Text-to-Pay Compliance: TCPA, 10DLC Registration and the Consent You Need

Four rulebooks apply to one text

A payment-link text has to satisfy four separate authorities, and they care about different things:

The good news is that a payment-link text is transactional: it completes a transaction the customer already agreed to. Transactional messages have a lighter consent standard than marketing under the TCPA and are the most favored category under carrier rules. The bad news is that the lighter standard still requires consent, and that the line between transactional and marketing is easy to cross by adding one sentence. Community banks and credit unions carry a further set of frameworks on top of these four, covered in their own section below.

The TCPA: what consent you need and when

The TCPA restricts calls and texts made to mobile numbers using an automatic telephone dialing system or an artificial or prerecorded voice without the called party's prior express consent. Almost every business texting platform sends messages through software, and although the Supreme Court narrowed the definition of an autodialer in 2021 (Facebook v. Duguid, holding that the system must use a random or sequential number generator), plaintiffs still litigate the question, several states define automated dialing more broadly, and the carriers require consent regardless. The practical rule for a business is to obtain consent for every mobile number you text, and to document it.

Two levels of consent

Under the FCC's rules, a message that contains any advertisement or telemarketing content is treated as marketing in its entirety.

For text-to-pay, the message must stay purely transactional to stay under the lighter standard. "Your invoice #1042 for $1,240.00 is ready. Pay here: link" is transactional. The same message with "and ask about our spring maintenance plan" on the end is marketing, and needs written consent it probably does not have.

Revocation

Consent can be withdrawn at any time, by any reasonable means. FCC rules effective in 2025 spell this out: a customer can revoke by replying with words such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE, or in any other message that a reasonable person would understand as a request to stop, and the business must honor the request within ten business days. Businesses may send one confirmation text after an opt-out, and it must not contain marketing. Since a payment text is transactional, a customer who opts out of texts has not cancelled their invoice, only the channel; the invoice moves to email or phone.

Timing

The TCPA's calling-hour restriction of 8 a.m. to 9 p.m. in the recipient's local time applies to telephone solicitations. Payment texts are not solicitations, but several state laws are broader (Florida restricts to 8 a.m. to 8 p.m.), carriers frown on late-night traffic, and a payment reminder at 11 p.m. is bad for approval rates anyway. Send between 9 a.m. and 8 p.m. local time and you never have to think about it.

Reassigned numbers

Mobile numbers are recycled. Consent belongs to the person who gave it, not the number, so texting a number that has since been reassigned is a violation even with a valid consent record. The FCC maintains a Reassigned Numbers Database; querying it before texting a number that has been silent for a long time gives a safe-harbor defense. For payment links, the practical control is not to text stored numbers that have not transacted recently without re-confirming.

Carrier registration: 10DLC, toll-free and short codes

Regardless of the law, the carriers decide whether your message is delivered. Since 2023 the three major US carriers block application-to-person (A2P) traffic from ordinary ten-digit long codes that is not registered. Registration goes through The Campaign Registry (TCR), usually via your messaging provider, in two steps.

1. Brand registration. Your legal business name, EIN, address, website and a contact. The registry verifies the business and assigns a trust score that determines your daily message limits and throughput. Sole proprietors have a separate, lower-volume path. A one-time fee of a few dollars applies, and optional vetting for a higher score costs more.
2. Campaign registration. A description of the use case, sample messages, how customers opt in, how they opt out, and how HELP is handled. The use case for text-to-pay is typically Account Notification or Customer Care; a business that also sends marketing registers a Mixed or Marketing campaign or, better, a separate one. Campaign vetting takes days, costs a small fee, and carries a monthly fee per campaign in the low single dollars, plus per-message carrier surcharges of a fraction of a cent.

