Telco: numbers and senders

A phone number is an address you rent, not an identity you own. Every sender in this guide answers one question differently: how does a business prove who it is before a carrier, Meta or Google lets it reach someone's phone?

A few years ago the answer was "it doesn't": you bought a number through an API and texted that afternoon. Today almost every route to a handset sits behind a registry. US carriers have blocked unregistered 10DLC traffic since early February 2025, and only verified toll-free numbers can send since January 31, 2024. Singapore labels unregistered brand senders "Likely-SCAM" (since January 2023), Australia labels them "Unverified" (since July 1, 2026) and Spain blocks them (since September 15, 2026). The product you've joined is less a number store than an identity and approval pipeline with numbers attached.

I think about the business in four layers:

• Numbering. Who holds which numbers and where calls and texts route. In the US and Canada that's the NANP (North American Numbering Plan: +1, ten digits). NANPA hands number blocks to carriers, and the NPAC (the national porting database) tracks every number that has changed carrier. Platforms usually sit at the end of a resale chain.
• Messaging trust. Whether a business may send A2P (application-to-person, meaning automated) traffic from a sender. In the US: The Campaign Registry for 10DLC, Somos for toll-free and a CTIA-run registry for short codes, all under each MNO's (mobile network operator, the carrier) own filters and fees. Abroad: national sender registries, increasingly mandated by regulators.
• Caller identity. Whether a call shows up signed, named, labelled "Spam Likely" or blocked.
• Rich channels. WhatsApp (an app over mobile data, independent of carriers) and RCS (the carriers' rich messaging standard, with Google running the business hub) swap the bare number for a verified brand, and add Meta's or Google's rules.

The platform's job: take a customer's use case and country, pick the sender, collect the identity and consent evidence each gatekeeper wants, push it through every approval, keep a dozen external states in sync, and decide who eats the bill when a message is blocked, a number is hijacked or an OTP (one-time passcode) form gets pumped, meaning bots trigger texts to numbers whose carrier shares the revenue with the fraudster. (Most of the hard product calls live in that last clause.)

Four things make this harder than the B2B platforms you know:

1. The truth lives elsewhere. Registries, carriers, Meta and Google own the records; your database mirrors them.
2. State is per carrier, not per country. An RCS agent can be live on one network and pending on the next.
3. The rules that block you day to day come from carriers and industry bodies, not statutes.
4. Money moves on every message, at prices set by memo. Each US text carries a carrier fee of a few tenths of a cent, and all three major US carriers changed theirs in 2026; WhatsApp began charging for service replies on October 1, 2026.

The sender map

Eight sender types cover almost every case.

• US 10DLC long code. An ordinary ten-digit US number used for A2P. It must sit under a registered brand (the legal entity, keyed by its EIN, the US tax ID) and campaign (one registered use case) at The Campaign Registry (TCR). Cheap, two-way, throughput set by a vetting score.
• Toll-free. 800, 833, 844, 855, 866, 877 and 888 numbers (822 is assigned, awaiting launch). Text-enabled in Somos's TSS Registry, and allowed to send only after toll-free verification (TFV), a per-number review of the business and its opt-in flow.
• Short code. A 5 or 6 digit code you lease, never own, from the CTIA-overseen Short Code Registry (US) or the Canadian Telecommunications Association. Every carrier approves every program.
• Alphanumeric sender ID ("alpha"). A brand string of up to 11 characters in place of a number. One-way, and never allowed in the US or Canada. Providers' country guides show three patterns: dynamic, any ID goes (Germany, France, the UK outside protected IDs); pre-registered (India, Singapore, UAE, Saudi Arabia, Spain, Australia, the Philippines, Indonesia, Nigeria, and Mexico if you want the ID preserved); and not supported, where the carrier swaps in a number or short code (Colombia, Argentina, Chile).
• International long code. A local, mobile or national number abroad. Most are voice-only, and mobile ranges are often person-to-person only (France has reserved 06 and 07 numbers for individuals since 2023, per ARCEP). Buying one usually means a regulatory bundle: local address, company documents, sometimes a local entity.
• RCS agent. RCS (Rich Communication Services) is the carriers' rich messaging standard inside the phone's own texting app; Google renamed its business side "RCS for Business" in September 2025. The sender is an agent with a name, logo, colors and a verified check, launched carrier by carrier, with an SMS sender behind it as fallback.
• WhatsApp sender. A phone number on Meta's Cloud API, inside a WhatsApp Business Account (WABA), inside a Meta business portfolio. Recipients see a reviewed display name. Outside a 24-hour customer service window the business may send only pre-approved templates. Meta is the network.
• Voice caller ID. The number on an outbound call plus what the receiving carrier shows with it: a STIR/SHAKEN attestation (the originating provider's signed claim about the caller), a CNAM caller name, an analytics label like "Spam Likely", or branded calling with a name, logo and reason (CTIA's Branded Calling ID, live at T-Mobile and, since September 15, 2025, Verizon).

