A PO box, a phone number, and a cancelled account
This week my company stopped paying Twilio. Not because the service failed, not because a competitor was cheaper, but because Twilio's compliance team decided that a company whose only registered address is a post office box does not have a real address. Finland's Trade Register disagrees. So does the telecom operator that bills our phone lines to that same box every month. Neither opinion counted.
The amount at stake was small: a few euros a month for messaging and some voice automation. The principle is not small. It is the second time in a week, after Scaleway, that a European-facing provider has lost a paying customer to a rule that protects nobody, and the pattern is worth naming before I forget how it felt.
The rule, and the country it was not written for
The requirement was plain: to keep a verified business sender, provide a physical street address for the company. A PO box would not be accepted, regardless of documentation.
In Finland that rule has no footing. The Trade Register (PRH) accepts a PO box as a company's address, and many small firms have no other. There is no office because there is no need for one: the work happens at a kitchen table or in a cockpit, the mail goes to the box, the accountant sees everything electronically. A Finnish bank will open an account on that basis. The tax authority will register you for VAT on it.
So will the phone companies. Our DNA landline is billed to that box, and so are our accounts with Elisa and Telia. None of them has ever asked for anything else.
That is the detail that turns an annoyance into an argument. If the point of address verification is to confirm that a real, traceable company stands behind a phone number, Finnish operators have already done it, under Finnish telecom rules, for the same company at the same address. Twilio was not adding a check. It was rejecting the result of one.
Who a no-PO-box rule actually stops
Ask who is inconvenienced by “no PO boxes” and the answer is not the people the rule imagines.
A scam operation running SMS phishing at scale does not use a PO box. It rents a virtual office with a street address in a respectable city for a few hundred euros a year, buys a shelf company with a clean filing history, and submits a utility bill it printed that morning. Every one of those passes a street-address check. The check is not hard to pass; it is only hard to pass honestly.
The honest small company, by contrast, has exactly one address and it is the one in the register. It cannot produce a second one without either renting an office it does not need or lying. Most will not lie, so they leave. The rule therefore sorts applicants into two groups: those willing to buy a plausible address, and those who will not. It keeps the second group out.
This is the general shape of box-ticking compliance. A control that is cheap for a fraudster and expensive for a legitimate user is not a fraud control. It is a tax on honesty, collected in hours and in lost customers, and it shows up on no one's ledger.
What leaving cost, and what it returned
I could have complied. Changing the registered address means a filing with the Trade Register, a new address on every invoice and contract, a round of emails to every supplier that bills us, and the small monthly cost of an address we would use for nothing except satisfying one vendor. It also had to happen inside Twilio's verification deadline. The honest estimate was a week of administrative work to keep a service costing less than a lunch.
So I replaced it instead. Our messaging now runs on our own setup, at close to zero marginal cost. The one thing lost is an AI-handled voicemail, which was a convenience, not a dependency.
The lesson is not that Twilio is bad. It is that for a technical founder, the cost of routing around a provider is now very close to zero, and every compliance step that assumes otherwise is pricing itself out of its own market. Twilio did not lose a customer to a competitor. It lost one to an evening.
The pattern: compliance as a global export
No Finnish rule requires a street address. Wherever this one comes from, it protects no one and only adds paperwork. It was written by a team whose job is to be able to show a regulator a document. The document is the product. Whether the document reduces fraud is someone else's department.
Rules like this travel. A requirement drafted for one idea of a legitimate business is applied, verbatim, to every market the provider sells into. Countries with lighter company law, strong registers and high trust get the worst of it: their legitimate firms look irregular to a checklist designed for somewhere with more paperwork and less trust. Finland is a high-trust country being audited by a low-trust template.
And the firms route around it, which has two costs the provider never sees. The first is revenue, small per customer but concentrated among exactly the early-stage builders who become large accounts if they stay. The second is visibility. Every founder who routes around the provider moves a sender and its traffic to channels the provider cannot see. The compliance regime meant to make messaging traceable has pushed a little more of it out of view, and it will count this as a success because the file is complete.
Regulators should notice the same thing. A rule whose main effect is to push honest users off the platform you can supervise, onto infrastructure you cannot, is not stricter. It is blind.
One test for every KYC rule
Before a control goes into a verification checklist, someone should be able to answer a single question: what does a competent fraudster have to do to pass this, and what does an honest small company have to do? If the first answer is “spend €300 on a virtual office” and the second is “re-register the company”, the control is backwards and should not ship.
I will go back to Twilio the day the company has an office with a brass plate on the door, because by then I will have the staff to fill in the forms. Until then our messages run on our own setup, our phone lines are billed to a PO box the state is entirely happy with, and one more sender has quietly left the system that was supposed to be watching it.