What the reviewers look for, and what gets campaigns rejected:

• Opt-in description and evidence. A precise account of where the customer agrees to texts: the verbal script, the checkout checkbox, the form. Screenshots or the script text help. "Customers give us their number" is rejected.
• Sample messages that match the use case and include the business name. A payment-notification campaign with a sample that says "50% off this week" is rejected.
• A privacy policy and terms on your website that mention SMS, state that mobile information will not be shared with third parties for marketing, and describe opt-out. Reviewers check the URL.
• Opt-out and HELP language in the samples and in the flow.
• No public URL shorteners. Links through bit.ly and similar are a filtering signal. Use your own domain, or a branded short domain.

The alternatives to 10DLC are toll-free numbers, which have their own verification process, moderate throughput and no per-campaign fee, and short codes (five or six digits), which cost hundreds of dollars a month, take weeks to provision, and offer the highest throughput and the least filtering. Most businesses sending payment links are well served by a registered 10DLC number, which also lets customers reply and call.

The CTIA principles: what every campaign must do

The CTIA Messaging Principles and Best Practices are the standard the carriers and messaging platforms enforce contractually. They are short and specific:

• Consent before the first message, appropriate to the message type, with a clear description at the point of opt-in of what the customer will receive, how often, that message and data rates may apply, and how to opt out.
• Sender identification in the first message and periodically after: the business name.
• STOP handling. Recognize the standard keywords (STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT) in any case, stop immediately, and send one confirmation.
• HELP handling. Reply to HELP with the business name, a contact method and how to opt out.
• Content restrictions. No content relating to sex, hate, alcohol, firearms or tobacco (the SHAFT categories) and nothing illegal, deceptive or that evades filtering. Cannabis, gambling and some lending are restricted or prohibited on 10DLC regardless of local legality.
• No snowshoeing. Spreading the same traffic over many numbers to evade limits.
• Message frequency matching what was disclosed.

For a payment-link program, all of this fits in the consent language and two automated replies. The section after next shows the text.

State laws to know about

Several states have passed their own telephone solicitation laws with broader definitions and their own damages. They target marketing, but the definitions can catch messages that combine a transaction with a pitch, and a few reach further.

As of the time of writing; state telemarketing law changes every year and you should check the states where your customers live.

The safe posture is the same everywhere: keep payment texts purely transactional, keep them inside 9 a.m. to 8 p.m. local time, keep the count low, and honor opt-outs instantly.

Community banks and credit unions: the frameworks that apply in 2026

A community bank or credit union that texts a member a link to make a loan payment, clear an overdraft or pay a fee is doing the same thing as a plumber texting an invoice, and the TCPA treats it the same way: the message is transactional, it needs documented prior express consent for the number, and STOP must be honored. Two things are different for a financial institution (FI).

The TCPA's financial-institution exemption does not cover payments. In 2015 the FCC exempted certain bank messages from the consent requirement: fraud and identity-theft alerts, data-breach notifications, remediation steps and money-transfer notifications, provided they are free to the end user, limited to three per event over three days, carry no marketing and offer an opt-out. A payment reminder or a pay-by-text link is none of those. An FI that texts fraud alerts without consent still needs consent for text-to-pay.

The TCPA is one of several frameworks an examiner will expect to see addressed. The table lists the ones that reach a text-to-pay program at a US community bank or credit union as of 2026.

As of the time of writing. Check with compliance counsel for the states and charter type that apply to your institution.

What this means for an implementation at a community FI:

• Capture SMS consent where the member already signs things: digital banking enrollment, the loan application, the account agreement. A separate, specific SMS disclosure, not a line buried in the general terms.
• Keep the text body short and generic: institution name, item, amount, due date, link, opt-out. "[Institution]: Your auto loan payment of $412.00 is due Oct 20. Pay here: link. Reply STOP to opt out."
• Put the payment page on a domain the member recognizes and, where it shows account detail, behind authentication.
• Treat text-to-pay as a servicing message. Keep it in its own 10DLC campaign, separate from any marketing program, with its own consent record.
• Route the vendor through the third-party risk program before the pilot, not after; the contract terms in the vendor section below are what the reviewers will ask for.

IVR and phone payments alongside text-to-pay

Many organizations pair text-to-pay with an interactive voice response (IVR) line or agent-assisted phone payments, and the question of what compliance considerations apply to IVR and text-to-pay capabilities together comes up in every vendor review. The two channels share the TCPA and PCI DSS but diverge on the details.

