Number recycling is not an administrative clean-up task. It is a controlled change of subscriber identity across the HLR, MNP lookup path, messaging estate, DCB authorisation chain and fraud controls. The decisive control is the HLR lifecycle state: it must prevent a released MSISDN from being treated as a live endpoint while historical routing, charging and consent records remain reachable elsewhere in the operator stack.
Establish one authoritative lifecycle for each MSISDN
The host operator and MVNO need one shared state model for the number, even where they operate separate inventory and subscriber-management systems. The minimum sequence is active, barred, terminated, released to quarantine, eligible for reissue and reassigned. These states are not interchangeable. Barring preserves the subscription while restricting service. Termination ends the commercial relationship. Quarantine withholds the number from a new allocation while downstream systems complete withdrawal.
The HLR, or the corresponding HSS or UDM state, should remain authoritative for service access. A correlated number-inventory state must also exist in BSS/OSS, with MNP status maintained as a separate, auditable control. No single record proves that a number is safe to release. The release gate needs agreement across subscriber state, number ownership, portability and downstream withdrawal.
Sequence termination before pool release
A controlled sequence starts with the termination order for the SIM or eSIM profile. It then detaches the IMSI, withdraws the subscriber record, closes service-specific routing, updates portability and interconnect tables, and only then releases the MSISDN into quarantine. Each event should be idempotent. Retries must produce the same terminal state rather than duplicate withdrawals, contradictory timestamps or premature pool release.
A durable correlation identifier should link the MSISDN, IMSI, ICCID or eUICC profile, tenant identifier and termination order. That identifier must survive deletion or archival of the customer-facing account. It gives operations and revenue assurance a stable key for reconstructing the release sequence without treating the recyclable MSISDN as the permanent record key.
Dormancy requires separate treatment. Zero usage, balance expiry or a long period without registration does not prove termination. At a Tier-2 MNO, Western Europe, ~8M subscribers, prepaid expiry and number-inventory timers ran independently. The inventory process identified false release candidates after balance expiry, although the subscriber platform still permitted recharge-led reactivation. The corrective control was an explicit terminated state, not a shorter reconciliation interval.
Treat MNP as a routing-control dependency
Portability data must be checked at each material transition, not appended as a post-termination validation. At termination, the workflow should query the relevant portability database and establish whether the MSISDN remains homed locally, has ported out, or is attached to a pending order. Removing a local subscriber record does not return a ported-out number to donor inventory.
The reverse condition applies to inbound ports. Reassignment should wait until recipient-side routing, HLR provisioning and portability activation agree. If the subscriber is active before portability propagation completes, traffic may continue towards the donor. If portability activates before subscriber provisioning, the recipient can attract calls and messages for an endpoint that is not ready to receive them.
Transition | HLR state | MNP state | Routing action |
|---|---|---|---|
Donor-side termination | Withdrawn locally | Ownership check required | Hold inventory release pending portability result |
Port-out completion | Absent or terminated | Recipient active | Route to recipient; exclude from donor pool |
Inbound port activation | Provisioned and service-ready | Recipient active | Open recipient routing after state agreement |
Control cache behaviour across every route
Lookup policy must be consistent across the SMSC, SBC, voice routing, A2P delivery and IPRN partner paths. Cache TTLs should reflect the portability feed’s delivery characteristics, not a generic network default. Negative responses need bounded caching because an unavailable or not-found result can become stale during an active port. Lookup failure should trigger an explicit exception path rather than an assumption that the number remains on-net.
A Tier-1 MNO, Southeast Asia, ~32M subscribers found that voice and messaging domains consumed the same portability source with different refresh policies. Voice routing reflected completed ports within minutes, while an SMS cache retained the donor result for several hours. The number state was correct in the central database, but delivery remained split by service. The remediation aligned TTLs, added cache-age telemetry and blocked recycling where any routing domain reported an older portability version.
Clear historical reachability from messaging, DCB and fraud systems
Quarantine protects a future assignee only if old identity, consent and risk relationships are detached. Messaging controls may retain MSISDN-to-account associations in delivery policies, A2P suppression lists, RCS registries and consent stores. Before reassignment, these links should be purged or cryptographically severed so that an old subscriber record cannot be resolved through the recycled number.
Payment controls require an independent withdrawal sequence. Merchant mandates, recurring billing tokens and chargeback-monitoring links must be cancelled or detached. The operator should preserve immutable settlement, tax, reversal and dispute evidence under a non-reassignable internal identifier. An MSISDN can remain an indexed attribute for investigation, but it cannot serve as the sole key for a liability record that outlives the subscription.
