What are 10DLC trust scores?

How to register for an A2P 10DLC trust (or RISQ) score as P2P SMS long code messaging for businesses is phased out

OpenMarket – October 7, 2020

Does your business send mobile messages to US customers? Then it’s time to get ready for A2P 10DLC.

One of your first steps should be to look into whether you need to obtain a trust score (also known as a RISQ score or vetting score) for 10DLC (10-digit-long-code) use cases.

Not all businesses will need them. But many will. This post sets out why a trust score is so important – and what you need to do next.

(This blog post was originally published in 2019 . It was updated on October 7, 2020)

10 DLC summary

For years, the big US carriers have wanted to stop businesses communicating with customers via long codes designed for person-to-person (P2P) use. They now instead want this traffic to be transported via dedicated short codes or 10DLC numbers  sanctioned for application-to-person (A2P) messaging.

In April, 2020, Verizon became the first US carrier to launch its 10DLC service – announcing it will charge businesses $.0025 per SMS message and $.0052 per MMS.

AT&T and T-Mobile are now soft-launched, and Sprint is set to go live by the end of October or early November. We’re in conversation with the tier-two and three carriers about their launch plans – more news to come on that in the future.

So what does soft launch mean? In the case of T-Mobile it means they will not be charging messaging fees until March 1st, 2021. This grace period with no passthrough charges is designed to incentivize the transition from shared short code and grey-route long codes sooner rather than later.

Similarly, AT&T will not be charging messaging fees during their soft launch – but the date they will begin to charge has not yet been confirmed.

We’ve created a quick tips sheet for businesses getting ready for 10DLC – here. And one for SMS providers, too – here.

How to vet your SMS long code use cases

To protect their 10DLC routes, Verizon, AT&T, T-Mobile and Sprint want to make sure the traffic being sent on them won’t result in bad messaging experiences for their customers.

In other words, they want to keep spam and smishing off their network. Some carriers will require brands to obtain trust or RISQ (Routine Information and Services Quality) scores from independent verification agencies.

Each carrier has its own policies and processes. Here’s what we know so far:


Verizon doesn’t require businesses to obtain a trust score. Instead it is using filters to block any traffic it deems to be a spam risk. It has not yet set out plans to limit throughput for 10DLC use cases, but you can expect healthy TPS (transaction per second) rates of around 30. They will allocate throughput in much the same way they do for short codes today.


As part of the 10DLC campaign registration process, each campaign is given a “message class” by AT&T based on the information you submit to The Campaign Registry. Depending on the use case and how trusted your brand is, throughput varies from 0.5 TPS to 200 TPS. That’s quite a big variation, but we expect most brands will fall somewhere in between.

If you need more throughput than the message class allows for, you might be given the opportunity to go through a vetting process with a verified independent agency. A good trust score from them might lead to higher throughput.


The throughput you’re allocated by AT&T works on the campaign level, but with T-Mobile (and Sprint too) it’s allocated at the brand level – and it works as a daily limit. So if you have more than one campaign running, your daily quota is split across those campaigns. There are two options when it comes to receiving your daily messaging quota.

The first method is through default vetting in two tiers. The high-performance is for public companies and requires a vetting score of 75 or higher. This will earn you a daily quota of 200,000 messages. The low-performance tier (with a vetting score of 0–24) will earn a daily quota of 2,000 messages.

There’s a third route. Any brand that doesn’t fit one of the above tiers, or that wants to improve their vetting score, will need to be third-party vetted. There are four buckets in this category for vetting scores:

0–24 vetting score receives a 2,000 daily messaging quota
25–49 vetting score receives a 10,000 daily messaging quota
50–74 vetting score receives a 40,000 daily messaging quota
75–100 vetting score receives a 200,000 daily messaging quota

More on 10DLC throughput

For guidance, the maximum throughput on P2P long codes is low for business use cases – one transaction per second (TPS). Around 30 TPS is a good throughput to expect for 10DLC. This equates to well over a million a day. But throughput for short codes can be much higher – hundreds a second (even up to 1,000).

T-Mobile has set out the tiers and messaging limits shared above. And AT&T has its messaging classes.

In other cases, and as a general rule, our feeling is that if a brand has a good reputation, and the use case is deemed to be a low spam risk, then they will receive a throughput that is suitable for almost every type of use case. And, as we mentioned, if you’re not happy with the throughput you’re given, you can undergo further third-party vetting to try to increase it.

Which use cases are deemed high risk?

An example of a use case likely to receive a high trust score (i.e. low risk) would be SMS-based two-factor authentication (2FA). This is because consumers have asked for this traffic, they respond to it, and it’s safe and necessary.

Promotional marketing campaigns by third-party affiliates would be on the other end of the scale. These are considered more likely to pose a spam risk. However, a marketing campaign run by a well-known brand with a good reputation is almost certainly likely to be considered safe traffic and should therefore receive a good score.

AT&T has released an illuminating code of conduct that sets out types of traffic it considers to be undesirable. It includes:

– Loan advertisements with the exception of messages from direct lenders for secured loans

– Credit repair

– Debt relief

– Work from home, ‘secret shopper,’ and similar advertising campaigns

– Lead generation campaigns that indicate the sharing of collected information with third parties

Where can you get a trust (or RISQ)  score from?

To obtain your score, you will soon be able to submit information via self-service tools on the indigo multi-channel messaging platform, including data that makes up your campaign brief, and then work with the independent provider to get the trust score.

The indigo platform makes it easy for you to manage many of the tasks you need to complete on your way to obtaining a trust score – and lots of other 10DLC-related processes. You can:

– Search for and purchase 10DLCs

– Navigate the vetting process

– Register brand information

– Register campaign information

– File a campaign brief with the US Carriers that require it

– Manage opt-in/opt-out information

– View the status of filed US campaigns and see which 10DLCs are assigned to them

– View a summary of your owned 10DLCs (and all other originators) and their status

To talk about your options get in touch. We’d be happy to guide you along your 10DLC path.


See all blogs

Related Content