10DLC Compliance Made Simple: Everything You Need to Know About Business SMS in 2026

The rules of business texting changed dramatically over the past few years, and if you're still sending SMS messages without proper 10DLC registration, you're playing with fire. Carriers are actively filtering unregistered traffic, fines are escalating, and businesses that ignore compliance are watching their messages disappear into the void.

This guide breaks down everything you need to know about 10DLC compliance in 2026 — from registration to ongoing best practices — so you can text your prospects and customers with confidence.

What Is 10DLC and Why Does It Exist?

10DLC stands for "10-Digit Long Code," which refers to standard local phone numbers (the regular 10-digit numbers you're used to seeing) being used for Application-to-Person (A2P) messaging. Before 10DLC, businesses had limited options for sending text messages at scale:

Shared short codes (5-6 digit numbers) were expensive, slow to provision, and risky — if one business on a shared short code got flagged for spam, every business sharing that code suffered.
Toll-free numbers worked but carried their own verification requirements and limitations.
Unregistered long codes were technically possible but treated as Person-to-Person (P2P) traffic, subject to heavy filtering and extremely low throughput.

The major carriers — AT&T, T-Mobile, and Verizon — introduced 10DLC as a middle ground. It lets businesses use standard local numbers for A2P messaging with proper registration, higher throughput, better deliverability, and full compliance with carrier requirements.

The bottom line: As of 2026, 10DLC registration is not optional. If you're sending business text messages from a standard phone number in the United States, you must be registered. Unregistered traffic is being actively blocked by all major carriers.

The Registration Process: Step by Step

The 10DLC registration process has three stages. Here's exactly what happens at each one.

Step 1: Brand Registration

Brand registration tells the carriers who you are. You'll need to provide:

Legal business name (must match your EIN/tax records exactly)
EIN (Employer Identification Number) — sole proprietors can use SSN but face lower trust scores
Business address (must match IRS records)
Business type (corporation, LLC, sole proprietor, etc.)
Industry/vertical
Company website
Contact information

Your brand registration is submitted to The Campaign Registry (TCR), which is the central authority that manages 10DLC registrations. TCR verifies your business information against public records and third-party data sources to assign a trust score.

Typical timeline: Brand registration usually takes 1-5 business days for standard businesses. Some may require additional verification.

Step 2: Campaign Registration

Once your brand is approved, you register individual campaigns. A campaign defines what type of messages you're sending and to whom. Each campaign requires:

Use case description — What are you texting about? (e.g., "Appointment reminders for dental patients," "Sales follow-up for inbound leads")
Sample messages — At least 2 example messages you'll send
Opt-in flow description — How do people consent to receive your texts?
Opt-in keywords — Usually "YES," "START," or "SUBSCRIBE"
Opt-out keywords — Must include "STOP" at minimum
Help keywords — Must include "HELP" at minimum
Message volume estimate — How many messages per month?
Content attributes — Does the campaign include links, phone numbers, age-gated content, etc.?

Important: Your sample messages and use case must accurately reflect what you'll actually send. Carriers review these, and sending messages that don't match your registered campaign is a fast track to getting filtered or suspended.

Typical timeline: Campaign registration takes 3-10 business days and may require back-and-forth if your use case description isn't clear enough.

Step 3: Number Assignment

After your campaign is approved, you assign your 10DLC phone numbers to the campaign. A number can only be assigned to one campaign at a time (though one campaign can have multiple numbers).

Once assigned, your numbers are cleared to send A2P traffic at the throughput level determined by your trust score.

Trust Scores: What They Are and Why They Matter

When TCR processes your brand registration, it assigns a trust score based on the verified information about your business. This score directly determines your messaging throughput — how many messages you can send per second.

How Trust Scores Work

Trust scores typically range from low to high, with factors including:

Business size and age — Established companies with longer operating histories score higher
EIN verification — Businesses with verified EINs score much higher than sole proprietors
Industry — Some industries (finance, healthcare) may receive additional scrutiny
Public records match — How well your submitted information matches verified public data
Previous violations — Any history of carrier violations tanks your score

What Trust Scores Mean for Throughput

| Trust Level | Approximate Messages/Second | Daily Capacity | |---|---|---| | Low | 1-2 msg/sec | ~10,000/day | | Medium | 10-15 msg/sec | ~100,000/day | | High | 50-75 msg/sec | ~500,000/day |

For most small and mid-size businesses doing outbound sales or customer communication, even a low trust score provides more than enough throughput. The bigger concern is deliverability — a properly registered number with a low trust score will still outperform an unregistered number that's being filtered.

