The same signal, two opposite laws

One and the same technical fact —a device observed operating with several chips— is, in Chile, an observation criterion that can end in blocking and, in Uruguay, a ground for exemption.

This is not a legal curiosity. It is evidence that the registration of mobile devices is not a matter of standards but of national law. It is also the starting point of this series.

The indicator that one regulation treats as grounds for requiring proof of the device's title, the other treats as grounds for not blocking it. Neither is mistaken: each solves a different problem in its own market. What does not exist is a single configuration that satisfies both.

What the standard does define, and where it stops

In TS 22.016, 3GPP defines three lists for classifying a device: the allowed, tracked and prohibited lists (“white”, “grey” and “black” in earlier versions), and leaves their use to the operator's discretion. It also defines three query interfaces for four network generations: 2G and 3G share the MAP protocol (Mobile Application Part), with the CHECK_IMEI operation (TS 29.002); LTE uses S13 (TS 29.272), and 5G uses N5g-eir (TS 29.511). And it defines the structure of the identifier: the IMEI is the type allocation code (TAC) plus serial number plus check digit, and when it is queried it travels without the check digit (TS 23.003). In 5G, moreover, the equipment identity register function is optional (TS 23.501): a 5G core can operate without it.

The GSMA, for its part, provides the global identifier and a shared database. It is worth reading what the GSMA itself says about that database in its Device Registry documentation: it does not submit, verify or check the information, which is provided solely by contributors, and it disclaims responsibility for its accuracy, currency and completeness. Operators, in its words, use the data of others to manage their own block list. It follows that blocking does not propagate from one country to another by itself: it depends on each operator importing the information. The third-party access policy, PRD FS.44 v1.0 of 20 January 2021, is expressly declared non-binding, and given its subject matter —who accesses the data and under what conditions— it does not regulate the operator's register.

Taken together, the two layers amount to everything an equipment register brings out of the box: three lists, three interfaces, one identifier and an unverified database that each party decides how to import.

What the standard does not define: when to query the register —that is core network configuration, not a mandate—, blocking deadlines, additional lists, the criteria for placing a device under observation, notification to the user, the burden of proof or reporting to the regulator.

That is where national law begins. And that is where fragmentation begins.

The region's only common floor, and where it stops

There is one binding regional instrument: Decision 786 of the Andean Community (Comunidad Andina, CAN), of 24 April 2013, on the exchange of information on lost, stolen or robbed and recovered mobile terminal equipment, which binds its four member countries: Bolivia, Colombia, Ecuador and Peru. It sets blocking within a maximum of 48 hours from the report, the daily upload and download of information, the unblocking of recovered devices within 48 hours and only by the reporting operator, and the mandatory use of the GSMA database by operators of GSM technology. Its annex defines the minimum record —IMEI, processing date, operator, reason and action— and expressly prohibits including the user's personal information in the exchange.

It is the only common floor. It covers four countries out of fifteen, and its Article 9 leaves the sanctions regime to each country. Above that floor, each jurisdiction built its own.

First divergence: deadlines

The specifications cited set no synchronisation frequency for the register. Several regulators do.

Chile

The operator's equipment identity register (EIR) updates the negative list at intervals of no more than fifteen minutes.

Res. Ex. 207/2026, Article 6

Chile

Moving an IMEI–IMSI combination to the exception list, and moving an irregular IMEI to the negative list or returning it to the exception list, are carried out within one hour.

Res. Ex. 207/2026, Articles 4 and 5

Argentina

Negative list updated three times a day, according to an official communication from the regulator.

ENACOM, communication of 10 August 2023 (Res. 2459/2016)

Dominican Republic

Base Centralizada de Datos del Sistema de Series Negadas (centralised database of denied serial numbers) updated every twelve hours.

Res. 041-20, INDOTEL, Article 7

Peru

For services and devices linked to crimes, blocking within one calendar day of the report; reactivation or unblocking, also within one day.

Res. 134-2025-CD/OSIPTEL, Articles 4.3 and 5.2

Andean Community

Blocking within a maximum of forty-eight hours from the report.

Decisión CAN 786, Article 4

The fifteen-minute refresh that Chile requires and the forty-eight hours of the Andean floor measure different moments in the chain but, in ATC's analysis, the distance between them is not one of nuance: it is one of architecture. A system that reconciles by overnight batch can meet the Andean deadline and does not meet the Chilean refresh.

Second divergence: lists that exist in no specification

The standard returns one status per device. The region asks for more, and asks for different things.

• Chile creates observation and exception lists, and determines status on the IMEI–IMSI combination (the “par” (pair) defined in Article 1 of the resolution), not on the IMEI alone. The standard has no concept of status per combination.
• Dominican Republic inserts a grey list with a legal duration of fifteen calendar days as a tracking period, before the move to the negative list.
• Colombia maintains six grounds in its negative database (base de datos negativa), two of which have no equivalent in any standard: “reincidente” (repeat offender), for IMEIs that, removed after three years in the negative database and subject to six-monthly review, carry traffic again, and “administrativo” (administrative), which covers subscription fraud and unsold inventory and which, according to the regulator, may under no circumstances be used against financed devices in arrears.
• Peru maintains the White List (Lista Blanca) of the national equipment register (RENTESEG) and uses it, together with the holder's history, to decide which devices to block (see the next divergence).