Sender cheat sheet

Sources (as of Oct 2026): TCR fees, US Short Code Registry FAQ, txt.ca, Google's launch approval and US billing, Meta's throughput and messaging limits. 10DLC and toll-free throughput, review times, alpha lead times and the rule for Canadian numbers are provider-reported, not published by carriers or regulators.

Which sender? Five questions

1. Where do the recipients live? US or Canada: numbers (10DLC, toll-free, short code), RCS or WhatsApp. Elsewhere: start from the country's alpha pattern, then ask whether people read SMS at all. In Latin America WhatsApp is the default business channel (the direction is solid; the penetration figures I've seen are unsourced).
2. Do they need replies? Then alpha is out.
3. What's the peak, not the average? Providers report that a low-scoring 10DLC campaign gets 240 SMS a minute at AT&T, and a sole proprietor brand 1,000 a day at T-Mobile. Flash sales and OTP spikes need a high vet score or a short code.
4. Marketing, transactional or one-time passcode? The category sets the consent bar, the campaign type, quiet hours, the WhatsApp price and, in India, the header suffix. WhatsApp currently doesn't deliver marketing templates to US numbers at all.
5. How soon, and must the brand show? WhatsApp can be live in minutes, 10DLC in days, toll-free in days to weeks, a US short code in weeks to months. Branded options: alpha (outside North America), RCS, WhatsApp and, for calls, branded calling.

My defaults: for a US customer, 10DLC for conversational and transactional traffic, toll-free when they want one national number at modest volume, and a short code only when volume justifies a prepaid lease and the lead time. Abroad, a registered alpha for one-way alerts and OTPs, WhatsApp where people live in it, and local numbers only when replies matter and the country allows A2P on them.

What doesn't transfer

Money flows

Money moves in three streams: rent, registration and per-message fees. The surprises live in the third.

Sources: TCR fees, Short Code Registry, txt.ca, Meta pricing and non-template pricing, Google, TransNexus. Carrier fees, the DCA fee, the campaign minimum, number rent and international prices come from provider and aggregator pages (secondary).

Three things surprise people from SaaS:

• Registration is marked up. One large provider charges $20 a month for a campaign that costs $10 at TCR, and $83 for a $41.50 vet.
• Carrier fees move mid-contract. All three major US carriers changed theirs between January and May 2026, each by memo. If your pricing can't pass a new carrier fee through within a month, you're funding carrier price increases out of margin.
• WhatsApp's October 2026 change is bigger than it looks. In Meta's own worked example, one customer interaction goes from one charge on July 1 to five on October 1. Support-heavy customers feel it first.

The power map

Power here follows who can block a message, not who has the biggest contract.

• Carriers hold the pen in US messaging: throughput, filtering, fees, fines and suspension of any brand, number or provider. Abroad they also approve sender IDs one by one and set termination prices.
• Meta is the network, the rulebook and the price-setter for WhatsApp, with no carrier veto. It reprices quarterly and recategorizes your templates.
• Google admits RCS partners and approves launches on Google-managed carriers, but carriers set RCS prices, and Apple decides how iPhones render business RCS.
• iconectiv sits at three chokepoints: porting (NPAC), routing data (LERG) and SHAKEN token administration.
• The FCC holds the lever that matters most to a platform: removal from the Robocall Mitigation Database, after which downstream providers must refuse your traffic. It removed about 185 providers on August 6, 2025 and about 1,200 on August 25, 2025 for deficient filings (Mintz).
• Plaintiffs' lawyers and state attorneys general are the real enforcers of consent and quiet hours.
• Regulators abroad increasingly mandate sender registries: Singapore, Australia, Spain, India, and Colombia from about August 2027 (Mobile Time).
• You, the platform, are the first line of KYC and decide whether a fine or a pumping loss is absorbed or passed on. You have less power than customers assume, and more exposure than most contracts admit.

Regulation in practice

What's written and what's enforced differ; the gap is where roadmap risk lives.

