Outbound & SMS Compliance

Before you can make outbound calls or send SMS through Guava, your organization needs to complete a set of carrier and regulatory registrations. They're required — you can't make outbound calls or send SMS without them — and several have prerequisite relationships, so the order matters. All registrations are submitted from the Guava Compliance page; Guava handles submission and coordination with carriers on your behalf.

Why this matters

Carriers and regulators require businesses to register before they can send outbound voice or SMS traffic — it's part of how the industry combats spam and fraud. These registrations serve two purposes: they keep you compliant with federal law, and they directly improve your campaign performance.

Regulatory compliance. The Telephone Consumer Protection Act (TCPA) and FCC regulations govern how businesses can contact consumers by phone and SMS. Non-compliance exposes your organization to significant legal liability — TCPA violations carry statutory damages of $500–$1,500 per call or message. The registrations here establish the documentation trail that demonstrates your organization is operating lawfully.

Better pickup and deliverability rates. Registered businesses are treated differently by carriers. For voice, your phone numbers become associated with a verified business identity, which increases the likelihood that calls are answered rather than blocked or flagged as spam. For SMS, A2P 10DLC registration is required for messages to be delivered at all on major US carriers — unregistered traffic is filtered.

AI voice disclosure. All calls placed through Guava are handled by an AI voice agent. FCC rules require that callers disclose the use of AI-generated voices at the beginning of a call. Guava's agents are configured to make this disclosure automatically, but you are responsible for ensuring your agent scripts and call flows meet the disclosure requirements in every jurisdiction where you operate.

Your compliance responsibilities

Guava handles carrier registration and submission on your behalf, but your organization remains responsible for the following. See our Terms of Service for additional details.

• Do Not Call (DNC) scrubbing — you must scrub your contact lists against the National DNC Registry and maintain an internal DNC list. Contacts who have opted out must not be dialed.
• Consent — you are responsible for obtaining and documenting the appropriate level of consent (express written consent for marketing calls/SMS, prior express consent for informational calls) before contacting consumers.
• Call time restrictions — federal rules under the TCPA restrict outbound calls to between 8 AM and 9 PM in the called party's local time zone. Some states have stricter windows. You are responsible for configuring your campaigns accordingly.
• AI voice disclosure — you must disclose at the start of each call that the caller is an AI. You are responsible for ensuring your agent's greeting includes this disclosure.
• State-specific regulations — several states (California, Florida, Texas, and others) have additional restrictions beyond federal law. You are responsible for understanding and complying with the laws in every state where you dial.
• Opt-out handling — consumers who request to be added to your DNC list must be honored within 30 days and must not be contacted again.

Overview

There are four registrations:

Steps 2 and 3 can be completed in parallel once Step 1 is approved. Step 4 requires both Steps 2 and 3 to be complete.

Outbound Dialing Registration

Outbound Dialing Registration is the first step and a prerequisite for everything else. It's a Know Your Customer (KYC) form that verifies your business identity and establishes your compliance baseline — you cannot proceed until it is approved.

To get started, open the Guava Compliance page and submit the Outbound Permissions form under General Forms. Once submitted, the form enters a review queue for the Guava team. Upon approval, your organization is enabled for outbound dialing and you gain access to the rest of the compliance registrations.

The submitter must have authority to control or manage the company and bind it to agreements. US-based businesses only; a valid EIN is required.

What you'll need to provide:

1. Business Identity — legal business name, business type, industry, EIN, physical address, and website.
2. Point of Contact — the person authorized to enter into agreements on behalf of the company (name, email, phone, and job title).
3. Compliance Contact — a contact for compliance-related communications (may be the same as the point of contact).
4. Call Setup — the types of calls you plan to make (outbound, inbound, WebRTC), a description of your use cases, your phone number plan, and whether your use case involves PHI or cardholder data.
5. Telecom Compliance — FCC Robocall Mitigation Database (RMD) registration status, TCPA/TSR certification, consent method, Do Not Call Registry validation, and internal DNC list practices.

Use Cases

A Use Case is a named grouping that ties together your campaigns, SMS Campaign Registration, and analytics provider attestation under a single business purpose. Each use case has a name (e.g., "Collections", "Appointments") and a type selected from a standard list of 45 categories (e.g., Abandoned Cart, Appointment Reminders, Lead Generation, Telehealth, Survey/Research).

