Sinch Community

Purpose   Sinch is committed to maintaining a trusted messaging ecosystem that protects consumers, supports legitimate messaging programs, and meets the compliance expectations established by Mobile Network Operators (MNOs), industry associations, and applicable regulatory requirements.   This document defines the Sinch process for identifying, managing, communicating, remediating, and closing Messaging Compliance Incidents.   Sinch follows established industry compliance frameworks, including severity definitions, remediation timelines, Service Level Agreements (SLAs), and cure periods established by: Cellular Telecommunications Industry Association (CTIA) Mobile Network Operators (MNOs) Canadian Telecommunications Association (CTA) Canadian wireless carriers Applicable messaging ecosystem standards This framework applies to Sinch messaging products operating in the United States and Canada, including: Short Code Messaging Toll-Free Messaging A2P Long Code Messaging A2P 10DLC Messaging (United States) RCS Messaging Other sanctioned A2P messaging channels supported by Sinch Compliance Incident Definition   A Compliance Incident is any event where messaging activity, registration information, consent practices, traffic patterns, customer behavior, or messaging content may violate: Carrier messaging requirements CTIA or CTA industry standards Sinch Acceptable Use Policy Customer contractual requirements Applicable laws and regulations Compliance incidents may be identified through: Carrier monitoring Industry audits Consumer complaint reporting Spam reporting channels Sinch Compliance Operations KYT (Know Your Traffic) monitoring Content and campaign review Registration and consent validation Sinch-initiated incidents carry the same operational importance as carrier or industry-initiated compliance actions. United States Compliance Incident Severity Framework Sinch utilizes the CTIA and MNO-defined severity framework as the baseline for US messaging compliance incidents.   The CTIA Short Code Monitoring Handbook severity model provides the foundation for severity classification, response expectations, remediation timelines, and cure periods.   Severity Definition Examples Required Response Severity 0 Critical compliance incident involving immediate consumer harm, fraud risk, abuse, or significant ecosystem impact Phishing, fraud, malicious messaging, unauthorized traffic, significant consumer harm Immediate action, possible suspension, investigation, RCA, carrier remediation Severity 1 High priority compliance issue requiring expedited correction Significant policy violations, consent concerns, elevated complaint activity, campaign abuse Immediate corrective action within defined cure period Severity 2 Compliance issue requiring remediation but limited immediate impact Registration issues, content concerns, campaign health issues Corrective action and monitoring Severity 3 Lower risk compliance observation Minor issues, informational findings, best practice gaps Notification and remediation guidance Canada Compliance Incident Severity Framework   Sinch Canada follows a similar compliance incident methodology aligned with Canadian carrier expectations, CTA guidance, and Canadian messaging ecosystem practices. Canadian compliance actions utilize comparable severity concepts and remediation requirements.   For Canadian Short Code programs, the enforcement approach follows the notification and remediation framework outlined by Canadian industry guidance. Canadian severity classifications are maintained separately:   Severity Definition Examples Required Response Severity 1 Critical compliance incident requiring immediate intervention Fraud, phishing, malicious messaging, significant unauthorized traffic, consumer harm Immediate containment, investigation, corrective action, possible suspension Severity 2 High priority compliance issue requiring timely remediation Consent concerns, campaign violations, elevated complaints, unacceptable traffic patterns Corrective action within required remediation period Severity 3 Compliance concern requiring correction Registration issues, content concerns, campaign health degradation Remediation plan and monitoring Severity 4 Informational or lower-risk issue Minor findings, administrative gaps, recommendations Notification and correction US / Canada Severity Alignment Although severity numbering differs between regions, Sinch aligns response actions based on risk and required remediation urgency. Business Impact United States  Canada Critical / Immediate Consumer Risk Severity 0 Severity 1 High Risk Compliance Issue Severity 1 Severity 2 Campaign Health Issue Severity 2 Severity 3 Informational / Best Practice Severity 3 Severity 4 Incident Intake and Validation Upon identification of a potential Compliance Incident, Sinch Compliance Operations will: Validate the reported activity Identify impacted: Customer Brand Campaign Messaging product Sending resources Assign severity Open a compliance ticket Begin required