US brand vetting

Before sending A2P (Application-to-Person) 10-digit long codes (10DLC) messages and short codes in the United States, businesses must complete a process known as brand vetting. This is a mandatory step within the registration process and is designed to verify the legitimacy of your organization and ensure adherence to U.S. messaging regulations.

Brand vetting involves submitting your business information for identity verification and risk assessment through The Campaign Registry (TCR). A successful vetting process improves message deliverability, builds trust with mobile carriers, and helps prevent spam and abuse. Depending on your use case, different levels of vetting may apply, including standard, enhanced, or political vetting.

This guide provides clarity on what is required for brand vetting and gives more information about when to use it, including helpful hints, to be sure your brand is approved and ready to launch compliant SMS campaigns in the United States.

Brand vetting for A2P 10-Digit Long Codes (10DLC)

This section describes the brand vetting process for 10-Digit Long Codes (10DLC).

Brand identity verification

After brand registration, each brand undergoes an automated identity verification process. This validates the EIN (Employer Identification Number), legal company name, and legal company address with third-party independent sources and confirms the existence of the brand with an identity status.

Third-party brand vetting

Third-party brand vetting is a process by which a brand requests additional vetting by a third party (for example, Aegis Mobile, WMC Mobile, or Campaign Verify for political vetting). This is a paid service.

Standard vets

Standard vets are optional and are used to gain access to higher throughput levels potentially or to help verify a brand. A standard vet is an automated review of compliance history, employee count, and so on. Once completed, a 0-100 score is provided, which determines your throughput level for some carriers.

Enhanced vets

Enhanced vets are optional and are typically requested if a user is unsatisfied with their standard vet score. If you have already submitted a standard vet appeal and believe a more thorough review would yield a higher score, you can order an enhanced vet.

Political vets

Political vets are required for non-profit brands without a 501(c)(3/4/5/6) Tax Exempt Status that want to use the political special use case. Non-profit brands with 501(c)(3/4/5/6) Tax Exempt Status are not allowed to request or import a political vet from any vendor.

Public profit

As part of recent updates, public profit brands registering for 10DLC must now complete two-factor authentication (2FA) as part of brand identity verification.

When submitting a new brand with a public profit entity type, you must also provide a business contact email address. This address must pass The Campaign Registry (TCR) initial validation. For example, it must be properly formatted, must not be a personal or free email service, and cannot be a generic distribution address. Once the email address is successfully validated, the brand identity verification process will begin.

Brand identity verification flow

As part of brand identity verification, TCR performs a basic identity verification (matching the EIN/TaxID with the legal entity name).

Next, TCR verifies whether the business email address is associated with the brand. Once the association is established, a 2FA email is sent to the brand's business contact. If either the basic identity verification or the email association check fails, the 2FA will not be triggered and the brand changes to an UNVERIFIED identity status.

2FA verification flow

The 2FA email contains a verification PIN and a link. When the brand contact clicks on the link, they are directed to a site and are prompted to enter the following information:

• Brand contact first name
• Brand contact last name
• Brand contact job title
• Verification PIN from the 2FA email

The brand contact then clicks a COMPLETE button to submit the information. Once the 2FA is complete, the brand transitions to a VERIFIED state and is able to register campaigns.

Tips for 10DLC brand vetting

The following information provides tips for the brand vetting process for 10DLC:

• The 2FA email comes from [email protected]
  • It is recommended that you add this email address to your safe senders list to ensure that the messages are received
• If you have any problems completing the verification from the link in the email:
  • Try turning off or pausing your VPN
  • Try a different browser
  • Try copying and pasting the URL into a browser directly
• If your brand is still unable to complete the verification, contact TCR (if you are registering directly in TCR as a campaign service provider) or contact Infobip Support if you are registering using the Infobip US Sender Registration app or API
• If a brand fails the initial verification process, it may be due to one of the following reasons:
  • The information submitted does not perfectly match the Brand's Form SS-4 documentation provided by the IRS
  • The brand submitted for verification is a new entity that has not yet been updated into the system

For either use case, provide your SS-4 documentation to [email protected] to appeal the Brand for verification.

If a non-profit organization is a registered as a 501c3 organization and this is not reflected in verification, send further documentation, including your Form SS-4, to [email protected] to review and update the brand.

Brand vetting for US short codes

This section describes the brand vetting process for US short codes.

Brand vetting by Aegis Mobile

The CTIA and the US Short Code Registry have implemented a new requirement for leasing new short codes during the renewal of existing short codes (that were not formally vetted).

All brands must complete a vetting process aimed at enhancing consumer protection and improving transparency.

Once a brand is successfully vetted for short code leases, end brands do not need to go through the entire vetting process again when leasing another code. However, every year, brands need to complete 2FA verification from Aegis. The verification email is sent to the end brand client email on file. However, if there is a transfer of the lease, the brand must undergo vetting again. At this time, there are no fees associated with this vetting process.

Net new short code lease brand vetting and existing short codes prior to renewal

When applying for a new short code lease, you must provide the following:

• Legal company name
• Legal entity type
• Doing Business As (DBA)
• Country of registration
• Stock market symbol
• Company website URL
• Federal tax ID
• DUNS, GIIN, LEI (if applicable)
• Brand address
• Brand point of contact:
  • First name
  • Last name
  • Phone number
  • Email

Aegis Mobile will complete an initial verification process where the confirmation ensures that the legal name and Federal Employer Identification Number (FEIN) match, that the brand contact email is valid and relates to the company’s published URL, and an authentication process is triggered.

A 2FA PIN is then sent to the brand’s email point of contact from [email protected].

The brand should verify that the email has been received by clicking the VERIFY button in the email or, alternatively, by visiting the URL and providing the 2FA PIN. See the following image.

If the criteria are not met, an INCOMPLETE status is issued without further processing. Status indicates that certain information does not meet the needs for completing the vetting activity.

For short codes managed by Infobip, Infobip sends an email to the content provider contact, advising them of the reasoning and that they must provide correct information for resubmission. If the content provider wants to appeal, provide a copy of the CP-575 notice (the official confirmation letter issued by the IRS) for further review by Aegis Mobile.

Tips for US short codes brand vetting

The following information provides tips for the brand vetting process for US short codes:

• The verification mail comes from [email protected]
• Match the Federal Tax ID (FEIN) and legal entity name, match email address, website URL and address from the CP-575 notice (the official confirmation letter issued by the IRS)
• Brand Point of Contact email matches the company URL (free email services are not permitted: if the company does not have a company domain, these are viewed on a case-by-case basis)