Toll-Free Verification Requirements: What the Form Asks For in 2026

Toll-free numbers are the ones that start with 800, 888, 877, 866, 855, 844 or 833. To send texts from one, the business submits a verification request through its messaging provider. The provider reviews it and passes it on for carrier approval.

Twilio's help article says verification is required for sending over toll-free numbers to the US and Canada. It applies to software vendors and aggregators that send for other businesses as well as to direct senders.

Toll-free verification is separate from 10DLC. Twilio's campaign vetting FAQ describes toll-free messaging as an alternative that needs verification and does not rely on brand and campaign registration. The two reviews now ask similar questions, which is the subject of a Telnyx support article on why toll-free verification now mirrors 10DLC.

Twilio's help article gives two dates. Traffic from numbers that had never been submitted or were not approved, which Twilio calls Restricted, has been blocked in the US since 8 November 2023. Traffic from numbers with a request still under review, called Pending, has been blocked since 31 January 2024.

A blocked message returns error 30032, named as a toll-free number that has not been verified. Twilio's help article says blocked messages are subject to messaging fees. Its error page lists three causes: the number was never submitted, the request is still under review, or the request was rejected.

The practical point for an agency is that there is no interim sending. A client cannot text from the number between submission and approval. Once verified, Twilio says a number sends three text segments per second by default, and that the rate can be raised.

Twilio's API guide lists the request fields and marks which are required. The required ones are the business name, the business website, a notification email, one or more use case categories, a use case summary, a production message sample, one or more opt-in image addresses, the opt-in type, an estimate of monthly message volume, and the toll-free number itself.

The business registration number, the authority that issued it and the country of registration are required for every business type except a sole proprietor. Twilio also requires an approved customer profile on the account before a request can be submitted.

Several fields are optional on Twilio and still worth filling in, because other providers treat them as required or check them on the website. These include the privacy policy address, the terms address, a sample help message, the opt-in confirmation message and the opt-in keywords.

Bandwidth's support article says that from 17 February 2026 all new toll-free verification submissions must include a business registration number. The fields had been optional since 1 October 2025. A submission without them fails with denial code 1112, described as a business registration number that is missing or invalid.

Bandwidth names four data points: the number itself, its type, the issuing country as a two- or three-letter country code, and the business entity type. It gives a US EIN and a Canadian business number as examples and says organizations elsewhere use their own country's registration number.

Telnyx gives the same date and says a submission without the number is rejected immediately. Its article adds that the exact legal name must match the tax records, and that a mismatch between the details entered and the official registration form is a cause of the missing-or-invalid rejection.

Twilio's API guide lists eighteen accepted registration authorities, from the US EIN to European and Australian business identifiers, with a catch-all option for others. It says supplying the number and related details reduces review time and the risk of rejection.

On Twilio the proof is a link to an image that shows the opt-in workflow, hosted at a public address. The request also names the method. Twilio's list of methods is verbal, web form, paper form, by text, mobile QR code, and import.

Telnyx describes the same evidence as a signup form link or a screenshot of a text-to-join call to action. It says consent must be specific to the business that is submitting, and that purchased lead lists carrying consent given to a partner do not qualify. It also asks that sample messages include the brand name and opt-out wording, and that the use case summary match the opt-in disclosure.

The underlying standard is the wireless industry's. CTIA's Messaging Principles and Best Practices, dated May 2023, says a call to action should tell people what the program is, who is sending, that they are opting in, any fees, and how to opt out and find the privacy policy. It also says senders should not use opt-in lists that have been rented, sold or shared.

• A public image or link showing the real sign-up screen
• The business name on that screen, matching the name on the request
• A description of what messages people will get
• Opt-out wording in the sample message
• Consent collected by the business itself, with no bought or shared lists

Telnyx's article lists the website conditions it checks. The site has to be live, with no under-construction page. It needs a footer link to the privacy policy. The business contact email should match the website's domain and be visible on the site.

On the policy itself, Telnyx says the privacy policy must state that text opt-in data will not be sold or shared with third parties, and that the terms link must lead to the services agreement. This matches what 10DLC reviewers look for, and the same public pages can serve both registrations.

Twilio's shared rejection codes, in use from 15 September 2026, treat these points separately. Its support article says a disclosure required in the call to action has to appear where consent is collected, and that putting it only in the terms of service may not resolve the error. It also separates missing opt-out instructions from instructions that are present and noncompliant, with a different code for each.

Twilio's API guide exempts the sole proprietor business type from the registration number, authority and country fields. Bandwidth's article on the requirement does not address sole proprietors.

Telnyx describes its own handling. A sole proprietor leaves the registration number and type blank, selects the issuing country and chooses sole proprietor as the entity type. A sole proprietor without an EIN may be sent to manual verification, which Telnyx says requires a government-issued ID and sometimes a live selfie, and adds to the approval time.

Telnyx also states a preference. It says carriers strongly prefer an EIN and calls getting one the best practice even for a sole proprietor with no employees. That is Telnyx's guidance to its customers. We did not find the same statement in a carrier document.

Twilio's two pages give slightly different figures. The API guide, modified on 18 September 2026, says Twilio reviews requests within three business days. The help article, updated on 1 June 2026, says to allow approximately three to five business days. Neither covers the time for carrier approval separately.

When a request is rejected, Twilio marks whether it can be edited. If it can, the business has seven days from the initial request to resubmit for priority review. After that the number stays restricted until a new request is made. Twilio's help article says rejections for content, or for violations of its acceptable use and messaging policies, cannot be resubmitted.

Rejection reasons have become more detailed. Twilio introduced new toll-free rejection codes on 15 May 2024 and shared codes for toll-free and 10DLC from 15 September 2026. Sinch reports that toll-free rejection codes grew from 38 to 83 in May 2025 and to 118 from 15 September 2026. The second Sinch figure comes from a community post and was not confirmed by a carrier source.

One more point catches agencies that move clients between platforms. Twilio says a verification record cannot transfer between accounts or sub-accounts, and cannot transfer between providers when a number is ported. The number has to be verified again where it lands.