remediation actions The compliance ticket is the system of record for: Incident details Evidence Communications Customer actions Remediation deadlines Closure approval Severity 0 / Critical Incident Process (United States) & Severity 1 (Canada) These incidents require immediate action. Examples include: Fraudulent messaging Phishing Malicious content Account compromise Significant unauthorized messaging Consumer harm   Sinch Actions Upon receiving a Severity 0 notification from an MNO, CTIA or a Severity 1 from Canadian MNO or CTA: Sinch will: Notify the affected Partner, CSP, or Brand Identify impacted messaging resources Suspend or restrict traffic when required Begin investigation Collect evidence Coordinate remediation A Root Cause Analysis (RCA) may be required.   Brand / Partner Responsibilities The Brand or Partner must: Immediately stop offending activity Investigate the cause Provide requested evidence Submit RCA documentation within the required timeframe Implement corrective controls RCA documentation should include: Summary of incident Root cause Timeline Impact assessment Corrective actions Preventative measures Reactivation may require carrier approval. Not all incidents will qualify for unsuspension. Sinch-Initiated Critical Compliance Incidents - Severity 0 Sinch may identify critical incidents before escalation from a carrier. Examples: Fraud detection through KYT monitoring Suspicious traffic patterns Customer account compromise Abuse indicators Significant consent failures Sinch may: Suspend traffic Restrict messaging resources Require immediate remediation Require RCA Deprovision resources when necessary Proactive Compliance Alerts Sinch may issue proactive compliance alerts when campaign health indicators require attention. Examples: Increasing opt-out rates Elevated spam complaints 7726 / 7727 complaint signals Content concerns Consent concerns Registration inconsistencies Proactive Alerts require customer action but generally do not require RCA unless requested. Opt-In Consent Audits Consent-related concerns may trigger an Opt-In Consent Audit. Audits may be initiated by: CTIA MNOs CTA Canadian carriers Sinch Compliance Operations Reviews may include: Opt-in records Messaging logs Consent collection methods Consumer interaction history Opt-out handling Required remediation may include: Campaign updates Consent process changes Traffic restrictions Additional verification Customer Communication and Ticket Management All compliance incidents are managed through Sinch ticketing workflows.  See Process Documentation below. Each ticket will contain: Severity level Incident description Impacted resources Required action Cure date or remediation deadline Supporting information Closure criteria Customers and partners are expected to provide timely responses and complete remediation actions. Incident Closure An incident may be closed when: Remediation is completed Required documentation is provided Compliance risk is addressed Traffic behavior is verified Monitoring confirms improvement Closure does not remove ongoing compliance obligations. Repeat or unresolved incidents may result in: Increased monitoring Additional restrictions Suspension Resource deprovisioning Governance Sinch Compliance Operations owns administration of this process. Sinch reserves the right to take action necessary to protect: Consumers Carrier networks Messaging ecosystems Customers operating compliant messaging programs This process will evolve as CTIA, CTA, MNO, and regulatory expectations change. ... View more

A new set of security best practices has been released by the CTIA: Messaging Security Best Practices. The CTIA represents the U.S. wireless communications industry and companies throughout the mobile ecosystem in the United States.  These guidelines are a response to the growing popularity of messaging services and the corresponding increase in attempts by malicious actors to exploit these platforms. The best practices are intended to help all stakeholders in the messaging ecosystem, including businesses that use messaging to communicate with their customers, to take steps to protect consumers from unwanted and malicious messages.     Key Takeaways for Your Business    The CTIA's Messaging Security Best Practices emphasizes a multi-layered approach to security, with a strong focus on the following three areas:  Deploy Robust Multi-Factor Authentication (MFA): A primary defense against unauthorized access is to implement strong authentication protocols. The CTIA recommends adding an extra layer of security by requiring multiple authentication factors.   This can include a combination of passwords, security tokens, or biometric verification. By implementing robust MFA, you can significantly reduce the risk of account takeovers and unauthorized access to your messaging platform.   