GSMA Open Gateway API Certification and Regulatory Innovation Consultant

BACKGROUND INFORMATION

Within the framework of the project "Regulatory Innovation in Central America and the Dominican Republic" (Project 9RCA24005, Contract N.º 700001869), implemented by the International Telecommunication Union (ITU) with the financial support of the European Union Global Gateway, ITU is supporting beneficiary countries in the operationalization of regulatory sandboxes and other innovation mechanisms, and in strengthening institutional capacities to foster agile, evidence-based regulation in the telecommunications and digital ecosystem.

The purpose of the consultancy is to provide specialized technical advisory support to the pilot, “Support for promoting innovation and user protection through access to Application Programming Interfaces (APIs) with the Groupe Spécial Mobile Association (GSMA) Open Gateway/CAMARA standard”.

The pilot supports participating operators, through the regulator, in taking steps towards the development and launch of the SIM Swap and Number Verification APIs. Support will be differentiated according to each operator’s systems, capabilities and specific needs. The assignment will support one participating operator in preparing a GSMA Open Gateway certification submission, develop an operator-specific methodological guide, financial-sector workshop, and document lessons learned and guidance arising from the pilot.

TERMS OF REFERENCE

Under the direction of the Director of the ITU Regional Office for the Americas and the guidance of the Project Manager and the project technical team, and in close coordination with the Superintendencia de Telecomunicaciones (SUTEL) of Costa Rica. The consultant will perform the following activities:

• Support GSMA Open Gateway conformance and certification preparation for one participating operator by advising its development team on the preparation, execution and documentation of conformance tests for the SIM Swap and Number Verification APIs, schedule the initial coordination call and conformance test-window with the GSMA, maintain the certification calendar, document test results, and compile the certification package up to the point of submission to the GSMA. Certification is issued by the GSMA and remains outside the control of the consultant and the project.
• Prepare and validate an operator-specific methodological guide for the development and launch of the SIM Swap and Number Verification APIs, cover architecture options, direct or aggregator-based exposure models, identity and consent, testing and conformance, and a roadmap towards launch and certification. Validate the guide with the technical counterpart designated by the operator. The operator’s team remains responsible for writing, deploying, owning and maintaining all code.
• Coordinate a possible pilot test of the SIM Swap and/or Number Verification APIs between a participating operator and one or more financial institutions, to document the benefits of this technology for fraud prevention in the financial sector should interest arise.
• Develop technical inputs and materials for the financial-sector workshop in coordination with ITU and the GSMA, covering relevant frauds-prevention use cases for banks and fintech companies, including documented cases concerning fraud reduction in other markets. ITU is responsible for workshop logistics and SUTEL for convening participants.
• Document lessons learned and prepared guidance for SUTEL on the use of non-regulatory measures to promote competition in the telecommunications sector, using network APIs as a case study, and document sustainability plans for participating operators. Ensure that operator-specific technical information is treated as confidential and that information included in cross-operator or public facing outputs is anonymized unless written authorization for disclosure has been obtained.

CONCRETE DELIVERABLES

In addition to the technical progress reports, the consultant will deliver the following key outputs, each subject to SUTEL technical no-objection and written approval by the ITU PIRCA team:

• Submission of technical progress reports every 20 working days, documenting planned and completed activities, accomplishments, achieved results, deliverable status, outstanding issues, risks and dependencies with. the first report due 20 working days after the contract start date, also including a detailed work plan, certification calendar, milestone and delivery schedules and stakeholder-coordination arrangements.
• GSMA Open Gateway certification package, comprising the conformance evaluation report for the SIM Swap and Number Verification APIs, signed by the participating operator, supporting test evidence and the complete certification submission package, prepared up to the point of submission to the GSMA.
• Delivery of operator-specific methodological guide and financial-sector workshop package, comprising a validated methodological guide for developing and launching the SIM Swap and Number Verification APIs and technical inputs, documented fraud-prevention use cases and presentation materials for the financial sector workshop, to be completed before 30 May 2027.
• Submission of a regulatory guidance package with lessons learned, comprising the anonymized lessons learned from the API pilot, guidance for SUTEL on the use of non-regulatory measures to promote competition, using APIs as a case study, and sustainability plans for participating operators, to be completed before 30 June 2027.

COMPETENCIES

• Knowledge of the GSMA Open Gateway/CAMARA framework, in particular the SIM Swap and Number Verification APIs, and of the GSMA Open Gateway conformance and certification process is required.
• Strong technical assessment and methodological design skills are required.
• Excellent technical writing skills, including the ability to turn technical results into lessons learned and recommendations are required.

QUALIFICATIONS REQUIRED

REMUNERATION INFORMATION

USD 340 per working day.

ADDITIONAL INFORMATION

• The development, integration and testing of the APIs is carried out by a firm contracted separately by ITU and is not part of this consultancy.
• Restatement, translation or summary of publicly available CAMARA and GSMA material does not constitute a deliverable.
• Operator technical information shall be treated as confidential, shall not be shared between operators without written authorization, and shall appear in the lessons learned document only in anonymised form.
• Missions to Costa Rica (2-3) will be aligned with key milestones: start of the assignment, financial-sector workshop and closing event therefore the candidate should be able to travel internationally for key project milestones, if not based in Costa Rica.