When a mobile user send an SMS to a mobile number, in this case a VMN, the message is sent from the mobile to SMSC platform of the mobile user's network. The SMSC then requests the location of the destination mobile number using a GSM MAP Send Routing Info for Short Message (SRIfSM). This request is sent to the HLR of the VMN that respond withe the MSC address and IMSI of the VMN. Once the SMSC has this information it can then perform a GSM MAP Forward Short Message (FSM) to the MSC address with the IMSI and SMS. On receiving this FSM request the MSC returns an acknowledgement indicating a successful delivery to the SMSC. Prior to the acknowledgement being sent the MSC - as a VMN server - may pass the received message to an application via SMPP and only one it has received a confirmation from the application will the MSC return an acknowledement to the sending SMSC.
The receiving mobile network to which the VMNs below may have a dedicated HLR to service incoming SMS to VMNs - possible integrated into the VMN server. This HLR maybe part of the VMN server. GSM MAP SRIfSM requests would be routed to this dedicated HLR based on the SCCP called party address in the request which would be the destination mobile number. This routing would look at the initial digits of the called party address as part of Global Title Translation (GTT) and route to the VMN server based on the result of this.