitlement.
“Allocated” and “Adopted” carry statutory meanings. Ofcom Allocates numbers to a person. A provider Adopts a number when, among other things, it is “allocating or transferring that number to a particular customer” or “authorising the use of that number by others” (section 56(6) CA 2003). A provider that has not been Allocated a number may Adopt it only where the person Allocated it has authorised it, directly or indirectly, to do so (GC B1.2). The Numbering Plan designates each number range for a purpose, and a number may be Adopted or otherwise used only in accordance with that designation (Numbering Plan, Part B, paragraph B1).
Ofcom sets these conditions under section 45 of the Communications Act 2003 (CA 2003). Under section 58(1)(i), a general condition may require a provider to secure compliance by its customers with Ofcom’s rules on the use of numbers, and B1.8 is a condition of that kind. A customer that is not itself a Communications Provider is bound directly only by the Non-provider Numbering Condition, which Ofcom sets under section 59 and may enforce in civil proceedings, and which covers two cases: advertising an unbundled tariff number, where the service charge must be shown (Condition 1), and using a telephone number as a Global Title, a network address used for signalling between mobile networks (Condition 2).
Ofcom opened the investigations into Vonage Business Limited and Voxbone SA on 24 September 2026, on B1.6, B1.8 and B1.9(c). In announcing them, Ofcom said it expects providers to run “know your customer” checks on business customers, to keep each customer’s risk under review by monitoring for misuse, and to respond to incidents. Ofcom has made no finding against either provider; it will decide whether there are reasonable grounds to believe each has contravened the conditions. Both investigations form part of Ofcom’s enforcement programme into phone and text scams, which Ofcom opened on 1 February 2024 and extended on 17 October 2025. Two earlier investigations under the programme, opened in October 2024 and April 2025 on overlapping B1 conditions, had no published outcome on 30 September 2026. In June 2025 Ofcom directed the first of those providers, under GC B4.4, to block calls and messages to and from specific numbers linked to fraud.
The steps Ofcom counts as reasonably practicable
Ofcom’s good practice guide to help prevent misuse of sub-allocated and assigned numbers, published on 15 November 2022, does not bind anyone, but Ofcom has said that in number misuse cases it would “expect to take the Guide into account in considering whether enforcement action is appropriate”. A provider is within the guidance whenever it sub-allocates numbers to another provider or reseller (a sub-allocatee) or assigns them to an end user, for use for the purposes of, or in connection with, a business, including where a sub-allocatee further sub-allocates or assigns them.
Before transferring numbers, a provider is expected to collect a business customer’s registered company details, trading names, registered office, the nature of its business, its existing numbers and websites, and the contact details of the senior manager responsible for numbering (paragraph 3.5). Further checks include the Companies House register and disqualified directors, the fraud risk databases of Cifas (the UK fraud prevention service), the FCA register where relevant, the individual insolvency register, and links to accounts the provider has already blocked (paragraph 3.8).
Indicators of a higher-risk customer include a request for numbers that does not match the stated use, sign-up outside business hours, a generic email address, use of a virtual private network (VPN), and a non-UK IP address for a business that claims to be UK-based. A combination of indicators may identify such a customer where a single indicator does not (paragraphs 3.11 and 3.12). The provider is expected to document its checks, and where they identify a potential risk, a senior manager is expected to decide, with written reasons, whether to sub-allocate or assign numbers (paragraphs 3.14 and 3.15).
| Stage | What Ofcom expects the provider to do | Guide paragraphs |
|---|---|---|
| Before transferring numbers | Run basic and further customer checks, test the stated use against the volume requested, and record the checks and the senior manager’s decision | 3.5, 3.8, 3.9, 3.14, 3.15 |
| When more numbers are requested | Consider checks on every request, apply further checks to a significant request, and carry out further due diligence where a higher-risk customer asks | 3.10, 3.13 |
| After transfer | Keep each customer’s risk under review, monitor use such as outbound call volume and duration, and reassess after complaints or a major change to the customer’s company structure | 4.4, 4.5, 4.7 |
| On a report of misuse | Review the evidence, act in a timely way, and block, suspend or withdraw numbers in proportion to the risk | 5.2 to 5.4, 5.8 to 5.11 |
The checks are how a provider shows it took the steps B1.8 requires. B1.6 and B1.9(c) impose outcome duties: the range holder must secure that its numbers are Adopted or otherwise used effectively and efficiently, and a provider must not transfer use of numbers unless that is so. Ofcom has not yet decided a case under the programme on whether a provider that followed the guide in full has also met B1.6 and B1.9(c) where its numbers were misused anyway.
