Short Codes and 10DLC Registration and Vetting Requirements
Registration is now the gatekeeper for delivery: failing to vet your Brand and Campaign will result in total carrier blocking.
The landscape of application-to-person (A2P) messaging has undergone a seismic shift. For years, businesses operated in a “wild west” where local long codes (10-digit numbers) were used for high-volume texting without oversight. This loophole has been permanently closed. Today, the choice between Short Codes (5-6 digits) and 10DLC (10-Digit Long Code) is no longer just about marketing preference; it is a strict compliance decision governed by The Campaign Registry (TCR) and mobile carriers. The core pain point for most organizations is not sending the message, but getting the network to accept it. Without a verified “Brand” and approved “Campaign,” your messages simply disappear into the digital void, often without an error code.
This vetting process is often messy and opaque. Businesses face rejections for vague reasons like “unverified use case” or “website non-compliance,” leading to critical delays in operational communication. The carriers—AT&T, T-Mobile, and Verizon—have effectively privatized the enforcement of messaging rules, imposing pass-through fees and strict throughput limits based on a “Trust Score” that many senders do not understand. Navigating this requires more than just a credit card; it requires a documented chain of trust from the tax ID to the privacy policy.
This article clarifies the exact requirements for registering Short Codes and 10DLC routes. We will dissect the vetting criteria used by the Direct Connect Aggregators (DCAs), explain how to maximize your Trust Score to increase message limits, and provide a roadmap for resolving the most common rejection triggers. The goal is to move your messaging traffic from “filtered” to “verified” with the least amount of friction.
Critical checkpoints for successful registration:
- Consistency is Key: The company name on your EIN letter (SS-4) must match exactly with the name on your website and your TCR registration profile. A single typo triggers manual review.
- The “opt-in” Evidence: You cannot just say you have consent; you must upload a screenshot or URL of the exact webform where the consumer checks the box, including the legal disclosure text.
- Privacy Policy Mandate: Your website MUST have a privacy policy that explicitly states: “Mobile information will not be shared with third parties/affiliates for marketing/promotional purposes.”
- Campaign Use Case: selecting “Mixed” or “Undeclared” use cases results in higher surcharges and lower deliverability. Be specific (e.g., “Account Notifications” or “2FA”).
See more in this category: Digital & Privacy Law
In this article:
- Context snapshot (definitions, differences, documents)
- Quick guide to Registration
- Understanding Vetting in practice
- Practical application
- Technical details: Trust Scores & Throughput
- Statistics and scenario reads
- Practical examples
- Common mistakes
- FAQ
- References and next steps
- Legal basis
- Final considerations
Last updated: November 24, 2024.
Quick definition: Short Codes are 5-6 digit numbers leased for high-volume, high-speed messaging, requiring extensive carrier audits. 10DLC are standard 10-digit local numbers now sanctioned for business traffic via a central registration system (TCR).
Who it applies to: Every entity sending business text messages to US numbers. This includes non-profits, political campaigns, local service providers, and major enterprises. There is no “small business exemption” from registration, only different pricing tiers.
Time, cost, and documents:
- 10DLC Time: Brand vetting takes 1-3 days; Campaign approval takes 1-5 days (longer for T-Mobile manual review).
- Short Code Time: 8-12 weeks for provisioning and carrier approval.
- Documents: IRS SS-4 letter (EIN proof), screenshots of opt-in flows, sample messages, and a compliant privacy policy URL.
- Cost: 10DLC has low monthly fees ($2-$10) plus per-message surcharges. Short Codes cost $500-$1,000/month to lease plus hosting fees.
Key takeaways that usually decide disputes:
Further reading:
- The “Call to Action” (CTA): If carriers cannot find where the user signs up (the CTA), they will reject the campaign. You must provide a direct link or image.
- Sample Messages: Providing samples that look like spam (e.g., “URGENT! CLAIM NOW!”) or lack opt-out instructions (“STOP to end”) leads to immediate rejection.
- Brand Identity: The text messages must clearly identify the sender (e.g., “Hi from Acme Corp”). Anonymous texts are blocked.