• Enforced on every message: registration. Unregistered 10DLC and unverified toll-free are blocked. Unregistered alpha senders are blocked (Spain since September 15, 2026 per CNMC; the Philippines and UAE per provider guides) or relabelled (Singapore "Likely-SCAM" since January 31, 2023 per Allen & Gledhill; Australia "Unverified" since July 1, 2026 per ACMA).
• Enforced through lawsuits: the TCPA. A 2025-2026 wave of class actions applies the 8am to 9pm quiet-hours rule to marketing texts (TCPAWorld).
• Enforced by contract: carrier fines, and CTIA short code audits graded from Sev-0 (immediate fix, possible suspension) to Sev-2.
• Written but loosely enforced: STI-GA actively pursues only misused A attestations; porting intervals depend on complaints.
• Not yet regulated: call labeling. The FCC proposed verified caller names and foreign-call marking in October 2025 (Wiley); no final rules as of this review.
• Under FCC consideration: number resale. The numbering NPRM (a proposed rulemaking, WC Docket 26-49, adopted March 2026) would extend robocall certifications to every provider that gets numbers, resellers included, limit resale to a single level, and act against number cycling (single-use or rotating numbers). For a platform whose number supply runs through layers of resale, this is the biggest structural risk on the board. Also coming: the TCPA opt-out rewrite scheduled for an FCC vote on September 30, 2026 (outcome unconfirmed at this review), and Ofcom's rules, adopted July 2026, requiring carriers and aggregators to verify alpha sender IDs for UK A2P from July 15, 2027.
• Deadlines slip. Spain moved alias blocking from June 7 to September 15, 2026. Mexico replaced its June 30, 2026 deadline for linking mobile lines to a national ID with a staggered schedule ending December 31, 2026 (Infobae). Plan for the later date, build for the earlier one.

The cost of being wrong

Mistakes here cost in four currencies: weeks, fees, deliverability and, for 911, safety.

• Wrong sender. A US short code takes 2 to 4 weeks by the registry's count and 8 to 12 by providers', and the lease is prepaid and non-refundable even if carriers never activate it. Picking one for next week's launch means a missed launch.
• Sloppy registration. A legal name or EIN that doesn't match official records fails the identity check; each campaign rejection costs another review round.
• Silent filtering. The customer pays for messages that never arrive, and blames you.
• Fraud. A pumped OTP form turns the customer's messaging budget into someone else's termination revenue.
• Losing your RMD listing or SHAKEN token. Downstream providers refuse your voice traffic: a platform-wide outage no code fix can undo.
• WhatsApp enforcement. It escalates from a warning to template blocks, 1 to 30 day messaging blocks, then a locked or disabled account, and it lands on the customer's whole WABA.
• 911 address errors. A call reaches the wrong PSAP (public safety answering point, the 911 call center). Regulators fine for it (Ofcom fined UK broadband provider Gigaclear £122,500 over caller-location failures), and the fine is the smallest part of the cost.

Emergency calling

Every voice-enabled number you sell is a 911 obligation, and the provider carries most of it.

US. For interconnected VoIP (VoIP connected to the public phone network), 47 CFR 9.11 requires the provider to:

• Send every 911 call to the right PSAP with the caller's number and location.
• Deliver a dispatchable location: a validated street address plus suite, apartment or floor (9.3). Automatically for fixed service since January 6, 2021; for nomadic service since January 6, 2022 where technically feasible, otherwise the Registered Location (the last address the customer gave), other location data or, as a last resort, a national emergency call center.
• Collect a Registered Location before service starts, and let the customer update it.
• Tell every subscriber where 911 may not work, get an affirmative acknowledgment, and supply warning labels.

In practice the platform validates the address through its 911 provider, ties it to the number, and deletes it on release or port-out. The customer gives a real address, updates it after moves and, for a multi-line phone system, complies with Kari's Law (direct 911 dialing and on-site notification, since February 16, 2020). Terms push address accuracy onto customers; the notice duties stay with the provider.

NG911 raises the floor. Under the FCC's 2024 order, originating providers, interconnected VoIP included, must deliver 911 over SIP to NG911 delivery points within six months of a valid request from a 911 authority, and pay to get the traffic there. A June 2026 order (FCC 26-39) adds IP 911 traffic aggregators to the providers with reliability duties, after an 18-month transition that starts with an FCC public notice. If your platform aggregates customers' 911 calls before handing them to a 911 provider, find out now whether you're covered. Text-to-911 follows the same pattern: route texts within six months of a valid PSAP request.

