A2P 10DLC Registration with Twilio: Step-by-Step Guide

Introduction

If your company requires to implement a messaging service to send, for example, SMS reminders for appointments, booking confirmations or any other message of any kind, you'll need a cloud communications solution. Whether it's a generally known brand such as Twilio or any other 3rd party provider, they all have a particularly same requirement: you'll have to go through the A2P 10DLC Campaign Verification if you want to send SMS from a 10-digit US phone number to other US numbers.

You may encounter different steps or even a different UI on each platform in order to fill the form, but the concept here is the same:

1. You first register your brand, providing all the legal details to the communications provider
2. You fill out the A2P 10DLC campaign form, in which you indicate what you're going to be using the campaign for
3. You either go back and forth adjusting the details until it gets approved and then you'll be able to send SMS from within the purchased phone number

Keep in mind that these steps are only needed once the development/integration is complete or when you ran out of free credits from within the platform you chose. While you integrate Twilio in your project, Twilio will provide a test 10DLC phone number for you to play with.

What is A2P 10DLC?

A2P stands for Application-to-Person: any message your software sends to a human, as opposed to a person typing on a phone. 10DLC stands for 10-Digit Long Code, which is just a standard US phone number. Put together, A2P 10DLC is the framework US carriers use to register business messaging that goes out over ordinary local numbers.

The reason it exists: the US SMS/MMS system was not designed to be used the way it is being used now. Before this compliance framework was in place, businesses sent application traffic over numbers meant for person-to-person conversations, and carriers had no reliable way to tell a legitimate appointment reminder from a scam. Spammers flooded the channel with fake messages and phishing attempts, and carriers needed a way to protect their customers while keeping the network from degrading.

Registration solves that by tying every message to a verified business identity. Once your traffic is registered, carriers know who is sending it, which is why registered traffic gets better throughput and deliverability while unregistered traffic gets filtered or blocked outright.

Feel like knowing more about it? Take a look at Twilio's explanation here.

Who needs to register, and when

You need A2P 10DLC registration if you are sending SMS or MMS to US phone numbers from a US 10-digit long code. That is the specific case it covers. A few situations that people often confuse with it:

• Toll-free numbers use a different process. Toll-free verification is its own form with its own review, so registering a brand and campaign here does not cover it.
• Short codes are a separate product entirely, with a separate application, a much higher cost, and a longer lead time.
• Messages to numbers outside the US are not governed by A2P 10DLC. Other countries have their own rules, and some require sender ID registration of their own.
• WhatsApp traffic is governed by Meta's approval process, not by this one.

On timing: you do not need any of this while you are still building. Twilio gives you a trial number and free credits to develop against. Registration becomes necessary when you leave the trial plan and start sending to real customers, so the practical move is to build the integration first and start the paperwork once you know the messaging program you are actually going to describe on the form.

Getting started

Explanations set apart, let's go to the Twilio Console and register both the Brand and Campaign. Keep in mind that in order to start the A2P 10DLC Campaign Verification, your account must be out of the free/trial plan.

Head over to the twilio console and log in using your credentials.

Once you're in the portal, head over to Messaging > Regulatory Compliance > Onboarding. Once in there, you'll be prompted to create a Customer Profile (if you haven't created one yet).

The Customer Profile is needed for Twilio's KYC. It basically asks for some general company information, including contact information and also EIN. This is the first step and it is a required step in order to create a Brand out of this Profile. Some of the fields that are needed to fill out are:

General information

• Business legal name.
• Business address.
• Business PO code.

Business information

• Business Type (Corporation, LLC, etc.).
• Industry Type - make sure to fill the right one as Twilio sometimes verifies that the messages you send from within a campaign matches your industry type
• EIN.
• Business URL - needs to be a valid website which provides both contact information and ideally a contact form.

Contact information

• People to contact - this includes role, full name, email address and a phone number
• Notifications email - this email is the one that gets Twilio news but also notifications like billing alerts, usage reports, and so on.

Once you filled out all the information, you should have a Customer Profile like this:

The next step is to register a Brand. Brands in Twilio are defined based on 2 things: your Customer Profile and the message throughput that you need. Take a look at the following diagram to see which brand type suits you best

So, once in the Brand section of the form, pick up the one that suits you best for your use case. Depending on the brand type, twilio is going to do a one-time fee charge to register the brand. Keep in mind that if the brand registration fails by any reason, such as wrong information, and you need to re-register the brand, you will be charged with the same fee.

The brand verification can take up to 48 hours and you'll have to wait until the brand gets registered in order to create a campaign.

Once the brand is approved, the last step is to create the campaign that's going to allow you to send SMS to any US phone number. Keep in mind that you can create as many campaigns for a brand as you like, there's no specific limit for that. I also encourage you to do so in order to keep track of the costs of each campaign in the billing panel.

Choosing your campaign use case

The use case you pick tells carriers what kind of messaging program this is, and it is checked against the sample messages you provide. Picking one that does not match what you actually send is a common reason campaigns get rejected, and it can also get your traffic filtered later even after approval.

The dropdown carries a set of standard categories. The ones that come up most often in practice:

• Low Volume Mixed: several kinds of message over a modest volume. This is the sensible default for most small and mid-sized businesses, and it is what I reach for unless the project clearly calls for something else.
• Mixed: the same idea without the low-volume ceiling, for higher throughput.
• Customer Care: support conversations, account servicing, and follow-ups.
• 2FA: one-time passcodes and login verification. If this is what you are doing, pick it rather than burying it inside a mixed campaign.
• Account Notification and Delivery Notification: transactional updates such as appointment reminders, order status, and shipping alerts.
• Marketing: promotional messaging. This one carries the strictest consent expectations, so only choose it if you genuinely have explicit marketing opt-in on record.