Quick guide to Short Code vs. 10DLC Registration
Choosing the right path depends on volume and budget, but the compliance rigor is high for both. Short codes are the “VIP lanes” of the highway, while 10DLC is the regulated general traffic.
- 10DLC is for everyone: Unless you send >500k messages a day or need instant speed (e.g., critical alerts), 10DLC is the standard. It uses local area codes which increase trust for conversational use cases.
- Short Code is for mass blasts: If you are sending marketing blasts to 1 million people at once, 10DLC throughput limits (messages per second) will be too slow. Short codes handle 100+ MPS (messages per second).
- Vetting is mandatory for 10DLC: You cannot just “buy a number.” You must register your Legal Entity (Brand) and then register your specific use case (Campaign). Without this, traffic is blocked.
- Short Code audits are severe: Carriers will manually test your keywords (HELP, STOP) on a live handset before activating a short code. One failed test resets the 8-week clock.
Understanding Vetting and Trust Scores in practice
The registration ecosystem centers on The Campaign Registry (TCR). TCR acts as the central hub where “Brands” (businesses) and “Campaigns” (use cases) are logged. However, TCR does not do the vetting itself; it relies on third-party vetting partners (like Aegis Mobile or WMC Global) to verify the legitimacy of the business.
When you register a Brand, the system checks your EIN/Tax ID against official databases. A match yields a “Verified” status. For higher throughput, you can pay for “Secondary Vetting.” This analyzes the age of the company, credit history, and size to assign a Trust Score (0-100). This score dictates your daily message cap on T-Mobile and your throughput (MPS) on AT&T.
For example, a local bakery with a standard registration might get a Low Trust Score, limiting them to 2,000 messages/day. A large bank with secondary vetting and a High Trust Score might get 200,000 messages/day. The system is designed to throttle “fly-by-night” spammers while opening the gates for established entities.
The Registration Hierarchy (Order of Operations):
- Step 1: Brand Registration: Tell TCR who you are (Legal Name, EIN, Address).
- Step 2: Vetting (Optional but Recommended): Pay an extra fee to get a “Trust Score” if you need more than 2,000 messages/day.
- Step 3: Campaign Registration: Tell TCR what you are sending (Marketing, 2FA, Customer Care). This connects the use case to the Brand.
- Step 4: Number Association: Link your actual 10-digit phone numbers to the approved Campaign ID.
Legal and practical angles that change the outcome
The “Sole Proprietor” trap is a common practical issue. If you do not have an EIN (Tax ID) and operate as an individual, 10DLC registration is restricted. Carriers have severely limited “Sole Prop” campaigns due to abuse. If you are serious about business messaging, incorporating (obtaining an EIN) is almost mandatory to get decent deliverability.
Another pivotal angle is the “SHAFT” (Sex, Hate, Alcohol, Firearms, Tobacco) policy. Carriers strictly police these categories. While federal law might allow selling CBD oil or firearms accessories, carrier policies often block them on 10DLC and Short Codes. If your website sells vape pens and you register for “Account Notifications,” the vetting team will likely check your site, see the prohibited content, and ban the campaign permanently for “Content Violation.”
Workable paths parties actually use to resolve rejection
When a campaign is rejected for “website non-compliance,” the fix is usually specific. The vetters are looking for a compliant footer. You must add a line to your privacy policy or contact page: “By providing your phone number, you agree to receive text messages from [Business Name]. Message and data rates may apply. Message frequency varies.”
If the rejection is for “insufficient opt-in,” you must provide a hosted URL of a mock-up image showing your webform. Do not just describe it in text. The reviewers need to see the checkbox. If you collect numbers verbally (in-store), upload a photo of the physical signage at the point of sale that describes the SMS program.
Practical application of Registration Workflows
To successfully navigate the registration gauntlet, follow this clean sequential workflow. Deviating from this order is the primary cause of “stuck” applications.
- Audit Your Digital Presence: Before logging into any portal, ensure your website has a Privacy Policy and Terms of Service. Verify that your legal name on the footer matches your EIN letter.