Secure Your APIs: Application Programming Interfaces (APIs) are a common target for attackers. The CTIA recommends that Communications Platform as a Service (CPaaS) providers and message senders monitor the use of API credentials for evidence of compromise. Where there is evidence of a compromise, immediate action should be taken to remedy the problem. Businesses should also ensure that they have written agreements with any third parties that are given access to API credentials, and these agreements should describe the appropriate use, protection, and sharing of those credentials.  Actively Monitor Accounts for Intrusion: The CTIA recommends that all stakeholders in the messaging ecosystem should monitor their respective systems and take appropriate action to address any activity that suggests the system has been compromised.   This includes monitoring for "Unwanted Messages" that may be an indicator of a security breach. Other best practices include conducting regular security audits to identify and address potential vulnerabilities.     What This Means for You & Actions to Take    The CTIA's new best practices are a clear signal that the wireless industry is taking the threat of messaging fraud and abuse seriously. While these best practices are voluntary, they are widely adopted by the industry, and non-compliance can lead to a variety of negative consequences, including the blocking of your messages by mobile carriers.    We recommend that you take the following steps to ensure that your business is in compliance with these new best practices:    Action  Description  Review Your Authentication Practices  Ensure that you have implemented robust MFA for all user accounts, especially those with access to your messaging platform.   Secure Your APIs  Review your API security practices and ensure that you are in compliance with the CTIA's recommendations. This includes monitoring for compromised credentials and having written agreements with any third parties who have access to your APIs.  Enhance Your Monitoring Capabilities  Implement a system for actively monitoring your messaging platform for signs of intrusion and take immediate action to address any suspicious activity.  Educate Your Team  Ensure that your team is aware of the latest messaging security threats and best practices.  By taking these steps, you can help to protect your business and your customers from the growing threat of messaging fraud and abuse.   ... View more

Note: The content of this article is based on reported information and beta testing results. The iOS 26 feature set will still evolve with subsequent releases (e.g. iOS 26.1, iOS 26.2, etc).   Apple’s iOS 26 release introduces important changes to how text messages are displayed on iOS devices. This will will likely impact brands that rely on SMS, MMS, RCS and Voice calling to reach consumers.   New features include message screening for "Unknown Senders", call screening to filter spam calls, and spam reporting for voicemail. These new tools provide more robust spam protection, though users can manage settings to customize their filtering preferences.   This article details the filtering functionalities that are included with iOS 26, provides guidelines for message visibility, and discusses additional features that are reported to be included with the iOS update.     The key change: screening Unknown Senders   Apple has updated their Unknown Senders screening functionality (previously known as Filter Unknown Senders) in iOS 26. When activated by users, this feature becomes a configurable setting in the Messages app. Messages from unrecognized senders (or numbers) are labeled as Unknown Senders.   In the earliest release of iOS 26, these messages were placed in a newly created folder labeled Unknown Senders. No corresponding notifications or previews are pushed for these types of messages. This means that even opted-in subscribers might miss a message unless your brand is recognized as a trusted sender or an action was completed to establish your brand as a trusted sender. To change these settings, iOS users must go to Settings > Messages and scroll down to the Message Filtering section. The table below describes the locations in which messages may arrive in iOS 26: Location Description Main inbox Trusted messages appear here normally. Unknown Senders This folder is for messages from senders/numbers not in your contacts. It is useful for filtering out promotional messages. Note: This inbox appears if the corresponding toggle is activated (which is the default behavior). When activated, this functionality move messages from unknown senders to the Unknown Senders list while suppressing the corresponding notifications. Note: when Screen Unknown Senders is Enabled further options are possible to Allow Notifications for messages that are: Time Sensitive - Including alerts, verification codes and urgent requests.  *Enabled by Default Personal - Identified and not sent by businesses or organizations Transactions - Including order updates, receipts and confirmations Promotions - Including general offers and updates sent to multiple recipients Spam This folder is for messages detected as outright scams or junk. Apple's on-device intelligence identifies these threats and automatically moves them to this folder. In iOS 26 this setting is on by default.       