Bulk SMS in Malawi means reaching two networks, Airtel and TNM, and following two laws that the same regulator, MACRA, now oversees. The Electronic Transactions and Cyber Security Act 2016 bans unsolicited commercial messages without consent and makes it an offence to keep sending after someone unsubscribes, and the Data Protection Act 2024 gives people the right to object to direct marketing.
Last reviewed: 28 October 2026. This article summarises public rules and is not legal advice. Check edge cases with the regulator.
This guide goes deeper than our short bulk SMS overview for Malawi. It covers MACRA's dual role, what consent and opt-out mean in practice, the 2025 SIM verification drive, writing in Chichewa and English, mobile money habits and a checklist.
Malawi at a glance
| Item | What to know |
|---|---|
| Regulator | MACRA (Malawi Communications Regulatory Authority), for telecoms and, since 2024, data protection |
| Spam rule | Electronic Transactions and Cyber Security Act 2016, section 42 (unsolicited communications) |
| Data protection | Data Protection Act No. 3 of 2024, in force since 3 June 2024 |
| Mobile networks | Airtel, TNM |
| Number format | +265 followed by 9 digits, e.g. +265 99X XXX XXX or +265 88X XXX XXX |
| Languages | English (official) and Chichewa |
| Currency | Malawian kwacha (MWK), written locally as MK |
One regulator, two roles
MACRA has long licensed Airtel and TNM and supervised telecoms. The Data Protection Act 2024 made it the data protection authority too, with powers to issue guidelines, handle complaints and enforce the Act. The Act came into operation on 3 June 2024 under Government Notice 40 of 2024.
For senders this is convenient: the authority that oversees how networks handle bulk traffic is the same one that will look at how you collected the numbers.
Consent and opt-out under the 2016 Act
Section 42 of the Electronic Transactions and Cyber Security Act, headed "Unsolicited communications", says a person shall not send unsolicited electronic communication to a consumer without first obtaining consent. The Act defines "opt-in" as a system where a consumer gives consent to receive communications. A person who continues to send unsolicited commercial communications after the recipient has unsubscribed commits an offence. Section 41 separately requires advertising content to be identifiable as such.
In practice:
- Collect opt-in for promotional SMS: a tick box at sign-up, a signed form at a branch, or a keyword reply.
- Name your business at the start of every message so the sender and purpose are clear.
- Give an unsubscribe route in every promotional message and stop immediately when someone uses it. Continuing after an unsubscribe is the specific act the Act makes an offence.
Direct marketing under the Data Protection Act 2024
The 2024 Act sets the usual principles: process personal data lawfully, fairly and transparently, for specific purposes, and keep it accurate and secure. Section 24(3) adds that where personal data is processed for direct marketing, the data subject may object to that processing. The Act also sets registration requirements for data controllers and processors of significant importance; check with MACRA whether your organisation falls in that group.
The eSMS dashboard keeps an opt-out list for your account. Once a number is on it, any send to that number is blocked, which covers both the unsubscribe offence in the 2016 Act and the objection right in the 2024 Act.
Two networks and SIM verification
Malawi's mobile market is a two-network market: Airtel and TNM. Many people carry both SIMs to get the best bundle, so the same customer may appear twice in your list with different numbers. De-duplicate by customer ID, not by number, and let the customer choose a preferred number.
Store numbers as +265 followed by 9 digits, removing the leading 0 that Malawians usually write (0999..., 0888...). In 2025 MACRA announced a subscriber verification campaign requiring a national ID for SIM registration, with limits on the number of SIMs per person. Numbers that were never verified may have been switched off, so clean old lists with a service message before any campaign and remove numbers that fail.
Chichewa and English
English is the language of banks, government and most formal business messages. Chichewa reaches more people, especially in the Central and Southern regions and in rural areas. A good approach is English for anything with numbers and deadlines, with a short Chichewa greeting or thank-you. "Zikomo" (thank you) is understood everywhere.
Both languages are usually written with plain Latin letters, so they fit the GSM-7 alphabet: 160 characters per message, 153 per part. Some Chichewa spellings use ŵ, which is outside GSM-7 and would switch the message to Unicode (70 characters). Most SMS writers use a plain w.
