Business Rules - Telecommunications (EN)

Invariant business rules of the telco domain (EU/UK/international scope). Each rule has a unique code, description, motivation and priority. Rules are referenced in workflows and entities where applicable.

Primary normative sources: EU Regulations, 3GPP/ETSI/GSMA standards, national NRA decisions (AGCOM/Ofcom).

---

BR-01: Per-second billing for consumer contracts

Code: BR-01 Name: Per-second-billing-consumer Description: Voice calls in consumer contracts must be billed per second of actual conversation, with no connection charge or rounding-up. Motivation: Legal obligation in Italy (Law 40/2007, AGCOM delibera 418/07/CONS, in force since 1 June 2018). Similar principles apply in other EU markets under national NRA decisions. Source: AGCOM delibera 418/07/CONS. Entities involved: Contract (type=consumer), Traffic (type=voice) Priority: MANDATORY - violation constitutes contractual breach and NRA sanction Exception: Business (B2B) contracts may have different rounding if explicitly agreed in the contract.

---

BR-02: MNP completion within 3 business days

Code: BR-02 Name: MNP-SLA-3-business-days Description: The mobile number portability (MNP) process must be completed within 3 business days from the customer's request to the recipient operator. Motivation: Regulatory obligation. In Italy: AGCOM Delibera 147/11/CIR. In the UK: Ofcom rules. The donating operator must validate the request within 1 business day. The technical cut-over typically occurs overnight. Source: GSMA PRD IR.26 (general guidelines). Entities involved: Contract (status=pending_portability), SIM (status=ported_out) Priority: MANDATORY - NRA penalties for SLA breach Flow: Customer request → donating operator validation (≤1 day) → technical cut-over → SIM ported_out

---

BR-03: Number portability cannot be blocked

Code: BR-03 Name: MNP-non-blockable Description: The donating operator cannot block or refuse number portability even if the customer has an active contract, unpaid debt, or applicable early termination fee. The right to port is unconditional. Motivation: Right established by the EU Electronic Communications Code (Directive 2018/1972/EU, art. 106) and implemented in national law. Outstanding debt is collectable but cannot block the MNP. Entities involved: Contract, SIM Priority: MANDATORY - absolute regulatory constraint Note: The operator may initiate separate debt recovery but not block the MNP process.

---

BR-04: Roaming data consumption notifications (80% and 100%) - EU

Code: BR-04 Name: RLAH-consumption-notification Description: When a subscriber roaming within the EEA reaches 80% and 100% of the data bundle included in their plan (under EU Regulation 531/2012 "Roam Like At Home"), the operator must send an SMS/push notification. Motivation: Obligation under Regulation (EU) 531/2012, as amended by Regulation (EU) 2022/612. The 100% notification must include the cost for additional out-of-bundle consumption (if applicable). Source: Art. 15 of Reg. (EU) 531/2012. Entities involved: Traffic (type=roaming_data), Contract Priority: MANDATORY for EU consumer subscribers roaming intra-EEA Systems involved: Mediation system (volume monitoring), SMSC (notification)

---

BR-05: Network availability SLA (uptime)

Code: BR-05 Name: Network-uptime-SLA Description: The operator must guarantee the network availability (uptime) level contracted with the customer. For consumer contracts, the minimum expected availability is defined in the Service Charter; for B2B contracts it is defined in the SLA (typically 99.9%–99.99% annually). Motivation: Contractual and regulatory obligation. National NRAs may require publication of QoS measurements. Source: AGCOM Delibera 154/12/CONS (Italy, mobile network QoS measurements). Entities involved: Network, Contract, AccessPoint Priority: MANDATORY - violation generates right to refund or penalty Measurement: MTTR (Mean Time To Repair) ≤4h for P1 incidents; annual availability target ≥99.99%

---

BR-06: SIM cryptographic keys (Ki) never exposed to application layers

Code: BR-06 Name: SIM-key-security Description: SIM cryptographic keys (Ki, OPc - used for AKA authentication) must never appear in application logs, API responses, error messages or unencrypted auditing systems. Motivation: Ki keys are the network authentication credentials. Their exposure would enable SIM cloning (IMSI takeover). Obligation derived from data protection regulation (GDPR) and operator security requirements. Source: GSMA FS.07 (Security Classification). Entities involved: SIM Priority: MANDATORY - violation constitutes a GDPR data breach requiring NRA notification Technical mitigation: Ki keys reside only in HLR/HSS/UDM and the SIM chip; never extracted to business application systems.

---

BR-07: Atomic SIM provisioning (BSS + OSS synchronised)

Code: BR-07 Name: Atomic-provisioning Description: The SIM provisioning process must be atomic: BSS status (CRM + billing) and OSS status (HLR/HSS/UDM) must always be consistent. A partial provisioning (BSS updated but HLR/HSS not, or vice versa) is a domain error that must be detected and corrected. Motivation: A BSS/OSS inconsistency produces billing errors, authentication failures, or active services that are not billed. Requires compensation mechanisms (saga pattern or 2PC). Standard telco sector operational pattern. Entities involved: SIM, Contract Priority: MANDATORY - partial provisioning error generates SLA breach and potential revenue loss SLA: Provisioning error rate must be <0.5% (industry standard KPI).

---

BR-08: IMSI not transmitted in plaintext over radio interface in 5G

Code: BR-08 Name: SUCI-5G-privacy Description: In 5G NR networks, the subscriber's IMSI must not be transmitted in plaintext over the radio interface. SUCI (Subscription Concealed Identifier) must be used - the IMSI encrypted with the operator's ECIES public key. Motivation: Prevention of IMSI catchers - devices that intercept plaintext IMSI transmissions to track subscriber location. SUCI is introduced in 5G Security Architecture (3GPP TS 33.501) as mitigation. Source: 3GPP TS 33.501 §6.12. Entities involved: SIM, Network (generation=5G-SA) Priority: MANDATORY for 5G SA networks - 3GPP security requirement Note: 4G LTE networks do not have this protection; IMSI can be requested in plaintext during Attach. 5G NSA inherits the vulnerability from the 4G core.

---

BR-09: EU Net Neutrality

Code: BR-09 Name: EU-net-neutrality Description: The operator cannot block, selectively throttle or discriminate internet traffic based on origin, destination, content type or application, except for reasonable traffic management to preserve network quality. Motivation: Regulation (EU) 2015/2120, Title IV. BEREC publishes regularly updated implementation guidelines. Zero rating is subject to case-by-case assessment. Source: Reg. (EU) 2015/2120; BEREC Net Neutrality Guidelines. Entities involved: Traffic, Contract, Network Priority: MANDATORY - violation subject to national NRA and BEREC sanction Permitted exceptions: Reasonable traffic management, network emergencies, court orders.

---

BR-10: EU RLAH (Roam Like At Home) wholesale cap compliance

Code: BR-10 Name: RLAH-wholesale-compliance Description: Operators offering Roam Like At Home (RLAH) services within the EEA must ensure their wholesale roaming costs from visited networks do not exceed the caps set by the European Commission, to ensure the retail RLAH obligation is commercially sustainable. Motivation: Regulation (EU) 531/2012 as amended by Regulation (EU) 2022/612 sets maximum wholesale roaming charges for voice, SMS and data. Operators that cannot sustain RLAH at these caps can apply for a sustainability derogation from their national NRA. Source: Art. 6e and 6f of Reg. (EU) 531/2012 as amended. Entities involved: Traffic (type=roaming_data/roaming_voice), Contract Priority: MANDATORY - operators must monitor wholesale roaming costs vs EC-set caps