10DLC brand rules

The legal company name field must be populated for every entity type except sole proprietor, where TCR wants it omitted and the person's name used instead.

The registered legal company name must match the IRS CP-575 / 147C record for the submitted EIN, character for character.

The registered legal name must include the entity suffix exactly as filed — no abbreviation, expansion, or omission.

The legal name field must contain only the entity name — not a contact person or role suffix appended to it.

A DBA, trade name, subsidiary name, or product name must not be submitted in the legal company name field.

A legal business name already registered as a brand at TCR cannot be registered again, by anyone.

The display name, company name, and any first and last name fields must contain real, natural text — not obfuscated, garbled, or placeholder strings.

Outside the sole-proprietor tier, the registered brand must be a business entity rather than an individual's personal identity.

Each brand must be scoped to a single message sender — one brand per company, client, franchise or subsidiary, and no number shared between brands.

A tax ID or business registration number must be supplied for every entity type except sole proprietor.

The EIN must be exactly nine digits (formatting characters aside).

A US EIN must be submitted in the hyphenated XX-XXXXXXX form.

A Social Security Number must not be submitted in the business registration number field.

A DUNS number must not be submitted as the US business registration number.

Where a business-registration identifier type is declared, it must be one of EIN, DUNS, CBN, CN, ACN, CIN, VAT, VATRN, RN or Other.

The business-registration identifier value must be in the form its declared type requires.

einIssuingCountry must be a valid ISO-3166 alpha-2 code and must equal the country the business is registered in.

Where the entity does not appear in third-party verification databases, an official registration or IRS document must be uploaded with the brand.

For a country on TCR's VAT-optimised list, submit only the numeric portion of the VAT ID; elsewhere submit the corporation registration number or national tax ID.

A brand registered in a country outside TCR's permitted-country list cannot be registered at all.

At least one provider requires external vetting on every non-US customer before the brand can be used.

A registration that requests a volume tier requiring a tax ID cannot be filed on the sole-proprietor path.

entityType must be exactly one of PRIVATE_PROFIT, PUBLIC_PROFIT, NON_PROFIT, GOVERNMENT or SOLE_PROPRIETOR.

The selected entity type must match how the business is classified on its tax record, with documentation where the classification is not machine-verifiable.

A brand whose country of registration is not the US must be PRIVATE_PROFIT — GOVERNMENT and NON_PROFIT are US-only classifications.

Where a business_type is declared, it must be one of Co-operative, Corporation, Limited Liability Corporation, Non-profit Corporation or Partnership.

The PUBLIC_PROFIT classification is available only to a company whose shares are genuinely publicly traded.

A PUBLIC_PROFIT brand must declare both its ticker symbol and the exchange it trades on.

A public company's stock exchange must be one of the supported registry values.

A stock symbol already registered against another brand cannot be used again.

A brand running the charity use case must be accredited by at least one independent non-profit accreditation body.

A charity brand must retain its organisation name, EIN, charity website and accreditation listing URL as proof of 501(c)(3) standing.

A brand holding 501(c)(3) status must not register the Agents & Franchises, Carrier Exempt, Proxy, Social or Sweepstake use cases.

The GOVERNMENT entity type is reserved for US federal, state or local government bodies.

The SOLE_PROPRIETOR tier is for a US individual without an EIN. Supplying an EIN disqualifies the registration.

The sole proprietor brand name must be the individual’s first and last name — never an LLC, Inc, Corp or other registered entity name.

The sole-proprietor mobile number must be an active US or Canadian wireless number in E.164 that can receive SMS.

A mobile number used for sole proprietor OTP verification may back at most three brand registrations, and must not be a CPaaS-issued number.

The sole-proprietor OTP must be answered YES within 24 hours, or the verification must be re-triggered.

Any change to the sole-proprietor mobile number reverts the brand to UNVERIFIED and requires the OTP to be run again.

External vetting, and the throughput increases vetting buys, are not available on a sole-proprietor brand.

Logo and banner assets for RCS cannot be uploaded to a sole-proprietor brand.

Some providers refuse sole proprietor registrations outright, and one also refuses sole proprietor appeals.

Street, city, state or region, postal code and a two-letter country must all be populated.

For a US or Canadian address, the state or province must be the two-letter abbreviation.

The registered address must match the address on the IRS or national registration record exactly, including abbreviation style.

House number, street, locality and postal code must all resolve to a deliverable address at the postal authority.

