A credible MVNO compliance requirements checklist is not a legal appendix to complete after the commercial deal is signed. It is a launch-critical operating tool. A missing consent record, unclear 999 responsibility or unsupported number-porting process can stop sales, breach a wholesale agreement or damage a new brand before it has earned its first renewal.
The difficult part is that compliance does not sit in one place. It crosses the host MNO agreement, the MVNE platform, the SIM and eSIM supply chain, customer care, billing, marketing and security operations. The right framework is therefore not a generic regulatory list. It assigns ownership, evidence and escalation routes to each obligation.
Start with the MVNO model, not the regulation
A light MVNO selling prepaid travel eSIMs has a materially different exposure from a full MVNO with its own core network functions, enterprise IoT estate and post-pay credit book. The legal duties may apply to the entity providing the communications service, but operational duties are often divided between the brand MVNO, MVNE and host operator.
That division must be explicit. Do not assume the host network handles an obligation because it owns radio access, or that the MVNE handles it because its platform processes the data. In a regulatory investigation, customer complaint or security incident, the question will be simpler: who was responsible, and can they prove what they did?
Before building controls, map every customer-facing and network-facing activity. Identify the regulated entity, the contractually accountable party, the operational owner and the evidence holder. Where these are different organisations, include service levels, audit rights and incident notification deadlines in the wholesale contract.
The MVNO compliance requirements checklist
1. Confirm the legal entity and market permissions
Establish which entity contracts with subscribers, bills them and determines the service proposition. That entity is usually at the centre of consumer, privacy and telecom obligations, even where the underlying network is outsourced.
For a UK proposition, assess the applicability of Ofcom’s General Conditions and the wider framework for providers of electronic communications services. In the United States, the position can involve FCC registrations, state-level requirements and obligations linked to the precise service model. Cross-border travel offers add another layer: the country of incorporation is not the only jurisdiction that matters.
Keep a jurisdiction register that records launch markets, applicable authorities, filings, renewal dates and accountable executives. It should be reviewed whenever the MVNO expands distribution, adds a new service type or changes its contracting entity.
2. Turn the wholesale agreement into an operational control map
A wholesale agreement can look comprehensive while leaving important gaps between its schedules. The commercial team may see rates and minimum commitments; the compliance team needs to see operational accountability.
Test the agreement against day-to-day events: a customer reports a fraud loss, a regulator requests records, an eSIM activation fails, a number port is disputed, or a security event affects personal data. Determine who investigates, who communicates with the customer, who informs the authority and who bears the cost.
Pay particular attention to obligations relating to lawful intercept, data retention, emergency calling, network security, SIM registration, number portability and fraud management. Not all will apply in every market or MVNO model. What matters is a documented decision, supported by legal advice where needed, rather than a silent assumption.
3. Design consumer compliance into the customer journey
Most consumer failures are not caused by a missing policy document. They occur when product, marketing and care teams present terms differently, or when a billing engine cannot apply the promises made in an advert.
Review the full journey from advert to cancellation. Customers should understand pricing, allowances, fair-use conditions, roaming treatment, renewal mechanics, service limitations and routes for complaints. Pre-contract information, contract summaries and notices must be delivered in the form and timing required in each market.
This matters especially for low-cost and travel-led MVNOs. A headline price can be commercially powerful, but undisclosed activation charges, restricted roaming destinations or automatic renewal wording will create avoidable disputes. Compliance should review the actual checkout screens, eSIM activation emails and agent scripts, not just legal copy stored in a shared folder.
4. Put privacy and data governance around the real data flows
An MVNO may hold identity data, CDRs, location-related information, usage records, payment details, support transcripts and device identifiers. These data sets are spread across CRM, billing, care, analytics, anti-fraud and wholesale platforms.
Maintain a data map that shows what is collected, why it is processed, where it is hosted, who receives it and how long it is retained. Confirm whether the MVNO, MVNE and host MNO act as controllers, processors or equivalent roles under the applicable privacy regime. The answer may differ by processing activity.
A practical evidence pack should include:
- data-processing agreements and international transfer mechanisms;
- retention and deletion rules for subscriber and usage data;
- consent records for marketing and optional data uses;
- a tested subject-access and deletion request workflow; and
- breach triage procedures with clear notification deadlines.
Do not confuse a privacy notice with privacy governance. If the business cannot locate a subscriber’s data across its supplier chain, it cannot reliably honour the rights described in that notice.
5. Treat security as a supplier-chain discipline
The most common MVNO security weakness is fragmented accountability. The brand may own the customer relationship, the MVNE may operate provisioning and charging, a third party may distribute eSIM profiles, and the host MNO may hold network-level logs.
Set minimum security requirements for each supplier, then verify them. Access controls, privileged-account management, encryption, vulnerability handling, security monitoring and incident response need practical evidence, not a questionnaire completed during procurement two years ago.
The trade-off is speed. A start-up MVNO cannot conduct the same depth of supplier assurance as a national operator on day one. It can, however, focus on the systems that expose subscriber data, enable SIM swaps, issue refunds or alter service configuration. Those are the controls that protect both customers and commercial continuity.
6. Make payments, credit and fraud controls proportionate
If the MVNO accepts card payments, payment-card security responsibilities must be allocated across the payment provider, billing platform and brand. If it offers post-pay service, handset finance or high-value enterprise connectivity, add credit assessment, collections and fraud controls to the operating model.
SIM-swap fraud, account takeover and unauthorised porting deserve particular attention. Define the verification threshold for changes to a subscriber’s SIM, eSIM profile, payment method, account email and porting instruction. Excessive friction will hurt conversion and care costs; weak verification can lead to direct customer loss and regulator attention.
Measure fraud controls by outcomes. Track failed verification attempts, unusual activation patterns, chargebacks, disputed ports and time to contain an incident. A policy without operational telemetry is a statement of intent, not a control.
7. Test emergency, portability and service-continuity duties
Emergency calling is an area where technical architecture and regulatory responsibility meet. The capabilities expected from a conventional mobile service may not map neatly to a data-only travel eSIM, an app-based voice product or a business IoT offer. Document what the service supports, what it does not support and how that is communicated to users.
The same principle applies to number portability, service suspension and outage communications. Test the hand-offs between the MVNO, MVNE and host network before public launch. A porting process that works in a spreadsheet but fails when a customer has an overdue balance, an active eSIM and a disputed identity record is not ready for scale.
Run incident exercises with named participants from customer care, network operations, legal, communications and the wholesale partner. The objective is not to create theatre. It is to expose decision delays before they become customer-facing failures.
8. Govern compliance as a commercial operating rhythm
Compliance needs a calendar, not a one-off launch project. Assign an executive owner, maintain a register of obligations, review supplier performance and record material decisions. Product changes should trigger a compliance assessment before build begins, particularly when introducing eSIM, roaming bundles, device finance, enterprise management portals or new data-sharing arrangements.
A monthly control review is usually sufficient for an early-stage MVNO, provided serious incidents are escalated immediately. As the subscriber base, jurisdictions and service catalogue grow, formal risk committees and internal assurance become more useful. The aim is disciplined visibility, not a bureaucracy that blocks product decisions.
The best test is simple: if a regulator, host MNO or enterprise customer asked for evidence tomorrow, could the team show who owns each requirement, how the control operates and what happened when it last failed? Build the checklist so the answer is available in hours, not assembled under pressure over several weeks.