For business text messaging, Ofcom has made comparable checks mandatory. In its 15 July 2026 statement on mobile messaging scams, Ofcom set new rules requiring mobile operators and business messaging aggregators to run know your customer checks on business senders, applying from 15 July 2027. For telephone numbers the checks remain guidance, measured against B1.8. Ofcom regulates other methods scammers use under separate rules, including the ban on leasing Global Titles and the Calling Line Identification rules on the caller’s number shown to the person called.
Contract terms between a provider and its business customers
A provider secures compliance by its customers, and by their customers, largely through its contract with them. Ofcom expects that contract to require the customer to use numbers in compliance with GC B1, the Numbering Plan and the Non-provider Numbering Condition and, where appropriate, to require a sub-allocatee to take all reasonably practicable steps to secure compliance by its own customers (paragraph 4.2). The responses to misuse that Ofcom lists, which are requiring urgent action from the customer, temporary blocks, suspending services and withdrawing numbers, are contractual controls, and a provider can use them only if its contract gives it the right to do so (paragraph 5.10).
Ofcom encourages providers to inform the range holder of suspected incidents of misuse, with details of the customer, the incident and the steps taken (paragraph 5.13), and a contract term can make that report obligatory. Ofcom also expects checks to be considered whenever a customer asks for more numbers (paragraph 3.10), which a provider can apply only if its contract allows it to refuse or delay the request.
For a buyer of a range holder or a sub-allocatee, the records Ofcom expects are the evidence of B1 compliance: documented checks and senior manager decisions, risk reviews, the record of misuse investigations and their outcomes (paragraph 5.2), and any request Ofcom has made under GC B4.4 to block access to numbers. A penalty for breach of a general condition falls on the provider that committed it. Under section 97 CA 2003 the penalty may not exceed ten per cent of the turnover of that provider’s relevant business, generally for the year ending with the 31 March before Ofcom gave notification under section 96A. On a share sale the provider is unchanged, so the target company remains liable to any penalty. Those records fall within regulatory due diligence on the deal.
Viewpoint
I read the two investigations as Ofcom applying its 2022 guide as the working test for B1.8. Ofcom says the programme aims to “ensure telecoms providers are complying with our rules and taking into account our industry guidance”. Neither earlier investigation under the programme has produced a published decision, so the 2022 guide remains Ofcom’s published account of the steps it expects of a provider that sub-allocates or assigns telephone numbers.
Several of the higher-risk indicators in paragraph 3.11 of the guide, including sign-up outside business hours, a VPN, a generic email address and a non-UK IP address, are features of online self-service sign-up. Where a provider sub-allocates or assigns numbers through an automated flow with no human review, those checks can only be applied inside the flow itself. Ofcom has said it will publish an update on each investigation in due course, and until it does, the 2022 guide remains the published statement of what Ofcom will take into account.
Frequently asked questions
What is General Condition B1.8?
General Condition B1.8 requires a Communications Provider to take all reasonably practicable steps to secure that its customers, in using telephone numbers, comply (where applicable) with Condition B1, the National Telephone Numbering Plan and the Non-provider Numbering Condition. Ofcom sets it under sections 45 and 58 of the Communications Act 2003.
Is Ofcom’s good practice guide on number misuse binding?
No. Ofcom’s good practice guide of 15 November 2022 is guidance, not a condition. Ofcom has said it would expect to take the guide into account in considering whether enforcement action is appropriate in number misuse cases, so the steps in the guide are the steps Ofcom will look for when it assesses compliance with General Condition B1.8.
What penalty can Ofcom impose for breach of General Condition B1?
Ofcom may give a provider a notification under section 96A of the Communications Act 2003 that sets out the contravention and any penalty Ofcom is minded to impose. Under section 97 the penalty may not exceed ten per cent of the turnover of the provider’s relevant business for the relevant period.
For advice on General Condition B1 compliance, number sub-allocation contracts or an Ofcom investigation, contact Rob Bratby at Bratby Law.
