A2P SMS compliance is the set of rules that govern automated messages from businesses to people: sender registration, provable consent, honest opt-outs, and correct content.
These rules exist because A2P traffic is automated and scalable, which makes it both valuable and abuse-prone, and carriers enforce them to protect their networks and subscribers. The compliance stack maps to the message flow, and the SMS gateway product line is where the rules are configured.
This guide is the hub for two deeper articles on US sender registration and the consent and opt-out workflow.
A2P Traffic Is Regulated Because It Is Automated
Person-to-person traffic is low-volume and conversational, so carriers treat it differently from automated traffic that can scale to millions of messages. A2P regulation exists to keep automation honest: senders must identify themselves, recipients must have consented, and complaints must be manageable. The rules differ by market, but the principles are consistent.
The scale is the reason for the rules: a single business sending to a million recipients can create more complaint volume than an entire carrier's person-to-person traffic, so carriers gate A2P at the source. The gate is registration, and the ongoing control is reputation.
The principles map to delivery: registration determines whether the message is accepted, consent determines whether it should have been sent, opt-outs determine whether the sender keeps its reputation, and content determines whether the recipient complains. Each principle has a delivery consequence.
The principle that matters operationally is that compliance is scored: carriers measure registration, complaint rate, and content against the declared use case, and the score shapes delivery. A compliant sender with a low complaint rate gets better throughput, which is why compliance is a delivery factor rather than a legal sidebar.
The sender registration guide and the consent workflow guide break the principles into implementation steps.
Sender Registration Is the First Gate
Before a business can send A2P traffic in a regulated market, it must register as a sender: the business identity, the message use case, and the sending volume are declared to the carriers or their intermediaries. In the US, that means 10DLC registration or toll-free verification; other markets have their own paths. Registration is the first gate because unregistered traffic is filtered or blocked.
The registration should name the use case precisely, because the same number used for marketing and transactional traffic needs the declarations to match. A mismatch between the declared use case and the actual messages is what triggers the filtering that registration was meant to prevent.
The registration also sets the expectation for content: a marketing registration expects promotional templates, and a transactional registration expects order or alert messages. Mixing the two under one registration is what the scoring model penalizes.
The US-specific mechanics are covered in the 10DLC and toll-free verification guide.
Consent Must Be Provable, Not Just Collected
Consent is the legal basis for the message, and it must be provable: the business should be able to show when consent was given, for what purpose, and through which channel. A checkbox that cannot be traced is not consent in an audit. The consent record should travel with the recipient data, so every sending system can check it before a message goes out.
The consent record should also capture the language of consent, because a user who consented in one language deserves messages that match, and an audit may ask what the user was told.
The consent check should also cover the message class: a consent record for order alerts does not authorize marketing, and the gateway should refuse a message whose class does not match the record. The class check is the same one the audit applies.
| Consent element | What to record |
|---|---|
| Who | The recipient identity |
| When | Timestamp of consent |
| Purpose | The exact message type |
| Channel | Where consent was captured |
| Version | The terms in force at capture |
The same rule applies to alert and public-notice messaging, as the alert compliance guide explains for non-emergency notices.
Opt-Outs Are a Delivery Metric, Not a Legal Formality
An opt-out that is honored on one route but ignored on another is a broken promise, and carriers measure opt-out and complaint rates as part of sender reputation. The opt-out should be one reply away, synced across every sending system immediately, and visible in the delivery reports. A high opt-out rate is a content and audience problem, not a compliance problem to hide.
The opt-out should be processed in the same system that sends, because a reply that lands in a different tool than the campaign engine is a reply that goes nowhere. The sync is a design requirement, not an integration nicety.
The opt-out rate should be watched like a delivery metric: a sudden rise after a campaign is a signal about audience fit and frequency, and the fix is better targeting, not a faster opt-out form.
The complaint rate should be reviewed with the same lens: a complaint is the strongest signal a recipient gives, and a spike after a campaign means the audience or the content missed the mark.
The review should compare the complaint rate against the baseline from the previous period, because a rate that looks small in isolation can be a clear trend when compared.
The Compliance Stack Maps to the Message Flow
| Stage | Compliance control |
|---|---|
| Collection | Capture consent with proof |
| Sending | Verify consent and sender registration |
| Delivery | Use the registered sender ID |
| Opt-out | One-reply stop, synced everywhere |
| Audit | Log the message trail per recipient |
The stack should be owned: one person accountable for each stage, because a compliance stack without owners is a checklist that no one runs. The stack should also be tested end to end with a fake recipient: collect consent, send, opt out, and confirm the trail.
Build Compliance Into the Gateway Configuration
The gateway configuration should enforce what the compliance team decides: approved templates per use case, sender IDs per market, consent checks before submission, and opt-out handling on every route. When the rules live in the configuration, a new campaign cannot bypass them by changing the message content.
The enforcement should be tested with a real audit scenario: attempt to send a marketing message to an opted-out number and confirm the gateway refuses it before the queue. A rule that only works on paper is the same as no rule.
The enforcement should be versioned, because a compliance rule change should be testable and reversible like any other configuration change.
The version history should be reviewable, so an audit can see which rules applied at the time of a specific campaign rather than only the current configuration.
Telarvo Expert Views
Compliance is a delivery factor, not a legal afterthought: unregistered senders get filtered, high complaint rates damage reputation, and a consent record that cannot be shown is a risk. We tell teams to put the rules in the gateway configuration so every message passes the same gate.
— Messaging Compliance Consultant, Telarvo Store
Validation note: A2P rules differ by market and change over time; confirm registration, consent, and opt-out requirements per market.
Conclusion
A2P SMS compliance works when sender registration, provable consent, honest opt-outs, and the audit trail are built into the message flow and enforced by the gateway configuration.
Key Takeaways for Messaging Teams
Register the sender per market before sending. Prove consent from collection to audit. Honor opt-outs on every route and watch the rate. Log the message trail per recipient. Enforce the rules in the gateway configuration, not in the campaign copy.
Questions to Ask Before You Launch
Ask which registrations apply in each market, how consent is captured and stored, and how opt-outs sync across systems. Ask Telarvo Store for the gateway configuration that enforces your compliance stack.
FAQs
What is A2P SMS?
Application-to-person messaging: automated messages from a business system to a person's phone, which carriers regulate differently from person-to-person traffic because the scale can create outsized complaint volume.
Why is sender registration required?
It identifies the business and its use case, which lets carriers filter abuse and protect recipients, and it sets the content expectations that the scoring model enforces through delivery.
What counts as provable consent?
A traceable record of when consent was given, for what purpose, through which channel, and under which version of the terms.
How are opt-outs measured?
As a delivery metric: carriers track opt-out and complaint rates, which feed sender reputation, and the rates should be reviewed per campaign and per use case.
Where should compliance rules live?
In the gateway configuration, so every message passes the same registration, consent, and opt-out gates, and the configuration should be versioned for audits.