Mandatory call blocking in Europe: Sweden, Italy, Spain and the UK
By Dmitry B. Updated 7 min read
In 2026, four European countries moved from asking telecom providers to fight spam and scam calls to requiring it. Sweden now makes providers block suspected spam and scam calls using traffic data only, and Spain makes operators block commercial-looking calls that don’t come from its new 400 range. Italy and the UK went after a different link in the chain: they fined the companies that handed out phone numbers without checking how their customers used them.
| Country | What changed | When | Who it applies to |
|---|---|---|---|
| Sweden | Providers must not connect a call or deliver an SMS when traffic data suggests it is a spam or scam attempt. Traffic data only, never content | In force Aug 1, 2026. PTS rules expected early 2027 | Providers of number-based services |
| Spain | Commercial calls may only come from nine-digit numbers starting with 400. Operators block commercial-looking calls from other numbers | Oct 17, 2026 | Operators, contact centers, outbound teams |
| Italy | AGCOM fined two number holders for not checking the numbers their call center customers used | Orders Sep 23, announced Oct 12, 2026 | Number holders, wholesale and CPaaS providers |
| UK | Ofcom fined a number range holder for no know your customer (KYC) checks and no misuse monitoring | Oct 21, 2026 | Anyone who sub-allocates numbers |
Two shifts behind the new rules
Read together, the four moves point in two directions.
Block on signals, not on what was said. Sweden tells providers to decide from traffic data: the calling and called numbers, the time, the duration and the sender name. Spain asks operators to block on behaviour, such as very high call volumes from numbers outside the 400 range. Neither asks anyone to listen to calls.
Whoever holds the number answers for it. Italy and the UK did not fine the people making the calls. They fined the companies that gave those callers numbers and did not check what happened next.
Sweden: a legal duty to block
Since August 1, 2026, providers of number-based services in Sweden must not connect a call or deliver an SMS when traffic data gives reason to believe it is part of a scam or meant to mislead a wider group of people. PTS, the Swedish telecom regulator, confirms the date and that the decision must rest on traffic patterns, not on the content of the call or message.
The law draws three clear lines:
- The test uses traffic data, never content.
- There is no general duty to monitor all traffic.
- A high number of calls alone is not enough to block.
PTS supervises the rule and expects to publish its detailed rules in early 2027. A Bird & Bird summary notes there is no direct administrative fine for now, but PTS can issue orders backed by conditional fines.
CLI spoofing: why Italy and the UK now fine number holders
CLI, or calling line identification, is the UK and EU name for caller ID. CLI spoofing means a call shows a number that isn’t the real caller’s. On the receiving end, apps such as Identity Phone focus on verified caller identity, so the person answering can tell whether the caller really is who the screen says. Both regulators below treat the company that holds and hands out numbers as responsible for checking how they are used.
Italy: AGCOM fines over call center numbers
On October 12, 2026, AGCOM, the Italian communications regulator, announced two fines under orders 229/26/CONS and 230/26/CONS of September 23, 2026:
- Retelit Digital Services: EUR 700,000
- Tekmind: EUR 122,500
AGCOM found that both failed to check the numbers their call center customers used, including spoofed numbers.
The same release reports what Italy’s anti-spoofing filters, in place under order 106/25/CONS, achieved. In the first eight months of 2026 they blocked about 191 million calls from abroad that carried a fake Italian caller ID. That is about 790,000 calls a day, or 7.2% of international calls. After Italian mobile numbers were added to the filter, calls from abroad showing an Italian mobile number fell 95%.
UK: an Ofcom fine for number misuse
On October 21, 2026, Ofcom fined Tismi GBP 437,500 for failing to prevent scammers from misusing its phone numbers. Ofcom found that between November 2022 and January 2025 the company:
- did not carry out adequate KYC checks before sub-allocating numbers
- did not monitor for misuse
- had no documented process to act on misuse reports
About 366,000 sub-allocated numbers were affected. The fine includes a 30% reduction because the company admitted the breach.
“There’s no excuse for communications providers failing to put in the proper checks and balances to prevent numbers being misused,” said Ofcom’s George Lusty.
Spain: the 400 prefix
From October 17, 2026, commercial calls in Spain may only be made from nine-digit numbers starting with 400. These numbers can make calls but cannot receive them. Operators must block calls that look commercial, for example very high call volumes, when they come from other numbers.
The ministry says its 2025 plan had already blocked more than 400 million spam and scam calls and nearly 32 million SMS. For outbound teams calling Spain, campaigns now need 400 numbers, and high-volume traffic from other ranges may not get through.
What these rules have in common
The rules differ by country, but the questions they raise for a provider are similar:
- Can you score a call from number and traffic signals alone, without touching content?
- Do you know who holds the number a call claims to come from?
- Do you see when a number you hand to a customer gets flagged?
- Do you have a written way to handle a misuse report?
These are questions to check your own setup against, not legal advice. Each regulator’s text sets the actual requirement.
The US is on a similar path through the FCC’s Robocall Mitigation Database. Our post on robocall mitigation database removals covers that side, and more is in our robocalls articles.
Where CallerAPI fits
None of this replaces reading the rules in each country. CallerAPI gives providers the signals to act on:
- Robocall scoring API: decides from number reputation and caller ID checks, never call content, and returns a deterministic block or allow decision.
- Falcon: our free, self-hosted robocall firewall, which can block on those same signals.
- Carrier lookup API: current carrier, line type and porting status, to spot a caller ID that doesn’t match the network a call arrives from.
- DID reputation monitoring: see when a number you hold gets flagged.
- Spam phone number database: a feed refreshed every minute, for providers who build their own blocking logic.
We accept and score numbers from any country, with the deepest complaint data in North America.
Check how a number scores or talk to our team about your traffic.
FAQ
Does Sweden’s law let carriers listen to calls?
No. The decision must rest on traffic data such as the numbers involved, time and duration, never on what was said.
When do Sweden’s detailed rules arrive?
PTS expects to publish them in early 2027.
What is the 400 prefix in Spain?
A nine-digit, call-only number range that Spanish commercial calls must use from October 17, 2026.
Why did Ofcom fine Tismi?
Ofcom found it did not carry out adequate KYC checks before sub-allocating numbers, did not monitor for misuse and had no documented process for misuse reports, between November 2022 and January 2025.
What is CLI spoofing?
CLI is calling line identification, the UK and EU term for caller ID. CLI spoofing is when a call displays a number that does not belong to the real caller.
Look up a number
Open the public record for any number. See the complaint count and the subject.
Look up a number