Canada. CRTC Telecom Decision 2005-21 requires enhanced 9-1-1 for fixed VoIP, an interim service comparable to basic 9-1-1 for nomadic VoIP (in practice a third-party call center), and customer notice of limitations with express consent. The NG9-1-1 transition deadline is March 31, 2027 (CRTC 2025-67); in November 2025 the CRTC denied a request to change it.

Elsewhere. The EU requires free access to 112 with network and handset-derived location (AML, Advanced Mobile Location, where the phone sends its own position), with accuracy rules in Delegated Regulation 2023/444. The UK requires uninterrupted access to 999 and 112 with accurate caller location. In Latin America: Brazil uses 190 (police), 192 (ambulance), 193 (fire) and 199 (civil defense), all free (Anatel); Mexico has used 911 nationally since January 2017, with AML location required for calls and SMS (IFT); Colombia uses 123 (CRC).

The first thing I check on any voice product: can a number go live without a validated 911 address? If it can, that's the bug.

Top failure modes

Sources: Meta's marketing limits, categorization and send messages docs, Google, Apple, CNMC, ACMA, 47 CFR 9.11; filtering, porting and alpha details from provider guides (secondary).

False friends

Sources: Meta pricing, Google US billing, STI-GA, Somos ROC, TRAI.

Where my analogy broke

"A phone number is like a domain name." I assumed I'd own it, point it anywhere and transfer it with an auth code. It broke on my first port. The number belongs to a carrier's block, my platform sits at the end of a resale chain, the move is a carrier-to-carrier order that one mismatched field can reject, and when a customer lets it go the law makes it age at least 45 days before anyone else can have it.

"Registration is app store review." One review, then you ship. Except 10DLC alone has four gates, each carrier keeps its own approval state, and passing them all doesn't stop a filter from dropping the message next Tuesday. Approval is a license to try, not a delivery guarantee.

"A delivery receipt is an HTTP 200." I wanted an acknowledgment to mean the job was done. Here it means the next hop took the message. Filtering is often silent, and abroad a message can arrive with its sender rewritten. I now trust delivery rate by carrier and by country, and little else.

"Pricing is cloud pricing: cost plus margin, revisited at renewal." Then three US carriers changed their per-message fees within five months, each by memo, mid-contract, and Meta started charging for replies that had been free. Prices here are effective-dated inputs from outside, not a page I own.

"Compliance is a legal checklist." I expected to read the rule and be done. The FCC's one-to-one consent rule died in court in January 2025, and reviewers kept rejecting lead-generator consent anyway. The binding rule is whatever the strictest gatekeeper in the path enforces this quarter.

Self-check: 20 questions

1. A US clinic wants two-way appointment reminders, about 5,000 a day. Which sender, and what gets approved first? Answer
2. What approval states do a 10DLC brand and campaign pass through, and who moves each? Answer
3. Why is 10DLC throughput counted differently at AT&T and T-Mobile, and what raises it? Answer
4. A customer wants branded OTPs in Colombia. What will recipients see, and what should they use instead? Answer
5. How do a brand, a campaign and a number differ in 10DLC, and who counts as a sole proprietor? Answer
6. Our inventory says a number is ours, but calls route to another carrier. Which system of record wins? Answer
7. What changed in WhatsApp pricing on October 1, 2026, and which customers feel it first? Answer
8. Who pays when an OTP form gets pumped, and how do our product settings shift that? Answer
9. Why can a message show "delivered" and never reach the person? Answer
10. What does an A attestation prove, and what changed for signing providers in September 2025? Answer
11. Who can stop a US business text from reaching a phone, and who can stop a WhatsApp message? Answer
12. A Canadian retailer wants to text customers in Canada and the US. What changes versus a US-only customer? Answer
13. How should we store fees and approvals so we can say what applied when a message went out? Answer
14. What happens to a number between a customer releasing it and someone else getting it? Answer
15. A port came back rejected. What do we check, and why don't we just submit a new order? Answer
16. Who approves an RCS agent's launch, and why might it work on Android but not iPhone? Answer
17. What must the platform and the customer each do before a VoIP number can call 911? Answer
18. What do Singapore, Australia and Spain do to unregistered alphanumeric senders? Answer
19. Which pending FCC proceeding could change how we source and resell numbers? Answer
20. Which mistakes on this team cost weeks, which cost money, and which can't be fixed with code? Answer

Sources

Undated entries were read on October 1, 2026.

