twilio-compliance-onboarding

Overview

Most Twilio channels require registration or approval before traffic flows. Skipping this step is the #1 onboarding mistake — developers build first, then discover messages are blocked or calls labeled as spam.

Lifecycle: Choose numbers/senders (twilio-numbers-senders) → Register them (this skill) → Follow traffic rules (twilio-compliance-traffic)

---

Decision Tree: What Do I Need to Register?

Messaging Programs

Voice Trust Programs

Voice trust priority: STIR/SHAKEN first (required for Level A attestation) → Voice Integrity (spam label remediation) → Branded Calling (mobile only, beta) → CNAM (simplest, lowest impact). All voice programs require an approved Trust Hub Business Profile as prerequisite.

---

A2P 10DLC — Deep Dive

A2P 10DLC is the most common program and the most common source of onboarding delays.

Registration Flow

1. Create Customer Profile — Business identity in Trust Hub (required for all programs)
2. Register Brand — EIN, business name, address, website. TCR typically approves within minutes. Respond to OTP verification within 24 hours. Brand best practices
3. Register Campaign — Use case, 2+ sample messages, opt-in proof, privacy policy. Review takes 10-15 business days. Campaign best practices
4. Associate phone numbers — Link numbers to campaign via Messaging Service

Message Flow (Opt-In Documentation)

The message flow field is the #1 reason campaigns get rejected. Reviewers click your links and follow your opt-in steps. If submitting via API, the field must be 40–2049 characters.

4 required elements:

1. Description of opt-in method(s) with clear language inviting users to sign up (no pre-checked boxes)
2. Message frequency (e.g., "Up to 4 msgs/month")
3. "Message and data rates may apply" disclosure
4. Link(s) to opt-in image/mockup (must be publicly accessible)

Example of a strong message flow:

"Customers opt in by texting JOIN to 55555, or by checking the SMS opt-in box during checkout at shop.acme.com. The checkout page displays: 'Check this box to receive exclusive deals via text. Up to 4 msgs/month. Message and data rates may apply. Reply STOP to opt out. Reply HELP for help. Privacy Policy: acme.com/privacy. Terms: acme.com/tc.' In-store signage also promotes keyword opt-in with full disclosures. Screenshot of signage: [Google Drive link]"

How to document opt-in by scenario:

All links must be publicly accessible. Non-English disclosures need a translated version included.

Consent Requirements

Three tiers of consent (CTIA guidelines):

Critical rules:

• Consent is per-campaign. Signing up for order updates does NOT grant consent for promotions. Separate opt-ins required.
• Consent must be voluntary. If customers must opt in to messaging to complete a purchase or create an account, the registration will be rejected.
• Brand name must appear in the consent disclosure — generic "you agree to receive texts" is insufficient.

Privacy Policy & Terms and Conditions

Both are required. Registrations without them are rejected.

Privacy policy must include:

• What data you collect and how it's used
• That mobile information will NOT be shared with third parties for marketing (CTIA requirement)

Terms and conditions must include:

• Program/brand name and description
• "Message and data rates may apply"
• Message frequency or recurring message disclosure
• Customer support contact information
• HELP and STOP opt-out instructions (displayed in bold)
• Link to privacy policy
• "Carriers are not liable for any delayed or undelivered messages"

Pro tip: Create messaging-specific privacy policies and terms rather than updating your main company documents. Dedicated policies are easier to keep current if requirements change.

Mixed Use Case Campaigns

If you send both marketing and transactional messages (e.g., order confirmations AND promotions), use the Mixed campaign use case:

• Select "Mixed" as the campaign use case during registration
• Allows 2-5 sub-use cases within one campaign (e.g., Customer Care, Marketing, Account Notification, 2FA, PSA)
• Describe each sub-use case clearly in the campaign description
• Sample messages must cover each declared sub-use case

Do NOT register separate campaigns for each message type unless they use different phone numbers or have different opt-in flows. Mixed is the intended solution for multi-purpose messaging from the same sender.

Campaign Rejection Gotchas

Failed campaigns can now be edited directly in Console (API editing is private beta).

Registration Tiers

Russell 3000 companies qualify for 200,000 segments/day automatically.

Common Errors

---

Toll-Free Verification

Required for US/Canada toll-free SMS. Simpler than A2P 10DLC.

• Submit via Console (Active Numbers → Regulatory Information tab) or API
• Requires: paid account, Customer Profile, business name, website, use case description, sample message, opt-in type
• Unverified toll-free numbers cannot send SMS to US/Canada — status shows "Restricted"
• If rejected: resubmit within 7 days for priority review. After 7 days, number reverts to Restricted and resubmission goes to back of queue
• ISVs must have an approved Primary Business Profile before submitting for secondary customers
• 527 political organizations require Campaign Verify tokens before Console submission
• Don't use multiple toll-free numbers for the same use case ("snowshoeing")

Docs: Console onboarding | Why rejected?

---

WhatsApp WABA Registration

Self-Signup Flow (Direct Customers)

1. Console → Messaging → Senders → WhatsApp Senders → "Create new sender"
2. Select phone number (Twilio or non-Twilio — must not already be registered with WhatsApp)
3. Click "Continue with Facebook" → Meta Embedded Signup popup
4. Create or select Meta Business Portfolio
5. Create or select WABA (all senders on same Twilio account must share one WABA)
6. Set display name, category, description — Meta reviews display name post-registration
7. Phone verification via OTP (SMS or voice)
8. Registration completes within minutes

Post-Registration Requirements

• Meta Business Verification required before production messaging — can take several weeks
• If display name rejected by Meta, messaging is limited to 250 messages/24 hours
• Outbound messages require pre-approved Message Templates (submitted to Meta, 24-48hr approval)
• Free-form messages only within 24-hour service window after customer initiates

ISV Path

Enroll in Meta's Tech Provider Program to onboard customers. Different flow from self-signup.

Docs: Self sign-up | WhatsApp hub

---

RCS Onboarding

4-6 weeks minimum. RCS has a detailed 7-part compliance process covering sender profile, privacy/ToS, eligibility, campaign details, opt-in/consent, sample messages, and common rejection reasons.

See twilio-rcs-messaging for the full onboarding guide, sending patterns, and device support.

Quick summary: Create RCS Sender in Console → complete compliance submission → Twilio specialist reviews → Google + carrier approval → add to Messaging Service → go live.

Docs: RCS onboarding | Compliance guide | Regional availability

---

CANNOT

• Cannot skip A2P registration for US 10DLC — Mandatory for all senders, no exceptions for small volume
• Cannot register Sole Proprietor A2P via API — Console only
• Cannot combine unrelated use cases without Mixed campaign — Use the "Mixed" use case category to register 2-5 sub-use cases under one campaign
• Cannot require A2P registration for Verify traffic — Twilio Verify is exempt from A2P registration
• Cannot use voice trust programs without Trust Hub — All voice programs require an approved Trust Hub Primary Customer Profile
• Cannot use Branded Calling on landlines — Mobile-only. US: Public Beta (T-Mobile, Verizon). Non-US: availability varies by country and carrier — check eligibility for your specific numbers. Use CNAM for landlines.

---

Next Steps

• Channel overview and onboarding guide: twilio-messaging-overview
• Choose the right number type first: twilio-numbers-senders
• Follow traffic rules after registration: twilio-compliance-traffic
• Set up Messaging Services for number pools: twilio-messaging-services
• Send SMS after registration: twilio-sms-send-message
• Secure your account: twilio-security-hardening