Improving Your Trust Score

If your initial trust score is lower than expected:

Verify your EIN is correct and matches IRS records exactly
Ensure your business name matches across all registrations, your website, and public records
Appeal through your messaging provider — you can request a re-evaluation with additional documentation
Build sending reputation — consistent, compliant messaging over time can improve your standing

TCPA Compliance: The Legal Foundation

10DLC is a carrier-level registration system, but it sits on top of the Telephone Consumer Protection Act (TCPA), which is federal law. Violating TCPA can result in fines of $500 to $1,500 per individual message. Yes, per message.

Opt-In Requirements

TCPA requires express written consent before sending marketing text messages. This means:

The recipient must actively agree to receive texts (no pre-checked boxes)
The consent must be documented and stored
The consent must clearly disclose that texts will be sent, approximate frequency, and that data rates may apply
Consent for one type of message doesn't cover another (e.g., transactional consent doesn't cover marketing)

Valid opt-in methods include:

Web form with explicit SMS consent checkbox (unchecked by default)
Keyword opt-in (texting "START" or "YES" to your number)
Paper form with clear SMS consent language
Verbal consent (though this is harder to document)

Time Restrictions

TCPA restricts when you can send marketing messages:

No texts before 8:00 AM or after 9:00 PM in the recipient's local time zone
Some states have stricter windows (e.g., Oklahoma restricts to 8 AM - 8 PM)
Always default to the more restrictive rule when state and federal requirements conflict

Opt-Out Handling

This is non-negotiable. You must:

Honor opt-out requests immediately (within the same messaging session)
Support "STOP" as an opt-out keyword at minimum
Send a confirmation when someone opts out (e.g., "You've been unsubscribed. Reply START to re-subscribe.")
Never send another message after opt-out unless the person re-opts in
Maintain a suppression list and check it before every send

Required Disclosures

Every SMS program should include in its initial opt-in confirmation:

Business name
Message frequency (e.g., "Up to 4 msgs/month")
"Msg & data rates may apply"
How to opt out ("Reply STOP to unsubscribe")
How to get help ("Reply HELP for help")

Common Mistakes That Get Businesses Flagged

Based on what we see across the industry, here are the most frequent compliance failures:

1. Sending Without Registration

The most basic mistake. Unregistered traffic is being filtered at increasingly aggressive rates. If your messages aren't arriving, this is likely why.

2. Mismatched Campaign Content

You registered for "appointment reminders" but you're sending promotional offers. Carriers compare actual message content against registered use cases, and mismatches trigger reviews.

3. Purchased or Scraped Contact Lists

Buying a list of phone numbers and blasting them with texts is a TCPA violation waiting to happen. You have no proof of consent, and complaint rates from purchased lists are astronomical.

4. Missing Opt-Out Mechanism

If someone texts STOP and keeps getting messages, you'll face complaints, carrier flags, and potentially lawsuits. Opt-out must be automatic and immediate.

5. Ignoring Time Zone Restrictions

Sending a text at 9:30 PM because it's 9:30 PM in your time zone, while it's 11:30 PM in the recipient's time zone, is a violation. Always calculate based on the recipient's location.

6. No Consent Records

When a complaint comes in, you need to prove the person opted in. If you can't produce documentation of when and how they consented, you lose.

7. Sharing Numbers Across Unregistered Campaigns

Using one phone number across multiple types of messaging without proper campaign registration for each use case.

The Cost of Non-Compliance

Let's talk real numbers so the risk is concrete:

TCPA fines: $500-$1,500 per unsolicited message. A batch of 1,000 texts could mean $500,000-$1,500,000 in liability.
Carrier filtering: Your messages simply stop arriving. No notification, no error — they just vanish. Your response rates crater and you have no idea why.
Number blocking: Carriers can block your numbers entirely, requiring you to get new numbers and re-register.
Campaign suspension: TCR can suspend your campaign registration, cutting off your ability to send from any number tied to that campaign.
Class action lawsuits: TCPA is one of the most litigated consumer protection laws in the United States. Plaintiff attorneys actively look for violators.
Reputation damage: Once flagged, rebuilding trust with carriers takes months, and your deliverability suffers the entire time.

A2P vs P2P: Why the Distinction Matters

Understanding the difference between Application-to-Person (A2P) and Person-to-Person (P2P) messaging is critical:

A2P messaging is any text sent from a business application to a person. This includes:

Automated outreach sequences
Appointment reminders
Marketing campaigns
Order confirmations
Two-factor authentication codes

P2P messaging is a genuine conversation between two individuals using their personal phones.