- Gather the “EIN Letter” (SS-4): Find the PDF from the IRS assigning your Tax ID. You will need the exact address and spelling used there. “LLC” vs “L.L.C.” matters.
- Register the Brand: Submit your details to your messaging provider (Twilio, Vonage, etc.) who acts as your proxy to TCR. Wait for the “Verified” status.
- Select the Campaign Type: Choose the most specific use case. “Mixed” campaigns are more expensive and scrutinized. If you send marketing and alerts, consider splitting them into two campaigns if volume allows (though one number can only be on one campaign).
- Submit Campaign Details: Enter your sample messages. Ensure they include “[Brand Name]:” at the start and “STOP to end” at the end.
- Wait for DCA Approval: The Direct Connect Aggregators (gatekeepers for carriers) will review the submission. This can take 24 hours to 5 days. Do not submit traffic until this is “Active.”
Technical details: Trust Scores and Throughput
The Trust Score is the algorithm that determines your destiny on 10DLC. It is a number from 0 to 100.
* 0-24: Very Low Trust. High risk of blocking. Low throughput.
* 25-49: Low Trust. Standard for new, small businesses. Cap approx. 2,000 msgs/day on T-Mobile.
* 50-74: Medium Trust. Established SMBs. Higher caps.
* 75-100: High Trust. Large enterprises. Cap approx. 200,000+ msgs/day.
Throughput (MPS) varies by carrier. AT&T limits based on MPS (Messages Per Second). T-Mobile limits based on Daily Allowance. Verizon filters based on content but doesn’t have a hard “cap” in the same way, though they apply heavy spam filtering.
- Resubmission Fees: T-Mobile charges a $50 “Campaign Activation” fee and recently introduced a “Non-Compliance Fee” for serious violations. Re-vetting often incurs costs.
- Low Volume Mixed: A specific campaign type for small businesses sending <75 messages/minute. It has lower fees but strictly enforced limits.
- Toll-Free Numbers: Toll-Free (8XX) numbers have a separate vetting process (verified by the aggregator, not TCR). They are a middle ground—faster to set up than Short Codes, but higher throughput than unvetted 10DLC.
Statistics and scenario reads
The market has consolidated around verified traffic. Unregistered traffic is essentially dead, with delivery rates dropping to near zero on major networks. The shift has pushed legitimate businesses to clean up their data, while spammers are forced to “snowshoe” (use many numbers) which carriers are now aggressively detecting.
Delivery Success by Registration Status
98%
Traffic flows freely with minimal filtering delays.
15%
Most messages are blocked at the carrier gateway (Error 30007/30008).
99.9%
The gold standard for critical alerts, virtually immune to spam filters if compliant.
Cost vs. Performance Shift
- Setup Time: 10DLC (Days) → Short Code (Months). Choose 10DLC for speed.
- Cost Efficiency: 10DLC (Low Fixed, High Variable) → Short Code (High Fixed, Low Variable). Short code wins only at massive scale (>500k/mo).
- Vetting Rigor: Automated (10DLC) → Manual Human Audit (Short Code). Short code requires a “compliance dossier.”
Monitorable Metrics
- Error Rate (%): Spikes in “30007” errors indicate carrier filtering due to bad content or lack of registration.
- Throughput Lag: If messages are queuing up and delivering hours late, your Trust Score/MPS limit is too low for your volume.
Practical examples of Registration Scenarios
Scenario A: The Rejected Real Estate Agent (Fail)
Context: A solo realtor registers a “Sole Proprietor” brand but submits 500 messages/day with “investment opportunities.”
The Block: The carrier rejects the campaign. Reason: Sole Prop campaigns are strictly limited in volume (usually <100/day) and "Investment/Lead Gen" content is heavily scrutinized on low-trust routes.
The Fix: Incorporate as an LLC, get an EIN, and register a Standard Brand. Change the use case to “Customer Care” and ensure opt-in is clear.
Scenario B: The Approved Dental Clinic (Success)
Context: A dental practice registers a Standard Brand using their EIN. They choose the “Health Care” campaign type.