Third divergence: analytical criteria written into the regulation

This is what is most foreign to the standard. Some regulators do not ask for a result: they ask for a method.

The Chilean resolution, published in February 2026, sets out in its Article 2 three criteria for placing an IMEI–IMSI combination on the observation list: spatio-temporal incompatibility between base stations according to a time-and-distance table —excluding satellite and Wi-Fi traffic—, coinciding or overlapping voice calls with the same device, and a single IMEI associated with ten or more different IMSIs during the reporting period. That is not a query to a register: it is correlation of call and signalling records. Blocking comes only afterwards, if lawful title is not proven.

Peru takes another route: it orders the blocking of devices that are not on the White List and that are linked to holders with a history of using devices with an altered IMEI. The criterion combines the status of the device with the history of the person, and the TS 22.016 lists provide for no such attribute.

And Uruguay, as noted at the outset, uses the same indicator as Chile to reach the opposite conclusion.

Fourth divergence: obligations outside the network

Several regimes turn the operator, or the regulator itself, into a component of a procedure that is not its own.

Guatemala requires the regulator to forward updates of the national database to the Public Prosecutor's Office (Ministerio Público) and to the Ministry of the Interior (Gobernación) within a maximum of twenty-four hours. Its Decreto 8-2013 also empowered the regulator, during a thirty-six-month window that has now expired, to provide batches of IMEIs in order to regularise devices: a power over an identifier that is allocated at global level. Bolivia requires that, upon an attempt to activate a device reported as robbed or stolen, the operator physically retain the device and refer it to the Public Prosecutor's Office together with the applicant's details; if the report is for loss, the device is retained and the owner is notified.

None of those obligations can be met with a status query.

One period, three directions

What makes the one-size-fits-all approach unworkable is not only that the regimes differ. It is that they are moving in different directions at the same time.

Three regulators, one period

1. OCT 2025

   Colombia removes

   According to Colombia's Communications Regulation Commission (CRC), from 1 October 2025 blocking for non-type-approved devices ceases to apply, as provided in Resolución CRC 7811, issued on 16 June 2025, which also prohibits making device registration conditional on type approval.

2. FEB 2026

   Chile creates

   Resolución Exenta 207/2026, published on 3 February 2026 and in force from 31 October 2026, establishes observation criteria per IMEI–IMSI combination, a fifteen-minute refresh and one-hour deadlines.

3. APR 2025 – AUG 2026

   Peru escalates

   The Supervisory Agency for Private Investment in Telecommunications (OSIPTEL) reports more than 4.9 million blocking orders since April 2025, as at 11 August 2026, for devices outside the White List and linked to a history of altered IMEIs. It is a regulator's figure released in an official communication, announced together with that month's round of 360,000 devices.

A single set of rules cannot simultaneously satisfy those three regulators. And all three are the same market.

A detail that breaks implementations

There is a small and costly divergence. Chile requires the fifteen-digit IMEI, with the check digit (Article 6). In the query to the register, the identifier travels with fourteen digits, without that check digit, in accordance with TS 23.003. In the 2025 public consultation, before the regulation, a Chilean operator stated to the Undersecretariat of Telecommunications (SUBTEL) that its EIR worked with fourteen digits. If the two formats are not aligned, the query may fail to find what is in fact on the list, without any error flagging it.

The specifications cited define how the check digit is calculated, but not who calculates it or at what point in the chain. In ATC's analysis, that decision once again falls to national law and to each operator's integration, this time in the guise of a formatting detail.

What could not be verified

• Paraguay: blocking within thirty minutes of registration in the regulator's system and the referral to the Public Prosecutor's Office of every attempt to activate a blocked device appear only in 2017 press reports. The instruments are Ley 5629/2016, Decreto 6728/2017 and Resolución CONATEL 647/2017, whose text was not accessible; a 2026 resolution amended those complementary regulations and its content was not verified.
• Honduras: the daily update at 24:00 against the GSMA database and the five-year retention appear in a draft regulation and in a third-party report, not in the official text. The 2017 reform provided for a national database in which the regulator would compare the white list against the negative list; its current operation could not be confirmed in a current official source.
• El Salvador: no specific regulation on blocking device identifiers was located. The absence was verified; it is not asserted that none exists.
• Nicaragua: no national database was documented. Blocking appears as a negative list per operator.
• Mexico: the regulator's agreement with the GSMA dates from 2015 according to a secondary source. The replacement of the Federal Telecommunications Institute (IFT) by the Telecommunications Regulatory Commission (CRT) in October 2025 appears in press reports, and the transfer of that agreement could not be verified.

Processing takes place on the infrastructure the operator defines, so that critical signalling data remain under its control and under the jurisdiction it determines.