Y&M AdvisorsField Notes
← All posts
field-notes

Automating SMS and WhatsApp client onboarding under France's 2026 sender-ID rules

  • twilio
  • brevo
  • yousign
  • typescript
  • postgresql
  • ovh
  • cursor
  • sms
  • whatsapp
  • compliance
  • b2b2c

When a business texts you, do you actually know who's sending the text?

In France, until this year, the honest answer was often no: reports of sender-number spoofing to Arcep grew 123% between 2024 and 2025 alone. We recently built a messaging platform that had to fix exactly that.

Three roles are involved:

  • The platform: the software sending the texts and WhatsApp messages.
  • The business clients: the companies paying to use it. A chain of hair salons, a network of car dealerships, a group of clinics.
  • The end customers: the people who actually get the texts. The business clients' customers, not the platform's.

Diagram of three roles: the platform sends the message, the business client pays to send it, the end customer receives it

Three roles: the platform sends, the client pays, their customer receives.

A message has to look like it came from the business client, not from the platform running quietly in the background. This year in France, that stopped being a nice-to-have. It became law.

One shared, anonymous number breaks down fast

The fast way to build this: one phone number, one account, swap the message text per client. Fast to build. Fast to break:

  • One business client gets flagged as spam, and every other client sharing that number pays for it.
  • Billing, delivery history, and support tickets for unrelated clients pile up in one account.
  • The end customer has no way to know which real business is contacting them.

That last point is exactly what regulators are done tolerating.

WhatsApp message from an unidentified sender with no business name, and the recipient replying STOP

No identifiable sender. The only sane response is STOP.

The fix: each business client gets its own number, its own identity, its own history and billing.

Diagram showing one platform connecting to three isolated business clients, each with their own phone number and sender name, each reaching their own separate end customers

Each business client gets its own isolated sending identity. Nobody shares a number.

That part is just engineering. French regulation is what forced it to be provable.

What actually changed in French law

Since 1 March 2026, the Charte Business Messaging 2026 from AF2M governs who can send a business text in France, and under what name, whether the message is a marketing campaign or an appointment reminder:

  • No generic sender names. "INFO" or "ALERT" are banned outright.
  • The sender name must map to a real, registered business. Carriers can demand proof.
  • It applies to all SMS landing on a French network, wherever the sender is based.

Older, but now strictly enforced: a French local number needs a compliance dossier before it can send a single message. Business registration, verified address, named legal representative. Twilio documents this as a "know your customer" check, the kind banks run, applied to phone numbers instead. (On this project, Twilio handled WhatsApp and French number compliance; day-to-day transactional SMS ran through Brevo, at least initially. Brevo's per-sub-account costs run steep before volume arrives, worth revisiting once client count is high enough for economies of scale to change the math, especially since a WhatsApp utility message through Twilio starts at $0.0084 outside the customer service window; a longer message like ours runs close to double that, around $0.017 on this project's own billing.)

Same year, French consumer law flipped telephone prospecting from opt-out (the Bloctel list) to strict opt-in, under Loi n° 2025-594, effective 11 August 2026. Different channel, same direction: anonymous commercial contact is on its way out.

None of this is unreasonable on its own. Apply it to a platform onboarding new business clients every week, and "give them a phone number" turns into a legal case file a regulator can reject.

The manual process: fine once, a mess at scale

Onboarding a business client, by hand, looked like this:

  1. Create a sub-account in the messaging provider's console.
  2. Upload a scan of the business registration document.
  3. Type in the postal address and legal representative's name.
  4. Wait for a review that comes back approved, rejected, or needing a fix.
  5. Once approved, buy a number and copy identifiers between screens to attach the sender name.

Every one of those five steps can cost you an afternoon: a typo, an address format the reviewer rejects, a forgotten field. Every rejection sends you back to step 4.

Tolerable for your first client. Not tolerable once new clients arrive weekly instead of yearly.

WhatsApp made this worse, not better. Since each business client gets exactly one number, every single onboarding is a first-and-only WhatsApp Business Account for that client, and Meta requires the client themselves to complete Embedded Signup to create and own it. Give that number SMS capability and Meta texts the client a verification code directly. Give it voice-only capability instead, and Meta places a call to a number the client doesn't have a phone for, because we do. Someone has to answer that call, so it's routed to Twilio's voicemail Twimlet, which records it, transcribes it, and emails the code over. Then that code has to reach the client fast enough for them to type it into their own Embedded Signup screen before it expires.

The fix, in five steps

The fix wasn't clever engineering. It was making the legal requirement automatic, instead of a manual step someone has to remember every time.

Five-step vertical diagram: isolate the business client, assemble the compliance dossier from existing data, poll for approval instead of blocking, provision the number and identity together, and handle opt-outs centrally

Five steps, running automatically for every new business client.

  1. Isolate the client immediately. A sub-account exists before any number or message does.
  2. Assemble the dossier with zero data retention. Registration, address, legal representative are pulled live from the business's own record and forwarded straight to the compliance provider. The messaging layer never stores a copy, only the resulting approval reference.
  3. Poll for the decision, don't block on it. Rejections surface the exact reason, so they get fixed and resubmitted without starting over.
  4. Provision the number and the sender identity together. No number goes live without a verified identity attached.
  5. Handle opt-outs centrally, once, instead of rebuilding consent logic for every client.

Zero data retention was a deliberate constraint, not an accident: the messaging layer is a pass-through for compliance data, never a second home for it. Fewer places holding a Kbis document means fewer places that document can leak from.

The dossier isn't the only paperwork this replaced. The sender name itself needs a signed Letter of Authorization. That signature is now handled via electronic signature (e.g. Yousign).

Get this right, and a customer sees a safe SMS and a clear WhatsApp message like this: a real business name, a verified link, one tap.

WhatsApp message from a verified business sender with its logo, a clear call-to-action button, and the recipient tapping it

Identified sender, verified link, one tap. This is the target state.

The lesson

None of this needed exotic engineering. It needed noticing early that a compliance requirement scales with the number of business clients, not staying fixed, and building onboarding so compliance is a pipeline, not a checklist.

Next time a French carrier tightens the rules again, and they will, the fix is one change in one place, not a scramble across every client's paperwork.

Stack notes: Twilio and Brevo for messaging, Yousign for e-signature, a TypeScript and PostgreSQL backend, OVH for object storage, built in Cursor.

Further reading and sources