Rules and risks

How the rules work

What's written and what's enforced differ, and the gap is where roadmap risk lives.

• Enforced on every message: registration. Unregistered 10DLC and unverified toll-free traffic is blocked. Unregistered alpha senders are blocked (Spain since September 15, 2026 per CNMC; the Philippines and UAE according to provider guides) or relabelled (Singapore "Likely-SCAM" since January 31, 2023 per Allen & Gledhill; Australia "Unverified" since July 1, 2026 per ACMA).
• Enforced through lawsuits: the TCPA. A 2025-2026 wave of class actions applies the 8am to 9pm quiet-hours rule to marketing texts.
• Enforced by contract: carrier fines, and CTIA short code audits graded from Sev-0 (fix now, possible suspension) to Sev-2.
• Written but loosely enforced: STI-GA only actively goes after misused A attestations, and porting intervals get enforced when someone complains.
• Not yet regulated: call labeling. The FCC proposed verified caller names and marking of foreign calls in October 2025; there were no final rules when I last checked.
• Under FCC consideration: number resale. The numbering proposal (WC Docket 26-49, March 2026) would extend robocall certifications to every provider that gets numbers, resellers included, limit resale to one level, and act against number cycling (single-use or rotating numbers). For a platform whose number supply runs through layers of resale, I think this is the biggest structural risk on the board. Also coming: the TCPA opt-out rewrite set for an FCC vote on September 30, 2026 (I haven't confirmed the outcome), and Ofcom's rules, adopted July 2026, which require carriers and aggregators to verify alpha sender IDs for UK business texts from July 15, 2027.
• Deadlines slip. Spain moved alias blocking from June 7 to September 15, 2026. Mexico replaced its June 30, 2026 deadline for linking mobile lines to a national ID with a staggered schedule ending December 31, 2026. I'd plan around the later date and build for the earlier one.

What mistakes cost

Mistakes here cost weeks, fees and deliverability, and with 911 they put people's safety at risk.

• Wrong sender. A US short code takes 2 to 4 weeks by the registry's count and 8 to 12 by providers', and the lease is prepaid and non-refundable even if carriers never activate it. A short code won't be ready for a launch next week.
• Sloppy registration. A legal name or EIN that doesn't match official records fails the identity check, and each campaign rejection costs another review round.
• Silent filtering. The customer pays for messages that never arrive, and blames you.
• Fraud. A pumped OTP form turns the customer's messaging budget into someone else's termination revenue.
• Losing your RMD listing or SHAKEN token means downstream providers refuse your voice traffic, a platform-wide outage no code fix undoes.
• WhatsApp enforcement. It escalates from a warning to template blocks, 1 to 30 day messaging blocks, then a locked or disabled account, across the customer's whole WABA.
• 911 address errors. A call reaches the wrong PSAP (public safety answering point, the 911 call center). Regulators fine for it (Ofcom fined UK broadband provider Gigaclear £122,500 over caller-location failures), though a caller sent to the wrong center is the bigger problem.