Regulators and law

• 47 CFR 9.3 and 9.11, 911 for interconnected VoIP, Cornell LII
• 47 CFR 52.15, aging, 52.35, porting intervals, 52.103, toll-free statuses, Cornell LII
• 47 USC 615a, NET 911 Act, Cornell LII
• DA 26-12, revoke-all waiver, FCC, Jan 2026
• SIM swap and port-out fraud rules, Federal Register, Dec 2023
• NG911 order, Federal Register, Sep 2024
• FCC 26-39, NG911 reliability, FCC, Jun 2026
• Numbering NPRM fact sheet, WC Docket 26-49, FCC, Mar 2026
• Telecom Decision 2005-21 and 2025-67, CRTC, 2005 and Feb 2025
• Understanding CASL, ISED Canada
• Delegated Regulation 2023/444, EUR-Lex, 2023
• Gigaclear fine, Ofcom
• Alias registry circular, CNMC, Jun 2026
• SMS Sender ID Register goes live, ACMA, Jun 2026
• TCCCPR Second Amendment, TRAI, Feb 2025
• Ley 2300 de 2023, MinTIC Colombia, 2023
• Res. 8046, short codes, CRC Colombia, Dec 2025; Res. 5937, emergency numbers, 2020
• Numbering plan for professionals, ARCEP
• Emergency codes, Anatel
• 911 and AML guidelines, IFT Mexico, 2024

Registries and industry bodies

• Fees and Pricing and Auth+ 2.0, The Campaign Registry, Aug 2026 and Aug 2025
• Messaging Principles and Best Practices and Short Code Monitoring Handbook v1.9, CTIA, May 2023 and 2023
• FAQ, US Short Code Registry
• Apply for a short code and guidelines v3.9, Canadian Telecommunications Association, guidelines Nov 2021
• TSS Registry and ROC, Somos, 2018 (TSS)
• 2025 Annual Report, NANPA, Mar 2026
• Number portability, iconectiv
• Improper attestation, STI-GA, May 2023
• FreeCallerRegistry launch, Hiya

Platform owners

• WhatsApp Business Platform docs, Meta: pricing, non-template pricing, messaging limits, throughput, templates, categorization, marketing limits, send messages, enforcement, business-scoped user IDs
• Business Messaging Policy, WhatsApp, Sep 2026
• RCS for Business docs, Google, Aug 2026: launch, launch approval, brand verification, send messages, standard billing, US billing
• Turn on RCS messaging on your iPhone, Apple, May 2026

Legal and trade analysis

• One-to-one consent eliminated, Goodwin, Sep 2025
• TCPA revocation rules revised, Troutman Pepper Locke, Sep 2026
• Texas law covers texts, Morgan Lewis, Sep 2025
• Quiet hours class action, TCPAWorld, Feb 2026
• RMD removals, Mintz, Aug 2025
• Third-party SHAKEN rules and RMD recertification, TransNexus, Aug 2025 and Jan 2026
• Call labeling proposal, Wiley, Oct 2025
• Porting order, Kelley Drye, 2010
• Reassigned Numbers Database, Hudson Cook, 2021
• Singapore SSIR, Allen & Gledhill, 2023
• Mexico line registration, Infobae, Jul 2026
• Nigeria international A2P licence, Babalakin & Co, Jul 2025
• Colombia CRC 8308 obligations, Mobile Time, Aug 2026
• Prosecutors ask for 0303 back, Olhar Digital, Jan 2026
• Verizon signs BCID contract, TransNexus, 2025
• Ofcom messaging scam rules, Digital Policy Alert, Jul 2026

Provider and aggregator pages (secondary)

• AT&T surcharge changes, 10DLC fees, campaign vetting, Bandwidth, Aug to Sep 2026 (secondary)
• Carrier pass-through fees, Vibes, Sep 2026 (secondary)
• 10DLC rate limits, sole proprietor, toll-free consent, Telnyx, 2026 (secondary)
• Auth+ 2.0 expansion, Telgorithm, Aug 2026 (secondary)
• Unverified toll-free blocked, country guidelines, messaging fraud, US voice pricing, Twilio, Jan 2024 to Oct 2026 (secondary)
• Throughput limits, AWS End User Messaging (secondary)
• Non-compliance fines, SkySwitch, seen Oct 2026 (secondary)