Business Profile, CNAM, STIR/SHAKEN, A2P: All you need to know

I. Business Profile

TIPS DURING REGISTRATION:

• Whatever is in your Articles of Organization of your business should match when you’re filing in your info in the required fields.
  
• Business phone number format is (559) XXX-XXXX.
  
• Business EIN format is 00-12345678.
  
• It is critical that your Business name and Address match exactly as it does for your EIN listing. Visit EIN Tax ID Number Lookup & Validation to look up your EIN number. Or find your company’s W2 form, or any local or federal tax filings that may be online.
  
• The submission of your Business Profile may take up to 72 hours for approval depending on your provider.
  
• Business website domain must match your business name. Certain providers may also ask for a business social media page to further validate this connection and ensure consistency across platforms.

Common customer errors for EIN/Tax ID

• Using an incorrect business name, such as the name of the messaging provider, DBA, or a trade name of the company instead of the official legally registered name. The Legal Name must not be abbreviated in any way and must appear exactly as it is filed with the IRS (US) or the equivalent tax authority in other countries.
  
  • Further recommendations: For US businesses, to ensure you’re providing accurate information, enter your business’s EIN into the HIPAA Space lookup website. If your business appears in the results, please fill in your business name exactly according to the business listing information.
    
• Entering a number in the EIN or Tax ID field that is not a valid EIN or home country company ID number.
  
• Providing a DUNS number instead of an EIN for a US-based company.
  
• Using SSN to register your brand. If you used your SSN to file your taxes, you are a sole proprietor and should await further guidance from Twilio on registering your brand.

II. CNAM

Caller ID Name (15 characters only)

Once you establish your Business Profile in the Trust Center or Trust Hub of your calling and messaging service provider, they typically handle the implementation of CNAM registration for you automatically.

In the United States public telephone network, Caller ID Name (CNAM) is a functionality that associates a personal or business name with the calling party, allowing the recipient to identify the incoming caller.

• CNAM registration is free
  
• A CNAM cannot start with a number, it should begin with a letter.
  
• A CNAM can only contain letters, numbers, periods, commas and spaces
  
• Registering for CNAM allows business owners to display their business name or a recognizable identifier when making outgoing calls. This improves the likelihood of their calls being answered, especially when the end-user doesn’t have their number saved.

III. STIR/SHAKEN

STIR (Secure Telephone Identity Revisited) / SHAKEN (Signature-based Handling of Asserted information using tokens) – is a suite of protocols and procedures intended to combat caller ID spoofing on public telephone networks.

In simple terms, STIR/SHAKEN provides a means for service providers to verify that the caller ID information transmitted with a call matches the actual caller’s number. If everything checks out, the call gets a “verified” status, helping to assure the recipient that the call is legitimate and not a spoofed call.

These technologies are increasingly important as regulators, carriers, and service providers seek to combat unwanted and fraudulent calls. As of June 2021, major US carriers are required by the Federal Communications Commission (FCC) to implement STIR/SHAKEN to help reduce robocalls and call spoofing.

There are two main benefits of STIR/SHAKEN

1. Firstly, it reduces the likelihood of your phone number being flagged as spam. Caller ID verification plays a role in the algorithms used by carriers to identify potential spam calls.
2. Secondly, it makes it significantly more difficult for scammers to manipulate your phone number for Caller ID purposes, resulting in fewer instances of phone number identity theft.

IV. A2P 10DLC

This is a new industry-standard created by telecom carriers to regulate traffic to end-users.

WHO IS IT FOR?

This is a new industry-standard created by telecom carriers to regulate traffic to end-users.

WHAT

 A2P 10DLC requires businesses to register their brands and campaigns and to obtain consent from recipients before sending them messages. This helps to ensure that messages are sent only to those who have opted in, and that businesses are accountable for their messaging practices. It provides carriers with basic information about who you are and the messages you send.

WHY

A2P 10DLC was created in response to the growing problem of spam and fraudulent SMS messages. By requiring businesses to register and obtain consent, A2P 10DLC helps to protect consumers from these unwanted messages, and to improve the overall trust in SMS as a communication channel.

Registering means your messages will see better deliverability, reduced spam/fraud and increased trust between end user and your business.