Priority Notifications To prevent recipients from missing important messages, some messages may temporarily bypass iOS filtering. The Messages application will identify time-sensitive messages and surface them for users in the main conversation list for one hour (even if they are from unknown senders/numbers). These exceptions may include one-time passcodes, verification codes, order confirmations, and appointment alerts.  Messages that highlight urgency may be identified as Priority Notifications. This is a significant shift from prior iOS versions. Note: SMS visibility depends heavily on sender reputation, user interaction, and, ultimately, the Message Filtering settings for the device. This may vary in some situations and depends on several factors (for example, whether the user's device is new, what specific version of iOS 26 the device is running, etc.).     How Sinch helps keep your messages visible   Sinch is actively testing iOS 26 to ensure brands can adapt smoothly. We recommend the following strategies to maintain visibility:   Encourage subscriber-initiated opt-ins - When users send the first opt-in message, Apple automatically classifies your brand as a Known Sender, ensuring your messages appear in the main inbox with corresponding notifications. Use QR codes - When applicable user initiated messages will be prioritized.  Use Contact Cards - Prompt subscribers to save your brand as a contact during onboarding. Once saved, your messages are permanently treated as trusted. Engage early and often - Apple’s rules promote sender recognition after three or more interactions. Using welcome flows, conversational messaging, and follow-up offers helps secure Known Sender status. Rely on Sinch expertise - As an industry leader and CTIA board member, Sinch was one of the first to communicate these changes to our partners in the ecosystem. Sinch works closely with carriers and ecosystem partners to combat spam and safeguard trusted messaging—ensuring your communications continue to reach subscribers reliably. What to do now   Sinch recommends you take the following actions given the changes: Review your current opt-in flows to ensure subscriber-initiated engagement where possible. Add Contact Cards to your welcome journeys where possible. Strengthen early subscriber engagement to build Known Sender recognition. Additional screening functionalities   In addition to message screening, iOS 26 reportedly updates call screening and spam reporting functionalities.   Calling   Similar to message filtering, there are settings that manage filtering for calls. When enabled, the Screen Unknown Callers feature automatically screens unknown callers before notifying the user. Once the caller shares their name and the reason for their call, the device rings and displays a real-time transcript. The user can decide if they want to answer, ignore, or block.     Report Spam for voicemails   iOS 26 adds a new Report Spam button for voicemails from unknown numbers. This allows you to report unwanted or junk voicemails directly to Apple from the Phone app.    Note that Apple’s filtering logic may still evolve. However, by incorporating Sinch’s proven best practices, you can help ensure that your messages will remain front and center in iOS 26.   Other new features in iOS 26   Below are additional new features that are reported to be included with the release of iOS 26:   Liquid Glass design iOS 26 introduces a fresh, unified design language—Liquid Glass, inspired by visionOS—with rounded, translucent elements that react to motion and lighting, bringing a fluid and layered visual experience system-wide. Home & lock screen enhancements Lock Screen Widgets can now be placed at the bottom of the screen. The time display dynamically adjusts in size based on the background or notification stack. A new Clear theme lets you apply translucent, glass-like app icons. You can apply a 3D depth effect to wallpapers—so subjects appear to pop off the screen as you move the device. Battery & power management Adaptive Power has been added. This is a smart mode that adjusts brightness and limits performance during heavy usage without disabling background tasks like traditional Low Power Mode. Estimated time to full charge now appears on both the Lock Screen and in Settings. Battery usage is now color-coded: orange for high usage, blue for normal or low usage. Each app shows how much it contributed to background activity, notifications, or battery drain. Wireless charging speeds on iPhone 16 models increase from 15 W to up to 25 W via third-party Qi2 chargers, enabling ~50% battery in ~30 minutes. Accessibility upgrades Reader Mode offers improved text readability for users with low vision or reading impairments. Braille Access lets your iPhone serve as a full-featured braille device—including input, navigation, transcript reading, and Nemeth code support—no external hardware