Sending SMS OTP to El Salvador (+503): rules, routes and delivery design

Numbering, validation and portability

El Salvador's national numbering plan, communicated by SIGET to the ITU and in force since 23 November 2011, uses eight digits for any fixed or mobile subscriber anywhere in the country. The first digit is the National Destination Code: 2 identifies fixed lines, 6 and 7 identify mobile. Freephone and premium ranges use 7 and 11 digits, and 116 111 is the child helpline.

Because national numbers are a fixed length, E.164 validation is simple and worth doing before you spend a message on an unroutable destination.

What published route policy allows

The constraints below are commercial route policy for El Salvador as published by Twilio and retrieved on 17 August 2026. They are not Salvadoran law, they differ between suppliers, and they change without notice. They matter because they decide what your users actually see.

• Route policyTwo-way SMS is not supported, so you cannot rely on the user replying — no reply-to-verify flows, and no reply-STOP handling on the same route.
• Route policyConcatenation is supported, but not necessarily for every sender ID type, and where a message splits depends on character encoding.
• Route policyMMS is converted into an SMS containing a URL, so never send a passcode as an image.
• Route policyAn SMS addressed to a Salvadoran landline is rejected with error 21614: no log entry and no charge, but also no delivery. Filter fixed-line numbers before submission.
• Flowstates viewBecause the sender ID can be rewritten, put your brand name inside the message body as well as in the sender field, so the user can still identify who sent the code.

Salvadoran legal context for messaging

Two instruments matter most for A2P messaging into El Salvador: the consumer protection statute and the 2024 personal data protection statute. Neither is an SMS-specific marketing code, so the obligations have to be read onto your use case rather than copied from a checklist.

• Salvadoran law / officialLey de Protección al Consumidor (Decreto Legislativo 776, as reformed), Art. 18 lit. n): every supplier is prohibited from carrying out commercial and advertising activity, and debt collection against a debtor, co-debtor, guarantor or their relatives, outside business days and hours by means of repetitive SMS, MMS, telephone calls, email or other modalities. The same article defines business days and hours as Monday to Friday, 08:00 to 18:00.
• Salvadoran law / officialArt. 21-C numerals 14 to 16 place further duties on telecommunications operators: easy and free deactivation of SMS/MMS subscriptions through at least the channel used to subscribe, free monthly itemisation of SMS/MMS charges, and a free, easy mechanism for the consumer to cancel receipt of promotions and offers by SMS, MMS, email, phone call or any other advertising channel. These duties are written for operators, not for every A2P sender, but they set the local expectation for how opt-out should work.
• Salvadoran law / officialLey para la Protección de Datos Personales, Decreto Legislativo 144 of 12 November 2024, published in Diario Oficial No. 219, Tomo 445 on 15 November 2024, is now the general data protection statute. Processing personal data requires free, specific, informed, express and individualised consent, and the law grants a right to object that expressly covers profiling for commercial or direct-marketing purposes. Supervision sits with the Agencia de Ciberseguridad del Estado (ACE).
• Salvadoran law / officialThe official sources reviewed for this page do not establish a national do-not-call or do-not-contact registry in El Salvador, nor a statutory requirement to support a specific keyword such as STOP or HELP. Absence of a specific rule is not permission: the consent, opt-out and timing rules above still apply.
• Route policyTwilio's own compliance guidance for El Salvador — vendor best practice, not law — asks senders to obtain opt-in consent, message only during daytime hours unless urgent, support HELP and STOP in the local language, and honour do-not-call lists.

Message design and encoding

Spanish OTP copy fits comfortably in one GSM-7 segment if you resist the temptation to add accented flourishes and emoji. Accented characters such as á, í, ó and ú are not all in the basic GSM 03.38 alphabet, and a single character outside it forces the whole message into UCS-2 — cutting your budget from 160 characters to 70 and typically doubling cost.

• Flowstates viewKeep the code to 6 digits, put it early in the message, and never wrap it in punctuation that autofill heuristics trip over.
• Flowstates viewWrite plain Spanish and avoid characters outside GSM 03.38. "Su codigo Flow2FA es 123456. Vence en 5 minutos. No lo comparta." fits one segment.
• Flowstates viewDo not tell the user to reply STOP on an SMS OTP route into El Salvador: replies are not supported, so the instruction would be misleading. Offer opt-out and support through your app or a documented contact channel instead.
• Route policyNever send a passcode as MMS or an image: it is converted to an SMS with a URL, which both breaks the flow and trains users to click links in verification messages.

Delivery design and fallback

SMS in El Salvador behaves like most Central American markets: mostly fast, occasionally lumpy at peaks, and hard to diagnose from the sending side alone because the sender ID may have been rewritten downstream. Design for the failure case rather than assuming it away.

• Flowstates viewMeasure conversion (codes entered correctly ÷ codes requested), not just carrier-accepted rates. A route can accept everything and still be losing users.
• Flowstates viewRate-limit per identity and per IP, and cap resends: pumping fraud targets exactly this endpoint, and El Salvador is not exempt.
• Flowstates viewLog the sender ID you requested alongside what your provider reports, so you can see when it was overwritten and correlate that with delivery outcomes.
• Flowstates viewRun a pilot on real Salvadoran handsets across more than one operator before launch. Portability means you cannot assume a test number represents the operator its prefix suggests.

Pre-launch checklist

• Flowstates viewValidate destinations as ^\+503[67]\d{7}$ and reject fixed-line 2-prefixed numbers before submission.
• Route policyDecide your sender strategy: pre-registered alphanumeric for Claro El Salvador (allow about a week) or accept an overwritten sender elsewhere.
• Flowstates viewPut the brand name in the message body because the sender ID may not survive.
• Route policyRemove any "reply STOP" wording from Salvadoran SMS templates: two-way SMS is not supported.
• Flowstates viewKeep OTP traffic separate from marketing traffic, with separate consent records, so the Art. 18 lit. n) timing restriction is clearly not engaged.
• Salvadoran law / officialRecord consent in a form that satisfies Decreto 144: free, specific, informed, express and individualised — and make objection to marketing profiling easy to exercise.
• Salvadoran law / officialProvide a free, easy way to stop promotional messaging, mirroring the Art. 21-C expectation even if you are not a telecommunications operator.
• Flowstates viewConfirm with your supplier, in writing, the throughput, sender ID handling and OTP route separation they will actually give you for +503.

How Flow2FA handles El Salvador

• Flowstates viewOne REST API for SMS, WhatsApp where configured, and email, so a Salvadoran fallback ladder is configuration rather than a second integration.
• Flowstates viewSMPP v3.4 binds for teams that already have their own carrier relationships and want Flow2FA for orchestration rather than delivery.
• Flowstates viewServer-generated otpId on /otp/generate and validation against that id on /otp/validate — the same contract everywhere, with no caller-supplied identifiers.
• Flowstates viewSender ID registration for Claro El Salvador, route selection and per-operator throughput are commercial matters we scope per account. Ask us for the current position for +503 rather than inferring it from this page.