Key concepts

People mix up the number (an E.164 address, the international format of country code plus national number, allocated to a carrier and reaching you through resale), the sender (whatever the recipient sees) and the business (the legal entity a gatekeeper has checked) all the time.

A 10DLC sole proprietor is a person or business without an EIN (an LLC with one isn't), verified by a one-time code to a US or Canadian mobile; providers say it gets one campaign and one number. And Auth+, today required only of public companies, will extend to new brands of every type except sole proprietors from January 21, 2027, according to providers.

In every case someone else issues and checks the identity, at a different level for each sender type, so I'd model brand, campaign, sender and number as separate records, each with its own history.

A number has one lifecycle; a sender has several running side by side, and the bugs tend to show up where they disagree.

The NANP number lifecycle, from the platform's side: spare → allocated to a carrier block → in your inventory → reserved → active → porting out or released → aging → spare again. Aging is set by law: a disconnected number must age at least 45 days, and at most 90 days for residential and 365 for business numbers. Toll-free runs its own clocks for reserved, assigned and disconnected numbers.

On top of the number, every sender layer keeps its own state:

Abroad, add degraded states: delivered but labelled "Likely-SCAM" (Singapore) or "Unverified" (Australia), or delivered with your sender overwritten.

Take the same clinic chain. Its appointment-reminder campaign clears the DCA on Monday; it can be live at T-Mobile by Tuesday and still pending at AT&T on Thursday, so some patients get their reminders and others don't.

"Approved" in one system rarely means live everywhere, so show customers the state per carrier. Port-out and release should also clean up the campaign link, any hosted SMS route (texting on a number whose voice stays with another carrier) and the 911 record.

Your inventory database is a copy. Nearly every fact a customer cares about is owned by someone else.

The one record that's yours is consent. It's the sender's own system of record, and in a lawsuit or a carrier audit it's the only defence you have. CTIA's short code handbook expects consent records kept six months after an opt-out. The reassigned-number safe harbor only protects callers who can prove they checked the Reassigned Numbers Database, so keep those query logs too.

Most rules that decide outcomes here are written by carriers and industry bodies, and they change by memo.

The US baseline is CTIA's Messaging Principles and Best Practices (May 2023, still the latest):

• Consent scales with content: implied for conversational, express for informational, express written for promotional messages.
• One opt-in per campaign, not transferable; no rented or bought lists.
• Opt-out works in plain language, not only STOP, with one confirmation message.
• No public URL shorteners and no snowshoeing (spreading traffic across many numbers to dodge filters).

CTIA's short code handbook adds HELP and STOP wording and the SHAFT rules (sex, hate, alcohol, firearms, tobacco): legal SHAFT content needs an age gate.

Carriers set throughput by rule, from the vet score. A retailer's campaign with a vet score of 40 gets 240 texts a minute at AT&T, so a 100,000-text flash sale takes about seven hours to go out; with a score above 75 it would take under half an hour.

Carriers don't publish these tiers; I took them from provider documentation in October 2026. What moves you up a tier is the vet score, and a standard vet costs around $40 at TCR.

Rich channels have their own rulebooks. Since April 9, 2025, Meta approves a WhatsApp "utility" template that reads like marketing as marketing. One line like "upgrade your seat for $29" at the end of an airline's boarding-pass template can turn a cheap utility message into a marketing one. Google holds each RCS agent to the use case declared at launch: OTP, transactional, promotional or multi-use. Abroad, countries add content categories and quiet hours: India's P/S/T/G header suffixes, the UAE's "AD-" prefix with no promotions from 21:00 to 07:00 (according to provider guides), and Colombia's advertising window of weekdays 07:00-19:00 and Saturdays 08:00-15:00 under Ley 2300.

Anything an outside party can change belongs in configuration with an effective date.

The price of a message depends on the day it was sent, and sometimes on which carrier memo you read.

Meta runs a cleaner calendar: WhatsApp prices change only on January 1, April 1, July 1 or October 1, with at least a month's notice for a rate change and six for a change of pricing model. A template is charged at whatever category it holds when sent.

The FCC splits dates in two. A rule can be "effective" while compliance waits for OMB (the White House office that approves paperwork burdens) and a Federal Register notice, as the SIM-swap and NG911 rules did. The date to track is the compliance notice.

Picture a logistics company sending 50,000 delivery texts a month, mostly to T-Mobile users. The January 2026 change added a fraction of a cent to each, which is roughly $75 a month on a contract nobody reopened. Multiply that across every customer and every carrier, and you need to know which fee applied to which message.

