Status of this module: November 2026. The roles and money flows below change slowly. The named companies and numbers change quickly; each one is dated and has a source in the list at the bottom. Where a figure comes from a company's own press release or a market-research firm, it says so. Treat numbers as "about", and check the source for the current value.
1. The value chain on one page
Spectrum & regulators ──▶ TowerCo / neutral host ──▶ Mobile operator (MNO) ──▶ Customers
(licences) (masts, sites, power) radio + core + billing (people, devices, companies)
▲ ▲ ▲
Vendors ─────────┘ Cloud/IT/Integrators ──┘ └── MVNO / MVNE (resell, run on MNO)
Between operators: interconnect · roaming (IPX, hubs, clearing houses) · A2P messaging (aggregators, CPaaS)
· wholesale voice/SMS carriers · IP transit and peering (Tier 1/2 networks, IXPs)
Around them: standards bodies (3GPP, ITU, IETF, GSMA) · security vendors · satellite operators
Everything on a phone screen is a chain of companies, each doing one link and charging the next.
2. The roles (what each kind of company does)
| Role | What they do | Typical examples of the type |
|---|---|---|
| MNO — Mobile Network Operator | Owns spectrum licences, radio network, core, SIMs and customers | National operators and their groups |
| MVNO — Mobile Virtual Network Operator | Sells mobile service under its own brand without its own radio network; rents capacity from an MNO | Supermarket, bank, flanker brands |
| MVNE / MVNA | Enabler: provides core, billing and platform so a brand can launch an MVNO quickly / Aggregator: brings many MVNOs to one host | Platform companies |
| Types of MVNO | Thin/branded reseller (sells only), light (own SIM and billing, host's core), full (own core and SIM/HLR, host's radio only) | |
| TowerCo | Owns masts, rooftops and power; leases space to several operators | Independent and carved-out tower companies |
| Neutral host / RAN sharing | One party builds shared radio or indoor coverage for several operators (MORAN: shared radio; MOCN: shared radio and spectrum) | Stadium, metro, rural sharing |
| Vendor | Sells radio, core, transport, OSS/BSS, security equipment and software | Ericsson, Nokia, Huawei, ZTE, Samsung and others |
| Integrator / managed services | Builds and runs networks on behalf of operators | Vendors and IT service firms |
| Hyperscaler / telco cloud | Public cloud hosting of cores and IT; operators partner for cloud-native networks | Large cloud providers |
| Wholesale carrier | Sells voice, SMS, data transit and capacity to other operators | International carrier arms of big groups and independents |
| Tier 1 / Tier 2 IP network | Backbone that carries internet traffic. Tier 1 can reach the whole internet using only settlement-free peering, without buying transit | See section 5 |
| IXP | Internet exchange point where networks hand traffic to each other | National exchanges, e.g. CIX in Croatia |
| IPX provider | Managed, quality-assured IP network between operators for roaming signalling, data, voice and messaging | See section 5 |
| Roaming hub / clearing house | One connection to many roaming partners; collects and settles usage records (TAP/BCE) | See section 5 |
| SMS aggregator / CPaaS | Connects businesses (A2P senders) to many operators; sells SMS, voice, chat APIs | See section 6 |
| Signalling provider / STP provider / GT lessee | Provides SS7/Diameter connectivity or addresses to other companies | See section 7 |
| Security vendors | Signalling/SMS/voice firewalls, fraud systems, analytics | See section 8 |
| Satellite operator | GEO/MEO/LEO capacity; now also direct-to-device services with operators | Module 17 |
| Regulator / ministry | Licences, numbers, competition, consumers | Module 22 |
| Standards body | 3GPP, ETSI, ITU, IETF, IEEE, GSMA | Module 22 |
3. How money flows
| Flow | Who pays whom | How it is priced |
|---|---|---|
| Retail | Customer → operator | Subscription, bundles, prepaid, devices |
| Interconnect (voice) | Calling operator → called operator | Per minute termination rate; EU-regulated "Eurorates" (Module 22) |
| Roaming (wholesale) | Visited operator → billed to home operator (IOT, Inter-Operator Tariff) → customer pays retail | Per MB/min/SMS; EU caps inside the EU; TAP/BCE records via clearing |
| A2P messaging | Company → aggregator → carrier(s) → destination operator | Per message; each hop takes a margin; the destination operator charges a termination fee |
| Transit / wholesale carrier | Operator or aggregator → carrier | Per minute/message, with quality tiers |
| IP transit | Network → upstream network | Per Mbit/s (95th percentile); peering is usually settlement-free |
| IPX / hub | Operator → IPX/hub provider | Per connection and/or traffic; hubs can reduce the number of bilateral contracts |
| Tower leases | Operator → TowerCo | Per site per year plus extras |
| Infrastructure | Operator → vendor | Equipment, licences, support, managed services |
| Spectrum | Operator → state | One-off auction price and/or annual fees |
Example chain 1 — a bank sends a one-time code to a customer abroad (A2P SMS)
Bank app ─▶ CPaaS / aggregator ─▶ (optional) transit carrier ─▶ destination operator's SMSC ─▶ phone
pays per SMS margin margin termination fee collected by the destination operator
Why it matters: every hop is paid per message, so the cheapest route wins — and cheap routes are where grey routes, spoofed senders and SMS pumping appear (Modules 5, 25–27). The firewall of the destination operator is where the "legitimate vs. grey" decision is made.
