SIM Binding and the WhatsApp Business API: What DoT Said

Does India's SIM-binding rule apply to the WhatsApp Business API?

Nobody with the authority to answer has said either way. Neither the Department of Telecommunications (DoT) nor Meta has published anything on how the SIM-binding directions of 28 November 2025 treat the WhatsApp Business Platform, and I checked both on 16 October 2026.

What has been published is specific, and it is worth reading closely because it is shaped around a phone. The government's announcement names WhatsApp as one of eight apps, and it describes two obligations: keeping the app "continuously linked to the SIM card" that is "installed in the device", and logging out "the web service instance of the Mobile App". A WhatsApp Cloud API number has no device in that sense and no WhatsApp web session; a number in the WhatsApp Business app, and a coexistence number, very much does.

This page sets the published wording against each way an Indian business actually runs WhatsApp, and marks precisely where the text stops. It is a reading of public documents, not legal advice. If a compliance decision rests on the answer, take it to a lawyer.

A note on sources, because it matters here. I could not find the directions themselves on the DoT website. The most authoritative texts I could verify are the Press Information Bureau (PIB) release of 1 December 2025, of which DoT hosts a copy as a PDF on its own website, and the government's written answer to Rajya Sabha unstarred question 4331 on 2 April 2026. MediaNama, a technology-policy publication, printed what it presents as the full text of the directions on 29 November 2025. A press reproduction is not a government publication, so MediaNama is cited below only where it is labelled as press; everything else quoted comes from those two government documents or from Meta's own pages.

• Does India's SIM-binding rule apply to the WhatsApp Business API?
• What did the Department of Telecommunications direct on 28 November 2025?
• Is the six-hour WhatsApp Web logout still in force?
• When does SIM binding take effect?
• Where is the SIM in a WhatsApp Cloud API setup?
• Which WhatsApp business setups sit closest to the directive's wording?
• Does a coexistence number count as an app on a phone?
• What happens to a team sharing one number through WhatsApp Web?
• Does a Cloud API team inbox depend on a phone session?
• What has Meta said about SIM binding?
• What can an Indian business check before 31 December 2026?

What did the Department of Telecommunications direct on 28 November 2025?

DoT directed messaging apps that identify users by Indian mobile number to work only with that number's active SIM in the device, and to log their web versions out periodically. The PIB release names the date, the legal basis and the apps:

"DoT issued Directions to major App Based Communication Services on 28.11.2025 under the Telecom Cyber Security (TCS) Rules, 2024 (as amended) to prevent the misuse of telecommunication identifiers and to safeguard the integrity and security of the telecom ecosystem. These include WhatsApp, Telegram, Snapchat, Arattai, Sharechat, Josh, Jiochat and Signal." (PIB — DoT's directions for SIM binding, 1 December 2025)

The two obligations, as the release states them, numbered (i) and (ii) in its list:

"Ensure that the App Based Communication Services is continuously linked to the SIM card (associated with Mobile Number used for identification of customers/users or for provisioning or delivery of services) installed in the device, making it impossible to use the app without that specific, active SIM."

"Ensure that the web service instance of the Mobile App, if provided, shall be logged out periodically (not later than 6 hours) and allowing the facility to the user to re-link the device using QR code." (PIB — DoT's directions for SIM binding)

The same release set the timetable at the time: "Directions mandates to complete the implementation in 90 days and submit the report in 120 days." Counted from 28 November 2025, ninety days ran to 26 February 2026; MediaNama's press copy of the directions counts them "From 90 days of issue of these instructions". That date has since moved, as the next sections show.

Two smaller sentences in the release are easy to miss and matter to a business. The problem DoT describes is apps that let users "consume their services without availability of the underlying Subscriber Identity Module (SIM) within the device in which App Based Communication Services is running" (DoT's copy of the PIB release), which describes an app running on a device that could hold a SIM. And the release carves out travel:

"The direction does not affect the cases where the SIM is present in the handset and the user is on roaming." (PIB — DoT's directions for SIM binding)

Is the six-hour WhatsApp Web logout still in force?

Not as a fixed six hours, according to the government's own answer in Parliament. In its written reply to Rajya Sabha unstarred question 4331, answered on 2 April 2026, the Minister of State for Communications and Rural Development said:

"Under these directions, the web service instances of such mobile apps are required to be logged out on the basis of risk-based analysis. No specific time period has been stipulated for such logging out." (Rajya Sabha unstarred question 4331, 2 April 2026)

That is a clear departure from the "(not later than 6 hours)" in the December release, and the question it answered asked specifically about the six-hour period. Two things follow, and neither should be stretched.

