10DLC in 2026: The SMS Compliance Rules That Will Block Your Texts If You Ignore Them

If your business sends text messages to customers in the United States, you already need to know what 10DLC is. If you do not, the bad news is your messages may not be getting delivered right now.

Since February 1, 2025, every major US carrier blocks unregistered business SMS traffic entirely. No throttling. No warnings. Just silent failure. Your appointment reminders, order confirmations, shipping updates, review requests, and marketing texts simply never arrive.

And 2026 made things more complicated, not less. Fee increases. A new FCC one-to-one consent rule that took effect January 27. Higher fines. More state laws. If you have been getting by with a half-configured setup from two years ago, your business is either losing deliverability already or walking into a compliance fine.

This guide covers what actually matters for 10DLC in 2026, and what most SMS platforms are not telling their customers.

What 10DLC Actually Is

10DLC stands for 10-Digit Long Code. It is the framework US carriers built to separate legitimate business texting from spam.

Before 2021, any business could text from a regular local number with almost no rules. The result was predictable. Spam, scams, and phishing texts clogged carrier networks. Consumers stopped trusting SMS. Deliverability tanked for everyone, including legitimate businesses.

To fix this, AT&T, T-Mobile, and Verizon created a mandatory registration system administered by The Campaign Registry, known as TCR. You register your business as a Brand. You register each type of message you send as a Campaign. Each Campaign gets assigned to specific phone numbers. Carriers monitor traffic against what you registered. Break the rules, and you get throttled, blocked, or fined.

Who Has to Register

Basically every business that texts customers in the United States from a local 10-digit number. That includes:

• DTC brands sending order confirmations, shipping updates, or marketing texts through Klaviyo, Postscript, Attentive, or any SMS platform.
• Health practices sending appointment reminders and review requests.
• Home services companies sending technician arrival notifications or quote follow-ups.
• SaaS and subscription businesses sending 2FA codes, transactional alerts, or billing reminders.
• Wholesale operations texting retail buyers about orders or restocks.
• Any business running SMS flows through Twilio, Telnyx, Bandwidth, or a similar provider.

The only exceptions are toll-free numbers, which have a separate registration process, and true person-to-person texting. And carriers define person-to-person narrowly. If a message is automated, templated, scheduled, or sent as part of a marketing or support workflow, it is application-to-person, also called A2P, and it needs 10DLC registration.

If a human types each text individually and the traffic is roughly symmetrical, you might qualify for a P2P exemption. For the vast majority of businesses, you do not. Assume you need to register.

What 10DLC Costs in 2026

Registration fees are small. The problem is they compound with non-compliance fees and carrier pass-throughs. Here is the honest breakdown as of 2026.

Registration Fees, Paid to TCR

• Brand Registration: $4.50, one-time per business.
• Standard Brand Vetting: $41.50, one-time. Strongly recommended for any real traffic. Without a vetting score, your throughput will be capped at levels that make serious SMS campaigns impossible.
• Campaign Verification: $15 per campaign, one-time. Most businesses run one or two campaigns. Agents and franchises often need more.

Total to get started properly: around $60 one-time for a single-brand, single-campaign business. Not expensive. The mistake is skipping the vetting fee to save $41.50 and ending up throttled to a fraction of the throughput you paid for.

Monthly Campaign Fees

Campaigns carry a recurring monthly fee, billed by TCR and passed through by your SMS platform. Rates vary by use case:

• Low-volume campaigns (2FA, transactional): around $1.50 per month.
• Mixed and marketing campaigns: $10 to $15 per month.
• Special use cases (charity, political, emergency): vary widely.

Per-Message Carrier Fees

Every message you send carries a small per-segment fee that the carrier charges for delivery. Effective January 19, 2026, T-Mobile 10DLC messages cost $0.0025 per outbound segment. AT&T and Verizon have similar rates, with increases rolling in through 2026.

For a brand sending 100,000 SMS segments per month across all carriers, carrier pass-through fees run $200 to $500 monthly on top of your SMS platform costs.

What It Costs to Get This Wrong

This is where the stakes get real. The fines are not theoretical, and they have been rising.