Fraud engines should score the reassigned MSISDN as a new identity while retaining controlled access to historical abuse evidence. Carrying the former holder’s risk score into the new subscription can block legitimate service. Erasing all history can conceal recycled-number abuse patterns. The practical separation is between decisioning identity and evidential history, with access, retention and purpose controls applied to the latter.
Testing should cover one-time passwords, account recovery, wallet access and high-risk transaction approval. External platforms often treat the MSISDN as durable even after the mobile relationship ends. Those dependencies sit outside the operator’s direct control, but recycled-number tests can identify repeatable exposure by range, merchant or platform. Results should feed quarantine policy and partner escalation rather than remain within fraud operations.
The host should also require each MVNO tenant to attest that its CRM, wallet, identity and consent links have been detached. A host-side all-clear cannot compensate for a tenant retaining the number as an active recovery credential. Tenant acknowledgement should carry the same correlation identifier as the network termination order and form part of the release gate.
Set quarantine intervals from measured exposure
A uniform calendar rule is easy to administer but weak as a control. Quarantine should be parameterised from measured routing propagation, charging finality, portability windows and fraud recovery exposure. The baseline clock should not start when a customer requests closure. It should start only after subscriber withdrawal, MNP confirmation and the required downstream termination events have completed.
Operations should measure the maximum observed propagation time for HLR changes, portability feeds, SBC and SMSC caches, interconnect partner updates and tenant BSS synchronisation. Commercial teams must then add the periods in which late records remain credible: CDR arrival, TAP or roaming adjustment, DCB reversal, A2P delivery receipt and dispute initiation. The resulting interval is an exposure window, not simply a retention preference.
- Baseline quarantine clock
- Starts only after HLR/HSS withdrawal, MNP status confirmation and completion of downstream termination events.
- Routing-propagation allowance
- Set from measured worst-case cache expiry and partner feed latency across voice, SMS, A2P and IPRN paths.
- Commercial-finality allowance
- Covers late CDRs, DCB reversals, settlement adjustments and open dispute windows.
- High-risk extension
- Applied to numbers with recent porting, DCB activity, fraud flags or unresolved identity disputes.
- Reissue release condition
- Requires an auditable all-clear from inventory, portability, charging, messaging and tenant-control systems.
Longer classes are appropriate for recently ported numbers, DCB-active identities, enterprise ranges, numbers under fraud investigation and records linked to unresolved identity disputes. Emergency reissue should remain exceptional. The approval path should name wholesale, fraud, MNP operations and the affected MVNO tenant, record the reason, and state which residual risks have been accepted.
Late-event rates should be reviewed quarterly by source system and age bucket. A parameter that was sufficient before a new portability provider, messaging hub or DCB merchant integration may no longer cover observed propagation. Conversely, sustained evidence of faster finality can support a shorter class for low-risk ranges. Policy should follow measured tails, not averages alone.
Operate recycling as an auditable interconnect control
The operating model must produce evidence that each number was withdrawn, quarantined and reintroduced without residual routing or commercial attachment. A scheduled reconciliation should compare inventory, HLR, HSS or UDM records, MNP status, SMSC routing, SBC routes, DCB authority and tenant records by MSISDN, correlation identifier and lifecycle timestamp.
Mismatches need a severity model tied to release decisions. Active traffic towards a quarantined number, donor routing after port-out, unresolved recipient activation and residual DCB authority should block reissue automatically. Lower-severity timing differences can enter remediation queues, but only where the policy defines a bounded tolerance and the evidence shows no service or charging exposure.
Before return to the available pool, the operator should run test calls, MO/MT SMS checks, MNP lookups and charging probes. The results should be stored against the release decision. For bulk number recovery or range closure, wholesale partners and tenants need defined notification windows, file formats, acknowledgement rules and escalation routes. Exceptional early-reissue requests should use the same controls rather than an offline approval.
Partnership governance should review numbers in quarantine, blocked reissues, late events by source, portability discrepancies and mean remediation time. It should also track repeated failures by tenant, merchant or interconnect partner. That reporting turns recycling from a back-office inventory activity into a measurable routing-quality and revenue-assurance control.
Operator partnership review
Assess lifecycle governance
Averon’s partnership programme provides a framework for operators assessing number-lifecycle governance across Digital MVNO, HLR, MNP and routing dependencies.
As number pools tighten, recycling discipline becomes both a routing-quality and revenue-assurance control. Operators that measure cross-system propagation and enforce a shared release gate will reduce misrouted traffic, inherited payment exposure and avoidable MNP disputes.