10DLC Compliance for SMS: The Checklist Nobody Explains Clearly
Here's the SMS marketing 10DLC compliance checklist that actually matters. Register your brand correctly, register your campaign with the right use case, get consent documented in writing, keep your opt-out language exact, and monitor your throughput daily. Skip any of these and your messages get filtered, delayed, or blocked. I've watched a DTC brand I ran lose two weeks of revenue because we rushed the campaign registration to hit a launch date. Don't do that.
Most articles on this topic read like they were written by someone who has never sent a text message for money. I have. Let me walk you through what actually breaks and how to avoid it.
SMS Marketing 10DLC Compliance Checklist: The Non-Negotiables
10DLC stands for 10-digit long code. It's the system carriers use to let businesses send high-volume SMS from regular-looking phone numbers. Before 10DLC existed, businesses either paid for short codes or got flagged as spam constantly. Now you register, but registration is not a formality. It's a filter.
- Brand registration: Your legal business name, EIN, and address must match public records exactly. A mismatch here is the number one cause of rejected brands.
- Campaign registration: You pick a use case (marketing, mixed, 2FA, etc). Marketing campaigns get lower throughput and more scrutiny than transactional ones. Don't misclassify to get around this. Carriers audit it.
- Trust score: The registry assigns your brand a trust score based on business verification data. Low scores mean low daily message caps, sometimes as low as 250 messages a day split across carriers.
- Opt-in proof: You need a record of how and when each person consented. Not a policy statement. An actual timestamped record tied to the phone number.
- Opt-out handling: STOP must work instantly and permanently. No workarounds, no "are you sure" follow-ups.
Miss any one of these and you're not compliant, you're just lucky it hasn't caught up with you yet.
The Consent Language People Get Wrong
Consent isn't a checkbox that says "sign up for updates." Carriers and the CTIA want specificity. Your opt-in language needs to state the brand name, message frequency, that message and data rates may apply, and how to opt out. Here's a real example that passed review without a single revision request, used for a DTC skincare brand scaling past $1M in revenue:
"By providing your phone number, you agree to receive marketing text messages from [Brand] at the number provided. Message frequency varies. Msg & data rates may apply. Reply STOP to unsubscribe, HELP for help."
That's it. No cleverness needed. What kills people is trying to make it "on brand" and stripping out the required pieces. Carriers don't care about your voice. They care about the language matching what you filed in campaign registration. If your registered sample message doesn't match what you're actually sending, expect filtering.
Throughput Limits Nobody Tells You About Until You Hit Them
This is where most marketing teams get blindsided. Your daily message limit is not just about volume, it's about trust score and campaign type. A newly registered brand with a low trust score might get capped at 1 message per second, per number, which caps out around 3,000 to 6,000 messages a day depending on the carrier mix. If your list is 80,000 people and you try to blast a flash sale to everyone at once, you'll queue messages for hours, and by the time some people get it, the sale might be over. I saw this happen on a launch where we had 42,000 opted-in numbers and a trust score that only allowed roughly 4,500 messages an hour combined across AT&T, T-Mobile, and Verizon. We had to stagger sends over four hours. Plan your campaign timing around your actual throughput, not your list size.
To fix this long term:
- Build brand trust score by verifying with a real EIN, real website, and consistent NAP (name, address, phone) data across the web.
- Split large sends across multiple registered numbers if your platform supports it.
- Front-load your most important message content in case delivery gets delayed.
The Most Common Mistake: Treating Registration as One-and-Done
Here's what I see constantly. A team registers their brand and campaign once, gets approved, and never touches it again. Then they change their business name slightly, add a new use case like appointment reminders, or start running SMS for a new sub-brand under the same number pool. None of that gets re-registered. Carriers periodically re-audit trust data. If your registered business info drifts from what's publicly listed, your trust score can silently drop, and your delivery rates tank with no warning email, no obvious error. You just see open rates and click rates fall and assume your content got worse. Treat 10DLC registration like a living document. Any time your business details change, your message cadence changes, or you add a new campaign type, update the registration. It takes 15 minutes. Ignoring it costs you weeks of degraded delivery you won't even notice until revenue drops.
A Quick Audit You Can Run This Week
If you want to know where you actually stand, don't guess. Run this audit:
- Pull your last 30 days of SMS campaign data and check delivery rate by carrier. Anything under 92% delivery on AT&T or T-Mobile signals a filtering issue.
- Confirm your registered sample messages in your 10DLC dashboard match what you're actually sending word for word.
- Check your opt-in consent records for a random sample of 20 subscribers. If you can't produce a timestamp and method of consent for each one, you have a compliance gap.
- Verify your business name and EIN on file match your current legal filings exactly, including punctuation.
- Test STOP and HELP keywords yourself, on your own phone, right now.
This takes about two hours. I've run this exact audit on three different brands and found at least one real issue every single time, usually the sample message mismatch.
The Takeaway
10DLC compliance isn't complicated once you see it clearly. It's registration accuracy, honest consent records, exact opt-out language, and realistic throughput planning. Most delivery problems trace back to one of these five things, not some mysterious carrier conspiracy. Do the audit above this week. Fix the mismatch you find. Then put a recurring 90-day reminder on your calendar to re-check registration details. That single habit will save you more revenue than any clever subject line or perfectly timed send ever will.