FARMCO: Fertiliser for {{name}} is ready at Lumbadzi depot from Mon 10/11. Balance MK {{balance}}. Pay via Airtel Money or TNM Mpamba. Zikomo
Payment habits
Airtel Money and TNM Mpamba are the everyday wallets, alongside bank transfers for larger amounts. Kwacha amounts are often large numbers, so write them clearly with a separator, such as "MK 125,000", and never round in a way that differs from the invoice. Name the wallet and give the merchant or till number in the same message.
Use cases
- Agriculture: input collection dates, buying-point notices and payment confirmations for growers.
- Microfinance and banks: loan reminders, transaction alerts and OTPs.
- Health and NGOs: clinic reminders, campaign dates and community notices.
- Schools and universities: fee balances, results notices and term dates.
- Utilities and ISPs: outage notices and token or bill reminders.
Personalised sends by API
curl -X POST https://sms.esmsafrica.io/api/messages/send-bulk \
-H "Authorization: Bearer esms_live_..." \
-H "Content-Type: application/json" \
-d '{
"sender_id": "FARMCO",
"text": "FARMCO: {{name}}, your balance is MK {{balance}}. Pay via Airtel Money or TNM Mpamba. Zikomo",
"recipients": [
{"to": "+265990000001", "name": "Chikondi", "vars": {"balance": "45,000"}},
{"to": "+265880000002", "name": "Mphatso", "vars": {"balance": "12,500"}}
]
}'
Test keys simulate sends without charge. Parameters and scheduling are in the HTTP API docs; for login codes, use eSMS Verify.
Sender ID
Register your brand name as a sender ID, up to 11 characters, on both networks. Networks typically ask for your business registration, an authorisation letter and sample messages. eSMS Africa handles the filing; see the Malawi sender ID page for steps and fees. You can test on the eSMS default sender in the meantime.
Cost
A one-part SMS to Malawi costs MWK 78.3391 ($0.0451) at the basic tier, with MWK 72.7806 and MWK 67.0485 at higher volumes. Pay as you go from USD 20 by card or crypto, with no monthly fee. See pricing and the Malawi coverage page.
Setup checklist
- Check with MACRA whether you must register as a data controller of significant importance.
- Record opt-in for every promotional contact.
- Add an unsubscribe route to every promotional message and act on it at once.
- Normalise numbers to +265 and 9 digits; de-duplicate customers with two SIMs.
- Clean old lists after the 2025 SIM verification drive.
- Register your sender ID on Airtel and TNM.
- Write in English with a Chichewa touch, staying in GSM-7.
- Name Airtel Money or TNM Mpamba correctly in payment reminders.
Frequently asked questions
Is unsolicited SMS marketing illegal in Malawi?
Section 42 of the Electronic Transactions and Cyber Security Act 2016 prohibits sending unsolicited electronic communication to a consumer without consent, and continuing after an unsubscribe is an offence.
Who enforces data protection in Malawi?
MACRA, which the Data Protection Act 2024 designates as the data protection authority. The Act has been in force since 3 June 2024.
Do I need to send on both Airtel and TNM?
Yes, to reach everyone. One eSMS campaign or API call reaches both networks.
Can I write SMS in Chichewa?
Yes. Chichewa written with plain letters stays in GSM-7. Use English for amounts and deadlines and have a native speaker check templates.
Sources
- Data Protection Act No. 3 of 2024 (PDF)
- MalawiLII - Government Notice 40 of 2024 (commencement of the Data Protection Act)
- CIPIT, Strathmore University - Review of the Malawi Data Protection Act 2024
- MalawiLII - Electronic Transactions and Cyber Security Act, 2016
- MalawiLII - Electronic Transactions and Cyber Security Act: commencement notice
- African Wireless Communications - Malawian MNOs to launch subscriber verification in July 2025
Plan your campaign on the bulk SMS page for Malawi, then create an account and test with a free test key. For high volumes or programme-wide rollouts, talk to our team.