The logout obligation itself still stands: web instances are "required to be logged out". What has gone, on the government's own account, is a published fixed interval. The answer does not say what the risk-based analysis consists of, who performs it, or when the change was made, and I found no revised direction published by DoT explaining it. A press report agrees: MediaNama wrote on 16 October 2026 that "there has not been a revised written direction since then" (MediaNama).

So "WhatsApp Web will log everyone out every six hours" is no longer what the government says, and "the logout was scrapped" is not what it says either.

When does SIM binding take effect?

The government told Parliament the compliance date is 31 December 2026. The same Rajya Sabha answer reads:

"The Government has issued directions to certain app-based communication service providers to link the SIM card (associated with mobile number used for identification of customers/users or for provisioning or delivery of services) present in the device of the customer/user with the communication service apps concerned and has specified the timeframe for compliance with the same as 31.12.2026." (Rajya Sabha unstarred question 4331)

That is well beyond the 90-day window of the original release. The answer was given on 2 April 2026, and when I checked PIB, the DoT website and press coverage on 16 October 2026 I found no later government statement changing it. A date in a parliamentary answer can still move, so treat 31 December 2026 as the date on record when this was written, not as a promise.

Where is the SIM in a WhatsApp Cloud API setup?

Not in any device WhatsApp runs on. The number may still have a SIM somewhere, used to receive the verification code, but the Cloud API is a service your software calls over the internet, and Meta says where the work happens:

"Cloud API processes messages on servers in Meta data centers." (Meta — Data privacy and security)

Where the number does have a SIM, it matters at verification, and Meta's eligibility rule is about receiving a code, not about holding a SIM: an eligible number must "be able to receive voice calls or SMS". The same page lists fixed-line numbers among its phone types, described as "Assigned to physical locations (landline)", with voice verification rated "Standard" and SMS rated "Not Recommended" (Meta — Business phone numbers). A landline has no SIM card at all.

Registration itself, as Meta's registration page describes it, asks for a six-digit two-step verification PIN, not a device:

POST /<PHONE_NUMBER_ID>/register
Content-Type: application/json

{
  "messaging_product": "whatsapp",
  "pin": "123456"
}

And once a number is on the Cloud API, Meta's page says it leaves the phone app behind: "Registered numbers can still be used for everyday purposes, such as calling and text messages, but cannot be used with WhatsApp Messenger (“WhatsApp”)."

Set beside directive (i), the mismatch is plain. The direction speaks of a SIM "installed in the device" in which the app is running, and a Cloud API number has neither an app on a handset nor, in the landline case, a SIM. That is a description of the architecture. It is not a ruling that the directions do not apply, and DoT has said nothing either way about the Business Platform.

Which WhatsApp business setups sit closest to the directive's wording?

The closer a setup is to "an app on a phone with a SIM in it", the more plainly the published wording describes it. The table compares five common arrangements against the two directions as written. The right-hand column is a reading of words, not a legal conclusion, and one gap sits under all five rows: the release names WhatsApp, and neither DoT nor Meta has said whether that includes the separate WhatsApp Business app.

The first two rows are the ones the published text most obviously describes. Meta is reported to be testing SIM checks in the consumer app, as the press report quoted further down describes; nothing published says whether such checks extend to the Business app. The last two rows are where the text runs out. If you are deciding between the app and the Platform for other reasons, the trade-offs are laid out in WhatsApp Business app vs API.

Does a coexistence number count as an app on a phone?

Its app half does. A coexistence number stays live in the WhatsApp Business app on a phone while the same number is connected to the Cloud API, and Meta describes the arrangement in exactly those terms:

"They can still send messages on a one-to-one basis using the WhatsApp Business app, and WhatsApp keeps messaging history between both apps in sync." (Meta — Onboard WhatsApp Business app users)

That page also shows how dependent the connection already is on the phone. Among the reasons Meta lists for a coexistence disconnection is "PRIMARY_INACTIVITY (primary device inactive for approximately 14 days)", and it says businesses "can link up to four WhatsApp “companion” clients to their WhatsApp Business app account on other devices". A coexistence number is therefore the business setup on the Platform that sits nearest the directive's wording, because a phone, a SIM and linked web sessions are all part of it.

What Meta has not said is whether any SIM check in the Business app would reach the Cloud API side of such a number, or what a failed check would do to it. I would not plan around a guess in either direction. What can be done without guessing is to know which phone holds the SIM for each coexistence number, keep that SIM active in that phone, and not rely on a single person's handset you cannot reach. The other things that already change for a coexistence number are collected in what stops working under coexistence.