needed. Head Tracking allows cursor control via facial expressions (e.g., smile, eyebrow raise, blink). A built-in audio equalizer introduces Comfort and Focus modes to automatically adjust frequencies for better listening. Apple Intelligence enhancements Live Translation now works for voice and text conversations with on-device models, expanding language support. Genmoji enables you to combine existing emojis into new ones without typing prompts. Visual Intelligence integrates with ChatGPT and lets you tap on content—like screenshots—to ask questions or search using AI. Apple opens this up to developers. Integrating Apple Intelligence into a Swift app can now be done in as few as three lines of code. A full-screen preview provided after taking screenshots provides interactive AI-powered insights on selected areas  Voice dictation improvements You can now spell out words when dictating—useful for names, complex terms, or unusual spellings. Always-On Display (AOD) A Wallpaper Blur option gives you the ability to blur the background image on the Always-On Display. Wi-Fi advancements Added support for Wi-Fi Aware, allowing devices to discover and connect directly with nearby devices without an access point. Captive Assist simplifies public Wi-Fi logins by automatically sharing form credentials across your Apple devices. Keyboard feedback Pressing the emoji key now displays its description right below in the search box—helpful for accessibility and clarity. Screenshots & Screen Recording Full-screen previews no longer shrink into an icon—they stay full-screen after capture. iOS 26 adds support for HDR screenshots and screen recordings.   eSIM Transfer with Android You can now transfer an eSIM directly between an iPhone and an Android device—no carrier QR code needed. ... View more

FCC Revocation Rule 64.1200 (a)(12) -> Effective April 11 Some important news regarding the effective date for this policy.  The FCC has delayed the “reasonable methods” provision of the new revocation of consent regulations until April 11, 2026, in its Order released just four days before the revocation rules were set to take effect on April 11, 2025.   In response to waiver requests from several banking and financial institutions, the FCC acknowledged that businesses need additional time to implement revocation procedures that are both cost-effective and compliant with the new rules. Implementation is particularly challenging for organizations that use multiple communication systems or must coordinate revocations across various consumer-facing business units.   Despite this limited delay, the FCC emphasized that compliance with other provisions of the new revocation rules remains mandatory starting April 11, 2025. These include amendments to sections 47 C.F.R. § 64.1200(a)(9)(i)(F) and (d)(3).  The FCC has delayed implementation of this rule only as it relates to this broad application of opt-outs across unrelated communications. The rest of the new TCPA rule — including requirements to honor common opt-out keywords and process revocations within 10 business days — is still on track to go into effect on April 11, 2025.   Although the implementation deadline has been extended, it is unlikely the rules will be overturned. There is no active legal challenge, and the rules received unanimous FCC approval, consistent with the agency’s broader effort to empower consumers in choosing who may contact them.   Businesses should continue preparing for compliance by:   Updating processes to coordinate opt-outs across communication channels (e.g., calls vs. texts). Training staff on recognizing valid revocation requests. Setting clear parameters to identify when a call or text should be treated as a revocation. Establishing review mechanisms to ensure opt-outs are properly tracked and honored.   This supplementary Order allows consumers to revoke their consent to receive unwanted communications, such as telemarketing calls or SMS messages, at any time and through any reasonable means. This rule is also wrapped up under TCPA and is aimed at protecting consumers from unwanted or abusive communications.     Key Aspects of the FCC Revocation Rule:   Right to Revoke Consent: Consumers can withdraw their consent to receive calls or texts at any time. This revocation can apply to robocalls, telemarketing calls, or promotional SMS messages. Reasonable Means for Revocation: The rule allows consumers to revoke consent in any reasonable manner, which could include verbal requests, written requests, or replying with keywords (such as "STOP" to an SMS). There is no specific requirement for how consent must be revoked; it must simply be clear that the consumer no longer wishes to receive communications. The Order provides a list of keywords, with some new inclusions, revoke and opt out, in addition to the already mandatory list of stop, end, quit, unsubscribe and cancel that, if used, conclusively revoke consent and cannot be challenged. The list is not intended to be exhaustive. If a consumer uses a word or phrase not