Joris DeeneCLI spoofing—the manipulation of the number that appears on your screen during an incoming call—is a favorite tool of scammers. Since the Royal Decree of May 12, 2024, operators have been required to block international calls that appear to originate from a Belgian number. In a notice dated June 26, 2026, the BIPT clarifies exactly who is responsible for this blocking requirement and how legitimate calls routed through other countries may still go through. The answer to the question in the title: in principle, no—unless the call demonstrably originates from Belgium and the operator retains full control over the caller ID display.
CLI spoofing
In CLI spoofing (CLI stands for Calling Line Identification), the caller’s information is manipulated so that the person receiving the call believes they are speaking with a trusted party, such as their bank or the police. It is often a stepping stone to phishing and further fraud. The vast majority of these fraudulent calls are made from abroad with a Belgian number displayed as the caller ID.
To combat that practice, the Royal Decree of May 12, 2024 adopted pursuant to Article 121/8, § 1 Act of June 13, 2005, on Electronic Communications (hereinafter: WEC). The Royal Decree requires operators to block four categories of incoming international calls, including calls with a Belgian geographic, non-geographic, or mobile E.164 number displayed as the caller ID. It has been in effect since September 1, 2024, for landline numbers and since December 1, 2024, for mobile numbers.
However, the regulation raised questions about its implementation within the sector. With the Announcement of June 26, 2026 The BIPT Council addresses three of these: which operator is responsible for the blocking requirement, to which numbers it applies, and what happens to calls made from Belgium to Belgium but routed through infrastructure abroad.
The Announcement
The notice is not a binding decision but an interpretive explanation of a general nature. It leaves open the possibility that the BIPT may take a different decision under specific circumstances.
The BIPT imposes the blocking obligation on the operator that has a SIP/SBC (Session Border Controller) server on Belgian territory and that is the first to receive the call from abroad originating from a SIP/SBC server located abroad. Because the blocking occurs technically at the switch level, the geographic location of those servers is decisive in identifying the responsible operator. Whether or not an operator has registered with the BIPT (Art. 9 WEC) is irrelevant in this regard. Calls that travel exclusively over Belgian infrastructure and never leave Belgian territory fall outside the scope of the Royal Decree.
The core of the communication concerns relayed or transit calls: calls originating in Belgium and destined for Belgium, but whose routing involves a relay via a SIP server abroad. The Royal Decree does not define the terms “international” and “domestic” calls. The BIPT therefore relies on the objectives of the decree, as set out in the report to the King, which in turn refers to CEPT Recommendation (23)03. Based on this context, the BIPT concludes that the decision targets calls made from abroad, not calls made from Belgium.
On that basis, the BIPT has decided that transit calls may be treated as domestic calls during transit, provided that two conditions are met. First, during transit, the calls must be handled entirely via circuits specifically designated for domestic traffic, separate from international traffic, as required by Article 2 of the Royal Decree. Second, they must remain under the full control of the operator where the call was initiated. By “full control,” the BIPT means technical control over all relevant network elements, end-to-end, up to the interface of the receiving operator in Belgium, so that the calling line identification cannot be altered.
If these conditions are not met and the origin of the call cannot therefore be guaranteed, the call must be treated as an incoming international call, and all rules of the Royal Decree apply. Regardless of any contractual agreements between operators, the receiving operator in Belgium remains solely responsible for compliance.
Legal analysis and interpretation
The BIPT fills a gap in the decree by interpreting the legislature's intent
The BIPT’s most notable choice is methodological. The Royal Decree contains no definition of the terms “international call” and “national call”—precisely the terms around which the entire regulation revolves. Instead of a grammatical or textual interpretation, the BIPT has resolutely opted for a teleological approach: the purpose of the decree, as evident from the report to the King and the underlying CEPT recommendation, is decisive.
That choice is justifiable and even inevitable when the text contains a gap. Nevertheless, it deserves attention. The report to the King is not legislation in the strict sense, and a CEPT recommendation is, by its very nature, non-binding. The BIPT therefore bases its interpretation on instruments that themselves lack normative force, in order to exclude a category of calls (transit calls) from the scope of application that the literal text of Article 1 could indeed cover. This is pragmatic and consistent with the regulator’s apparent intent, but it illustrates how heavily legal certainty in this area relies on soft law.
