outbound compliance setup.md

Outbound Compliance Setup

Before you can make outbound calls or send SMS through Guava, your organization needs to complete a set of carrier and regulatory registrations. This guide walks you through the full process in order.

All registrations are submitted from the Guava Compliance page. Guava handles submission and coordination with carriers on your behalf.

Why this matters

Carriers and regulators require businesses to register before they can send outbound voice or SMS traffic. These registrations serve two purposes: they keep you compliant with federal law, and they directly improve your campaign performance.

Regulatory compliance. The Telephone Consumer Protection Act (TCPA) and FCC regulations govern how businesses can contact consumers by phone and SMS. Non-compliance exposes your organization to significant legal liability — TCPA violations carry statutory damages of $500–$1,500 per call or message. The registrations in this guide establish the documentation trail that demonstrates your organization is operating lawfully.

Better pickup and deliverability rates. Registered businesses are treated differently by carriers. For voice, your phone numbers become associated with a verified business identity, which increases the likelihood that calls are answered rather than blocked or flagged as spam. For SMS, A2P 10DLC registration is required for messages to be delivered at all on major US carriers — unregistered traffic is filtered.

AI voice disclosure. All calls placed through Guava are handled by an AI voice agent. FCC rules require that callers disclose the use of AI-generated voices at the beginning of a call. Guava's agents are configured to make this disclosure automatically, but you are responsible for ensuring your agent scripts and call flows meet the disclosure requirements in every jurisdiction where you operate.

Your compliance responsibilities

Guava handles carrier registration and submission on your behalf, but your organization remains responsible for the following. See our Terms of Service for additional details.

• Do Not Call (DNC) scrubbing — you must scrub your contact lists against the National DNC Registry and maintain an internal DNC list. Contacts who have opted out must not be dialed.
• Consent — you are responsible for obtaining and documenting the appropriate level of consent (express written consent for marketing calls/SMS, prior express consent for informational calls) before contacting consumers.
• Call time restrictions — federal rules under the TCPA restrict outbound calls to between 8 AM and 9 PM in the called party's local time zone. Some states have stricter windows. You are responsible for configuring your campaigns accordingly.
• AI voice disclosure — you must disclose at the start of each call that the caller is an AI. You are responsible for ensuring your agent's greeting includes this disclosure.
• State-specific regulations — several states (California, Florida, Texas, and others) have additional restrictions beyond federal law. You are responsible for understanding and complying with the laws in every state where you dial.
• Opt-out handling — consumers who request to be added to your DNC list must be honored within 30 days and must not be contacted again.

Overview

Steps 2 and 3 can be completed in parallel once Step 1 is approved. Step 4 requires both Steps 2 and 3 to be complete.

Step 1: Outbound Dialing Registration

This is a Know Your Customer (KYC) form that verifies your business identity and establishes your compliance baseline. It is a prerequisite for all other registrations — you cannot proceed until it is approved.

Go to the Guava Compliance page and submit the Outbound Permissions form under General Forms.

What you'll need:

• Business Identity — legal business name, business type, industry, EIN, physical address, and website
• Point of Contact — a person authorized to enter agreements on behalf of the company (name, email, phone, title)
• Compliance Contact — a contact for compliance-related communications (may be the same as above)
• Call Setup — types of calls planned, use case description, phone number plan, and whether calls involve PHI or cardholder data
• Telecom Compliance — FCC Robocall Mitigation Database (RMD) registration status, TCPA/TSR certification, consent method, DNC Registry validation, and internal DNC list practices

The submitter must have authority to bind the company to agreements. US-based businesses only; a valid EIN is required.

Once submitted, Guava reviews the form and approves your organization for outbound dialing. You'll receive confirmation when approved.

Step 2: Create a Use Case

A use case is a named grouping for a single business purpose — for example, "Appointment Reminders" or "Collections." Each use case ties together your campaigns, SMS Campaign Registration, and any analytics provider attestation.

Once your Outbound Dialing Registration is approved, go to the Guava Compliance page and click + New Use Case. You'll provide a name and select a type from a standard list of 45 categories (e.g., Appointment Reminders, Lead Generation, Telehealth, Survey/Research).

If you run outbound campaigns for multiple distinct purposes, create a separate use case for each. SMS Campaign Registration is completed once per use case.

Step 3: SMS Brand Registration

SMS Brand Registration registers your organization as an SMS brand with the carrier. This is a one-time, org-wide registration — you only need to complete it once regardless of how many use cases or campaigns you have. It is required before you can send any SMS messages through Guava.

Go to the Guava Compliance page and submit the SMS Brand Registration form under General Forms.

What you'll need:

• Brand Details — legal company name, DBA/brand name, company type (Public, Private, US Nonprofit, US Government), EIN/Tax ID, and optional alternate identifiers (DUNS, GIIN, LEI)
• Address — street address, city, state, zip
• Company Info — website, and stock symbol/exchange if publicly traded
• Business Contact — name, email, and mobile phone
• Support Contact — support email and phone number

Once submitted, the registration is forwarded to the carrier. Upon approval, your organization is assigned a business ID and your phone numbers are associated with your brand.

Step 4: SMS Campaign Registration

SMS Campaign Registration (A2P 10DLC) tells the carrier what kind of SMS messages you'll send, how consumers opt in, and what your compliance keyword responses are. You complete this once per use case. Without it, SMS messages for that use case will not be delivered.

Go to the Guava Compliance page, find the relevant use case card, and click SMS Campaign Form.

What you'll need:

• Campaign Details — campaign type, description of the SMS campaign, how consumers opt in (call-to-action / message flow), CTA URL, terms of service URL, privacy policy URL, and sample messages
• Compliance Keyword Responses — opt-in keywords and response, opt-out (STOP) response, and help (HELP) response. Each response must include your brand name, campaign description, and support contact info.
• Usage Disclosures — whether you use number pooling (50+ numbers), direct lending, embedded links (note: public URL shorteners like bit.ly or tinyurl are not permitted), embedded phone numbers, or age-gated content
• Traffic Profile — SMS traffic type (transactional, customer care, marketing, or mixed), associated website, message frequency, and whether the website/domain is displayed in messages

Once submitted, the registration is forwarded to the carrier for processing. Upon approval, SMS is enabled for that use case and your compliance keyword responses (opt-in, opt-out, help) are configured.

Common mistakes that cause rejections

This is the registration people most frequently get wrong. Carriers review submissions carefully and will reject campaigns that don't meet the requirements below.

Opt-in must be SMS-specific. Your opt-in language must be exclusive to SMS. You cannot combine SMS opt-in with consent for email, phone calls, or other channels in a single checkbox or statement. Each channel must have its own separate opt-in.

Phone number field must be optional. If your opt-in form includes a phone number field, it must not be marked as required. Consumers cannot be required to provide a phone number in order to access a service or complete a transaction.

You can only collect opt-in for yourself. Your opt-in language must refer only to your own organization. You cannot collect opt-in on behalf of marketing partners, agents, affiliates, or third parties. Consumer opt-in is not transferable or sharable — you cannot share opt-in status with any other party, and your Privacy Policy must explicitly state that you do not share SMS opt-in information with third parties.

Opt-out instructions must be included. Every opt-in call-to-action must include opt-out instructions. The standard language is: "Reply STOP to opt-out."

Links to Terms and Privacy Policy are required. Your opt-in call-to-action must include a link to your Terms and Conditions and a link to your Privacy Policy. These must be working, publicly accessible URLs at the time of submission.