The Submission: They provide a URL to their booking page which has a checked box “I agree to texts.” They submit sample msg: “SmileDental: Your appt is tomrw at 2pm. Reply C to confirm, STOP to cancel.”
The Result: Approved within 24 hours. The use case matches the industry, the opt-in is visible, and the sample message follows best practices (Identity + Keyword).
Common mistakes in 10DLC Registration
Mismatched Legal Name: Submitting “Joe’s Pizza” instead of “Joe’s Pizza Holdings LLC” as listed on the SS-4 form. This causes an instant “Tax ID Mismatch” error.
Missing Privacy Policy: Your website lacks a privacy policy, or the policy lacks the specific “No sharing for marketing” clause required by carriers.
Vague Opt-In Description: Writing “Customers opt in” is not enough. You must write “Customers enter their number on the checkout page at [URL] and check a box.”
Public URL Shorteners: Using bit.ly or tinyurl in sample messages. Carriers block these. Use a branded short domain or full links.
Ignoring Surcharges: Failing to budget for the “Carrier Pass-Through Fees” (e.g., $0.003 per msg) which are billed on top of the SaaS platform fees.
FAQ about Short Code and 10DLC Vetting
Do I need to register if I only send messages to my employees?
Yes. The carriers do not distinguish between “internal” and “external” traffic based on the destination. If you are sending A2P (Application-to-Person) traffic via a software platform, you must register.
However, you can register a “Low Volume Standard” campaign or a specific “Internal” use case if available. The vetting ensures that your internal system isn’t hijacked to spam the public, protecting the network integrity.
Why was my campaign rejected for “Opt-In” issues?
This is the most common rejection code. It usually means the reviewer visited your website and could not find a compliant place to sign up, or the disclosure text was missing.
To fix this, ensure you provide a direct URL to the form. The form must have a checkbox (unchecked by default) and legal text stating “I agree to receive text messages…”. If your opt-in is verbal or on paper, you must upload a photo of the script or form.
What is the difference between a “Standard” and “Low Volume” brand?
A “Standard” brand has full access to higher throughput tiers and can undergo secondary vetting for maximum limits. It incurs a slightly higher one-time registration fee.
A “Low Volume” brand is designed for small businesses sending fewer than 6,000 messages per day (limits vary by carrier). It has lower fees but cannot be upgraded to high throughput without re-registering as Standard. It is suitable for small local shops but risky for growing tech companies.
Can I use the same EIN for multiple Brands?
Generally, TCR expects a 1-to-1 relationship between an EIN and a Brand. However, large conglomerates with distinct divisions operating under one tax ID can sometimes register vertical-specific brands, but this is complex.
Usually, you register one Brand per EIN and then create multiple Campaigns under that Brand (e.g., one for Marketing, one for Support). This keeps your trust score consolidated and simplifies billing.
How long does the vetting process take?
Automated Brand registration is often instant or takes a few hours if the data matches databases perfectly. Campaign registration (the use case) goes to the DCAs (carrier gatekeepers).
Standard 10DLC campaigns are usually approved in 1-5 business days. T-Mobile manually reviews many campaigns, which can extend the timeline. Short Code vetting is much longer, taking 8-12 weeks due to the rigorous audit of your program’s compliance.
What happens if I don’t register and keep sending?
Your traffic will be blocked. Carriers have implemented “gradual blocking” where unregistered traffic sees higher and higher error rates (Error 30007, 30008). Eventually, it hits 100% blockage.
Furthermore, sending unregistered A2P traffic allows carriers to impose hefty fines (pass-through fees) for “Gray Route” usage. It is not a sustainable strategy and puts your business phone numbers at risk of being blacklisted.
Can I register a 10DLC campaign for CBD or Cannabis?
No. SMS runs on federal carrier networks. Because cannabis remains federally illegal in the US, major carriers (AT&T, T-Mobile, Verizon) strictly prohibit any “SHAFT” content (Sex, Hate, Alcohol, Firearms, Tobacco/Cannabis) on 10DLC and Short Codes.