The registered business address must be a street address; PO boxes are rejected.

The registration address must not appear in known spam or scam complaint data.

Every brand must supply a support phone number.

The brand support phone must be submitted in E.164: a leading plus, the country code, and digits with no separators.

An authorised representative's phone number already used on another brand cannot be used again.

The brand support email must be a syntactically valid address.

The brand support/business contact email must be on a domain the business controls, not a free consumer mail provider.

The brand contact email must be on a domain the business demonstrably owns — shown on its website, matching WHOIS, or verified by DNS.

The brand contact email must not be on a disposable or temporary mail domain.

The brand contact email domain must resolve with an MX or A record.

A PUBLIC_PROFIT brand must carry a business contact email — it is mandatory and it triggers the Authentication+ 2FA.

Any change to a PUBLIC_PROFIT brand's business contact email resets identity verification and requires the 2FA to be completed again.

A widely recognised company name paired with a free or non-corporate email domain must be treated as probable impersonation.

The brand website must be submitted with an explicit http:// or https:// scheme.

A website URL already registered against another brand cannot be registered again.

Where the brand registers no website, a compliant policy document must be attached to the registration or hosted at a public URL.

The display name must be populated within its length bound, and the DBA field must be populated even when it is identical to the legal name.

Any trading name the business uses publicly — on its site or in its messages — must be declared in the DBA field rather than substituted silently.

The industry vertical must be one of the 23 TCR values, and is required for every entity type except sole proprietor.

Outside the sole-proprietor tier, brandRelationship must be one of BASIC_ACCOUNT, SMALL_ACCOUNT, MEDIUM_ACCOUNT, LARGE_ACCOUNT or KEY_ACCOUNT.

The brand must be the legal entity whose messages are sent — never the agency, ISV, reseller, or software platform acting on its behalf.

The toll-free registration contact must be an authorised representative's full first and last name.

Sufficient identifying information must be obtained to verify and authenticate the sender's identity before that sender sends any message.

At most one brand may be registered against a given tax ID.

A brand submission is blocked where it matches an existing brand on legal name, registration number, mobile number, representative phone, email, website or stock symbol.

Remediating a failed brand differs by interface: the API permits an update in place, while the console requires delete and recreate.

The customer-profile and A2P bundle identifiers must be distinct, belong to the same account, and not be swapped.

All campaigns on a brand must be deactivated before the brand can be deleted.

A deleted brand cannot be reactivated; the deletion is final.

Traffic under suspension or carrier review must not be migrated to a new brand or campaign.

After a suspension, new brands created on the same tax ID should be expected to be restricted.

A deprecated starter-class brand must not be created or updated.

A campaign must not be submitted while the brand's vetting is still in review.

The chosen vetting provider must support the brand's entity type and country of registration.

On a vet import, the legal name and entity type must match the vetting report exactly, and the vetting token must be supplied.

An Authentication+ class vet must not be submitted for import — the class does not support it.

The brand website and business contact email must be populated before an Authentication+ or RBM vet is ordered.

A PUBLIC_PROFIT brand must reach identity VERIFIED with Authentication+ ACTIVE before any campaign can be registered.

Under Authentication+ 2.0 the vet must be ordered explicitly after the identity check; it no longer runs automatically.

The business contact must complete the Authentication+ 2FA PIN within 30 days of the vet being submitted, or the vet must be re-submitted.

An Authentication+ vet must not be ordered for a brand that is not PUBLIC_PROFIT.

After Authentication+ verification completes, brand identity information cannot be changed; a new brand must be created instead.

At least one provider requires standard or enhanced brand vetting for any use case beyond the lowest-volume mixed tier.

A successful vetting status on the brand and the content provider is required to be assigned a short code or to extend a lease.

A political brand must hold exactly one of: a Campaign Verify token, an Aegis political vet, or verified 501(c)(3/4/5/6) status.

A political vet must not be requested or imported for a brand that already holds 501(c)(3), (4), (5) or (6) status.

A 527 political organisation must hold a Campaign Verify token, and must record the FEC ID or state filing URL used to obtain it.

A Campaign Verify token may be imported only onto a US-based non-profit brand without 501(c) status, and only while the brand has no active campaigns.

Each Campaign Verify token is single-use and unique to one brand and CSP; a second use requires a reissue or a fresh political vet.

A Campaign Verify token must be checked for expiry before it is imported.

A second Campaign Verify import must not be submitted while one is in progress.