The simplest architecture keeps card and bank details out of both channels: the IVR or agent sends a secure checkout link by text to the number on the account, with consent captured on the call, and the customer completes payment on the hosted page. That is how text-to-pay most often ends up implemented inside a call center, and it turns the IVR's PCI problem into the text channel's consent problem, which is the easier one to solve.

How to evaluate a text-to-pay vendor in 2026

Searches for the best text-to-pay vendor with built-in TCPA compliance miss a point: no vendor can make you compliant. Consent is given to your business, by your customer, at your point of contact, and the record that wins a case is yours. What a good vendor does is make the compliant path the default and the non-compliant path hard. Whether you are a merchant, an ISO or a US community bank or credit union, these are the questions to ask.

Consent and opt-out

• Does the platform capture consent itself, with versioned language, a timestamp and the method, and attach it to the customer record? Or does it assume you did that somewhere else?
• Is the consent language published and reviewable, as FloPay's consent policy is, so your counsel can read exactly what customers are shown?
• Are STOP, HELP and the FCC's wider revocation keywords handled automatically, written to a suppression list, and checked before every send, including sends triggered from an integration or API?
• Can a customer who declines texts still pay another way? Consent must not be a condition of payment.

Messages and delivery

• Transactional-only templates by default, with the business name and opt-out text inserted automatically, so nobody can turn a reminder into marketing by typing a sentence.
• 10DLC: does the vendor register your brand and campaign, or send under its own registered campaign? Either can work. Ask which, and who answers when the carriers filter.
• Sending-hour windows and a cap on reminders per invoice, configurable per business.
• Links on a branded domain or the vendor's own, never a public shortener, pointing at a hosted, tokenized checkout page.

Security and records

• PCI DSS attestation covering the hosted page and tokenization, so the card never reaches your systems in the clear.
• Exportable consent records, message logs and reply logs, retained at least four years and available after the contract ends.
• A SOC 2 report or equivalent, a subprocessor list that names the messaging provider, and incident-notification terms.

Contract terms to read before signing

The contract decides who is left holding a TCPA claim. Look for:

• Responsibility for consent. Most agreements place it on you, which is correct, but check that the vendor commits to the controls above in the contract and not only in marketing copy.
• Indemnification for the vendor's own failures: a STOP the platform dropped, or a campaign registered wrongly.
• Data ownership, export and deletion at termination, including consent records and message logs.
• Carrier pass-through fees: whether 10DLC registration, per-message surcharges and filtering penalties are itemized or buried in the per-message rate.
• Term, auto-renewal and notice periods, and what happens to your registered campaign and phone number if you leave.
• For financial institutions: audit rights, business-continuity commitments, complaint-handling cooperation and the right to review the subprocessor, all of which examiners expect to see in a third-party contract.

Consent language that satisfies all four

Consent for a transactional payment text needs to be knowing and specific. The customer must understand that they are agreeing to receive a text, from whom, about what, roughly how often, that carrier charges may apply, and how to stop. The three formats below cover the ways a customer typically gives a number to a business.

1. Verbal consent on a phone order

Read the same script every time and record the answer. This is the form FloPay uses in its own consent policy:

Record the customer's name, the mobile number, the agent, the date and time, and the fact of a yes. If the answer is no, take payment another way and send nothing. There is no "consent or pay" option: a customer who declines texts must still be able to pay, and a flow that makes consent the price of service fails the written-consent disclosure rules, carrier campaign review and the customer's trust in one move.

2. A checkbox at online checkout or on an application form

An unchecked box, separate from the terms-of-service acceptance, next to the phone field:

Store the checkbox state, the timestamp, the IP address and the page version with the customer record.

3. Keyword opt-in

Where the customer initiates by texting a keyword (from a sign, an invoice, a website), the reply completes the disclosure:

If you also want to send marketing

Use a second, separate checkbox with prior-express-written-consent language: it must say marketing or promotional messages, name the business, say that automated technology may be used, and say that consent is not a condition of purchase. Register a separate campaign for it. Never bundle marketing consent into the transactional consent; it invalidates neither, but it invites the argument that the transactional consent was not knowing.

