10DLC Compliance Requirements: A2P Compliance Checklist for US Business Texting

Short answer: 10DLC compliance has two layers. You register your business (the brand) and then each texting use case (the campaign) with The Campaign Registry, and you follow the CTIA consent rules on every message you send. Get the first part wrong and carriers throttle or block your traffic. Get the second part wrong and they shut the campaign down even though the registration is approved.

Almost every guide to this topic covers the registration forms and stops there. Registration is the visible half. The half that gets working campaigns killed months later is the ongoing conduct piece: how you collected consent, what your STOP handling does, and whether the messages you actually send match the samples you registered. This walks through both, with the fees and limits sourced to the providers that publish them.

What is A2P 10DLC compliance?

A2P 10DLC is the framework US mobile carriers use to sanction application-to-person text messaging sent from ordinary 10-digit phone numbers. Before it existed, businesses texted from long codes that carriers could not distinguish from personal traffic. The registry gave carriers a way to know who is sending, what they are sending, and whether recipients agreed to it.

Compliance means satisfying three parties at once, which is why it feels heavier than it should. The Campaign Registry holds your brand and campaign records. The carriers, AT&T, T-Mobile and Verizon, decide what throughput you get and what they will deliver. The CTIA publishes the messaging conduct guidelines that carriers enforce as a condition of network access. None of that touches federal law, which is a separate obligation on top.

Layer one: brand registration

Brand registration verifies that your business is a real, identifiable entity. You submit your legal business name exactly as registered, your EIN or equivalent tax ID, entity type, country, and a working website. The details have to match public records. A legal name that differs from your tax registration by a word is the single most common reason a brand comes back rejected, and resubmitting costs time you usually have not budgeted.

Twilio publishes its pass-through fees for this, and because they originate with The Campaign Registry they land within cents of each other across providers: a one-time standard brand registration fee of $46 including secondary vetting, or $4 for a sole proprietor brand. Sole proprietor registration exists for genuinely small senders without an EIN, and it carries much lower sending ceilings in exchange for lighter vetting.

Layer two: campaign registration

The campaign is the use case, and this is where most of the compliance substance lives. Twilio's documentation describes campaign registration as providing information about how end users opt in, opt out and get help, along with a description of what your messages are for. In practice you submit a use case category, sample messages that represent what you will really send, a description of your opt-in flow, and a live opt-in URL carriers can check.

Two details cause most of the pain here. Your sample messages need to look like your production traffic, because carriers compare live sends against registered samples. If you register a shipping notification sample and then send promotional offers on that campaign, the mismatch is visible. And the opt-in URL has to actually work and actually show the consent language. A link to a homepage that mentions nothing about texting is a rejection.

Twilio charges a $15 campaign vetting fee at the time of vetting, plus a recurring monthly campaign fee that varies by use case. A sole proprietor monthly campaign fee runs $2. Providers commonly report 3 to 7 business days for a standard campaign to clear vetting, with brand plus campaign end to end typically landing somewhere between one and four weeks. Plan a launch around that rather than assuming same-week delivery.

What your trust score actually controls

Once your brand is registered it receives a trust score from 0 to 100. That number is not a badge, it is a throttle. It determines how many messages each carrier will accept from you in a day, and the gaps between bands are enormous rather than incremental.

Those limits reset at midnight Pacific. Brand type sets a ceiling of its own before trust score even applies. Twilio documents a sole proprietor brand at 1,000 SMS segments and MMS per day to T-Mobile, roughly 3,000 across US carriers; a low-volume standard brand at up to 2,000 per day to T-Mobile, roughly 6,000 across carriers; and a standard brand at anything from 2,000 up to unlimited depending on the trust score it earns.

The practical consequence: a business that registers as a sole proprietor because it was faster can find itself unable to send a Black Friday campaign at all, and moving up means starting a new registration rather than adjusting a setting.

The consent rules carriers enforce

Registration approval is not permission to message whoever you like. The CTIA Messaging Principles and Best Practices set the conduct standard, and carriers enforce them as a condition of network access, which means a sender who ignores them gets filtered or shut down regardless of registration status.

The core obligations are consistent across providers. Wherever you collect a mobile number, you need express written consent that makes clear the person agrees to receive messages from your business specifically. For recurring programs the CTIA expects a confirmation message before anything else is sent, naming the program, giving customer care contact details, explaining how to opt out, and disclosing message frequency and any fees.

Opt-out handling has to be automatic. Your system must recognize and immediately process STOP, END, CANCEL, UNSUBSCRIBE and QUIT, and the guidelines expect you to honor plain-language requests like "please opt me out" as well. HELP must return a response containing your company name and a customer care contact, a phone number or an email address.

Keeping all of that current across several regulators and carriers is an ongoing obligation rather than a launch task, and teams running messaging in more than one regulated area usually end up needing a system to track compliance obligations and map them to controls rather than a spreadsheet somebody updates when they remember.

Content that gets blocked regardless of consent

Carriers restrict certain content categories no matter how clean your opt-in is. The shorthand is SHAFT: sex, hate, alcohol, firearms and tobacco. Cannabis and CBD sit in the same bucket in practice even where state law permits the business.

Several other categories draw heavier vetting and ongoing filtering rather than an outright ban, including payday and high-interest lending, debt collection, credit repair, gambling outside licensed state programs, and anything that reads as a get-rich-quick offer. A campaign in one of these categories can be approved at registration and still see individual messages filtered at delivery.

