The 10DLC Registration Guide for 2026

Last updated July 21, 2026

10DLC (10-digit long code) is the carrier-sanctioned way for businesses to send application-to-person (A2P) messages over standard local phone numbers. Every sender registers two things with The Campaign Registry (TCR): a brand (who you are) and one or more campaigns (what you send and how people opted in). Carriers use that registration to assign your throughput and to decide whether your messages get delivered at all.

Registration is not optional. Since February 1, 2025, unregistered A2P traffic on long codes is blocked by U.S. carriers. In 2026 the compliance bar moved again: carriers now audit campaigns after approval, so registration is an ongoing state, not a one-time form.

For what a rejected campaign actually costs — in dollars and days — and the five reasons campaigns get bounced, see The Real Cost of a 10DLC Campaign Rejection.

• Legal business name exactly as it appears in state and IRS records — mismatches are the #1 delay.
• EIN (or the sole-proprietor path if you don't have one).
• Business address and website consistent with public records. The website you register must load cleanly — with a valid security certificate — at exactly the address you enter; reviewers open it in a real browser.
• Use case — what the messages do (customer care, marketing, 2FA, mixed, etc.). Unsure which fits? See the Use-Case Selection Guide.
• Opt-in documentation — exactly how a recipient consents (web form, keyword, verbal script, paper form), with evidence a reviewer can see: the exact page and form location, a screenshot, or the verbatim script. "Users opt in on our website" without a direct link is not enough.
• Sample messages that match the use case — realistic production messages, with variable content in [bracketed] placeholders and opt-out language where required.

Most rejections trace back to the call-to-action — the exact place a customer agrees to receive texts. Whatever form your opt-in takes (web form, keyword, verbal script), reviewers look for a specific set of disclosures at the point of consent. (For the full treatment with adaptable language, see the Opt-In & CTA Design Guide.)

• Your brand name — the program name in the consent language must match the registered brand or DBA.
• What they're signing up for — the message content, named in some form ("appointment reminders and account notifications", not just "messages from us").
• Message frequency — "Msg frequency varies" or a stated cadence.
• "Message and data rates may apply." — the carrier-mandated cost disclosure, verbatim.
• How to opt out and get help — "Reply STOP to unsubscribe" and "Text HELP for support" (in the consent language or the linked terms).
• Terms & privacy — SMS terms and a privacy commitment the consumer can actually reach: a linked policy, or a statement in the opt-in itself that mobile data will not be shared with third parties for marketing purposes.

Web forms carry a few mechanical rules of their own:

• Consent boxes are never pre-checked and never required to submit the form.
• Marketing consent gets its own dedicated checkbox — it can't ride along inside a general or multi-channel agreement. (Operational, non-marketing consent may be combined with phone/email in one disclosure.)
• For marketing programs, the phone-number field is optional, and the consent states it is not a condition of purchase.
• One opt-in covers one program — a single checkbox can't enroll someone in multiple messaging campaigns.

1. Brand registration. Your business identity goes to TCR and is checked against public records. Near-instant when the data matches.
2. Vetting (optional, recommended). A third-party score that unlocks higher throughput. Most businesses choose standard vetting; skip it and carriers assign conservative default limits.
3. Campaign registration. Declare the use case, describe the message flow — every way a consumer can opt in belongs in this one description — and document opt-in, opt-out, and help handling.
4. Sample message review. Marketing, mixed, and special use cases need at least two samples (up to five; realistically sized, 20–1024 characters). Samples must match the declared use case, mark variable content in [brackets], include opt-out language on recurring/marketing messages, and use branded links — public link shorteners like bit.ly are not accepted anywhere in 10DLC content.
5. Approval and go-live. Clean submissions typically approve in 24–72 hours. Through Tychron, your carrier rate limits are then applied automatically and traffic can start immediately.

