A2P 10DLC rule registry
Registration-side twins of runtime obligations: STOP and HELP handling, quiet hours, suppression scope, consent record retention, and programme change management. These verify what was declared at registration, and record what falls due after approval.
STOP, END, CANCEL, UNSUBSCRIBE and QUIT must all appear in the declared opt-out keyword set.
The campaign must declare an opt-out keyword set, and that set must be the one the sending platform is configured to honour.
Opt-out keywords must be matched case-insensitively, tolerantly of punctuation, and when the keyword is surrounded by other text in the same message.
Revocations phrased in ordinary language — "take me off your list", "please opt me out" — must be honoured even though they contain no declared keyword.
A consumer who sends STOP must never receive an error message in response.
Where several programmes share one application address, STOP must terminate every one of the consumer's active programmes on it, and any keyword menu must offer a STOP ALL option.
Published opt-out instructions must not designate an exclusive revocation method — a consumer may use any reasonable channel.
Revocations captured by an IVR key-press, a live agent, a designated website or number, an email or a voicemail must all be written into the same suppression list as a texted STOP.
A revocation sent by text also stops robocalls to that number, and a revocation given on a call also stops texts.
No message may be sent to a number after a valid opt-out is received, whatever the campaign type.
The time taken to honour a revocation is measured from receipt of the revocation, not from the confirmation, and must never exceed ten business days.
Every opt-out transaction must be recorded with the raw inbound text, the channel it arrived on, and the normalisation that was applied to it.
The per-campaign opt-out rate must be monitored, audited above roughly 0.5% on a send, and the campaign suspended with a root-cause analysis above 4% in 24 hours.
In a viral or referral programme, an opt-out must be honoured across every message sent through that application, programme or software.
Content engineered to defeat opt-out or content detection — deliberate misspellings, non-standard phrasing — is prohibited.
A HELP request must always produce a response, whether or not the sender is currently subscribed and whether or not the programme is a subscription.
The carrier deactivation feeds must be processed every day and the listed numbers removed from every opt-in list.
The programme must describe checking carrier deactivation data before each send, and logging each ingest.
Recipient lists must be scrubbed against the national do-not-call registry before any telephone solicitation, unless prior express written consent or an established business relationship applies.
Every send must be scrubbed against the brand's own company-specific do-not-call list.
A do-not-call request must be recorded, with the name and number, at the time the request is made.
Before texting a state's residents, determine whether the seller must register with that state and post a bond.
Every 10DLC A2P message must carry a valid, authorised carrier message class tag.
Similar or identical content must not be distributed across many sending numbers to dilute per-number reputation or evade filtering.
Numbers must not be cycled — used until deliverability degrades and then discarded, or freshly provisioned to escape a suspension.
A number blocked by a receiving network must never be auto-replaced with a fresh one, and a permanent block code must be treated as a programme defect rather than a replacement trigger.
Each 10DLC, short code or toll-free number must use a single static route; dynamic routing is permitted only for major network outages.
A2P traffic must not be carried over any path or setting not authorised by the service providers for non-consumer messaging.
Sub-aggregation is prohibited: no more than one party may control the content sent from, or the numbers receiving on, a single approved number.
Multiple fully-qualified domains, or multiple public URL shorteners, must not be cycled across bulk messages carrying similar content.
Traffic must continue to match the registered use case and the registered samples, not merely have matched them at approval.
Message types the subscriber did not consent to must not be sent — a survey to an OTP-only list, marketing to a transactional opt-in.
The message number and sender name must not be spoofed or substituted in any way that misleads a consumer.
Volume must not originate from SIM boxes, SIM farms, or disposable, rental or temporary telephone numbers.
A message sender with no business relationship with the CPaaS or wireless provider carrying its traffic must be treated as a compromised-system indicator.
Prohibited content must not appear in live traffic regardless of what the approved samples showed.
Where the Telemarketing Sales Rule applies, the programme must retain the consent request as it was presented, the purpose consent was sought for, and the consent actually given with its date and the consenting party.
Where the Telemarketing Sales Rule applies and consent was spoken, a recording of both the request and the consent given must be retained, making the purpose clear.
Every consent record must carry the prompt version played, the digit or spoken answer captured, the timestamp and the call identifier.
Where no message is sent within 30 days of collecting consent, the programme must reconfirm by double opt-in before its first send.
A charitable programme must let no entity other than the charity use the collected subscriber data, and only for the campaign it was collected for.
An identity-status appeal must be submitted within 45 calendar days of the brand being created, not of the decision being received.
Legal name, entity type, tax ID and tax ID issuing country must not be updated before an appeal is filed, and no brand update may be submitted while one is in flight.
