> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Compliance FAQ: sends, calls, and registration gates > Route the first compliance question — a rejected send, a blocked call, a pending registration — to the gate page that owns it, before you dig into a single error. # Compliance FAQ: sends, calls, and registration gates This is the routing layer for compliance questions: *a support reply, a first-time tenant setup, a "which gate fired?" lookup*. Each answer is one to three sentences ending in a deeplink to the page that owns the topic — read this page to route the question, read the linked page before you act on it. Nothing here is a claim source; the linked page is always authoritative. For the mental model behind the routing table — which gates fail open, which fail closed, and who owns each control — read the [Compliance Posture FAQ](/compliance/posture-faq) and the [posture map](/compliance/posture-overview). This page describes Orbit's platform controls. It is **not legal advice.** Which laws apply to your traffic, and what posture is adequate, depends on your jurisdiction, your recipients, and what you send. Confirm with qualified counsel. *** ## 10DLC & toll-free verification ## My 10DLC campaign is pending. Can I send? No. US long-code A2P traffic is **fail-closed**: sends are blocked until the campaign is approved by the carriers. Brand and campaign review typically takes 1–5 business days, and per-carrier statuses are tracked separately. See the full lifecycle on [10DLC registration](/guides/10dlc-registration) and the parallel [toll-free verification](/guides/toll-free-verification) track for TF numbers. *** ## What is the difference between a brand rejection and a campaign rejection? A **brand rejection** is about your identity payload (legal name, EIN, website); a **campaign rejection** is about the use-case description and message samples. Rejected content fixes mean re-submission, while a low vetting score calls for a re-vet — the remedy differs, so decode the rejection code first on [10DLC rejections, re-vetting, and the post-approval lifecycle](/guides/10dlc-rejections-and-revet). *** ## Sender ID & country requirements ## Which countries require sender pre-registration? Run [`GET /api/v1/compliance/country-requirements`](/compliance/country-requirements): the `registration` field on each country entry reads `none`, `recommended`, or `required`, and where it reads `required` you must have an approved Sender-ID entry before A2P SMS delivers. The per-entry workflow (`pending` → `approved`, or `rejected` with a reason) is on [Sender-ID Registration](/compliance/sender-id-registration). *** ## I got SENDER\_ID\_NOT\_REGISTERED on a send. What does it mean? The `from` value is a custom alphanumeric sender ID with no registration row on your account — this gate is fail-closed. Register it under Settings → Sender IDs, or send with the platform default sender or one of your phone numbers. The full diagnosis (including `SENDER_ID_NOT_APPROVED` and the transient `SENDER_ID_CHECK_UNAVAILABLE`) is on [Troubleshooting: SENDER\_ID\_NOT\_REGISTERED](/troubleshooting/sender-id-not-registered). *** ## STIR/SHAKEN ## Why is my outbound call signed at attestation level C? **C** means the platform cannot verify ownership of the calling number, so it attests "the gateway can't tell where this call originated" — which exposes the call to spam-likely treatment downstream. Register a delegate certificate to lift covered numbers from C to B (partial). Details on [Attestation posture](/compliance/attestation) and [Troubleshooting: attestation stuck at C](/troubleshooting/stir-shaken-attestation-downgrade). *** ## Should I register a delegate certificate? Yes, if you bring your own verified numbers (BYON): registering an ATIS-1000092 delegate certificate lifts the numbers it covers from C to **B**. A self-registered certificate can only ever reach partial (B) — full attestation (A) on a number you did not port into Orbit would be spoofing, and the registry will never mint that. The registry lives at `/compliance/attestation/delegate-certs`; see [Attestation posture](/compliance/attestation). *** ## TCPA & quiet hours ## What is the one gate I cannot turn off? The **US TCPA federal voice dialing window**: campaign and dialer voice to US (+1) recipients outside 8 AM–9 PM recipient-local is hard-blocked with `422 TCPA_FEDERAL_DIALING_WINDOW_BLOCKED` — no tenant toggle, no per-organization bypass, and no fail-open on a timezone-unresolved recipient. The $500–$1,500 per-call