For an Aegis political vet, the filing email must exactly match the email on the political registration, and must not be a consumer domain.

The contact name on an Aegis political vet must match an authorised name in the political registration — not the CSP's or the aggregator's.

A federal candidate, committee or party running a donation programme must be currently registered with the FEC.

An appeal may be filed only against a vet in a final state — never against one still pending.

At least one appeal category must be selected, and it must be one that is valid for the brand's entity type.

The LOW_SCORE appeal category is valid only for an external vetting appeal, never for an identity-status appeal.

A VERIFIED non-profit or government brand must still appeal where its tax-exempt or government attribute is missing.

Each brand text field must be within the strictest cap its downstream targets enforce.

The brand contact email and phone fields must contain no whitespace.

No brand field may contain an emoji or pictograph.

Required brand contact and address fields must not hold placeholder values such as N/A, TBD or none.

An RCS logo must be 224×224 pixels and at most 50 KB, a banner 1440×448 and at most 200 KB, both JPEG or PNG, with at most 50 of each per brand.

A brand whose business is buying, selling or sharing consumer information with third parties must not be registered for A2P messaging.

A brand whose business is gambling, betting, casino, lottery or raffle must not be registered for A2P messaging.

A brand whose business is high-risk financial services — payday and short-term lending, indirect loan marketing, stock alerts or crypto must not be registered for A2P messaging.

A brand whose business is cannabis, CBD, hemp derivatives, kratom or drug paraphernalia must not be registered for A2P messaging.

A brand whose business is a third-party job board or staffing aggregator must not be registered for A2P messaging.

A brand whose business is sweepstakes must not be registered for A2P messaging.

A brand whose business is third-party debt collection, debt consolidation or relief, or credit repair must not be registered for A2P messaging.

A brand whose business is get-rich-quick, work-from-home, multi-level marketing, mystery shopping or risky investment schemes must not be registered for A2P messaging.

A brand whose business is controlled substances, prescription drugs, or fireworks and pyrotechnics must not be registered for A2P messaging.

The brand must not appear on the submitting provider's internal blocklist.

The brand record must describe a real business; fabricated details or a known scam pattern must never be submitted.

Where the IRS CP-575 or 147C prints the entity name across more than one line, every line above the address line belongs in the legal name, and nothing below it.

On a submission that goes to TCR directly, the company name is the first line of the IRS-registered name and nothing after it.

The legal name must come from the IRS CP-575 confirmation letter or a 147C letter — the name on a W-2 or W-9 is not authoritative for this purpose.

Where the business has been acquired, the brand must carry the company information used for tax reporting at the time — not the acquirer's.

A newly issued EIN is not yet present in the records vetting providers query; registration fails until it propagates.

A non-US registration identifier should be confirmed against the issuing country's official register before it is submitted.

A brand registered outside the US will usually fail the initial automated identity check and must budget for an appeal or an external vet.

Any change to entity type, EIN, EIN issuing country or legal name re-runs brand verification and resets the identity status.

stockSymbol and stockExchange must be omitted entirely when the entity type is not PUBLIC_PROFIT.

A NON_PROFIT registration must be backed by an EIN that appears in the IRS Tax-Exempt Organization Search.

A non-profit brand must be marked as non-profit consistently across entity type, vertical, and any company-type field.

A GOVERNMENT brand must have the governmentEntity attribute set before the top carrier class can be assumed.

A sole-proprietor registration that declares a DBA must be re-filed as a standard brand.

Sole-proprietor traffic is capped at roughly 1,000 messages a day and 15 a minute, enforced at the CSP rather than by the carrier.

Where a CSP is enabled for sole-proprietor brands, monthly traffic reports must reach TCR by the 7th of the following month.

Where the registration record carries a suite, unit or apartment number, the brand address must carry it too.

A branch or local-office address must not be submitted where the official registered company address differs.

A PO box, mailbox service or general-delivery address cannot be used when express PIN delivery is requested for political vetting.

The brand support number must route to the business and be answerable during business hours.

The brand business-contact email must be an individual mailbox, not a role or group address such as info@ or sales@.

The brand contact mailbox must be able to receive external mail before Authentication+ 2FA is triggered.

The brand contact email must reach the business being registered, not the ISV, agency or reseller that filed the registration.

The registered website's domain must bear a recognisable relationship to the legal name or the DBA.

The declared industry vertical must match the business the registered website actually describes.

