What A2P messaging is
A2P (application-to-person) messaging is any SMS sent by a system rather than typed by a human — OTPs, alerts, notifications, and marketing. Carriers treat A2P differently from personal texting: it must be registered and consented, and unregistered A2P traffic is increasingly filtered or blocked outright.
Verification codes are A2P even though users request them, so the rules below apply to your OTP traffic.
- A2P covers OTPs, alerts, reminders, and marketing.
- Carriers require registration and, for many message types, proof of consent.
- Unregistered A2P is throttled or blocked in strict markets.
US 10DLC registration
In the United States, application messaging over standard 10-digit long codes must go through 10DLC (10-digit long code) registration: you register your brand (your business identity) and each campaign (the use case, such as "account verification"). Registration sets your throughput and trust score; skipping it means heavy filtering.
- 1
Register your brand
Submit your business identity (legal name, EIN, contact) to establish your sender identity with The Campaign Registry via your provider.
- 2
Register each campaign
Describe each use case — for OTP this is typically an account-verification / 2FA campaign — with sample messages and opt-in details.
- 3
Get throughput assigned
Your brand + campaign vetting determines your messages-per-second and daily limits.
- 4
Keep it current
Update registrations when your use case, volume, or message content changes materially.
Toll-free A2P also requires verification in the US, and short codes are separately provisioned — 10DLC is specifically the long-code path.
Consent and GDPR
Consent is the backbone of messaging compliance. For transactional OTPs the user's request to verify is generally the basis for the message, but you must not repurpose that number for marketing without separate, explicit opt-in. Under GDPR and similar laws, a phone number is personal data: collect it for a stated purpose, keep it only as long as needed, secure it, and honor deletion requests.
- Send OTPs only for verification the user initiated.
- Never reuse a verification number for marketing without separate opt-in.
- Treat phone numbers as personal data: purpose-limit, secure, and allow deletion.
- Keep an auditable record of consent where marketing is involved.
Sender registration by region
Beyond the US, many countries operate their own registration and sender-ID regimes. The specifics change often, so confirm current rules with your provider per destination — but the shape is consistent: register who you are and what you send.
| Region | Typical requirement |
|---|---|
| United States | 10DLC brand + campaign registration (long code); toll-free verification; short-code provisioning |
| United Kingdom / EU | Alphanumeric sender IDs common; GDPR consent and data-handling obligations |
| India | DLT registration of sender ID and message templates |
| Southeast Asia | Per-country sender-ID registration; some markets require pre-approved templates |
| Middle East | Sender-ID registration often mandatory; unregistered senders frequently blocked |
Build compliance into the flow
Compliance is easier as design than as cleanup. Capture the purpose and consent at the point you collect the number, template your messages so they match what you registered, and log enough to prove what was sent and why. When rules shift in a market, a well-structured flow is a configuration change, not a rebuild.
- Record purpose and consent at number capture.
- Match live message templates to what you registered.
- Log sends with enough context to demonstrate compliance.
- Review registrations when you enter a new country or change use case.