India's small businesses fear higher costs under SIM-binding rule

An Esya Centre study has examined how the DoT's SIM-binding directive could affect businesses. It flags possible disruption, higher costs and doubts over meaningful security gains.

India's small businesses could face higher operating costs and disruptions to daily operations due to the Department of Telecommunications' (DoT) SIM-binding directive, according to a new study by technology policy think tank Esya Centre.

The study, titled Rethinking India's SIM Binding Mandate: An Empirical Assessment, found that restrictions on accessing messaging services across multiple devices could affect businesses that rely on these platforms for customer interactions, employee coordination and service delivery.

Based on surveys of 353 businesses across 17 Indian cities, the study found that 92% of respondents rely on companion-device access, while 86% use the same business number across multiple devices.

The findings point to concerns that restrictions on these arrangements could disrupt workflows, delay communication and increase costs, particularly for micro, small and medium enterprises (MSMEs).

WHY BUSINESSES ARE CONCERNED

The DoT issued its SIM-binding directive in November 2025, asking internet-based messaging applications to ensure that users' accounts remain linked to their registered SIM cards.

The directive initially required automatic logout from web sessions every six hours. This requirement was subsequently replaced with risk-based logouts.

However, the Esya Centre study suggests that businesses could still face operational challenges if they are unable to access messaging accounts across multiple devices.

Around 78% of surveyed businesses said restricting access to a single handset would be extremely or moderately disruptive. As many as 83.5% expect delays and operational errors, while 82% said forced logouts would disrupt ongoing information exchange and workflows.

The concerns are significant because businesses increasingly depend on internet-based messaging services to communicate with customers, coordinate employees and deliver services.

SIM-BINDING COULD ADD TO BUSINESS COSTS

Apart from disruption to daily operations, businesses are also concerned about the financial impact of the directive.

More than three-fourths, or 76.3%, of surveyed businesses expect SIM-linked access restrictions to have an extremely or very significant financial impact.

The study found that 60.6% anticipate higher workplace-related expenses, while 58.6% expect additional expenditure on devices and equipment. Another 55% foresee increased staffing requirements.

These costs could add to the operational burden on smaller businesses that use the same business number across multiple devices.

The study also points to possible changes in consumer behaviour. Around 41% of surveyed consumers said they would obtain an additional SIM card to deal with SIM-binding restrictions, while 30.3% indicated they would purchase a new device.

WILL SIM-BINDING IMPROVE CYBERSECURITY?

The study also questions whether SIM binding would meaningfully improve the security of messaging platforms.

It argues that contemporary cyberfraud increasingly exploits vulnerabilities beyond SIM-based identity verification, including social engineering, compromised credentials and malware.

While 87.2% of surveyed businesses expressed concern about SIM-related fraud, 81% did not believe SIM binding would meaningfully improve security. Among consumers, 59% did not believe the directive would make messaging platforms safer.

The study argues that fraud-prevention measures should focus on the main ways in which unauthorised access and financial deception take place, rather than relying primarily on restrictions on communication access.

The Esya Centre has recommended a more proportionate, risk-based approach to preventing cyberfraud.

It has called for stronger Know Your Customer (KYC) processes, fewer vulnerabilities in SIM issuance, improved fraud-detection systems and action against mule-account networks.

The study has also recommended that major regulatory interventions affecting digital communication systems be accompanied by an assessment of their potential impact on users, businesses, communication resilience and organisational efficiency.

It argues that policymakers should assess both the intended security benefits of such measures and their possible effects on legitimate users and businesses.

The study concludes that fraud prevention measures should be tailored to the ways in which cybercrime occurs, while preserving the accessibility and flexibility of communication services on which consumers and businesses depend.