The DBA must be recognisably the same business as the legal name, the website, and the campaign — not an unrelated third name.

The website domain shown in the opt-in evidence must match the brand's registered domain.

The brand contact must be an authorised representative of the business, not a generic, third-party or aggregator name.

Where a reseller or agency sends, the consent must authorise messages delivered, or caused to be delivered, by the named seller.

Where a Texas exemption is relied upon, the basis for it must be documented and retained.

Where a provider permits more than one brand per tax ID, the number is still capped and each additional brand needs a documented business reason.

Each brand must have its own contact address, email and phone; reusing them across brands is a policy violation.

Brand status changes should be received as events on a webhook rather than discovered by polling.

Where the vetting score is below the carrier or use-case threshold, the underlying brand data must be corrected before a re-vet.

The vetting score determines the carrier class and daily throughput the brand receives, and 75 or above is the target.

A provider trust score at or below the gate blocks campaign registration entirely, and one just above it restricts which use cases are available.

Where the same brand is registered by more than one CSP, the same vetting token must be imported into each instance.

A completed vet expires when the brand information behind it changes.

The Authentication+ verification link and PIN expire after seven days and must be re-requested.

The skip-automatic-vetting flag may be set only for Low-Volume Standard registrations, 527 political organisations, and Campaign-Verify-registered brands.

External vetting should be ordered before registering a campaign that needs material volume.

The T-Mobile daily brand cap is an allowance against the tax ID, pooled across every campaign and every CSP that registered it, resetting at midnight Pacific.

Brand vetting must be renewed each year, with the 2FA verification completed again to the brand email on file.

Where a supporting document runs to several pages, all of them must be attached — partial submissions are rejected.

Appeals must rely on federal-level tax documentation; state-level documents are not accepted.

Every brand text field must be submitted in English; non-English submissions are rejected as untranslatable.

On a toll-free verification, every end-business detail must be populated rather than a subset of them.

The representative, the email, the address and the website must each independently resolve or validate.

A non-US brand cannot stay on the Low-Volume Standard class once additional vetting is required of it.

A verified public brand on the Russell 3000 starts at the top carrier classes; one that is not starts at the bottom until it is vetted.

A charity seeking a single unified short code for fundraising must demonstrate at least five years of operation.

Sole-proprietor brands cannot be migrated from one CSP to another.

The registered business phone number should be discoverable through a public web search for the business.

The brand website must be submitted as the root domain rather than a deep link or sub-path.

The industry vertical must be chosen from the list the target platform uses, which is not always the TCR vertical list.

brandRelationship must not be changed more than once in any three-month period.

business_regions_of_operation must be drawn from AFRICA, ASIA, EUROPE, LATIN_AMERICA and USA_AND_CANADA.

job_position must come from Director, GM, VP, CEO, CFO, General Counsel or Other, and the representative's exact business title must be supplied alongside it.

The business-identity and reseller flags must say correctly whether the registering party is the brand itself or an ISV, reseller or partner.

Where a toll-free verification is submitted on behalf of an end business, the ISV or reseller name must be disclosed.

The brand's role — seller or telemarketer — must be established, because the obligations and the liability differ.

Virginia holds the telephone solicitor and the seller jointly liable, and an agency arrangement does not shield either from the other's failure.

A CSP must not exceed the default cap of 1,000 registered brands without requesting an increase.

A brand must not exceed the default cap of 50 campaigns without requesting an increase.

On at least one provider, a brand's details become uneditable once it is verified.

External vetting exists to raise throughput, not to reverse a rejection, and it is not guaranteed to raise anything.

An enhanced vet must not be ordered where the standard vet has already returned a score at the top band.

A vet must not be re-ordered against unchanged brand information, nor more than once in three months after the first post-registration re-vet.

A second Authentication+ vet must not be submitted while one is pending.

An Authentication+ failure caused by an unanswered 2FA email must be resolved with a new vet rather than an appeal.

The appeal explanation must be no longer than 1,024 characters.

An appeal may carry at most ten attachments, each no larger than 10 MB, and no more than 30 MB in total.

Where altBusinessId is supplied, altBusinessIdType must be one of DUNS, GIIN, LEI or NONE.

Social-media profile URLs should be supplied to strengthen brand verification.

Non-production submissions should use mock brands so fees are not charged and duplicate detection is not polluted.

Company size, years in operation and domain age drive the trust score and cannot be improved by data entry.