# BRD-278 — Cannabis, CBD and related brands are not carried, whatever the traffic

> A brand whose business is cannabis, CBD, hemp derivatives, kratom or drug paraphernalia must not be registered for A2P messaging.

- **Rule ID:** BRD-278
- **Layer:** Brand (`BRAND`)
- **Checks:** `brand.vertical + brand fields + website content`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form; AI judgement over the crawled website or policy page; External record we cannot query — reported as a warning to verify
- **Fix type:** Hard stop — not remediable, resubmission will not help
- **Required by:** AWS, Bandwidth, Bird, Sinch, Infobip, Plivo
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/brand/brd-278/

## Why this rule exists

The prohibition attaches to the business rather than to the message, and it holds regardless of state legality — so a licensed dispensary sending nothing but appointment reminders or two-factor codes is still ineligible. That is the part legitimate operators do not believe until it happens: the traffic is harmless, the business is the disqualifier, and logistics companies serving the sector are caught by the same rule.

## How to fix it

A cannabis-sector brand cannot be registered for A2P messaging in the US, including for two-factor or transactional traffic. Use email, an app, or a web channel for customer messaging.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Bandwidth | `701` | no |
| Sinch | `CR2015` | no |

## Check this yourself

**Does this business sell, distribute, or serve the cannabis, CBD, hemp, kratom or paraphernalia sector in any part of its trade?**

1. Ask what the business actually sells, not what these messages say. The prohibition attaches to the business and holds regardless of state licensing.
2. Include logistics, payments and services to the sector — they are caught by the same rule.
3. Where the answer is ambiguous, settle it before submitting rather than after.

*What wrong looks like:* A licensed dispensary sending nothing but appointment reminders or two-factor codes is still ineligible. The traffic is harmless and the business is the disqualifier.

## Notes

Absorbs MSG-191: the ban attaches to the business type, so it holds even for 2FA-only or purely transactional traffic, which is exactly what MSG-191 states at the message layer. Whether a business is licensed in the cannabis sector may need a state licence register the product does not hold, so a brand that reads as ambiguous should be confirmed by the user before submission rather than after.