Two Important Requirements for A2P 10DLC System

1. Brand registration

Businesses must identify who they are to the carrier networks (Verizon, T-Mobile, AT&T, etc.) through a company “brand” registration. Every business must clearly identify who they are to the carrier networks. This is done through a company ‘brand’ registration. Think of it as the business’s digital ID card that it shows to the carrier network. It allows the networks to know which business is sending the messages.

a. Low Volume Standard Brand registration – sends less than 6000 messages/day (*OTF of $4)

b. Standard Brand registration – sends more than 6000 messages/day (*OTF of $44)

2. Campaign Registration

Businesses must register what type of messages they are sending, (i.e. marketing campaigns, customer service, account updates, etc). Campaign Registration lets the carriers know what type of messages your brand sends.

a. The A2P use case type: Specify the specific use case category that best describes your messaging.

b. The use case description: Provide a description of your messaging use case, outlining the purpose and context of your messages within your business operations. (Please see Table 1 below for reference)

c. The use case description: Provide a description of your messaging use case, outlining the purpose and context of your messages within your business operations. (Please see Table 1 below for reference)

• Sample messages should reflect actual messages to be sent under campaign and indicate templated fields with brackets
• Ensure consistency with your use case and Campaign description
• Include your opt-out message as at least one of the sample messages

d. Message Flow: Describe the process by which consumers opt-in to your campaign and give their consent to receive your messages. This entails explaining how users provide their consent and any mechanisms you have in place to manage opt-outs or unsubscribe requests.

• If there are multiple ways that users can consent to receive messages, you must include all of them.
• The call-to-action must be explicitly clear and inform end users of the Campaign. If multiple opt-in methods can be used, list them all.
• If a website is used for opting in, provide a link to the website. The website needs to have a privacy policy and terms of service. Privacy policies also need to include a statement of non-sharing for mobile numbers, message frequency, and “message and data rates may apply” disclosure. You need to provide a link to the policy.
• If you indicate that users can opt-in through text, provide the opt-in message and opt-in keywords in the fields below. Example: “End users opt-in by visiting www.example.com and adding their phone number. They then check a box agreeing to receive text messages from Example Brand. Additionally, end users can also opt-in by texting START to (111) 222-3333 to opt in. Term and Conditions at www.example.com/tc. Privacy Policy at www.example.com/privacy“

Opt-in keywords: If end users can text in a keyword to start receiving messages from this campaign, those keywords must be provided. If you do not support opt-in keywords, these do not need to be provided.

Opt-in message: If users can text in to start receiving messages, you must provide the automated message that end users will receive when they opt in to your campaign. Message must include brand, message frequency, opt-in confirmation, and information on how to opt-out.

*Prices may be subject to change without prior notice

Table 1: List of Standard campaign use cases

Tips during registration

• Should include Opt-out language in all outgoing messages (STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT)
  
• Should include information how the client opted in (website, ads, etc)
  
• Should have sender information (Company Name)
  
• Should NOT have shortened URL or Links
  
• Should NOT include spam keywords (Congratulations, Win, Click here)
  
• Should NOT be over 100 characters

Effective July 5, 2023, all 10DLC phone numbers used to send SMS and MMS messages to U.S. phone numbers must be fully registered to an approved campaign under your brand. Messages sent using unregistered phone numbers will be subject to a gradual increase of message blocking by Twilio, beginning on July 5, 2023, ultimately leading to a full block of all unregistered U.S.-bound messages sent after August 31, 2023.

How long will it take for the business profile to be approved?

• Review from carriers may take an average of 7 days

What happens if my business is found to be non-compliant?

• Messages sent from unregistered numbers or without consent may be blocked or blacklisted by carriers. Businesses that are found to be in non-compliance may be subject to fines or other penalties, depending on the carrier, starting from $1,000 up to $10,000.

End-User Content

How do end-users consent to receive messages?

• If there are multiple ways that users can consent to receive messages, you must include all of them. The call-to-action must be explicitly clear and inform end users of the Campaign. If multiple opt-in methods can be used, list them all.

If a website is used for opting in, provide a link to the website. The website needs to have a privacy policy and terms of service. Privacy policies also need to include a statement of non-sharing for mobile numbers, message frequency, and “message and data rates may apply” disclosure. You need to provide a link to the policy.

