A sales manager at a home services company called us last spring with a simple complaint: the Zoho workflow was firing, the activity timeline showed the SMS logged against every contact, and not one customer had replied in nine days. Nothing was broken in the CRM. The messages were being dropped by the mobile carriers before they ever reached a handset, because the phone number behind them had never been registered under A2P 10DLC. This is the single most common “my CRM is broken” ticket we see that turns out not to be a CRM problem at all.

Key Takeaways

• Since February 1, 2025, US carriers block unregistered application-to-person traffic outright — your CRM will happily report a message as sent while the carrier silently discards it.
• Registration has two layers: a brand (your legal entity, EIN, website) and a campaign (your use case, sample messages, and documented opt-in flow). Most rejections happen at the campaign layer, over consent language.
• Approval is not the finish line. Your brand’s trust score determines throughput — a poorly vetted brand can be capped at roughly 2,000 T-Mobile messages per day, versus 200,000 for a well-vetted one.
• Two dated 2026 changes matter: Twilio began requiring PrivacyPolicyUrl and TermsAndConditionsUrl on new API campaign submissions as of June 30, 2026, and carrier pass-through fees rose across AT&T, T-Mobile, and Verizon during the first half of the year.
• The FCC’s TCPA “revoke-all” requirement was pushed again, to January 31, 2027 — but every other consent and revocation obligation is already live and enforceable.
• Your website has to carry its share of the load. A live, public privacy policy that explicitly says SMS opt-in data is not shared with third parties is now effectively a technical prerequisite for texting from your CRM.

What A2P 10DLC Actually Is

A2P 10DLC is the framework US carriers use to sanction business messaging sent over ordinary ten-digit local phone numbers. Before it existed, businesses texted customers from long codes that were designed for person-to-person traffic, and carriers had no reliable way to distinguish a plumbing company’s appointment reminder from a spam campaign. The fix was a registry — The Campaign Registry (TCR) — that sits between messaging providers and the carriers.

Three objects have to exist and be linked before a message will deliver:

1. A brand. Your legal entity as the IRS knows it: exact legal business name as printed on your CP575, EIN, entity type, address, website, and a point of contact. Mismatches here — a DBA instead of the legal name, a typo in the EIN — are a common early failure.
2. A campaign. Your messaging use case: marketing, customer care, two-factor authentication, account notifications, and so on. This is where you submit sample messages and a written description of exactly how a person consents to receive texts.
3. The phone numbers. Each sending number has to be assigned to an approved campaign. An unassigned number is an unregistered number.

Salesforce spells the consequence out plainly in its Digital Engagement documentation: as of February 1, 2025, unregistered traffic is blocked by the carriers in the ecosystem. There is no grace period and no partial delivery. Worse, from your CRM’s point of view the send succeeded, so nothing in your reporting will tell you what happened.

Why “Sent” in Your CRM Doesn’t Mean “Delivered”

Every CRM we implement writes an activity record the moment it hands a message to its messaging provider. That record means the API call succeeded. It does not mean a carrier accepted the message, and it certainly does not mean a phone rendered it. Filtering happens downstream, and depending on the provider and the failure mode, the delivery receipt may never make it back into the CRM timeline in a way that anyone notices.

The practical implication for CRM owners: never trust send counts as a proxy for delivery. Before you debug a workflow, check the message logs in the underlying provider — Twilio, HubSpot’s SMS tooling, Marketing Cloud MobileConnect, Zoho Voice — and look at the error codes. Twilio’s rejection errors are specific enough to act on: 30909 means your message flow or call to action didn’t give reviewers enough information to verify consent, and 30933 means a required privacy policy URL is missing from the campaign registration.

The 2026 Changes Worth Putting on Your Calendar

This framework is not static, and 2026 has brought a run of tightening that catches teams who registered once, years ago, and never looked again.

Privacy policy and terms URLs became mandatory on new API submissions. In a changelog entry dated April 6, 2026, Twilio announced that starting June 30, 2026, PrivacyPolicyUrl and TermsAndConditionsUrl are required fields when registering a new A2P 10DLC campaign through its Messaging REST API. Submissions missing either field are rejected during campaign review. Existing registered campaigns are not affected — but any new number pool, new subsidiary, or new use case you register now needs both URLs live and publicly reachable.

Carrier pass-through fees moved. T-Mobile and US Cellular adjusted A2P fees in January 2026, AT&T raised per-message fees on April 1, 2026, and Verizon followed on May 1, 2026. Published fee guides currently put per-message carrier surcharges in the range of roughly $0.003 to $0.005 per SMS, on top of campaign registration of about $15 and recurring monthly campaign fees that vary by use case. Treat those as directional and confirm against your own provider’s current schedule — the point is that SMS cost modeling done in 2024 is now wrong.

