What are 10DLC trust scores?

How to register for an A2P 10DLC trust (or RISQ) score as P2P SMS long code messaging for businesses is phased out

OpenMarket – October 7, 2020

Does your business send mobile messages to US customers? Then it’s time to get ready for A2P 10DLC.

One of your first steps should be to look into whether you need to obtain a trust score (also known as a RISQ score or vetting score) for 10DLC (10-digit-long-code) use cases.

Not all businesses will need them. But many will. This post sets out why a trust score is so important – and what you need to do next.

(This blog post was originally published in 2019 . It was updated on July 06, 2021)

10DLC summary

For years, the big US carriers have wanted to stop businesses communicating with customers via long codes designed for person-to-person (P2P) use. They now instead want this traffic to be transported via dedicated short codes or 10DLC numbers sanctioned for application-to-person (A2P) messaging.

Every major US carrier is now live with their 10DLC services. OpenMarket is ready too. We have agreements in place with all the major carriers. And our self-service 10DLC tool called Numbers lets you do everything you need to buy, register and send and receive SMS and MMS messages via 10DLC.

You can check Numbers out here. We’ve also created a quick tips sheet for businesses getting ready for 10DLC – here. And one for SMS providers, too – here.

How to vet your SMS long code use cases

To protect their 10DLC routes, Verizon, AT&T, T-Mobile and Sprint want to make sure the traffic being sent on them won’t result in bad messaging experiences for their customers.

In other words, they want to keep spam and smishing off their network. Some carriers will require brands to obtain trust or RISQ (Routine Information and Services Quality) scores from independent verification agencies. This is just one of the 10DLC set-up processes that is automated by the Numbers 10DLC tool.

Each carrier has its own policies and processes. Here’s what we know so far:


Verizon doesn’t require businesses to obtain a trust score. Instead it is using filters to block any traffic it deems to be a spam risk. It has not yet set out plans to limit throughput for 10DLC use cases, but you can expect healthy TPS (transaction per second) rates of around 30. They will allocate throughput in much the same way they do for short codes today.


As part of the 10DLC campaign registration process, each campaign is given a “message class” by AT&T based on the information you submit to The Campaign Registry. Depending on the use case and how trusted your brand is, throughput varies, starting from around 1TPS.

If you need more throughput than the message class allows for, you might be given the opportunity to go through a vetting process with a verified independent agency. A good trust score from them might lead to higher throughput.


The throughput you’re allocated by AT&T works on the campaign level, but with T-Mobile (and Sprint too) it’s allocated at the brand level – and it works as a daily limit. So if you have more than one campaign running, your daily quota is split across those campaigns. There are two options when it comes to receiving your daily messaging quota.

The first is simple to figure out. Based on the brand registration score that’s assigned to you when you register with the Campaign Registry, T-Mobile will give you either a high performance score or a low performance score. Here’s the easy rule: If your company is on the Russell 3000 Index in the US, you’ll get the high performance score (75) and a daily maximum messaging volume of 200,000.

If you’re not a Russell 3000 company, you’ll automatically be put in the low performance bucket (0-24), with a 2,000 daily maximum. Remember the Russell 3000 Index is for US companies only, so any non-US brand will automatically be placed in the lower bucket.
There’s another route to get your score. Any brand that wants to improve their vetting score can be third-party vetted. If the brand you’re registering is a non-US entity on T-Mobile, or you’re not a Russell 3000 company, you’ll want to get third-party vetted.

Here’s a rundown of the four buckets for third-party vetting scores:

0–24 vetting score receives a 2,000 daily messaging quota
25–49 vetting score receives a 10,000 daily messaging quota
50–74 vetting score receives a 40,000 daily messaging quota
75–100 vetting score receives a 200,000 daily messaging quota

Request additional vetting

We’ve recently updated our Numbers application in the OpenMarket Customer Portal, to make it easier to request additional vetting.

Starting July 7, 2021 you can view the “message class” that’s assigned to you after you submit your brand registration and campaign.

If you’re not satisfied with the throughput you’ve been given, you can use the new feature to request additional vetting. You can request either Standard or Enhanced vetting. Standard is very fast and costs $40. Enhanced takes a few days and costs $95. You can request Standard first and then upgrade to Enhanced, which will cost $40 and then an additional $55. But please note that requesting either Standard or Enhanced does not guarantee that you’ll receive higher throughput.

For all the details on the new features, see the 10DLC section of our docs site.

More on 10DLC throughput

For guidance, the maximum throughput on P2P long codes is low for business use cases – one transaction per second (TPS). Around 30 TPS and more is a good throughput to expect for 10DLC. This equates to well over a million a day. But throughput for short codes can be much higher – hundreds a second (even up to 1,000).

T-Mobile has set out the tiers and messaging limits shared above. And AT&T has its messaging classes.

In other cases, and as a general rule, our feeling is that if a brand has a good reputation, and the use case is deemed to be a low spam risk, then they will receive a throughput that is suitable for most use cases. And, as we mentioned, if you’re not happy with the throughput you’re given, you can undergo further third-party vetting to try to increase it.

Which use cases are deemed high risk?

An example of a use case likely to receive a high trust score (i.e. low risk) would be SMS-based two-factor authentication (2FA). This is because consumers have asked for this traffic, they respond to it, and it’s safe and necessary.

Promotional marketing campaigns by third-party affiliates would be on the other end of the scale. These are considered more likely to pose a spam risk. However, a marketing campaign run by a well-known brand with a good reputation is almost certainly likely to be considered safe traffic and should therefore receive a good score.

AT&T has released an illuminating code of conduct that sets out types of traffic it considers to be undesirable. It includes:

  • Loan advertisements with the exception of messages from direct lenders for secured loans
  • Credit repair
  • Debt relief
  • Work from home, ‘secret shopper,’ and similar advertising campaigns
  • Lead generation campaigns that indicate the sharing of collected information with third parties

Where can you get a trust (or RISQ) score from?

To obtain your score, you are able to submit information via our self-service 10DLC tool (including data that makes up your campaign brief) and then work with the independent provider to get the trust score.

The 10DLC tool makes it easy for you to manage as many of the tasks you need to complete on your way to obtaining a trust score – and lots of other 10DLC-related processes. You can:

  • Search for and purchase multiple 10DLC numbers
  • Migrate your existing long codes
  • Register brand, campaign and use-case information
  • File a campaign brief with the US carriers that ask for it
  • Request Standard or Enhanced vetting if needed
  • View status of campaigns and which 10DLCs are assigned to them
  • View a summary of your owned 10DLCs (and all other originators)

Look out for errors and issues

Sometimes brands will experience failures or issues with their vetting scores. Often this is due to errors or mismatches in the data submitted for brand registration. For example, the business’s legal name, EIN and address don’t match with the official records. Make sure you check you’ve got these 100% accurate!

To talk about your options, get in touch. We’d be happy to guide you along your 10DLC path.


See all blogs

Related Content