The 10DLC Onboarding Process, Step by Step

Application-to-person (A2P) SMS over the major US carrier networks now requires brand and campaign registration via The Campaign Registry (TCR). The process — known industry-wide as 10DLC, for “10-digit long code” — has been mandatory in some form since 2021 and has progressively tightened. By 2026 the unregistered-traffic penalties are severe enough that any business sending more than the most casual one-off messages needs to be properly registered.

This guide walks through the registration process end to end: what brand registration is, what campaign vetting evaluates, the typical timelines, and the operational reality of getting from “we want to send SMS” to “we’re sending SMS at scale with high deliverability.”

Why 10DLC Exists

For most of SMS’s history, businesses sent application-driven messages from short codes (5-6 digit numbers) or, increasingly, from regular 10-digit phone numbers. The 10-digit path was attractive because the numbers were locally identifiable, but it was also unregulated — with predictable consequences for spam.

10DLC standardizes the registration of businesses (brands) and the messaging programs they run (campaigns) so that carriers can apply differentiated trust and throughput to each. A registered, vetted brand running a vetted campaign gets faster delivery and higher throughput than unregistered traffic.

Step 1: Brand Registration

The brand registration captures the legal identity of the business sending messages. You provide:

• Legal business name (must match an EIN or D-U-N-S Number)
• Business address (must match the registered address on the EIN)
• Tax ID (EIN for US, business number for Canadian senders sending to US recipients)
• Industry vertical (from a TCR-defined list)
• Brand website URL
• Contact information for the business compliance contact

TCR validates this data against external sources (Dun & Bradstreet, IRS records, business registries). Brand vetting takes 1-3 business days for clean submissions; longer if any data inconsistencies require resolution.

The output of brand registration is a Brand ID and a Trust Score (0-100). The Trust Score is composite — based on business age, public profile, vertical risk, and several proprietary factors. A higher Trust Score unlocks higher per-second throughput on subsequent campaigns.

Practical note: if your business is newly formed or has limited public profile, expect a lower initial Trust Score. This is recoverable — sending clean traffic for several months without complaints raises your score over time.

Step 2: Campaign Registration

Each distinct messaging program your brand runs needs its own campaign registration. A campaign is defined by use case + sample message content + opt-in/opt-out flow.

Use case categories include:

• Account notifications (transactional, password resets, shipping)
• Customer care (support replies, ticket updates)
• Marketing (promotions, newsletters)
• Two-factor authentication
• Polling / voting
• Public service announcements
• Mixed (multiple categories — slower vetting)

Each campaign also requires:

• Opt-in description and supporting evidence (URL of the opt-in form, sample workflow screenshots)
• Sample messages for each scenario the campaign sends
• Opt-out keyword handling (STOP, UNSUBSCRIBE, CANCEL minimum)
• Help keyword handling (HELP, INFO)
• Estimated message volume per month

Campaign vetting evaluates whether the use case category matches the actual messaging program, whether opt-in collection is consent-compliant, and whether content samples align with the declared use case. Vetting takes 2-7 business days; mixed-use-case campaigns trend slower.

Step 3: Number Assignment

After campaign approval, you provision phone numbers and assign them to the campaign. A single campaign can use multiple numbers (for throughput); a single number can only be assigned to one campaign at a time.

Numbers must be 10DLC-eligible. Most numbers acquired from cloud telephony platforms after 2021 are eligible by default; some legacy ported numbers may require a status update before assignment.

Step 4: Throughput Ramp

Once numbers are assigned, you can start sending. Carrier-imposed throughput limits apply per number, scaled by the Brand Trust Score and campaign category.

Typical 2026 starting throughputs (per second per number):

• Account notifications, low-risk verticals: 4-10 messages
• Customer care: 3-8 messages
• Marketing, financial / mortgage / health: 1-3 messages

Throughput ramps over time based on actual sending behavior. A clean sender with low complaint rates and no carrier filtering events sees throughput increase over the first 30-60 days. Senders with complaints, opt-outs above benchmark, or carrier-flagged content see throughput stagnate or decrease.

Common Failure Modes

The most common reasons campaigns fail vetting or get suspended after activation:

Use case mismatch. Registered as Account Notifications but sending marketing-flavored content. Campaign gets flagged, throughput drops, eventually suspended.

Opt-in evidence weak. TCR requires concrete evidence of consent collection (form URL, screenshot of checkbox flow). Vague descriptions of opt-in process are rejected.

Opt-out keyword non-handling. Carriers periodically test STOP responses on registered numbers. If a STOP doesn’t immediately remove the recipient and doesn’t trigger an auto-confirmation message, the campaign gets flagged.

Content drift. Approved sample content describes one tone; production content drifts toward marketing-aggressive. Carrier filtering catches the drift over weeks.

Volume spikes. Estimated 5,000/month, actually sending 50,000/month. Carriers flag the variance and may throttle.

Practical Recommendations

For businesses going through 10DLC for the first time:

1. Register the brand before you need to send. The 1-3 day vetting window is non-blocking for technical work but blocking for actual sends.

2. Be conservative on use case categorization. When in doubt, register as Mixed (slower vetting) rather than mis-categorize as Account Notifications and risk later suspension.

3. Build the opt-in flow before registering the campaign. TCR wants evidence; produce evidence first.

4. Plan for ramp time. Don’t assume Day-1 throughput equals long-term throughput. The first 30-60 days are the throughput-build phase; size your sending plans accordingly.

5. Treat 10DLC as ongoing, not one-time. Brands and campaigns require maintenance — re-vetting on annual basis, immediate updates if your opt-in flow changes, content samples kept current.

The 10DLC framework has matured to the point where compliant businesses can rely on the system. But the operational discipline required is real and ongoing — not something to set up once and forget.