Toll-free verification got stricter too. New toll-free verification submissions from January 2026 onward are expected to carry a business registration number (an EIN for US entities), country of registration, and legal entity type — fields that providers had been collecting optionally since late 2025. If your CRM texts from a toll-free number as a workaround, that path is converging with 10DLC, not escaping it.

The TCPA clock moved the other way. The FCC’s Consumer and Governmental Affairs Bureau further extended the effective date of the TCPA “revoke-all” provision — the rule requiring that an opt-out sent in response to one kind of message be applied to all future calls and texts from that caller on unrelated matters — to January 31, 2027. Do not read that as relief. Every other consent and revocation obligation remains fully enforceable: you must honor revocation requests made through reasonable methods, keyword opt-outs still apply, and the rule permits only a single clarification message after a revocation.

How This Lands in Each Platform

The registration requirements are set by carriers and TCR, so they are the same everywhere. What differs is where the registration form lives, who files it, and what you have to buy first.

One trap specific to the Zoho-plus-Twilio pattern: because the SMS credentials live in Twilio rather than in Zoho, the registration status is invisible from inside the CRM. Admins genuinely believe the integration is broken when the real answer is an unapproved campaign sitting in a Twilio console nobody has logged into since setup.

The Registration Walkthrough That Actually Passes

1. Pull your CP575 before you start. Register the brand under the exact legal name and EIN on that IRS letter, not the name on your website header. This one detail causes more resubmissions than any other brand-level field.
2. Fix your website first, not last. You need a live, publicly accessible privacy policy and a terms page. The privacy policy must state that mobile numbers and SMS opt-in data are not shared with third parties. If your policy mentions data sharing elsewhere, add an explicit carve-out saying text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text messaging service.
3. Rebuild your opt-in form to carrier spec. Consent must be separate, unchecked by default, and specific to text messaging — it cannot be bundled with a general terms acceptance or a newsletter signup. Disclose message frequency and include “Message and data rates may apply.”
4. Write the message flow like a reviewer has never seen your business. Twilio’s guidance for the message_flow field is 40 to 2,049 characters and requires you to describe every opt-in path you use — web form, keyword, paper form, QR code, verbal — in that single field, with links to your privacy policy and terms. If a path isn’t publicly reachable, host screenshots and link them.
5. Make sample messages look like real messages. Include your brand name in every sample, including keyword replies. Include opt-out instructions. Make the HELP response contain real contact details.
6. Pick the narrowest accurate use case. Registering everything as “marketing” when most of your volume is appointment reminders or account notifications invites both stricter scrutiny and worse economics.
7. Assign every sending number to the approved campaign. Including the ones your ops team quietly added last quarter.
8. Send a controlled test to real handsets on all three major carriers. Not a test to a colleague on one network. Filtering behavior differs by carrier, and a message that lands on Verizon can vanish on T-Mobile.

Approved Is Not the Same as Able to Send

This is the part that blindsides mid-market teams planning a campaign blast. Registration gets you a lane; your trust score determines how wide it is. TCR assigns brands a score from 0 to 100 during vetting, which maps to a message class on AT&T and a tier on T-Mobile.

Infobip’s carrier throughput reference gives a sense of the spread. On T-Mobile, Russell 3000 companies and brands with third-party vetting scores of 75–100 get around 200,000 messages per day; a score of 25–49 drops that to roughly 10,000 per day; and a low-vetting brand scoring 0–24 is capped near 2,000 per day, resetting at midnight Pacific. On AT&T, the per-minute throughput range across message classes runs from roughly 4,500 SMS per minute at the top end down to 75 per minute for low-volume classes.

If you are a 40-person company with a thin credit and web footprint, you may land in a tier that cannot physically deliver the 12,000-message reactivation campaign your marketing team has queued in HubSpot. Standard vetting — an automated review run by firms such as Aegis Mobile or WMC Global, typically around $40 — is the lever to raise that score. Appeals are free within 45 days of receiving a trust score; after that, a secondary vetting fee applies. Budget for vetting during implementation, not after your first throttled send.

The Rejection Triggers We See Most

• Opt-in described in the campaign but not actually present on the live website a reviewer visits.
• A consent checkbox that is pre-checked, or bundled with terms acceptance.
• Privacy policy silent on SMS data, or worse, stating data is shared with partners.
• Sample messages with no brand name, no opt-out instruction, or placeholder text.
• A message flow that says “customers sign up on our website” and nothing else.
• Brand name that doesn’t match the EIN record.
• Use case mismatch — registering as customer care and then sending promotional offers, which is also how approved campaigns get suspended later.

CRM Experts Online’s Perspective

We implement CRM and ERP systems for small businesses, agencies, and mid-market companies across more than twenty industries, and we have learned to treat SMS as a compliance workstream rather than a channel toggle. On projects where texting is in scope — recruiting firms, home builders, field service operators, mortgage and insurance teams — we now start brand and campaign registration in week one of the engagement, before a single workflow is built. The reason is arithmetic: HubSpot quotes six to eight business days for long code and Salesforce warns that carrier review can stretch to three weeks. If registration starts when the automation is finished, it becomes the critical path on go-live.

