On August 10, 2026, Egypt's National Telecom Regulatory Authority (NTRA) referred the country's four mobile operators to the Public Prosecution over lines registered in citizens' names without their knowledge or possession. Alongside the referral, it suspended bulk sales and activation of new lines through operator systems for corporations and entities, private or governmental. It also ordered operators to text existing holders and have them sign new contracts in their real names, with lines cancelled permanently if they miss the deadline.
The case for acting hard
The regulator's strongest argument is that the harm is severe and the safeguards failed. Enterprise reported that individuals found lines in their names they had never requested, including a student linked to a drug-trafficking case through an unknown line. The Middle East Observer put complaints at roughly 4,000 and said more than 1.5 million people used NTRA's "My Numbers" service to check their registrations. When someone can be tied to a criminal case through a SIM they never held, a line register that does not match real users is a due-process problem as much as a fraud problem. Corporate and government bulk accounts are a plausible channel for that mismatch, because one contract can carry many lines whose actual users are never identified.
A regulator that finds evidence of misuse in a channel is entitled to close that channel while it investigates. The referral of operators, rather than of individual users, also puts responsibility on the parties best placed to fix onboarding controls.
Where the design goes wrong
The problem is the breadth of the remedy and the absence of any stated end point. The NTRA text suspends bulk sales and activation for "corporations and entities" as a class. It gives no date on which the suspension lifts, and it says only that holders must act within "a specified deadline" without naming one. It also sets no conditions under which a compliant operator or business can resume. An indefinite freeze on a whole customer segment is a blunt instrument when the evidenced abuse is a subset of it.
The cost falls on users who did nothing wrong:
- Enterprises onboarding staff. A company expanding a field team, a logistics fleet or a call centre normally buys lines in bulk under one corporate account. Under the freeze it cannot activate new ones through that route.
- Government bodies. Public entities that provision lines for employees face the same halt.
- Machine-to-machine and IoT deployments. Connected meters, vehicle trackers, payment terminals and sensors typically hold SIMs under a corporate account, because a device has no natural person to sign a contract in "their real name." The NTRA announcement does not say whether these SIMs are inside or outside the freeze and re-contracting order. I could not confirm from the published IoT material how such SIMs are treated. That silence is the problem: operators, integrators and device makers must guess, and the safe guess for a risk-averse operator is to refuse.
NTRA does maintain an IoT Regulatory Framework that it says is meant to stimulate investment while governing service inside Egypt. A blanket corporate freeze sits awkwardly beside that stated aim unless the regulator clarifies that legitimately registered machine connectivity continues.
The re-signing order has its own risks
Requiring existing lines to be re-contracted in real users' names is directionally sensible. But it moves a compliance burden onto employees and small firms. A worker who carries a company-issued line must show up in person at a branch, and a line that belongs to a business rather than to a person has no obvious way to comply. Cancellation is permanent and the deadline is unpublished, so a missed text could disconnect a working line. Operators sending mass SMS notices also creates a template that scammers can imitate, which is a fraud risk in its own right.
The measure with the best ratio of benefit to cost is the one that is least disruptive: NTRA also told operators to accelerate biometric identity checks through their apps. The Middle East Observer reported that this was targeted for early September, though NTRA had set no binding date. Verification at the point of activation, tied to a named responsible user, addresses the root cause without stopping a category of legitimate commerce.
What proportionate looks like
A narrower response would keep the enforcement and drop the blanket freeze:
- Publish the deadline and the end conditions. State when the freeze lifts and what an operator must show to resume corporate activations, such as biometric verification of a named custodian for each line.
- Clarify the status of M2M and IoT SIMs. Say plainly whether device connectivity under registered corporate accounts is in scope, and if so, how a responsible entity, rather than an individual, satisfies the identity requirement.
- Allow verified corporate onboarding to resume first. Accounts that already carry verified custodians for each line are the lowest-risk group.
- Publish the evidence. The public number is about 4,000 complaints against a large subscriber base. Disclosing how many involved corporate channels would show whether the freeze matches the problem.
The Daily News Egypt report records the regulator's stated priorities: protecting user rights, safeguarding personal data and preserving the integrity of registration. Those are legitimate goals, and identity-linked registration serves them. But a policy that halts an entire customer segment for an unstated period, without telling connected-device operators where they stand, buys enforcement credibility at the expense of the connectivity that Egypt's digital economy runs on. The fix is to keep the prosecution and the biometrics, and to give business users a defined path back.