The same signal, two opposite laws

One and the same technical fact —a device observed operating with several chips— is, in Chile, an observation criterion that can end in blocking and, in Uruguay, a ground for exemption.

This contrast shows that the registration of mobile devices is defined by national law and not by the standard. It is the starting point of this series.

The indicator that one regulation treats as grounds for requiring proof of the device's title, the other treats as grounds for not blocking it. Both are consistent with the problem they address in their own market, and no single configuration can comply with both.

What the standard does define, and where it stops

In TS 22.016, 3GPP defines three lists for classifying a device: the allowed, tracked and prohibited lists (“white”, “grey” and “black” in earlier versions), and leaves their use to the operator's discretion. It also defines three query interfaces for four network generations: 2G and 3G share the MAP protocol (Mobile Application Part), with the CHECK_IMEI operation (TS 29.002); LTE uses S13 (TS 29.272), and 5G uses N5g-eir (TS 29.511). And it defines the structure of the identifier: the IMEI is the type allocation code (TAC) plus serial number plus check digit, and when it is queried it travels without the check digit (TS 23.003). In 5G, moreover, the equipment identity register function is optional (TS 23.501): a 5G core can operate without it.

The GSMA, for its part, provides the global identifier and a shared database. According to its Device Registry documentation, the GSMA does not submit, verify or check the information, which is provided solely by contributors, and it disclaims responsibility for its accuracy, currency and completeness. Operators, in its words, use the data of others to manage their own block list. It follows that blocking does not propagate from one country to another by itself: it depends on each operator importing the information. The third-party access policy, PRD FS.44 v1.0 of 20 January 2021, is expressly declared non-binding, and given its subject matter —who accesses the data and under what conditions— it does not regulate the operator's register.

Between the two layers, an equipment register has three lists, three interfaces, one identifier and an unverified database that each operator decides how to import.

What the standard does not define: when to query the register —that is core network configuration, not a mandate—, blocking deadlines, additional lists, the criteria for placing a device under observation, notification to the user, the burden of proof or reporting to the regulator.

That space is occupied by national law, and it is there that fragmentation originates.

The region's only common floor, and where it stops

There is one binding regional instrument: Decision 786 of the Andean Community (Comunidad Andina, CAN), of 24 April 2013, on the exchange of information on lost, stolen or robbed and recovered mobile terminal equipment, which binds its four member countries: Bolivia, Colombia, Ecuador and Peru. It sets blocking within a maximum of 48 hours from the report, the daily upload and download of information, the unblocking of recovered devices within 48 hours and only by the reporting operator, and the mandatory use of the GSMA database by operators of GSM technology. Its annex defines the minimum record —IMEI, processing date, operator, reason and action— and expressly prohibits including the user's personal information in the exchange.

That common floor covers four countries out of fifteen, and its Article 9 leaves the sanctions regime to each of them. Above it, each jurisdiction developed its own regime.

First divergence: deadlines

The specifications cited set no synchronisation frequency for the register; several regulators do set one.

Chile

The operator's equipment identity register (EIR) updates the negative list at intervals of no more than fifteen minutes.

Res. Ex. 207/2026, Article 6

Chile

Moving an IMEI–IMSI combination to the exception list, and moving an irregular IMEI to the negative list or returning it to the exception list, are carried out within one hour.

Res. Ex. 207/2026, Articles 4 and 5

Argentina

Negative list updated three times a day, according to an official communication from the regulator.

ENACOM, communication of 10 August 2023 (Res. 2459/2016)

Dominican Republic

Base Centralizada de Datos del Sistema de Series Negadas (centralised database of denied serial numbers) updated every twelve hours.

Res. 041-20, INDOTEL, Article 7

Peru

For services and devices linked to crimes, blocking within one calendar day of the report; reactivation or unblocking, also within one day.

Res. 134-2025-CD/OSIPTEL, Articles 4.3 and 5.2

Andean Community

Blocking within a maximum of forty-eight hours from the report.

Decisión CAN 786, Article 4

The fifteen-minute refresh that Chile requires and the forty-eight hours of the Andean floor measure different moments in the chain, but the distance between them requires a different architecture. A system that reconciles by overnight batch can meet the Andean deadline and does not meet the Chilean refresh.

Second divergence: lists that exist in no specification

The standard returns one status per device; the region's regulators ask for more, and each asks for something different.