If you indicate that users can opt-in through text, provide the opt-in message and opt-in keywords in the fields below.Example: “End users opt-in by visiting www.example.com and adding their phone number. They then check a box agreeing to receive text messages from Example Brand. Additionally, end users can also opt-in by texting START to (111) 222-3333 to opt in. Term and Conditions at www.example.com/tc. Privacy Policy at www.example.com/privacy“

V. FAQs

Is an EIN number mandatory?

• For A2P standard brand registration for US entities, EIN is required and mandatory.

I’m using SMS for a small business or a personal project. What should I do?

• If you’re an individual or small business without a Tax ID (EIN), you can register for a Sole Proprietor Brands.
  
  If you have a Tax ID (EIN) and low traffic requirement (less than 6,000 messages per day), Low Volume Standard Brands can be used for mixed messaging campaigns with multiple use cases, multiple numbers per campaign, and higher throughput than Sole Prop.
  
  No Tax ID (EIN): In order to qualify for Sole Proprietor registration, you must not have an EIN (Employer Identification Number). Any business that has a Tax ID (EIN) is not eligible, and should instead register for a Low Volume Standard Brand.

Why is Verification Important?

• Combatting Spam: Verification measures, such as STIR/SHAKEN (for voice calls) and A2P 10DLC (for text messaging), are a response to federal pressure on carriers to tackle the issue of spam phone calls and texts. By implementing verification, carriers can enhance their ability to identify and filter out spam, protecting consumers from unwanted and potentially harmful communications.
  
  
• Enhancing Deliverability: In the United States, the existing texting/SMS infrastructure was not initially designed to handle the increasing volume of business texting. To address this challenge, a separate channel, such as A2P 10DLC, has been created. By registering and verifying businesses, carriers can better manage and optimize the delivery of business text messages, improving their chances of reaching the intended recipients.

Can I change the CNAM display after it has been set up?

• Yes, most service providers allow you to change the CNAM display. However, the process and turnaround time can vary, so it’s best to check with your provider.

Does A2P 10DLC work internationally

• As of now, A2P 10DLC is primarily a solution for A2P messaging in the United States. Its compatibility with international carriers may vary, so it’s recommended to check with your service provider for specific details.

Is it required to register for all these?

• Yes, only account Owners and Admins have access to submit A2P 10DLC registrations. Users without proper access (Developers, Billing, Support users) will see a 502 Bad Gateway or 403 access error.
  
  Notice: Shutdown of Unregistered 10DLC Messaging
  Effective July 5, 2023, all 10DLC phone numbers used to send SMS and MMS messages to U.S. phone numbers must be fully registered to an approved campaign under your brand. Messages sent using unregistered phone numbers will be subject to a gradual increase of message blocking by Twilio, beginning on July 5, 2023, ultimately leading to a full block of all unregistered U.S.-bound messages sent after August 31, 2023.

How long does it take to get registered?

• Carrier review may take up to 7 days

Is WhatsApp messaging affected by A2P 10DLC?

• No, WhatsApp messaging is unaffected by any of these changes. WhatsApp messages are transmitted over the Internet, rather than through carrier networks like SMS and MMS.

Do I get penalty for non-compliance?

• Yes, depending on the carrier, fines may start from $1,000 up to $10,000.
  
  Content Violation –
  Content violating carrier policies including spam, phishing, and SHAFT violations (Sex, Hate, Alcohol, Firearms, Tobacco).
  
  Fee: $10,000 per violation
  
  Messaging Program Evasion
  Using filtering evasion techniques, such as snowshoeing and recycling numbers (releasing/purchasing new numbers), to dilute number reputation.
  For reference, Snowshoeing is defined as spreading similar or identical messages across many phone numbers with the intent or effect of evading unwanted messaging detection and prevention mechanisms.
  
  Fee: $1,000 Fine

I use multiple numbers in my Messaging Service for my use case. Would that be considered snowshoeing?

• It is not considered snowshoeing unless you are intentionally spreading the same or similar message across more numbers than you need to evade detection/filtering, or to dilute a numbers reputation, ie. to keep it from being marked a ‘spam’ by the carriers.
  
  An example of not snowshoeing: You could use Area Code Geomatch (automatically or you can manually select a phone number from your service that matches the country of the To phone number) with multiple numbers to create localized experiences.

Standard Industry for Business Communications FLOWCHART

This flowchart is designed to guide you through the process of compliance, offering a clear and direct path for understanding how it operates.

For any questions or concerns, feel free to reach out at [email protected]. We’re always happy to help!