Legal name, entity type, tax ID and tax ID issuing country cannot be edited while the brand has an active campaign or a vet in progress.
Messages may be sent only after the consumer has opted in; the single opt-out acknowledgement is the only permitted exception.
Consumers who send viral or referral messages must receive nothing of value for doing so.
HELP keyword support is required regardless of whether the programme sends recurring messages.
The campaign must declare a single opt-out confirmation and nothing further after a consumer revokes.
A programme messaging in a language other than English must honour STOP in that language, and must not return an error to the English keyword.
STOP, HELP and the rest of the mandatory keywords must be processed identically whether they arrive as SMS or MMS.
An opted-out consumer must be suppressed across every sending number and every campaign belonging to the brand, not only the number that received the STOP.
Where the recipient's state sets a shorter cure window for ceasing text solicitations, that window applies instead of the federal maximum.
Where a scope-clarification message is sent and the consumer does not reply, the revocation must be treated as covering all robocalls and robotexts from the sender.
A STOP sent in reply to a scope-clarification message must not trigger a second clarification message.
Where a consumer revokes in direct response to an exempted informational message, all further non-emergency robocalls and robotexts must stop.
Inbound message logs must be reviewed on a schedule for revocations the keyword handler did not catch, and those subscriptions terminated.
A consumer who opted out must not be re-subscribed on the strength of a subsequent form submission without a fresh, separately documented opt-in.
A delivery rejection indicating the carrier holds an opt-out for the number must be treated as a suppression event in its own right.
STOP and HELP response volumes must be monitored per campaign as an ongoing obligation.
A group-messaging programme must let any member leave at any time, carry anti-abuse controls proportionate to the distribution size, and prevent recursive group messaging.
A toll-free programme must not tell consumers that STOP, UNSTOP or START will behave in any way other than the fixed carrier behaviour.
A recurring programme must carry opt-out instructions at opt-in and at regular intervals thereafter — at least monthly.
HELP must be case-insensitive, functional over both SMS and MMS, and functional in the programme's language without erroring on the English keyword.
Every destination named in the HELP reply — a phone number, a URL or an email address — must actually reach help.
The FCC Reassigned Numbers Database must be queried using the date of consent, and re-queried at least every 30 days.
Where a state requires it, reassigned-number screening is an obligation rather than a safe-harbour option.
The recipient's local time must be derived from their actual location, not from the area code of their number.
Where the recipient's state sets a narrower window than 8am–9pm, that window applies.
Where the recipient's state sets one, a per-subject frequency cap — commonly three messages per 24 hours on the same subject matter — must be enforced.
No more than ten messages should reach one recipient in any 24-hour period without two-way engagement or explicit high-frequency consent.
A per-state matrix of quiet hours, frequency caps, consent standards and retention windows must be maintained, and every national campaign evaluated against the most restrictive rule that applies to it.
The national registry version used for a scrub must be no more than 31 days old at the time the message is sent.
Where a state operates a registry that is not fully merged with the federal one, recipient lists must be scrubbed against it as well.
The registry access and scrub process must be documented, including the registry version date used for each scrub.
Where a state requires it, opt-out replies must be honoured and accurate sender identification maintained under that state's own rules.
A campaign relying on the package-delivery exemption must offer an opt-out and honour it within six business days.
Traffic classified as P2P or unregistered is limited to roughly fifteen messages or segments per number per minute.
A campaign whose description, name, website, message flow and samples all match an existing campaign is a snowshoeing signal.
Where a number or short code is shared under an approved arrangement, documented records of every message sender operating on it must be immediately available.
Any use case that genuinely needs multiple numbers to distribute similar content requires special arrangements with the service providers.
Content and traffic patterns consistent with artificially inflated traffic must be detected and rejected.
Service providers may block any message a reasonable risk assessment suggests is unwanted, and the triggers include compromised credentials, grey routes, missing authentication and a pattern of abusing best practices.
The programme must retain a consent record holding the number, timestamp, medium, a capture of the consent experience, the campaign, an IP or call identifier, and the consenting party.
A capture of the exact language and action used to secure consent must be retained and versioned per consumer.
Every consent record must carry the source URL of the consent surface.
The retained consent agreement must identify the specific telephone number consented for and bear the consumer's signature.
Consent must be recorded against the individual consumer rather than at list level.
Revocation requests must be retained for the same period as opt-ins, with the channel recorded.
The stated retention period for consent and opt-out records must be the maximum of every applicable window, not the first one the brand found.
