Mortgage Texting Compliance Guide: TCPA, 10DLC & Short Codes (2026)

Mortgage texting compliance rests on three pillars: (1) TCPA consent — get express written consent before marketing texts and honor opt-outs by any reasonable means within 10 business days; (2) 10DLC registration — every business texting from a local number must register its brand and campaign with The Campaign Registry or face carrier blocking; (3) channel fit — 10DLC suits most brokers and lenders, while short codes suit high-volume servicers. Violations run $500–$1,500 per text under TCPA, so compliance is cheaper than any settlement.

This guide is educational, not legal advice. Confirm your program with compliance counsel.

Texting is the highest-performing channel in mortgage — and the most regulated. One misstep can turn a 98%-open-rate channel into a class-action exposure at $500–$1,500 per message. This guide gives loan officers, brokers, lenders, and servicers a single reference for the rules for texting borrowers (TCPA), 10DLC registration, and short codes — current as of 2026.

The Three Layers of Mortgage Texting Compliance

1. Federal law (TCPA + FCC rules) — governs consent: who you may text and how they can revoke.
2. Carrier/ecosystem rules (10DLC, short codes, CTIA guidelines) — govern deliverability: registered senders, vetted campaigns, prohibited content.
3. Mortgage-specific overlays (RESPA, UDAAP, state mini-TCPAs) — govern what you say: no misleading terms, required disclosures, state-level consent laws (Florida’s FTSA and Oklahoma’s TSA are stricter than federal law).

Most teams that get burned pass layer 1 but ignore layers 2 or 3.

Rules for Texting Borrowers (TCPA): What You Can and Can’t Do

Consent tiers

Message type	Consent required	Example
Marketing / promotional	Prior express written consent (clear disclosure + signature/e-sign)	“Rates dropped — refi could save you $240/mo”
Informational / transactional	Prior express consent (can be verbal or implied via provided number in context)	“Your appraisal is scheduled for Tuesday”
Existing-customer servicing	Express consent; strongest practice is written at application	“Your payment is due on the 1st”

Practical rule: collect express written consent for everything at 1003 intake and stop worrying about classification edge cases.

Consent language that works

“By checking this box, I agree to receive informational and marketing text messages from [Company] at the number provided, including via automated technology. Consent is not a condition of purchase. Msg & data rates may apply. Reply STOP to opt out.”

The 2025–2026 rule changes you must know

• Revocation rule (effective April 11, 2025): Borrowers can revoke consent by any reasonable means — not just “STOP.” Words like “cancel,” “unsubscribe,” or a plain-English “please stop texting me” all count, and you must honor revocation within 10 business days. Your platform must catch non-standard opt-outs.
• One-to-one consent rule vacated (January 2025): The FCC’s rule requiring lead-gen consent to name each individual seller was struck down by the Eleventh Circuit before taking effect. But buying aged or shared leads remains the single biggest TCPA risk in mortgage — treat purchased-lead consent as suspect unless you can produce the consent record.
• Quiet hours: No texts before 8 a.m. or after 9 p.m. in the recipient’s local time zone (stricter in some states).

Record-keeping

Keep proof of consent (timestamp, IP, form language), every message sent, and every opt-out — for at least four years (TCPA’s statute of limitations). A native Salesforce texting platform does this automatically because every message lives on the contact record.

10DLC for Mortgage Brokers and Lenders

10DLC (10-digit long code) is the carrier framework that lets businesses send application-to-person (A2P) texts from standard local numbers. If your LOs text borrowers from a business number today, that traffic must be registered.

How 10DLC registration works

1. Brand registration — your company registers with The Campaign Registry (TCR): legal name, EIN, website. One-time vetting.
2. Campaign registration — you declare use cases (e.g., “customer care,” “account notifications,” “marketing”), sample messages, and opt-in/opt-out flow. Monthly fee per campaign (typically $2–$10) plus small per-message carrier fees.
3. Number association — your texting numbers attach to the approved campaign.

Why 10DLC fits most mortgage brokers

• Local presence: borrowers answer a local number; 10DLC for mortgage brokers preserves the personal LO-to-borrower feel.
• Two-way conversations: perfect for pre-approval questions, document collection, and milestone updates.
• Low cost: registration fees are trivial compared to short code leases.
• Throughput: vetted brands get thousands of messages per day — ample for a branch or mid-size lender.

Warning: unregistered traffic is now heavily filtered or blocked outright by US carriers, and “gray route” workarounds violate carrier terms. If your texts silently stopped delivering, unregistered 10DLC is the most common culprit.

Short Codes for Mortgage Lenders and Servicers

A short code is a 5–6 digit number (e.g., 555-88) built for high-volume, one-way-heavy messaging.

Factor	10DLC	Short code
Cost	~$2–$10/mo per campaign	~$500–$1,000/mo lease + setup
Throughput	Good (brand-score dependent)	Massive (100+ msgs/sec)
Feel	Local, personal	Corporate, recognizable
Best for	Brokers, LOs, retail lenders	Servicers, large lenders’ payment & alert programs
Voice capability	Yes (same number can call)	No

Decision rule: a short code for mortgage lenders makes sense when you send 50,000+ messages/month of uniform alerts — payment reminders, escrow notices, text-to-pay links. For everyone else, registered 10DLC (or toll-free verification) wins on cost and conversational fit. Many enterprises run both: short code for servicing blasts, 10DLC for LO conversations.

Content Rules Carriers Enforce (Even With Consent)

• SHAFT restrictions and — critical for mortgage — heightened scrutiny of lending-related content. Carriers flag spam-prone and prohibited messaging patterns, including payday-loan-adjacent language; keep rate claims factual and compliant with Reg Z advertising rules.
• No link shorteners like bit.ly on shared domains — use branded short links.
• Identify yourself in every campaign (“[Company]: …”) and include opt-out language in the first message and periodically after.

A 10-Point Mortgage Texting Compliance Checklist

1. Express written consent captured at application/lead form
2. Consent records stored with timestamp and form language
3. All numbers registered (10DLC campaign or short code)
4. STOP + non-standard revocations auto-honored within 10 business days
5. Quiet hours enforced by time zone
6. Sender identified in every message
7. No sensitive data (SSN, account numbers) in message bodies
8. Branded links only; no public shorteners
9. Message + opt-out logs retained 4+ years
10. State mini-TCPA review (FL, OK, WA, CT at minimum)

A compliant platform automates points 3–9. 360 SMS App handles 10DLC/short code provisioning, automatic opt-out processing, quiet-hour scheduling, and full message logging on the Salesforce record — see how it powers compliant borrower engagement for mortgage teams and Salesforce texting integration end to end. Once compliance rails are in place, layer on drip campaigns that convert and automated borrower communication with confidence.

Text Borrowers Confidently — and Compliantly

360 SMS App bakes compliance into every message: 10DLC and short code support, automatic opt-out processing, and a complete audit trail inside Salesforce.

Talk to our experts →