SMS compliance
A2P 10DLC registration: why it fails, and how to pass first time
Six things decide whether your brand and campaign get approved. This is what each one is, which rejection code it maps to, and the single sentence that most failures come down to.
Written from the compliance checks we run against our own customers sites before they pay the vetting fee.
The part nobody warns you about
US carriers require any business sending automated texts over an ordinary ten-digit number to register two things: a brand, meaning who you are, and a campaign, meaning what you intend to send and how people agreed to receive it. Skip it and your messages do not bounce, which would at least be informative. They report as sent and quietly get filtered.
The unpleasant part is that you pay the vetting fee before you find out. A rejection frequently arrives as a code and a terse phrase, sometimes with no usable detail at all, and the natural response is to change something plausible and pay again. That loop is where most small businesses give up on texting altogether, and it is almost always caused by one of six things.
None of the six are hard. They are just not written down anywhere in plain language, which is what this page is for.
The six things reviewers check
In the order they matter. The first and third carry the most weight, because they are the two biggest rejection buckets.
Business profile completeness
TCR 30878 / 30795 / 30896Legal business name exactly as registered, tax or company registration number, a real street address, business type and vertical, and an authorised representative with a working email and phone. The word doing the damage here is exactly. If you registered as Smith Holdings Limited and you type Smith Co, that is a mismatch, and mismatches are rejections rather than queries. This check carries the most weight of the six because it is the biggest rejection bucket.
Your website is live and reachable
TCR 30897The site has to load, over HTTPS, and return a real page, and it has to do it quickly. The reviewer crawler is not patient: if your site cannot answer in a few seconds, your vetting is at risk for that reason alone. A holding page, a site behind a password, a domain that resolves but times out, or a link with a typo in it all fail here. So does a site that is one long single page when your registration describes an established business, because reviewers read a one-pager as a thinner signal.
The privacy policy clause
TCR 30909This is the one. In our own data it is the most common single reason a registration comes back rejected, and it is one sentence. Carriers require your privacy policy to state that mobile information collected through your opt-in is not shared with third parties for marketing. Not implied by a general data-sharing paragraph. Stated. Most businesses have a perfectly good privacy policy that simply never mentions SMS, and it fails.
Your sample messages
Content reviewThe examples you submit are read as representative of everything you will send. They need to identify your business by name, because a message that could be from anyone reads as a scam. At least one needs to show the opt-out, meaning STOP or unsubscribe wording. HELP should be answered somewhere. And the message and data rates line belongs in there too. Samples that are one line of friendly text with no identification and no opt-out are a common and entirely avoidable failure.
A form that actually collects consent
Opt-in evidenceSomewhere on your site there needs to be a form with a phone number field and a separate, unticked consent checkbox for text messages, with wording next to it saying what people are agreeing to. Consent bundled into a general terms acceptance does not count. Neither does a phone field with no consent language at all, which is what most contact forms are. Reviewers look for this because the whole scheme exists to prove people asked to hear from you.
The use case matches what you will send
AdvisoryRegister as low-volume mixed and then send marketing blasts and you have a problem later rather than at submission. This one is advisory rather than a hard gate, but getting it wrong stores up a filtering issue for the month you actually scale. Pick the use case that describes what you will really be doing in six months.
The sentence most rejections come down to
If you do one thing from this page, do this one. Your privacy policy has to say that mobile information is not shared with third parties for marketing. Add this, in these words, as its own line:
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
Then reference the programme itself, so the policy acknowledges that you send texts at all:
Reply STOP to unsubscribe. Msg and data rates may apply.
A general paragraph about not selling customer data does not satisfy this. Reviewers are looking for mobile or SMS data specifically, named, alongside a statement that it is not passed on. This is the most common reason registrations fail and it takes two minutes to fix.
Pass A2P Registration First Time
The six things carriers actually check, the exact privacy-policy wording they reject you for missing, the rejection codes decoded, and a copy-paste opt-in block for your forms.
If you have already been rejected
Do not resubmit the same thing hoping for a different reviewer. Work down the six checks in order, because the first and third catch most cases, and fix everything you find rather than the one thing you think caused it. Resubmissions cost money and the second rejection is the one that makes people quit.
If the problem is the brand score rather than a named fault, that is a different situation. A low score usually means the business looks thin to an automated check: recently incorporated, small web footprint, little external corroboration. Secondary vetting is a manual review you can request, and it regularly clears legitimate businesses that scored badly for no reason other than being new.
And if the fix is on a website somebody else built for you, send them the specific change rather than the rejection code. A developer who has never encountered carrier compliance cannot act on a code, but can absolutely add a sentence to a page and a checkbox to a form.
Common questions
What is A2P 10DLC?
A2P is application-to-person: a business sending texts through software rather than a person typing on a phone. 10DLC is the ten-digit long code, an ordinary local number. Together the term means business texting over a normal number, which US carriers require you to register before they will deliver it reliably. Unregistered A2P traffic gets filtered, so messages report as sent and never arrive.
Why did my A2P campaign get rejected?
In order of how often we see it: the privacy policy does not contain the mobile-information sharing clause, the business name does not exactly match the registration, there is no form on the site with a phone field and an SMS consent checkbox, the website is slow, password-protected or effectively a single page, or the sample messages do not identify the business and do not show an opt-out. Almost every rejection is one of those five, and all five are fixable in an afternoon once you know which one it is.
How long does A2P 10DLC registration take?
Brand registration is usually the fast half and campaign vetting the slow one, but the timing is set by the carriers and The Campaign Registry rather than by any platform, and it moves. The practical advice is the same regardless: start it before you need it, not in the week you are launching. A rejection plus a fix plus a resubmission is the scenario that actually hurts, and that is measured in days.
How much does it cost?
There is a one-off brand registration fee and a vetting fee, both set by the carriers and the registry, and both change often enough that any number written on a web page is a liability. Whichever platform you use should itemise the current figure before you submit. The cost that actually stings is not the fee, it is paying it, being rejected for a missing sentence in a privacy policy, and paying again.
Do I need this if I only send appointment reminders?
Yes. The requirement is about who is sending, not what you are sending: any business sending automated texts over a ten-digit number needs to register, whether the message is a marketing blast or a reminder that a dentist appointment is at four. Transactional traffic tends to be treated more favourably in vetting, but it does not exempt you.
Does this apply outside the United States?
No. A2P 10DLC is a US carrier scheme. Other countries have their own requirements, and several need a regulatory bundle instead, meaning identity and address documents for the business and sometimes proof of a local presence. Different paperwork, same underlying principle: prove who you are before you can send at scale.
Can I check whether I will pass before I pay?
You can, and you should, because the fee is charged whether you pass or not. Our platform runs the checks on this page automatically against your live site before submission and returns a score with a fix list, but you do not need us to do it: work through the six checks above by hand and you will catch most of what gets people rejected. How the pre-submission scan works.
Doing it without the guesswork
Our platform runs every check on this page against your live site automatically, before the vetting fee is charged, and returns a score with a fix list split into what you can do and what to send your web developer. That is covered on the SMS and email page, alongside hosted numbers and email domain authentication.
If you would rather not do the first registration yourself at all, it is part of what our team sets up in a done-for-you buildout. It is a one-time problem: once the brand is approved, adding campaigns later needs nobody.
See how the scan works