Two practical notes. First, you can register more than one campaign under the same brand, and there is no hard limit on how many. Splitting distinct messaging programs into their own campaigns keeps each one coherent for the reviewer and makes the costs legible in the billing panel. Second, do not pick Marketing as a catch-all because it sounds broad. A campaign whose declared use case is stricter than your actual messages is fine; one that is looser than your messages is what gets you rejected.

There are many different fields that need to be filled in the campaign form, so let's go through them step-by-step and I'll provide you my personal experiences on which ones are the most important (and which ones caused me to have to re-submit the form multiple times 😅)

• A2P Brand: Get's filled in automatically but you'll be able to select which brand gets associated to the campaign in case you have more than 1 brand.
• Campaign use cases: it's a dropdown which contains different purposes for the campaign, for which you can select only one. Generally the low-volume mixed option is your go-to unless you're looking for something really specific like sending OTP or 2FA messages (for which there's a specific option)
• Messaging Service: 10DLC Phone numbers will be assigned to that messaging service
• Campaign description: This is one of the most important inputs that could get your form submission denied. Don't be confused by the term “description” as in an internal identification to be able to find that campaign quickly; you have to tell Twilio what the campaign is about. If you hit the Learn more button that's below the input you'll be able to see some example of successful messages that can get the campaign approved.

Let's take a look at the second part of the form:

• Sample messages: At least 2 of them are required. These are also one of the most sensitive inputs in term of compliance, you need to specify what the messages that go through that campaign will say. You generally use dynamic values like “Hello, {{firstName}}, we received your call on {{date}}”. If you only plan to send 1 general-purpose SMS, provide 2 samples of that same message but with a different wording. One of the most important things that you should do when providing the sample message is a way to let the user know how to unsubscribe to that message. We'll go through the exact opt-out keywords further down, but it's important to reference them in the sample messages. Twilio pays particular attention on how do you let the users know that they have a way of cancelling your SMS.
• Message contents: The options are pretty straight-forward. If you include embedded links, the vetting team may ask for additional information about it - although I never had the need to send links through SMS, so I can't be a 100% certain on this one.

Let's take a look at the last piece of the form below:

I left the “Did you know?” part on purpose.

The how do end-users consent to receive messages is probably the most important input of the entire form. You have to be really descriptive in how they accept to receive your SMS, whether it's because they filled in some form through your CRM, or they call into your office, or any other scenario that you may encounter. I probably got rejected 3 times on this on my first days since this new compliance came in place, then again, in the Learn more link, you'll have some successful text examples that you could use as inspiration. Providing a public screenshot (like storing it publicly in your web server) of how you capture the phone number from your customers certainly helps to get the campaign approved, however, keep in mind that if you upload it to your own web server rather than some storage service for that screenshot, it really helps to use the server with the company website in it so Twilio can see that it matches with the rest of the information you provided.

Lastly, Opt-in Keywords and Message are samples that you can optionally include. I never filled those since Twilio already provides a standard auto-reply for those scenarios.

Once everything is done, you can hit the Submit button and then the vetting process will start. Keep in mind that it takes generally 5 to 7 business days in order to have an answer from Twilio, and it doesn't come in through your email/SMS, you'll have to come into the console and periodically verify the status of the campaign.

Opt-out keywords and ongoing compliance

Approval is not the end of it. Every registered campaign has to honour the opt-out keywords that carriers mandate, and Twilio handles the standard ones for you on registered 10DLC numbers.

• Opt out: STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT. Twilio blocks further messages to that number and replies with a confirmation.
• Opt back in: START, YES, UNSTOP.
• Help: HELP, INFO. Twilio replies with your help text and contact details.

There is a gotcha worth knowing about here, because it bites in production. Since Twilio intercepts these keywords at the platform level, your application may never receive the inbound message. Twilio stops delivering to that number, but your own database still has the contact marked as subscribed. Your system keeps queueing messages that silently go nowhere, and your reporting shows sends that never landed. If you keep subscription state in your own database, listen for the opt-out on the inbound webhook and mirror it, or reconcile against Twilio periodically.

This is also why the sample messages on the form need to reference the opt-out. A line as simple as "Reply STOP to unsubscribe" is what reviewers look for, and its absence is an easy rejection.

Why campaigns get rejected

Across the campaigns I have registered, rejections almost always come down to the same handful of things. In rough order of how often I have run into them:

• The consent description is vague. This is the big one. "Users sign up on our website" is not enough. Name the exact place and moment the phone number is captured and what the person agreed to at that point.
• The campaign description reads like an internal label. It is a description of your messaging program for a human reviewer, not a name for you to find the campaign by later.
• Sample messages have no opt-out language. Covered above, and easy to fix.
• Sample messages do not match the declared use case. Promotional copy under a transactional use case is an immediate flag.
• The business URL does not hold up. It needs to resolve, look like the company you registered, and carry contact information. A parked domain or a link with no way to reach anyone will fail.
• The industry type does not match the messages. Twilio does check this against what the campaign says it sends.

Re-registering a brand after a failed submission is charged again, so it is worth being slow and specific on the first pass rather than fast and generic.

Conclusion

That's it for now, if you already have the SDK set in place in your application and you're just waiting for the form to be approved, nothing else is needed on your end. Remember to move the 10DLC phone numbers to the messaging service that the campaign indicated to use once it gets approved, otherwise SMS will not go out either.

If the campaign is approved and you still need to wire up the sending side, I wrote a full walkthrough of that: sending SMS with PHP and Twilio, with working code you can lift straight into a project.

Remember to follow me on my networks that are attached in the header/footer.

Thanks!

-Gonza