Why it matters: Carriers apply different rules to each. A2P traffic requires 10DLC registration. If you're sending A2P messages without registration, carriers treat it as spam-like P2P traffic and apply aggressive filtering.

Some businesses try to disguise A2P traffic as P2P to avoid registration. This is a terrible idea. Carriers have sophisticated detection systems that analyze sending patterns, message volume, content similarity, and timing patterns. Getting caught means immediate blocking and potential blacklisting.

How AI Platforms Handle Compliance Automatically

Modern AI-powered sales platforms take the compliance burden off your plate by building it into the infrastructure:

Automatic opt-out detection: When someone texts "STOP," "UNSUBSCRIBE," "CANCEL," or similar keywords, the system immediately suppresses them — no human intervention needed.
Time zone-aware sending: Messages are automatically scheduled based on the recipient's local time zone, ensuring you never text outside legal hours.
Consent tracking: Every opt-in is logged with timestamp, source, and IP address, creating an auditable compliance trail.
10DLC registration management: The platform handles brand and campaign registration, number assignment, and ongoing compliance monitoring.
Content monitoring: Messages are checked against registered campaign use cases to prevent mismatches.
Throughput management: Sending rates are automatically throttled to stay within your trust score's allocated throughput, preventing carrier flags.

This is one of the biggest advantages of using a purpose-built platform versus trying to cobble together SMS compliance on your own. The rules are complex and constantly evolving — having compliance built into the system means you can focus on your actual business instead of carrier regulations.

Best Practices for Maintaining High Deliverability

Registration is just the start. Here's how to keep your SMS program performing well:

Warm Up New Numbers

Don't blast 10,000 messages from a brand-new number on day one. Start with low volume (50-100/day) and gradually increase over 2-4 weeks. This builds sender reputation with carriers.

Monitor Your Delivery Rates

Track delivery rates, not just send rates. A drop in delivery rate is often the first sign of carrier filtering. Investigate immediately.

Keep Your Content Clean

Avoid spam trigger words, excessive caps, and too many links or special characters. Write messages that sound like a real person, not a marketing robot.

Segment and Personalize

Generic blast messages get higher complaint rates. Personalized, relevant messages get higher engagement and lower complaints — both of which improve your sender reputation.

Maintain List Hygiene

Regularly clean your contact lists. Remove bounced numbers, long-term non-responders, and any numbers that have been disconnected or reassigned.

Respond to Replies

When someone replies to your text, respond promptly. Engagement signals to carriers that your messages are wanted, which improves deliverability.

Keep Consent Fresh

Consent doesn't last forever. Industry best practice is to re-confirm consent periodically, especially if you haven't messaged someone in 6+ months.

Checklist: Is Your SMS Program Compliant?

Run through this checklist to assess your current compliance status:

[ ] 10DLC brand registration is complete and approved
[ ] Campaign registration matches your actual messaging use cases
[ ] Phone numbers are assigned to approved campaigns
[ ] Express written consent is collected before sending marketing texts
[ ] Consent records are stored with timestamp, source, and method
[ ] Opt-out keywords (STOP, UNSUBSCRIBE, CANCEL) are handled automatically and immediately
[ ] Opt-out confirmation is sent when someone unsubscribes
[ ] Suppression list is maintained and checked before every send
[ ] Time zone restrictions are enforced (no texts before 8 AM or after 9 PM local time)
[ ] Initial disclosure includes business name, frequency, data rates notice, and opt-out instructions
[ ] Message content matches registered campaign use cases
[ ] Sending volume stays within trust score throughput limits
[ ] Delivery rates are monitored for drops that indicate filtering
[ ] Contact lists are regularly cleaned and maintained

If you can't check every box, you have work to do. The good news is that none of this is particularly difficult — it just requires attention and the right systems in place.

The Bottom Line

10DLC compliance isn't just about avoiding fines (though that's a good reason on its own). It's about ensuring your messages actually reach the people you're trying to contact. In a world where carriers are aggressively filtering non-compliant traffic, proper registration and adherence to TCPA requirements is the difference between a thriving SMS program and one where your messages disappear into a black hole.

The businesses that treat compliance as a foundation rather than an afterthought are the ones seeing the best results from their SMS outreach. Get registered, follow the rules, use a platform that handles the technical complexity for you, and focus on what matters — having real conversations with your prospects and customers.