Even if it is legal in your state, the campaign will be rejected. Attempting to disguise the content (e.g., calling it “Green Plants”) is a violation that results in massive fines and permanent banishment of the Brand.
Does a toll-free number need 10DLC registration?
Toll-Free numbers (8XX) do not use the TCR 10DLC system. They have their own verification process managed directly by the toll-free aggregator. However, the requirements are nearly identical: you must submit the Brand, use case, and opt-in proof.
“Unverified” toll-free traffic is now blocked just like unregistered 10DLC. You must complete the verification form with your provider to send traffic on a toll-free number.
What is “Secondary Vetting” and is it worth it?
Secondary vetting is an optional step where a third party (like Aegis Mobile) does a deeper dive into your business to assign a Trust Score. It costs a small fee (approx. $40 one-time).
It is worth it if you need higher daily limits. Without it, you are often capped at the lowest tier (approx. 2,000/day). If you plan to scale, secondary vetting is essential to unlock the higher tiers (up to 200k+/day) without changing your number.
Can I use a P.O. Box for my address in registration?
It is risky. The address you submit must match the address on your IRS SS-4 letter. If your tax ID is registered to a physical office, but you submit a P.O. Box, the automated identity check may fail.
It is always best to use the physical address associated with your corporate filing. Vetting algorithms favor physical locations as they are stronger indicators of a legitimate business entity.
References and next steps
- Download your SS-4 Letter: Locate your IRS EIN assignment letter immediately; it is the source of truth for your legal name.
- Update Privacy Policy: Add the “No mobile info sharing” clause to your website footer today.
- Screenshot Your Flow: Take clear screenshots of your signup form and the checkout checkbox to have ready for upload.
- Check Trust Score: Ask your messaging provider if they support Secondary Vetting if you anticipate growth.
Related reading:
- Digital & Privacy Law
- Understanding SHAFT policies and prohibited content.
- The difference between Promotional and Transactional messaging consent.
- How to handle T-Mobile’s daily campaign limits.
Normative and case-law basis
The 10DLC framework is not a law passed by Congress but a set of industry standards enforced by the Mobile Network Operators (MNOs)—primarily AT&T, Verizon, and T-Mobile—under the auspices of the CTIA (Cellular Telecommunications Industry Association). The “Messaging Principles and Best Practices” published by the CTIA serve as the de facto regulations for the industry.
However, the underlying requirement for consent is grounded in the Telephone Consumer Protection Act (TCPA) (47 U.S.C. § 227). The carriers use the registration process to ensure that senders are complying with TCPA consent rules (Prior Express Written Consent). The Campaign Registry (TCR) is the designated entity for managing 10DLC registrations, acting as a clearinghouse for trust data between Brands and Carriers.
For official industry guidelines, consult the CTIA Messaging Principles www.ctia.org or The Campaign Registry www.campaignregistry.com.
Final considerations
The era of anonymous, unrestricted business texting is over. The 10DLC and Short Code registration process, while bureaucratic and often frustrating, creates a layer of accountability that ultimately protects the channel from being overrun by spam. For legitimate businesses, it is a hurdle that, once cleared, offers better deliverability and higher consumer trust.
Success lies in treating registration not as a technical setting, but as a compliance dossier. Consistency between your tax documents, website, and registration data is the golden thread that pulls your application through the vetting algorithms. Do not rush the paperwork; a rejection creates a “flag” on your profile that is harder to fix than getting it right the first time.
Key point 1: 10DLC Registration is mandatory for A2P traffic; unregistered traffic is blocked.
Key point 2: Your Privacy Policy must explicitly ban sharing mobile data with third parties for marketing.
Key point 3: Trust Scores determine your daily limits; ensure your business data is accurate to maximize throughput.
- Audit your legal entity name against your EIN letter.
- Create a dedicated “Mobile Terms” page on your site.
- Separate marketing and transactional traffic into distinct campaigns.
This content is for informational purposes only and does not replace individualized legal analysis by a licensed attorney or qualified professional.
Do you have any questions about this topic?
Join our legal community. Post your question and get guidance from other members.
⚖️ ACCESS GLOBAL FORUM