Verbal consent must be evidenced per consumer by a recording, a transcript, or documented contemporaneous notes — never by the script alone.
Every consent record must carry the version and effective date of the consent script read to the consumer.
A programme taking spoken consent must have a documented no-recording evidence path, and must never refuse a consumer the opt-in because they declined recording.
Call recordings must be retained at least as long as the consent records they are the evidence for.
Where consent is collected outside the SMS channel — web, phone, point of sale or paper — the programme should send a double opt-in confirmation before recurring messages.
The message frequency stated in the consent disclosure, the SMS terms, and the campaign description must agree.
The number-pool attribute must reflect whether the campaign will actually send from multiple numbers.
The description must not mention message categories outside the declared use case.
An inbound message whose intent is a question must not be treated as a revocation merely because it contains a stop-word.
A documented process must exist for capturing revocations conveyed to customer-service agents, in-store staff or social messages.
The single permitted opt-out confirmation should reach the consumer within five minutes of the revocation.
A scope-clarification question may appear in the opt-out confirmation only where the consumer consented to several distinct message categories.
Every send attempt suppressed because the number was opted out must be logged.
The programme must leave a published route back for a consumer who opted out and later wants the messages again.
The published policy must not permit sharing or forwarding opt-out records to unaffiliated parties without the consumer's prior express permission.
On toll-free traffic, expect the carrier to append opt-out language to outbound messages — it is billable, cannot be removed and can only be shortened.
Customer-care contact instructions must be promoted at opt-in and at regular intervals thereafter, at least monthly.
A fresh opt-in must be obtained when a subscriber ports their number between carriers.
Destination numbers should be validated as real, active mobile numbers before sending, since platforms bill accepted requests regardless of delivery.
Where a state sets monthly solicitation volume caps and log-production duties, both must be met.
Sending should be restricted to normal daytime business hours in the recipient's local time as a platform default.
Personnel must be trained in the existence and use of the internal do-not-call list, and the training records retained.
Where an exemption requires it, exempted informational messages must not be charged to the called party or counted against their plan limits.
Low-volume campaigns must stay under their published ceiling, or be upgraded to a standard registration.
A UCaaS low-volume registration is limited to a low daily ceiling, a restricted throughput class, one number per human user, and no API or automated traffic.
Brand registration and vetting alone do not raise the sending platform's own default per-number rate; a separate increase must be requested.
Uncapped political throughput requires a valid political vetting artefact; 501(c) tax-exempt status alone yields only standard terms.
Traffic above the published consumer-operation reference thresholds is classified as non-consumer, whatever the sender intends.
A P2P exemption may only be registered where every published condition holds — no business sending, not a cloud communications suite, human-written messages, traffic symmetry no worse than one to three, and a clean compliance history.
Integrations must stay within the registry's published API rate limits.
Consecutive number ranges must not be purchased to support higher-volume sending.
At medium-to-high volume, marketing traffic should sit on its own campaign and number set, with a separate short code per brand and per message type.
A business or programme should send from one primary, recognisable source number.
A campaign should be registered only when it will actually send; sustained inactivity triggers dormancy suspension.
The autoRenewal setting must be chosen deliberately — true renews monthly, false deactivates at cycle end.
Where consent was verbal or via IVR, a call identifier must replace the IP-address field in the consent record.
Every consent record must carry the confirmation method used — a ticked box, a click, or a replied keyword.
The retention period must be measured from the last message sent in reliance on the consent, not from the date the consent was collected.
Every consent record must carry the identifier of the agent who read the consent script.
A recurring programme should describe expiring an opt-in after a long period of subscriber inactivity, with one final notification permitted.
Every submitted evidence image must carry its capture timestamp, the source URL, and enough provenance to tie it to the live surface.
A promotional campaign should indicate that sending respects recipient-local quiet hours.
The programme should state how long consent and opt-out records are retained.
The message volume the campaign implies should be consistent with the size of the business described.
A suppression architecture that cannot revoke across every message category for a sender must be flagged before the federal revoke-all rule takes effect on 31 January 2027.
Where a state enacts holiday blackout dates for solicitations, no solicitation may be sent on them.
Litigation exposure must be sized separately for state regimes with a private right of action, and carrier approval must not be treated as legal compliance.
The message validity period must be long enough for the message to survive queueing at the sender's actual throughput.
Message body wording should vary across a bulk send rather than being byte-identical to every recipient.
Every consent record must carry the device or browser user agent behind the submission.
Ekas runs every rule that gates approval, 823 of these 915, against your registration before it reaches the carrier. It reads your site, your policy pages and your opt-in the way a reviewer would, and hands you the fix, not just the verdict.