Use cases exist because different outbound activities often serve different purposes, and compliance registrations — particularly SMS campaign registration and analytics provider attestation — are scoped per use case. For example, if your organization runs both appointment reminder campaigns and marketing campaigns, those are two separate use cases, each with their own SMS campaign registration and analytics attestation.

Once your Outbound Dialing Registration is approved, go to the Guava Compliance page and click + New Use Case. You'll provide a name and select a type. You can then assign your existing campaigns to the use case and submit the SMS Campaign and Analytics Provider forms for it.

SMS Brand Registration

SMS Brand Registration registers your business as an SMS brand with the carrier. This is a one-time, organization-wide registration — you only need to complete it once, regardless of how many campaigns or use cases you have. It's a prerequisite for sending any SMS messages through Guava.

To register, go to the Guava Compliance page and submit the SMS Brand Registration form under General Forms.

What you'll need to provide:

1. Brand Details — legal company name, DBA/brand name, company type (Public, Private, US Nonprofit, US Government), EIN/Tax ID, and optional alternate identifiers (DUNS, GIIN, LEI).
2. Address — street address, city, state, and zip code.
3. Company Info — website, and stock symbol/exchange if publicly traded.
4. Business Contact — first and last name, email, and mobile phone.
5. Support Contact — support email and phone number.

Once submitted, your brand registration is forwarded to the carrier for processing. Upon approval, your organization is assigned a business ID and your phone numbers are associated with your brand.

SMS Campaign Registration

SMS Campaign Registration is an A2P (Application-to-Person) 10DLC campaign registration, completed once per use case. It tells the carrier what kind of SMS messages you'll send, how consumers opt in, and what your compliance keyword responses are (e.g., what happens when someone texts STOP or HELP). Without it, SMS messages for that use case will not be delivered.

To register, go to the Guava Compliance page, find the relevant use case card, and click SMS Campaign Form.

What you'll need to provide:

1. Campaign Details — campaign type (from the use case type list), a description of the SMS campaign, how consumers opt in (call-to-action / message flow), CTA URL, terms of service URL, privacy policy URL, and sample messages.
2. Compliance Keyword Responses — your opt-in keywords and response, opt-out (STOP) response, and help (HELP) response. Each response must include your brand name, campaign description, and support contact info.
3. Usage Disclosures — whether you use number pooling (50+ numbers), direct lending, embedded links (note: public URL shorteners like bit.ly or tinyurl are not permitted), embedded phone numbers, or age-gated content. You'll also confirm the campaign won't be used for affiliate marketing.
4. Traffic Profile — SMS traffic type (transactional, customer care, marketing, or mixed), associated website, message frequency, and whether the website/domain is displayed in messages.

Once submitted, the registration is forwarded to the carrier for processing. Upon approval, SMS is enabled for that use case and your compliance keyword responses (opt-in, opt-out, help) are configured.

Common mistakes that cause rejections

This is the registration people most frequently get wrong. Carriers review submissions carefully and will reject campaigns that don't meet the requirements below.

Opt-in must be SMS-specific. Your opt-in language must be exclusive to SMS. You cannot combine SMS opt-in with consent for email, phone calls, or other channels in a single checkbox or statement. Each channel must have its own separate opt-in.

Phone number field must be optional. If your opt-in form includes a phone number field, it must not be marked as required. Consumers cannot be required to provide a phone number in order to access a service or complete a transaction.

You can only collect opt-in for yourself. Your opt-in language must refer only to your own organization. You cannot collect opt-in on behalf of marketing partners, agents, affiliates, or third parties. Consumer opt-in is not transferable or sharable — you cannot share opt-in status with any other party, and your Privacy Policy must explicitly state that you do not share SMS opt-in information with third parties.

Opt-out instructions must be included. Every opt-in call-to-action must include opt-out instructions. The standard language is: "Reply STOP to opt-out."

Links to Terms and Privacy Policy are required. Your opt-in call-to-action must include a link to your Terms and Conditions and a link to your Privacy Policy. These must be working, publicly accessible URLs at the time of submission.