• $10,000 per message for content violations. Sending anything in the SHAFT categories (sex, hate, alcohol, firearms, tobacco), anything misleading, or anything that does not match your registered use case. One bad batch can cost six figures.
• $10,000 for sending from unapproved numbers. Numbers assigned to a different campaign, or unassigned numbers, cannot be used for A2P traffic.
• $2,000 per violation for phishing, smishing, or social engineering, under T-Mobile's Severity-0 framework.
• $1,000 per incident for snowshoeing, the practice of rotating through multiple numbers to evade filtering.
• $500 to $2,000 per incident for other compliance violations.

Unregistered traffic also incurs per-message surcharges of $0.006 to $0.017 per segment, several times higher than registered rates. A moderately active business sending unregistered messages can easily spend thousands of extra dollars monthly on surcharges alone, on top of the risk of fines.

And TCPA lawsuits are up 95 percent. Non-compliant SMS traffic is a magnet for class action lawyers. The cost of losing one case is larger than the cost of registering correctly for a decade.

The 2026 FCC Rule That Changes Lead Forms

This is the biggest regulatory change of the year, and many brands are not ready.

As of January 27, 2026, the FCC's one-to-one consent rule is in effect. It fundamentally changes how lead generation works for any business that buys leads or uses shared opt-in forms.

Under the new rule, if a consumer fills out a form that shares their information with multiple companies, each company needs separate, explicit consent to contact that consumer. You cannot have one checkbox that says "I agree to be contacted by partners" and then text the lead on behalf of five different businesses. Each relationship requires its own consent.

What this means practically:

• Lead generation forms need to name each specific company the lead will be contacted by.
• Each company needs an affirmative opt-in from the consumer, recorded with timestamp and source.
• Shared consent lists (often called "data broker leads" or "aged lead lists") are no longer compliant.
• SMS platforms now require proof of one-to-one consent for each recipient.
• Opt-in forms must include live, accessible Terms of Service and Privacy Policy URLs. This became a requirement in October 2025.

How Throughput Actually Works

Throughput is how many messages you can send per second, minute, or day. It is not set by your SMS platform. It is set by the carriers, based on your Brand Tier and Campaign type.

Your Brand Tier comes from your TCR vetting score. Without a vetting score, your brand defaults to the lowest tier, which caps you at around 2,000 T-Mobile messages per day. That is enough for a small practice sending appointment reminders. It is nowhere near enough for a DTC brand running a Black Friday SMS blast.

Here is what the T-Mobile daily caps look like in 2026:

• Top Tier (vetting score 75 to 100): 200,000 messages per day.
• High-Mid Tier (vetting score 50 to 74): 40,000 per day.
• Low-Mid Tier (vetting score 25 to 49): 10,000 per day.
• Low Tier (vetting score 1 to 24 or unvetted): 2,000 per day.

AT&T uses a different system called Message Class, with per-minute throughput ranging from 75 SMS per minute (unregistered) up to 4,500 per minute (top-tier registered). Verizon does not publish explicit limits but follows the same registration requirements.

The single most important thing most businesses miss: skipping the $41.50 vetting fee traps you in the Low Tier forever. That one fee is the difference between sending 2,000 messages a day and 200,000.

How to Register in 2026

The registration process is usually handled through your SMS platform, but the steps are the same across providers.

1. Register your Brand. Submit your legal business name, EIN, address, website, contact info, and business vertical. TCR will verify this against public records and IRS data. One Brand per EIN, no exceptions.
2. Complete Brand Vetting. Pay the $41.50 vetting fee. This generates your Trust Score and Brand Tier. Do this. It is the single highest-ROI $41.50 in SMS marketing.
3. Register Campaigns. Each campaign covers a use case: marketing, account notifications, customer care, 2FA, mixed. Describe what you send, include sample messages, specify opt-in and opt-out language, and provide the URLs to your Terms of Service and Privacy Policy.
4. Assign phone numbers to the Campaign. Each number can belong to only one Campaign. As of 2024, T-Mobile caps at 49 numbers per campaign.
5. Wait for manual review. TCR review plus carrier review takes 3 to 10 business days for standard cases. Political, emergency, and charity campaigns take longer.
6. Send traffic. Once approved, all messages from Campaign numbers must match your declared use case. Sending off-campaign content is a violation.