Example chain 2 — a roamer uses data abroad
Customer ─▶ visited operator ─(S8 over IPX)─▶ home operator
Visited operator writes usage records ─▶ clearing house (data clearing) ─▶ home operator
Home operator pays visited operator the wholesale (IOT) rate ─▶ bills customer at retail
Example chain 3 — an international phone call
Caller's operator ─▶ one or more wholesale carriers (voice transit) ─▶ called operator
Each hop earns a small margin per minute; the called operator earns the termination rate.
Why it matters: the same structure is abused by SIM-box bypass and IRSF fraud.
4. What the major kinds of company look like today (dated facts)
4.1 Operators and groups
- Scale: GSMA (The Mobile Economy 2026) reports about 8.8 billion wireless connections and 5.8 billion unique mobile subscribers (around 70% of the world's population). The 2025 edition gave 5.8 billion unique subscribers for end-2024 (71% penetration) and expected about 6.5 billion by 2030.
- Largest by subscribers (approximate; different sources count differently, and groups vs. single-country companies are not directly comparable): China Mobile (about one billion subscribers), then Bharti Airtel (about 670–680 million mobile subscriptions at end-2025 including joint ventures) and Reliance Jio (roughly 490–500 million). MTN Group (about 298 million) and Orange (about 291 million) appear in the same top-ten lists. Sources: GSMA Mobile Economy; CW Pakistan ranking; TeleGeography; Wikipedia list. These are secondary compilations.
- Big groups to know (for orientation, not a ranking): groups that own operators in several countries — for example Deutsche Telekom (T-Mobile brands, including Hrvatski Telekom in Croatia), Vodafone, Orange, Telefónica, América Móvil, Telenor, Telia, United Group (including Telemach), A1 Telekom Austria Group (A1 Hrvatska) and Liberty Global.
- State-linked national champions dominate in several countries (for example in China, where a small number of state-owned operators serve the whole market).
4.2 Radio and core vendors
- RAN: Dell'Oro and Omdia both rank Huawei, Ericsson, Nokia, ZTE and Samsung as the top five RAN suppliers (about 95–96% of the macro RAN market combined; Huawei and Ericsson together about two-thirds). Omdia puts the global RAN market at about US$35 billion in 2025; Ericsson is the largest vendor outside China.
- Mobile core: Omdia's 2025 core-network leaders report puts Huawei first in market share and Nokia first for portfolio competitiveness.
- Politics of vendors: several countries restrict or phase out specific vendors in 5G (EU 5G Toolbox, Module 22); this shapes who builds what.
- Others: transport and optical (Ciena, Cisco, Juniper, Nokia, Huawei), OSS/BSS and IT (Amdocs, Oracle, Netcracker and others), Open RAN players (Mavenir, Rakuten Symphony, Fujitsu, NEC and others), security (Section 8).
4.3 Tower companies (reported counts, approximate)
| Company | Reported size | Date |
|---|---|---|
| China Tower | about 2.15 million towers | end of 2025 |
| Indus Towers (India) | about 267,600 towers | 30 June 2026 |
| American Tower | about 148,800 towers across four regions | end of December 2025 |
| Cellnex (Europe) | about 114,500 sites | Q1 2026 |
| Crown Castle (US) | about 39,800 towers | end of 2025 |
| IHS Towers (Africa, Latin America) | about 37,600 towers | end of December (latest report) |
Source: Inside Towers and Cullen International summaries and company reports (secondary). Counts are "towers" or "sites" depending on the company and are not exactly comparable.
5. Carriers, IPX providers, hubs and clearing houses
Tier 1 networks. A Tier 1 network can reach the entire internet using settlement-free peering and buys no transit. There is no official list. Networks usually named as Tier 1 include Lumen, Arelion, NTT, GTT, Cogent and Zayo (membership is contested and changes over time). Source: Wikipedia and Dr. Peering; verify with CAIDA AS Rank and peering policies.
IPX (IP eXchange). GSMA defines IPX as interconnected IP networks run by international carriers and domestic providers that compete to interconnect service providers. An academic measurement study (ACM SIGCOMM CCR, 2020) identified about 29 active IPX providers. One provider, PCCW Global, states that operators can connect to its IPX in over 160 countries (a vendor claim). Operators typically connect to one or two IPX providers and reach the rest through their peering.
Roaming data and financial clearing. After roaming, usage records must be collected and valued, and the money settled. Syniverse is the best-known clearing house (its own releases claim top ranking from Kaleido Intelligence and over 700 carriers connected — vendor claims). Others named by analysts include Mobileum, Comfone, Nextgen Clearing, Transaction Network Services (TNS), BICS and iBASIS. The classic record format is TAP (Transferred Account Procedure); BCE (Billing and Charging Evolution) is its announced successor, and for years both will coexist.
