New: 10DLC add-on for CSPs

10DLC compliance,
for every message.

Moderation API checks every A2P 10DLC message against the campaign it was registered under. Catch campaign drift, pig-butchering openers, SHAFT content and missed opt-outs before a carrier fines you or your DCA suspends the campaign.

Built for CSPs, aggregators and CPaaS platforms.

AllowedBlocked0Held for review00 messages checked (simulated)

Carriers fine per violation. The fine lands on you, the CSP.

$2,000

per phishing or social-engineering violation

$1,000

per illegal-content violation

$500

per SHAFT or other content violation

2026 carrier fine schedules.

Campaigns are checked once.
Traffic changes every day.

A care campaign starts sending loan offers. Nothing in the message looks like spam, so filters let it through. The carrier still fines it, and the fine travels down the chain to you.
BrandWrites the texts
You, the CSPSends for many brands
DCAApproves campaigns
CarrierSets the fines
Messages go upFines come back down, and land on you

The 10DLC rules you answer for.

Approval checks the registration once. Content, consent and opt-out rules apply to every message you send.

Registration

Every brand and campaign is registered with The Campaign Registry: a use case, sample messages and what the texts will contain.

What is 10DLC?

Content

Live messages must match that registration. Carrier codes and the CTIA guidelines ban phishing and restrict SHAFT content.

What is SHAFT?

Consent and opt-outs

Recipients opt in, and every opt-out is honored. The TCPA and the FCC opt-out rules set the bar.

What is 10DLC compliance?

Catch drift before your DCA does.

SMS firewalls and DCAs catch some drift, after the message has left your platform. We check each message against your own campaign records first.
Spam and phishing at volume
Our add-on
Yes
SMS firewall
Yes
Manual review desk
No
SHAFT content
Our add-on
Every message, in context
SMS firewall
Keyword lists
Manual review desk
Samples, at approval
Finds campaign drift
Our add-on
On every message
SMS firewall
Some, upstream
Manual review desk
At approval only
Checks your own campaign records
Our add-on
Use case, samples, links, sender
SMS firewall
No
Manual review desk
Yes, by hand
Runs before traffic leaves your platform
Our add-on
Yes
SMS firewall
Depends on setup
Manual review desk
No
Opt-outs from any channel
Our add-on
Replies, free text and API
SMS firewall
STOP keyword only
Manual review desk
No
Evidence for a DCA audit
Our add-on
One record per campaign
SMS firewall
Logs
Manual review desk
Tickets and Slack
CapabilitySMS firewallManual review deskModeration API 10DLC add-on
Spam and phishing at volumeYesNoYes
SHAFT contentKeyword listsSamples, at approvalEvery message, in context
Finds campaign driftSome, upstreamAt approval onlyOn every message
Checks your own campaign recordsNoYes, by handUse case, samples, links, sender
Runs before traffic leaves your platformDepends on setupNoYes
Opt-outs from any channelSTOP keyword onlyNoReplies, free text and API
Evidence for a DCA auditLogsTickets and SlackOne record per campaign

Six 10DLC compliance checks on every message.

Read more about SHAFT and campaign drift.
10DLC add-on

Use case and samples

Does it match the registered use case and samples?

Care campaign → “0% APR smile loans”
10DLC add-on

Declared content

Links, numbers, lending or age-gated content the campaign never declared.

Embedded link: not declared
10DLC add-on

Link destination

Links that leave the brand’s site, shorteners and chat invites.

bit.ly → chat.whatsapp.com/…
10DLC add-on

Sender

Another company named as the sender.

Text says “Chase Bank”
Core API

Look-alike spelling

Swapped letters and look-alikes that beat keyword lists.

“emaiI”, “Fr33”, “Ꭺррӏе”
Core API

Scams and harmful content

Wrong-number openers, pig-butchering scripts, phishing and SHAFT, in 120+ languages.

“Hi Linda, is this still your number?”

Fits in front of your send path.

One API call, under 100 ms at p50. Start in shadow mode to see the flag rate before anything is blocked.
1

Campaign records

Brands, campaigns, samples and numbers, synced from your platform.

2

Every message

Matched to its campaign, then checked against it and our models.

3

Your thresholds

Per campaign or use case. Webhooks pause a campaign or alert your team.

4

One of three

AllowedBlockedHeld for review

Carriers and DCAs

Deliver and fine.

Ready for the FCC opt‑out rules.
25 November 2026.

All seven opt-out words have to work. A text after an opt-out invites a TCPA claim.

Replies in the conversation

STOPQUITENDREVOKEOPT OUTCANCELUNSUBSCRIBE
can you stop texting meOpt-out, in free text
Who is this?Not an opt-out

From any other channel

Opt-outs from your app, site or support team come in through our API.

Blocked before sendMessages to opted-out numbers never go out.

Proof, when the DCA asks.

One report per campaign, ready for any audit.

Campaign audit reportBright Dental, appointment reminders
CX4F9A2
Registration, as approved
Use case
Customer care
Samples
2 appointment reminders
Links declared
No
Traffic, 1 Sep – 31 Oct
Messages checked
48,210
Flagged
112
Carrier flags
0
Actions
14 Oct
Paused: undeclared link
15 Oct
Resumed after review
Example report

One letter can cost $2,000.

Keyword filters miss it. Carriers do not.

emaiICapital I, not a lowercase l
$2,000

for one phishing message

$200,000

if it went out 100 times

Every number

goes dark when the campaign is suspended

A backtest on your own campaigns.
Free, before you sign.

Send us 30 days of traffic. We show you what drifted.
  1. Week 1

    Export

    Campaign records and 30 days of traffic.

  2. Week 1

    Backtest

    Which messages drifted, and from which campaigns.

  3. Weeks 2–3

    Shadow mode

    Live traffic, checked in parallel. Nothing you send changes.

  4. Week 4

    Decide

    Go live, or keep the report.

FAQ

Frequently asked questions

What is 10DLC compliance?

Every text on a 10DLC number matches its registered brand and campaign, and follows carrier rules on consent, opt-outs and content. More in our glossary.

Who pays 10DLC carrier fines?

Carriers fine the DCA, and the DCA passes the fine to the CSP. The CSP pays, then tries to recover it from the brand.

What is campaign drift?

Live messages that no longer match what the campaign was approved for. A care campaign sending loan offers has drifted. See campaign drift.

Does this replace our SMS firewall?

It can. The core API catches spam, smishing, scams and SHAFT. Or run the add-on next to your current firewall.

What changes on 25 November 2026?

The FCC opt-out rules take effect. Stop, quit, end, revoke, opt out, cancel and unsubscribe all have to work.

Does it catch pig-butchering and wrong-number texts?

Yes. A pig-butchering scam often starts with a friendly wrong-number opener like “Hi Linda, is this still your number?”. We flag these openers and the scripts that follow in your A2P traffic.

What are the 10DLC rules for message content?

Messages must match the registered use case and samples, and follow carrier codes and the CTIA guidelines. Phishing is banned, and SHAFT content needs to be declared and age-gated.

How fast is it?

Under 100 ms at p50.

Get started with a free pilot.