What happens to a team sharing one number through WhatsApp Web?

It is the arrangement direction (ii) describes most directly. The PIB release explains the concern in one sentence:

"A session can currently be authenticated once on a device in India and then continue to operate from abroad, letting criminals run scams using Indian numbers without any fresh verification." (PIB — DoT's directions for SIM binding)

and it is explicit that the logout is "(its only for web version and not for App version)". For a business, the wording describes a common workaround: putting one WhatsApp Business number on several browsers so a team can answer it, though whether the directions cover the Business app at all is, as above, unstated. WhatsApp's own help article describes today's limits on linked devices:

"You can stay connected by linking up to four devices at a time to your primary phone. You’ll still need your primary phone to register your WhatsApp account and link new devices." (WhatsApp Help Center — About linked devices)

The same article says linked devices "will log out if your phone is unused for over 14 days". Direction (ii) pairs the logout with re-linking "using QR code", and the help article says new devices are linked through the primary phone. Read together, the published texts describe a logout that is undone at the primary phone; how often it happens has, on the government's April answer, no fixed period. When I read the article on 16 October 2026 it said nothing about India or SIM binding. The four routes for sharing one number, including linked devices and their limits, are compared in WhatsApp Business with multiple users.

Does a Cloud API team inbox depend on a phone session?

Not on a WhatsApp phone session. With a Cloud API number, agents work in your own software, which talks to Meta's servers, so there is no QR-linked WhatsApp Web session for a logout to end and no primary phone that has to be opened every fortnight. Whether DoT regards such an inbox as within its directions is, again, something it has not said.

WabaCRM is built on that model: a Meta-verified Tech Provider whose shared inbox runs on the Cloud API, where each agent signs in with their own account and team members are unlimited on every plan. A number can be connected through Embedded Signup, through coexistence or with manual Cloud API credentials, and the choice changes where the phone sits. A coexistence number keeps its phone in the picture, for the reasons in the previous section. How a team inbox divides the work is described in the WhatsApp shared inbox guide.

What has Meta said about SIM binding?

Nothing in its developer documentation that I could find on 16 October 2026. Meta's business phone numbers page mentions SIMs only as practical advice for receiving the verification code, describing mobile numbers as "Assigned to mobile devices/SIMs". The coexistence onboarding page, the Platform setup closest to a phone, does not mention SIMs or India at all. A search restricted to developers.facebook.com, business.whatsapp.com and faq.whatsapp.com returned no page about the Indian directions.

The one statement attributed to Meta came through the press. MediaNama reported on 7 April 2026 that "Meta confirmed to MediaNama that it is testing SIM binding on WhatsApp for regular Indian users" (MediaNama). That concerns the consumer app and regular users, and says nothing about the Business app or the Business Platform. It is a press report of a statement, not a Meta document, and it is not evidence either way about business accounts.

This is also a different regime from India's SMS rules. The SIM-binding directions were issued by DoT under the Telecom Cyber Security Rules; DLT is TRAI's registration system for commercial SMS and voice, and whether it touches WhatsApp is covered separately in is DLT registration required for the WhatsApp Business API.

What can an Indian business check before 31 December 2026?

An inventory, not a prediction. None of the following depends on guessing how DoT or Meta will treat the Business Platform, and all of it is useful whichever way that goes:

1. List every WhatsApp number the business uses and the surface it runs on: the Business app on a phone, the app plus WhatsApp Web, coexistence, or the Cloud API. The table above is the template.
2. For every number that lives in an app, record which phone holds its SIM and who holds that phone. That is the device direction (i) describes, and it is worth knowing whether it is a single employee's handset.
3. Count the WhatsApp Web and linked-device sessions the team depends on. Each is a web session of the kind the government told Parliament must be "logged out on the basis of risk-based analysis", and under WhatsApp's current help text re-linking one needs the primary phone.
4. Read the primary documents, not summaries. The PIB release, DoT's copy of it and the Rajya Sabha answer are the texts on record; check those same places for anything newer.
5. Take legal advice if an obligation turns on the answer. This page reads the published text; it cannot tell you how a regulator will apply it.

Every Meta quotation on this page was read from Meta's own documentation on 16 October 2026, and every government quotation from the PIB release, DoT's copy of it and the Rajya Sabha answer on the same day; all were re-checked word for word on 17 October 2026. Meta and the government change these documents without notice; the linked pages are authoritative and this one is not.