The concept of full control as a linchpin
The distinction between a permitted transit call and an international call that must be blocked hinges on the concept of full control. The BIPT defines this as end-to-end technical control that prevents the calling line identification (CLI) from being altered en route. This is a functional criterion: it is not the legal structure or contractual relationships that matter, but the actual, technical impossibility of manipulating the CLI.
Legally, this criterion places a significant burden of proof on the operator. Anyone wishing to invoke the “national call in transit” classification will have to demonstrate that they actually maintain end-to-end control. If they cannot substantiate this, the call falls back under the full blocking regime for incoming international traffic. This is consistent with two other provisions set forth in the Royal Decree: pursuant to Article 4, § 2, the receiving operator must disclose the identity of the user behind a specific call within 24 hours, and Article 5 allows the BIPT to revoke or suspend the right to an exemption in cases of abuse or fraud. The operator may therefore invoke the exception, but bears the burden of proof; anyone who fails to demonstrate compliance with the conditions falls back under the strict default regime.
Contractual Agreements Without Discharging Effect
A third point deserves emphasis because of its practical implications. The BIPT explicitly states that contractual agreements between operators do not shift the responsibility of the receiving operator in Belgium. Operators may contractually determine how they mutually ensure compliance, but the receiving operator remains solely liable to the BIPT. This is a classic concept in regulatory law, where public law obligations cannot be contractually waived; however, its explicit confirmation is no minor detail for the sector: it determines who bears the risk when a link in the chain fails.
Specifically, what does this mean?
For receiving operators in Belgium. The obligation to block applies to you as soon as you are the first to receive an international call via a SIP/SBC server located on Belgian territory. Contractual risk sharing with foreign or transit operators remains useful, but does not constitute a defense against the BIPT. Therefore, include robust guarantees and liability clauses in your interconnection agreements, and ensure that you can conclusively trace the origin of all traffic when the BIPT requests a user’s identity within 24 hours.
For operators who route domestic traffic through other countries. If you want your transit calls to be treated as domestic traffic, you must keep domestic and international traffic strictly separate and maintain verifiable end-to-end technical control. Proactively document that separation and that control. The burden of proof lies with you, and a failure to comply will not result in a fine per se, but will lead to your traffic being reclassified as international, resulting in a block.
For companies that use legitimate foreign call centers or cloud services. Customer service and telemarketing calls made from abroad using Belgian geographic numbers are only covered by the exception in Article 4 of the Royal Decree if the numbers are fully controlled by a company established in Belgium and the agreement with the Belgian operator includes a complete list of those numbers. Check whether your current setup for outbound calls meets these conditions, because a non-compliant setup means that your calls will be blocked and your customers will no longer recognize you.
Frequently asked questions (FAQ)
What exactly is CLI spoofing?
CLI spoofing is the manipulation of the caller ID on an incoming call so that the recipient sees a number other than the actual one. Scammers use it to impersonate a bank, government agency, or other trusted contact, usually as a stepping stone to phishing or financial fraud.
Can a company based abroad still call Belgian customers using a Belgian phone number?
This is permitted only under the exceptions set forth in the Royal Decree, such as for customer service or direct marketing, where the Belgian numbers are fully controlled by a company based in Belgium and have been provided to the operator in advance on a list. Outside of these conditions, the operator must block the call or suppress the caller ID.
Who is liable if a spoofed call gets through anyway?
With respect to the BIPT, the receiving operator in Belgium remains responsible for compliance with the Royal Decree, regardless of any agreements it has made with other operators. Mutual contracts cannot transfer this responsibility under public law.
Conclusion
The BIPT’s notice unequivocally places the obligation to block on the receiving operator in Belgium and provides a narrow, technically defined exception for legitimate domestic traffic routed through another country. Anyone wishing to invoke this exception bears the burden of proof regarding end-to-end control over caller ID and cannot hide behind contractual agreements. It remains to be seen whether this clarification will address all questions from the sector; the concept of “full control” will undoubtedly spark new discussions in practice.
Dutch
English