Wholesale voice/SMS carriers. Companies that sell termination and transit to operators, usually the international arms of big groups plus independents. Quality tiers range from "premium" (direct operator connections) to "grey" (unlicensed or bypass routes).
6. A2P messaging companies (aggregators and CPaaS)
- CPaaS (Communications Platform as a Service) sells APIs for SMS, voice, chat apps and email. Market-research rankings (Juniper Research, via TelecomTV) list Infobip as the CPaaS leader, ahead of Sinch, Twilio and Vonage; other known players include Route Mobile, Kaleyra and Bandwidth.
- Infobip was founded in 2006 in Vodnjan, Istria (Croatia) by Silvio Kutić, Roberto Kutić and Izabel Jelenić, and reached Croatia's first "unicorn" valuation in 2020. Sources differ on whether its headquarters is Vodnjan (operational) or London (legal).
- Business model: they buy termination from operators/carriers and resell it with APIs, number registration, verification (OTP), and increasingly RCS and chat apps. Many also run their own SMS firewalls or connect to operators' firewalls.
- Pressures: OTT messaging replaces some A2P use; regulators require sender-ID registration in many countries; fraud (pumping, smishing) drives stricter routing.
7. Signalling providers and Global Title leasing
- Signalling providers give operators or companies SS7 and Diameter connectivity (STP/DRA hosting, SIGTRAN over IPX), SMS/roaming "hubbing" and interconnect to many networks.
- Global Title (GT) leasing. A GT is a telephone-number-style address in SS7 (Module 4). A number-range holder (usually an operator) can lease GTs from its range to another company so that company can appear on the SS7 network. Legitimate users: MVNOs, IoT platforms, SMS aggregators, roaming hubs. Risk: the lessee can send any signalling message as if it were that operator, so criminals use leased GTs for location tracking and SMS interception (Module 25).
- Responses: the GSMA published FS.52, a code of conduct for GT (and now Diameter end-point address) leasing. The UK regulator Ofcom went further: in April 2025 it announced a ban on GT leasing by operators that hold UK mobile numbers — new arrangements immediately, existing ones from 22 April 2026 — plus guidance for number-range holders. Other regulators are following the debate.
- What it means for you: if you see a signalling connection from an unfamiliar company, ask: whose GT is it, who leased it to whom, and is it on the partner allow-list? (Module 26.)
8. Who supplies security and fraud tools
Not a ranking, only examples of company types named in public reports: signalling and SMS firewall and analytics vendors (for example Mobileum, Enea/AdaptiveMobile Security, Cellusys and others), network vendors with integrated firewalls, SBC and voice-security vendors, fraud management and revenue assurance vendors, SOC and threat-intelligence providers, and consultancies that publish telecom-security research. Operators combine vendor products with their own SOC (Module 26). (These names come from public security reports; the product lists were not re-verified here.)
9. Structural trends (what is changing)
| Trend | What it means |
|---|---|
| Consolidation | Many markets moved from four to three operators; regulators weigh price and investment effects |
| Tower spin-offs | Operators sold towers to TowerCos to raise cash and share costs |
| Network sharing | Joint rural coverage, shared 5G radio, national roaming for resilience |
| Cloud-native networks | Cores and IT move to containers and public/private cloud; hyperscalers become partners and competitors |
| Open RAN / vendor diversification | Pushed by cost and supply-security policy |
| 5G SA and slicing | New enterprise revenue ideas, private 5G |
| Satellite integration | Direct-to-device services with operators (Module 17) |
| eSIM and MVNO/IoT growth | Easier switching, more connectivity brands |
| A2P shifts | SMS declines in some countries, RCS and chat apps grow; strict anti-fraud rules |
| Security regulation | NIS2, 5G toolbox, GT-leasing bans, caller-ID signing (Module 22, 26) |
| 2G/3G sunsets | Spectrum re-used; legacy IoT and roaming complicate switch-off |
10. How to look up "who is this operator?" yourself
- MCC/MNC → the ITU list (and HAKOM-style national plans) gives country and network; cross-check with GSMA data.
- Global Title / E.164 prefix → whose number range? (national regulator's numbering plan.)
- Operator group → the company's annual report, investor page and the regulator's market report.
- Roaming partners → GSMA IR.21 (members) or the operator's roaming page.
- Market data → national regulator quarterly reports, GSMA Intelligence/Mobile Economy, TeleGeography.
- Ownership changes → press releases and stock-exchange filings (mergers happen often).
Remember this: telecom is a chain of paid hops. Operators own the customers and the radio, TowerCos own the masts, vendors build the boxes, carriers/IPX/hubs connect operators to each other, aggregators connect businesses to operators, and everyone bills the next link. Fraud and security problems almost always sit at a hop where the price is low and trust is high.