What happens if you skip 10DLC registration

Nothing visible, which is the problem. Unregistered A2P traffic on a 10-digit number gets filtered, throttled or blocked by carriers, and the failure is silent from the sending side. Your dashboard shows the message as sent. It never reaches the handset. Teams routinely lose weeks to this before working out that delivery, not their copy, is the issue. Twilio also documents that customers sending from a Twilio 10DLC number without registering incur additional carrier fees.

Registered senders pay a per-message carrier surcharge too, which is worth building into any cost model. Twilio publishes it as $0.0035 for AT&T and $0.0045 each for T-Mobile and Verizon on outbound long code traffic, on top of its US SMS rate of $0.0083.

Does WhatsApp need 10DLC registration?

No, and this is the most common point of confusion in the whole topic. A2P 10DLC governs SMS and MMS crossing US carrier networks. WhatsApp is an over-the-top service that delivers over the internet and never touches a carrier network, so there is no brand, no campaign, no trust score and no per-carrier daily ceiling. Meta runs its own approval regime instead: business verification, display name review, per-template approval, and messaging tiers of 250, 2,000, 10,000 or 100,000 unique customers per rolling 24 hours rising to unlimited.

That makes WhatsApp a genuine route for utility and authentication traffic to customers who use it, without carrier registration. It is not a substitute for US promotional messaging. Meta paused delivery of marketing-category templates to United States phone numbers on April 1, 2025, and that pause still holds, so promotional templates to +1 numbers fail with error 131049. The workable shape for most US teams is to keep 10DLC registered for promotional SMS and move transactional volume to WhatsApp where the customer is reachable there. Our 10DLC and WhatsApp guide works through that decision in detail, and do I need 10DLC for WhatsApp covers the short version.

A2P 10DLC compliance checklist

• Legal business name and EIN match your public tax registration exactly.
• Brand registered, and registered as the right type for the volume you actually plan to send.
• Campaign use case matches the messages you will really send, with representative samples.
• Opt-in URL is live, reachable, and displays the consent language carriers can verify.
• Consent is express, written, and names your business as the sender.
• Confirmation message goes out first on recurring programs, with frequency and opt-out wording.
• STOP, END, CANCEL, UNSUBSCRIBE and QUIT are processed automatically and immediately.
• HELP returns your company name plus a phone number or email for customer care.
• No SHAFT content, and heavier-vetting categories reviewed before you register.
• Sending volume planned against your trust score band, not your ambitions.

Frequently asked questions

What are the 10DLC compliance requirements?

Two registrations and an ongoing conduct standard. You register a brand with The Campaign Registry using your legal business name and tax ID, then register each campaign with its use case, sample messages and opt-in details. On every send you must have express written consent, process STOP and its variants automatically, answer HELP with company name and customer care contact, and avoid SHAFT content.

Is A2P 10DLC registration mandatory?

For sending business SMS or MMS from a 10-digit US number, effectively yes. Carriers filter, throttle or block unregistered A2P traffic, and providers may add non-registration surcharges or suspend the number. It is not a trust upgrade you can defer, it is a prerequisite for delivery. WhatsApp and short codes fall outside the framework entirely.

How long does 10DLC registration take?

Providers commonly report 3 to 7 business days for a standard campaign to clear vetting, stretching longer in busy periods, with brand plus campaign end to end typically landing between one and four weeks. Sole proprietor registrations usually move faster because vetting is lighter. Rejections restart the clock, and legal name mismatches are the most frequent cause.

How much does 10DLC compliance cost?

Twilio publishes a one-time brand fee of $46 for a standard brand or $4 for a sole proprietor, a $15 campaign vetting fee, and a recurring monthly campaign fee that varies by use case, $2 for sole proprietor campaigns. Carriers then add a per-message surcharge, published by Twilio as $0.0035 for AT&T and $0.0045 each for T-Mobile and Verizon. Fees are pass-through, so they differ slightly by provider.

What is a good 10DLC trust score?

Anything from 75 to 100 puts you in the top band, which T-Mobile currently caps at 200,000 messages per day. Below that the drop is steep: 50 to 74 allows 40,000 per day, 25 to 49 allows 10,000, and 1 to 24 allows 2,000. Scores reflect the verifiability of your business identity and the quality of your registration, not your sending history alone.

Can you send marketing texts without 10DLC?

Not from a 10-digit US long code. Unregistered promotional traffic is exactly what the framework was built to stop, and it will be filtered or blocked. Short codes and toll-free numbers have their own separate verification processes. WhatsApp cannot fill the gap for US promotional messaging either, because Meta paused marketing-template delivery to US numbers on April 1, 2025.

Does 10DLC registration make you TCPA compliant?

No. These are separate obligations enforced by different parties. 10DLC is a carrier delivery framework, and the CTIA guidelines are industry conduct rules. The TCPA is federal law with private right of action attached. Passing carrier vetting says nothing about whether your consent record would survive a legal challenge, so treat registration as necessary rather than sufficient and take advice from counsel.

Where this leaves you

If your US traffic is promotional, register properly, register as a standard brand if you have any real volume ambition, and treat the consent and STOP handling as the part that keeps the campaign alive after approval. If your traffic is transactional, it is worth checking how much of your audience is reachable on WhatsApp before you accept carrier registration, monthly campaign fees and a trust score ceiling as the cost of telling customers their order shipped.