• Chile creates observation and exception lists, and determines status on the IMEI–IMSI combination, not on the IMEI alone. The standard has no concept of status per combination.
• Dominican Republic inserts a grey list with a legal duration of fifteen calendar days as a tracking period, before the move to the negative list.
• Colombia maintains six grounds in its negative database (base de datos negativa), two of which have no equivalent in any standard: “reincidente” (repeat offender), for IMEIs that, removed after three years in the negative database and subject to six-monthly review, carry traffic again, and “administrativo” (administrative), which covers subscription fraud and unsold inventory and which, according to the regulator, may under no circumstances be used against financed devices in arrears.
• Peru maintains the White List (Lista Blanca) of the national equipment register (RENTESEG) and uses it, together with the holder's history, to decide which devices to block (see the next divergence).

Third divergence: analytical criteria written into the regulation

This is the divergence furthest from the standard: some regulators set the method as well as the result.

The Chilean resolution, published in February 2026, sets out in its Article 2 three criteria for placing an IMEI–IMSI combination on the observation list: spatio-temporal incompatibility between base stations according to a time-and-distance table —excluding satellite and Wi-Fi traffic—, coinciding or overlapping voice calls with the same device, and a single IMEI associated with ten or more different IMSIs during the reporting period. Those criteria require correlating call and signalling records, something a query to the register does not resolve. Blocking comes only afterwards, if lawful title is not proven.

Peru takes another route: it orders the blocking of devices that are not on the White List and that are linked to holders with a history of using devices with an altered IMEI. The criterion combines the status of the device with the history of the person, and the TS 22.016 lists provide for no such attribute.

And Uruguay, as noted at the outset, uses the same indicator as Chile to reach the opposite conclusion.

Fourth divergence: obligations outside the network

Several regimes turn the operator, or the regulator itself, into a component of a procedure that is not its own.

Guatemala requires the regulator to forward updates of the national database to the Public Prosecutor's Office (Ministerio Público) and to the Ministry of the Interior (Gobernación) within a maximum of twenty-four hours. Its Decreto 8-2013 also empowered the regulator, during a thirty-six-month window that has now expired, to provide batches of IMEIs in order to regularise devices: a power over an identifier that is allocated at global level. Bolivia requires that, upon an attempt to activate a device reported as robbed or stolen, the operator physically retain the device and refer it to the Public Prosecutor's Office together with the applicant's details; if the report is for loss, the device is retained and the owner is notified.

None of those obligations can be met with a status query.

One period, three directions

The one-size-fits-all approach is unworkable because the regimes, besides differing, are evolving in different directions at the same time.

Three regulators, one period

1. OCT 2025

   Colombia removes

   According to Colombia's Communications Regulation Commission (CRC), from 1 October 2025 blocking for non-type-approved devices ceases to apply, as provided in Resolución CRC 7811, issued on 16 June 2025, which also prohibits making device registration conditional on type approval.

2. FEB 2026

   Chile creates

   Resolución Exenta 207/2026, published on 3 February 2026 and in force from 31 October 2026, establishes observation criteria per IMEI–IMSI combination, a fifteen-minute refresh and one-hour deadlines.

3. APR 2025 – AUG 2026

   Peru escalates

   The Supervisory Agency for Private Investment in Telecommunications (OSIPTEL) reports more than 4.9 million blocking orders since April 2025, as at 11 August 2026, for devices outside the White List and linked to a history of altered IMEIs. The figure was announced together with that month's round of 360,000 devices.

No single set of rules satisfies those three regulators at once, and all three belong to the same regional market.

A detail that breaks implementations

There is also a divergence that appears minor and proves costly in practice. Chile requires the fifteen-digit IMEI, with the check digit (Article 6). In the query to the register, the identifier travels with fourteen digits, without that check digit, in accordance with TS 23.003. In the 2025 public consultation, before the regulation, a Chilean operator stated to the Undersecretariat of Telecommunications (SUBTEL) that its EIR worked with fourteen digits. If the two formats are not aligned, the query may fail to find what is in fact on the list, without any error flagging it.

The specifications cited define how the check digit is calculated, but not who calculates it or at what point in the chain. That decision falls, once again, to national law and to each operator's integration.

Processing takes place on the infrastructure the operator defines, so that critical signalling data remain under its control and under the jurisdiction it determines.