included in the Order, a rebuttable presumption is created “that the consumer has revoked consent, absent evidence to the contrary.” While this rebuttable presumption appears to be broad, the burden of proof still largely rests on the consumer. In the event of a dispute, consumers must point to the precise message or method used to convey their revocation of consent, and a court may look at the totality of circumstances surrounding the situation to determine “whether the consumer had a reasonable expectation that they could effectively communicate their request for revocation to the caller in that circumstance.” The Order clarifies that revocation of consent from a particular type of robocall or robotext operates as revocation of consent to all robocalls and robotexts from the caller or sender to that phone number. Once consent is revoked, a caller or sender cannot make robocalls or send robotexts to the recipient absent an applicable exemption. If an exemption applies, a caller or sender must comply with the conditions on the number and frequency of their communications, and the recipient can choose to opt out of receiving the exempted communications. The Order states that revocation of consent to receiving robocalls and robotexts operates separately from the ability of callers to make informational calls without consent. *It is recommended that you apply logic and consideration if your brand hosts multiple campaigns that are one-time, transactional and promotional in nature.  Ensuring that continued engagement with the subscriber involves only messaging they wish to receive. Obligation on Businesses: Once consent is revoked, businesses are required to stop contacting the consumer immediately. Failure to honor the revocation can result in penalties and lawsuits under the TCPA. Consumer Protection: The rule empowers consumers by ensuring they maintain control over the communications they receive. This rule has been confirmed by courts to apply even if the initial consent was given freely. Please note that our US Tier 1 carrier partners already established Best Practices for aggregators like Sinch to communicate downward to our customers to implement "other" opt-out keywords, to monitor  subscriber sentiment and if applicable to incorporate opt out keywords in other languages. We shared these in February 2024 as a CN they can also be found here in Community Sinch Opt-out Guide.   If you have any questions please reach out to your Legal, your Sinch Account Manager or a member of the North American Compliance Team. ... View more

The Messaging Team at Sinch wants to offer some suggestions for best practices for sending during the highest messaging periods of the year.  To ensure the best deliverability with the lowest latency we have increased our SMS and MMSC platform capacity for extra headroom and worked with our MNO partners to add additional capacity to support the large volume of traffic expected during the busy period leading up to and thru Black Friday and Cyber Monday.  There are also some simple steps offered below you can take to maintain high deliverability during the busy retail holiday periods.     For further reading on messaging performance during peak campaign periods—including SMS and MMS—please review the following resources: Notice of Potential Messaging Delays During Peak Campaign Periods (SMS) Notice of Potential MMS Messaging Delays During Peak Campaign Periods (MMS) General Best Practices   Avoid sending at top of the hour. That is when MNO networks are busiest Consider alternate sending times during peak MNO Network Sending times. 930am-3pm EST Use Shorter delivery validity period (where our apis support this) Avoid using multipart messages if possible.   Special Considerations for 10DLC   All 10DLC traffic MUST be properly registered sending into the USA. Send within your brand’s and campaign’s sending limits. These can be found in our 10DLC Guide. Please review our 10DLC Messaging FAQ's for more guidance on sending limits and registration.   MMS   Avoiding sending during top of the hour times, especially important where MNO networks are busiest. Make sure to only send MMS Best Practices for Images & Videos.   Learn more about and try out Sinch SMS   Take a look at the Sinch SMS Product page to learn more about our SMS products, or click here to sign up to our self-service portal and get started today. ... View more

What Senders (Originators, Numbers) are supported in the US for A2P SMS/MMS Services?   All A2P Senders in the US are Dedicated 2-way Products.  They all require some level of registration for the Brand (Sender) to the number(s).  They all must support/respond accordingly to mandatory Keywords for STOP (Opt-out) and HELP (Customer Support).  Supported Originators are Short Code, 10DLC (Local Numbers) and Toll Free Numbers (TFN).  Alpha is not supported today.   Take a look at the Sinch SMS Product page to learn more about our SMS products, or click here to sign up to our self-service portal and get started today. ... View more