The second thing we insist on is that someone owns the website side of this. The privacy policy, the terms page, and the consent checkbox are not marketing collateral in this context — they are technical dependencies of your CRM’s messaging function, and in 2026 they are dependencies that a provider API will reject you for missing. We usually end up writing the message flow description ourselves, because the version a client drafts describes their business and the version that passes describes the consent mechanics.

Third: design the opt-out plumbing inside the CRM, not just at the carrier. Carrier-level STOP handling suppresses the number at the messaging layer, but it does not necessarily write anything back into your contact record. If the CRM doesn’t know a contact revoked consent, your next list build will re-add them, your reps will see no indication, and you will have a TCPA exposure that is invisible on every dashboard you own. Build a field, sync the suppression, and report on it.

Finally, revisit registrations annually. Companies rebrand, get acquired, change EINs, spin up subsidiaries, and add number pools. Every one of those events can invalidate a brand record that was correct when it was filed.

FAQ

Do I need 10DLC registration if I only send a handful of texts a month? Yes. The threshold is not volume — it is whether the message is generated by an application rather than typed by a person on a handset. A CRM workflow sending five texts a month is A2P traffic and will be filtered if unregistered.

Can I avoid all of this by using a toll-free number? Not meaningfully. Toll-free traffic requires its own verification process, and from January 2026 new submissions are expected to include a business registration number, country of registration, and entity type — converging with 10DLC requirements rather than sidestepping them.

What if my reps text customers from their personal phones instead? That solves nothing and creates two new problems: the conversation never reaches the CRM, and when the rep leaves, the customer relationship leaves with them. It is also increasingly the thing that turns a routine discovery request into a bad day.

How much should I budget? Plan for one-time brand registration, roughly $15 per campaign registration, recurring monthly campaign fees in the low single to low double digits depending on use case, optional standard vetting around $40, and per-message carrier surcharges currently in the $0.003 to $0.005 range on top of your provider’s message price. Confirm exact figures with your provider — several of these moved in 2026.

My campaign was rejected. How many times can I resubmit? You can resubmit, and providers now support editing and retrying campaign registrations, but repeated rejections waste weeks. Fix the website and the message flow description before resubmitting rather than tweaking one field and trying again.

Does an approved campaign ever get revoked? Yes. Sending content that doesn’t match your registered use case — promotions under a customer care campaign, for instance — is a common route to suspension, as are spikes in opt-out or spam-report rates.

Do these rules apply outside the United States? 10DLC is a US framework. Other countries have their own sender ID registration and consent regimes, and if you text into Canada, the UK, or Australia from the same CRM, each needs separate handling.

Is the TCPA “revoke-all” delay a reason to postpone opt-out work? No. The delay to January 31, 2027 covers only the specific requirement to treat one opt-out as applying to unrelated future messages. Honoring revocation requests through reasonable methods, keyword opt-outs, and the ten-day window are obligations you have today.

Conclusion

Texting from your CRM is one of the highest-response channels most mid-market companies have available, and it is also the one most likely to fail silently and expensively. The fix is unglamorous: register the right legal entity, describe your consent flow the way a carrier reviewer needs to read it, get your website’s privacy and terms pages into compliance, vet your brand so you have the throughput your campaigns actually need, and wire opt-outs back into the CRM so your data stays clean and defensible.

If you are standing up SMS in Salesforce, HubSpot, Zoho, or a custom stack — or if your messages are already disappearing and nobody can tell you why — schedule a consultation with CRM Experts Online. We will audit your current registration status, your opt-in mechanics, and your CRM’s suppression logic, and get your messaging delivering before your next campaign goes out.

Further Reading

• Twilio changelog: A2P 10DLC campaign registration requires privacy policy and terms URLs starting June 30, 2026
• Twilio error 30909: Campaign rejected — Message Flow or Call to Action incomplete/unverified
• HubSpot: Register your business to send SMS messages in HubSpot
• Salesforce Help: Digital Engagement Messaging — US A2P 10DLC changes and registration
• Zoho Voice: Register your 10DLC business number for SMS/MMS setup
• Infobip: 10DLC throughput and carrier limits reference
• Trust scores for A2P 10DLC brands and how vetting affects throughput
• FCC further extends effective date for the TCPA “revoke-all” rule
• Bandwidth: 10DLC campaign vetting tips and tricks
• A2P 10DLC carrier fees in 2026

John M Perez

CRM & ERP Enterprise Technology Expert and Entrepreneurial Executive with 20+ years of leading CRM, ERP, Customer Experience, and Block-chain initiatives and projects across internal and customer facing technologies.  Proven success in closing large deals in Pre Sales customer facing engagements and deploying enterprise wide CRM & Customer Experience solutions internationally and domestically.