I'd store two dates on every approval and every fee: when it took effect and when you learned about it. Finance and carriers will both ask what applied when a given message went out.

The standards are old, every provider speaks its own dialect, and the signal you want is often missing.

• Numbers. E.164, and in the NANP the NPA-NXX-XXXX format (area code, exchange, line). Mobile and landline numbers share area codes, so you need a lookup to know the line type.
• Messaging. Platforms reach aggregators over SMPP (the SMS industry's binding protocol) or HTTP. Billing counts segments (the parts a long SMS gets split into), and every provider has its own error codes.
• Porting. An LSR (local service request) goes to the losing carrier, an FOC (firm order commitment, the agreed date) comes back, and the NPAC record flips. A simple port may be validated on just four fields: number, account number, ZIP code and passcode.
• Caller identity. STIR/SHAKEN (ATIS-1000074) signs each call. "A" means the signer knows the customer and checked its right to the number; "B", it knows the customer but not the number; "C", it's passing on traffic it didn't originate. Since September 18, 2025 a provider must sign with its own SPC token (the credential iconectiv issues to eligible providers). Since March 25, 2026 a terminating provider that blocks on analytics has to say so with SIP code 603+.
• 911. NG911 carries calls over SIP, with location inside the signaling as PIDF-LO (a standard location object).
• RCS. GSMA's Universal Profile (4.0 finalized March 2026). Google's API returns 404 when it can't reach a user; fallback is your job.
• WhatsApp. Cloud API only, since the On-Premises API ended October 23, 2025. Webhooks carry business-scoped user IDs, which you've had to support since April 2026. Embedded Signup v2 is deprecated on October 15, 2026.

An A attestation only tells you who signed the call and what they know about the caller; it says nothing about whether the call is wanted or legal.

A US business text passes through at least four companies before it reaches a phone, and any of them can stop it.

The chain: brand → platform (registered at TCR as the CSP, campaign service provider) → DCA or aggregator → carrier → handset. Alongside sit TCR, the vetting firms Aegis and WMC (whose scores set throughput), and Campaign Verify for political senders (providers say it's required on toll-free and short codes too since February 17, 2026).

Abroad, the mobile carrier is the gatekeeper and sets the termination price (what it charges to deliver to its subscriber). Colombia requires a registered integrator for short codes, Nigeria routes international A2P through a single licensed gateway, and Brazil plans a central directory that binds short code brokers by contract (announced January 2026; I haven't confirmed it's live).

Then there are counterparties nobody signs with: grey routes (traffic pushed through consumer SIMs in "SIM boxes" to dodge termination fees) and SMS pumpers. A lot of the rules in this guide exist because of them.

I keep these layers apart because each has a different enforcer and a different penalty.

Carrier policy is routinely stricter than the law. The 11th Circuit threw out the FCC's one-to-one consent rule on January 24, 2025, and the FCC later deleted it. Yet providers say toll-free and campaign reviewers still reject consent that lead generators gathered for unnamed "partners". The FCC allows up to 10 business days to honor an opt-out; carriers expect STOP to work immediately.

Canada is the useful contrast. CASL requires consent, sender identification and a working unsubscribe, with penalties up to CAD 10M for a business, but the part that would let people sue directly has been suspended since 2017. Providers say there's no 10DLC-style registry for texts within Canada, but Canadian numbers texting the US must register with TCR. Toll-free reaches both countries. Canadian short codes must answer STOP, ARRET, HELP, AIDE and INFO in English and French.

Most of this team's operational load lives in exception paths, and nearly all of them run on someone else's clock.

Regulators reverse themselves too. Brazil made the 0303 telemarketing prefix optional in August 2025, and federal prosecutors asked for it back in January 2026.

Say a dental group moves its main line to your platform, and the port form uses the practice's trading name while the losing carrier's record has the legal name. The port comes back rejected. The fix is a supplement to the same order, and a support team that doesn't know that starts over and loses days.

I'd design the rejection path before the happy path, since that's where your customer's launch slips and where they decide whether your platform earns its markup.

The default answer to "who pays?" is the sender, then whoever has a contract with the sender.

Take a fintech whose sign-up page texts a code to any number typed in. Overnight a bot enters 100,000 numbers in a few small countries, each text costs several cents, and the carriers there split that revenue with the fraudster. The fintech gets a bill of several thousand dollars for sign-ups that never existed, and it'll ask whether you should have stopped it.

Every setting that relaxes a protection (geographic permissions, rate limits, consent checks) is also a decision about who absorbs the loss, so write the answer into the spec and the contract.