statutory penalty is not the tenant's to waive. Read [The TCPA federal voice guard](/concepts/tcpa-federal-voice-guard); the stricter state overlays on top of it are on [US state calling windows](/compliance/state-calling-windows). *** ## Can a tenant lift the emergency-call block? No. Emergency numbers (911 / 112 / 999 / 000) always route on Orbit, and no tenant gate can block them — the same stance as the federal TCPA window. Details and the address-registration duty for emergency routing are on [Emergency calling](/voice/emergency-calling). *** ## How do state mini-TCPA overlays interact with the federal window? Stricter state overlays — Florida's Sunday ban, Mississippi's 7:30 PM close, and the Oklahoma / Louisiana / Alabama / West Virginia windows — sit **on top of** the federal rail on a most-restrictive-wins rule and, like the federal window, are not a tenant knob. The overlay map is on [US state calling windows](/compliance/state-calling-windows); the blocked-call codes (`TCPA_STATE_DIALING_WINDOW_BLOCKED`, `TCPA_DIALING_WINDOW_BLOCKED`, `TCPA_TIMEZONE_UNKNOWN`) are decoded on [Troubleshooting: state mini-TCPA blocked calls](/troubleshooting/tcpa-state-mini-tcpa-window-blocked-calls). *** ## Opt-out & suppression ## Does a STOP on SMS also block voice calls? By default, yes. A STOP keyword on a phone number records the opt-out with the `all` channel scope, which suppresses every channel reachable on that number — and the voice and dialer gates honour phone suppressions, so the number stops receiving calls too. Scope semantics (`all` vs a specific channel) and recovery are on [Opt-Out & Suppression Lists](/compliance/opt-out-suppression). *** ## When should I use CSV import versus the Consent API? Use the **CSV import** (`POST /compliance/suppression-list/import`) when you are backfilling a legacy opt-out list — it returns per-row results with intra-file deduplication. Use the **Consent API** for live per-event consent and revocation. Both feed the same suppression chain, so a suppressed address is dropped pre-dispatch regardless of entry point. See [Opt-Out & Suppression Lists](/compliance/opt-out-suppression). If your DNC pre-flight check returns `403 DNC_SYNC_NOT_ENABLED`, the fix is on the [DNC check gated troubleshooting page](/troubleshooting/dnc-check-gated). *** ## DNC & RND scrubbing ## Why is DNC off by default? Because DNC is a **list-hygiene** control, and list-hygiene controls fail open by design: you opt in with `dnc_sync_enabled`. The important caveat — on the hosted platform a clear verdict only counts as federal safe-harbor when `federal_feeds_synced: true`; until the federal feed is synced, a number listed only on the FTC register reads back clear. Sources, freshness, and the check endpoint are on [DNC Scrubbing](/compliance/dnc-scrub); the gate error itself is on [Troubleshooting: DNC\_SYNC\_NOT\_ENABLED](/troubleshooting/dnc-check-gated). *** ## BAA & HIPAA ## Why did my send throw HIPAA\_BAA\_REQUIRED? HIPAA mode is enabled for your organization and the send's audience or content matched PHI — the mode refuses PHI-bearing sends with `422 HIPAA_BAA_REQUIRED` until a Business Associate Agreement is executed, and HIPAA mode itself will not enable until then. The gate list is on [Send Gates](/compliance/send-gates); the two recovery paths are [Troubleshooting: HIPAA enable blocked (403)](/troubleshooting/hipaa-enable-baa-not-executed) and [Troubleshooting: HIPAA\_BAA\_REQUIRED (422)](/troubleshooting/phi-audience-baa-required). *** ## The one platform-mandated control ## Is there any compliance control the platform owns outright? Exactly one: the **US TCPA federal voice dialing window** described in the TCPA section above. Every other compliance control — quiet hours, DNC, RND, STIR/SHAKEN floors, HIPAA mode, DSAR, KYC gates, sender-ID registration — is tenant-owned, ships off or open, and fails open on unresolvable input. The full asymmetry list is on the [posture map](/compliance/posture-overview), and the guard itself is on [the TCPA federal voice guard](/concepts/tcpa-federal-voice-guard). *** ## Related references * [Compliance Posture FAQ](/compliance/posture-faq) — the operator-level mental model this routing table condenses. * [Your Tenant Compliance Posture: The Toggle Map](/compliance/posture-overview) — fail-open vs fail-closed per surface. * [Send Gates](/compliance/send-gates) — every send-time gate and its exact behaviour. * [Platform FAQ](/reference/faq) — non-compliance questions (authentication, billing, channels, webhooks).