Carrier pass-through fees apply per message on top of TCR fees, and they moved repeatedly in 2026: T-Mobile and UScellular updated rates January 19, Verizon raised outbound SMS/MMS surcharges May 1, and eighteen regional carriers added fees in both directions July 1. Current per-carrier schedules are available from your Tychron account manager.

Some content is prohibited on 10DLC no matter how it is registered — disclosures and age gates don't cure it, and carriers levy pass-through fines for violations (T-Mobile's published schedule runs from $500 per content violation to $2,000 per phishing instance, and $10,000 for repeat violations). The prohibited list includes:

• Cannabis, CBD, and kratom (federally illegal — prohibited even where state-legal), and other illegal substances.
• Gambling promotion, payday and other high-risk loans, cryptocurrency promotion, stock tips, and get-rich-quick offers.
• Debt-relief, debt-consolidation, and credit-repair programs.
• Lead generation and affiliate marketing — collecting or reselling contact data, or messaging on behalf of third parties whose leads you're passing along. TCR requires an attestation that affiliate marketing is not part of the campaign.
• Third-party job boards and work-from-home recruiting blasts (direct employers texting their own candidates are fine).
• Phishing, impersonation, deceptive senders, and evasion techniques like number rotation or URL cycling.

A second tier — alcohol, firearms, tobacco and vape, sweepstakes, political and charity programs, lending — is restricted: allowed with conditions such as a robust age gate (birthdate entry at minimum — a "reply YES to confirm you're 21" checkbox does not count), special use-case declarations, and extra registration details like FEC committee IDs or 501(c)(3) EINs. If your program touches any of these, talk to us before registering — the right structure up front beats a rejection.

Rejections cost real money as well as time: campaign vetting is billed per attempt ($15 each, rejections included — $50 each on the expedited track), so a campaign that takes three tries pays three times before it sends a single message. These are the failure patterns our vetting team sees most, matching what carrier reviewers reject for:

• Opt-in a reviewer can't see or verify. No direct link to the form, a login-walled flow with no screenshot, or a live page whose language doesn't match what the submission claims. Carriers reject what they cannot verify.
• Missing disclosures at the point of consent — no brand name, no frequency line, no "Message and data rates may apply", no STOP/HELP instructions.
• Vague use-case descriptions. "Notifications" is not a use case. "Appointment reminders and follow-ups for existing dental patients" is.
• Samples that don't match the declaration. Marketing copy under a customer-care campaign, cart reminders without a Marketing declaration, or an undeclared opt-in path implied by the description ("customers reaching out to us") that the message flow never explains.
• Consent mechanics that read as forced. Pre-checked boxes, consent required to submit the form, marketing consent bundled into a general agreement, or a mandatory phone field on a marketing form.
• Business-record mismatches. Brand name, EIN, or address that differs from state/IRS records — or a registered website that errors, redirects to a third-party domain, or throws a certificate warning.
• Public link shorteners in samples (bit.ly, tinyurl) instead of a branded domain.

• Confirm opt-ins immediately. Every recurring program sends a confirmation message right after opt-in containing the brand name, HELP and STOP instructions, frequency, and the rates disclosure.
• Honor STOP everywhere, fast. Since April 2025, FCC rules require honoring revocation made by any reasonable means — including natural-language replies like "please stop texting me" — within 10 business days, with at most one final confirmation message.
• Repeat the opt-out reminder. Include opt-out language in the first message and at least every fifth message or monthly. Sustained opt-out rates above 0.5% per day draw carrier audits.
• Use consent before it goes stale. T-Mobile expects a re-confirmation (double opt-in) if you haven't messaged within 30 days of collecting consent.
• Respect quiet hours. Keep marketing sends to 8am–9pm in the recipient's local time zone (some states are stricter — Florida ends at 8pm). An active wave of TCPA class actions targets consented-but-late texts.
• Keep consent records. For each opt-in, retain the timestamp, medium, exact language shown, phone number, and campaign — from opt-in until at least six months after opt-out. Records win disputes.