The messages themselves

With consent in hand, the messages have their own rules: identify yourself, say what the customer is paying, link to a hosted page, and never ask for card data in the text.

Ways to send a secure checkout link by text

The link can originate from several places, and the rules are the same for each: a point of consent, a transactional message, and a hosted page behind the link.

• From an invoice. The invoicing system texts the secure checkout link when the invoice is issued and again as scheduled reminders. Best for repeat customers who agreed to texts when the account was opened.
• From a phone call. An agent reads the consent script, confirms the mobile number and sends the link while the customer is still on the line. Best for first-time and one-off payments, and it replaces reading card numbers over the phone.
• From a field visit or front counter. The technician or clerk sends the link from a mobile app or the CRM at the moment of service.
• From a customer-initiated keyword. The customer texts a keyword printed on a statement, sign or invoice and receives the link in reply. The inbound text is the consent, and the reply completes the disclosure.

Whatever the origin, a secure checkout link is HTTPS on a domain the customer can recognize, is tied to one invoice or amount, goes inert once paid, and opens a page that tokenizes the card and never hands it to the business.

Three things to avoid in every message: public URL shorteners (filtered), all-capitals and exclamation marks (filtered and off-putting), and any request for card numbers, security codes or bank details in the text itself. Card data in an SMS is unencrypted in transit, stored on the customer's phone and your provider's logs, and puts your business in scope for the strictest PCI requirements. The link takes the customer to a hosted payment page where the card is entered, tokenized and never seen by you.

Records: what to keep and for how long

In a TCPA claim, the business must prove consent; the customer does not have to prove its absence. The statute of limitations is four years, so the record-keeping horizon is at least that long after the last message.

For every mobile number you text, keep:

• The consent event: date, time, method (verbal script, checkbox, keyword), who captured it, and the exact language shown or read, with a version identifier.
• For web consent, the IP address, user agent and page URL; for verbal, the agent and, if you record calls, the recording reference.
• Every message sent: timestamp, content, the number it went to, delivery status.
• Every inbound reply, especially anything that could be an opt-out, and the timestamp you processed it.
• The opt-out list itself, checked before every send, and never overwritten by a new consent unless the customer re-opts in explicitly.
• Your campaign registration, the samples you submitted, and the privacy policy and SMS terms as they stood when consent was given.

Most messaging platforms keep the message logs. The consent record is usually the business's responsibility, and it is the one that decides a case.

A launch checklist

1. Decide what you will send: payment links, reminders and receipts only, or marketing too. Register separate campaigns if both.
2. Write the consent language for each capture point (phone, web, form, keyword) using the templates above, and version it.
3. Update the website privacy policy and add SMS terms: message types, frequency, rates, opt-out, and a statement that mobile information is not shared with third parties for marketing.
4. Register the brand and campaign through your messaging provider. Have the consent screenshots and script ready for the reviewer.
5. Configure STOP and HELP auto-replies and confirm STOP writes to a suppression list checked before every send.
6. Set sending hours of 9 a.m. to 8 p.m. in the customer's local time (use the area code when you have nothing better), and a cap on reminders per invoice.
7. Use your own domain for payment links, pointing at a hosted, tokenized payment page.
8. Set the statement descriptor to the name customers know and put it in the receipt text.
9. Store consent records with the customer, and set a retention period of at least four years after the last message.
10. Test the whole path with your own phone: opt in, receive the link, pay, receive the receipt, reply STOP, confirm silence.

Where FloPay fits

FloPay's text to pay sends only transactional messages: payment links, reminders and receipts, with the business name, an opt-out instruction, and a link to a hosted checkout on which the card is tokenized. Consent is captured with the verbal script and the checkout checkbox published in the SMS consent policy, and recorded against the customer. STOP and HELP are handled automatically. Reminder timing and frequency are set per business in customer messaging. The rules in this guide are the reason the product is built the way it is.