The Opt-In and Opt-Out Rules That Matter

10DLC compliance is not just registration. It is ongoing. Four rules carriers enforce constantly:

• Every message must include your brand name. "Text from Sapt" is fine. Anonymous "thanks for the order" is a violation.
• STOP and HELP keywords must work. Recipients texting STOP must be opted out immediately. Recipients texting HELP must get support information. Ignoring these is an automatic fine.
• No public URL shorteners. Bit.ly, tinyurl, and other shared shorteners are blocked in most carrier filters because they are associated with phishing. Use your own branded domain or a dedicated shortener from your SMS platform.
• Content must match your registered use case. If you registered a transactional campaign, you cannot send a promotional SMS from those numbers. Cross-posting between campaigns is a Severity-0 violation.

The 2026 Compliance Checklist

If your business sends any kind of SMS, run through this list. If you cannot check every box, you have exposure.

• Brand registered and verified with TCR, matching your IRS business records exactly.
• Brand vetted through standard TCR vetting ($41.50) to avoid throughput caps.
• Every campaign registered with a specific, accurate use case description.
• All phone numbers assigned to the correct campaign.
• Opt-in forms include live Terms of Service and Privacy Policy URLs.
• For lead gen, one-to-one consent captured and stored for each recipient and brand combination.
• STOP and HELP keywords tested and working.
• Opt-out retention: 10 years if you do business in Virginia.
• Weekly monitoring of opt-out rates, spam complaints, and delivery rates.
• Review your campaign use-case descriptions quarterly. If your messaging shifts, your registration needs to shift with it.

What Most Businesses Get Wrong

After 10DLC becoming mandatory in 2025, three patterns show up over and over in businesses that have compliance problems.

First, they register once and forget. Registration is a starting line, not a finish line. Carriers re-verify brands periodically. Campaigns can expire. Use cases drift over time. A practice that registered a "reminders" campaign in 2024 and started sending promotional offers in 2026 is out of compliance even though they did everything right at the start.

Second, they skip vetting to save $41.50 and get stuck in the Low Tier. Then their Black Friday SMS blast hits the 2,000 daily T-Mobile cap by 9 a.m. and the rest of their customers never get the message. The $41.50 fee pays for itself the first time you need real throughput.

Third, they treat SMS consent like email consent. It is not. SMS consent requires explicit language, specific brand naming, and increasingly, one-to-one consent for shared lead sources. The old "I agree to receive marketing communications" checkbox does not cut it anymore. Not in 2026.

Where This Is Headed

Three trends to watch through 2026 and into 2027:

• More state-level laws. Texas, Virginia, and California already have state-specific SMS rules that go beyond federal TCPA. Expect more states to follow, each with its own retention, consent, and disclosure requirements.
• RCS is coming. Rich Communication Services, Google's replacement for SMS on Android, is in carrier beta with Fortune 500 brands. When it rolls out broadly, it will come with its own registration and compliance layer that mostly mirrors 10DLC.
• AI message auditing. Carriers are rolling out automated content auditing that flags messages differing from registered samples in real time. If your campaigns drift, your delivery rate quietly drops before you see a formal violation.

What Sapt Does for Clients on SMS

Sapt installs a connected growth system for brands and service businesses, and SMS is part of that system. We handle 10DLC registration, campaign vetting, brand tier optimization, opt-in flow design, and ongoing compliance monitoring as part of the platform. Your messages get delivered. Your opt-in forms pass FCC review. Your campaigns match your registered use cases automatically.

Our clients do not spend Sunday nights reading carrier compliance updates. They check a dashboard and watch their SMS funnel compound alongside their email, ads, and content. One system, not seven tools. Everything connected, everything learning.

If your current SMS setup is held together with spreadsheets and prayer, or if you are about to launch SMS and do not want to spend three weeks untangling 10DLC before your first text goes out, let's talk. Book a call at sapt.ai/funnel.