SMS for banks and financial services: use cases and compliance

SMS for banks and financial services works best for four jobs: fraud alerts, payment reminders, one-time login codes and conversations between advisors and clients. It goes wrong in three places: weak consent records, messages that are never archived, and texts that look exactly like the scams your customers are trained to ignore.

This guide is for banks, credit unions, lenders, wealth advisors, and the software platforms that text on their behalf. It covers which messages to send, how to register them, what records to keep, and how to write texts that are hard to fake. We make Ready, so we use it as the worked example. None of this is legal advice. Financial texting sits under the TCPA, carrier rules and your own regulator's expectations, and your compliance team or counsel makes the final call.

The four use cases that justify bank text messaging

Bank text messaging is not mainly a marketing channel. The texts customers actually want are the ones about their own money.

Fraud and security alerts

"Did you just spend $842 at an electronics store? Reply YES or NO." Customers read this kind of text fast and answer it fast. The FCC has created narrow exemptions for certain fraud and data-breach alerts from financial institutions. Those exemptions come with conditions, including limits on message count and content, and they must be free to the recipient. Whether your alerts qualify is a question for counsel. Don't assume the exemption applies.

Payment and due-date reminders

Loan payments, card due dates, overdraft warnings and low-balance alerts are informational texts. They work because they are expected and short. Debt collection messaging carries its own rules on timing, frequency and content, so keep routine reminders separate from collections.

Two-factor and one-time codes

Login codes and transaction confirmations are the highest-volume financial texts. They are also the most time-sensitive. A code that arrives four minutes late is useless.

Advisor and banker conversations

Relationship managers, loan officers and financial advisors text clients to schedule calls, chase documents or answer quick questions. This is where record-keeping obligations bite hardest, which we cover below.

How to register each use case for 10DLC

Every text from a regular 10-digit business number in the US has to sit on a registered A2P 10DLC brand and campaign. Unregistered traffic gets carrier-filtered. Financial brands also get closer review, because carriers see a lot of fraud dressed up as banking.

The most common mistake is registering everything as one marketing campaign. Carriers review and throttle by declared use case, so declare what you actually send. Our use-case picking guide covers this in depth. Here is how the four financial jobs usually map:

On Ready, registration happens in the app or through the registration API. There is no setup fee: the charge at submit is the first month, $25, and after that the monthly is $25 for registration + $2 per number. Most approvals take 2 to 7 days. If your sample messages get bounced, our 10DLC rules breakdown explains what carriers check.

If you are a platform texting for many institutions

Core banking, loan origination and advisor CRM vendors often send texts for dozens of credit unions or firms. Each institution should be its own brand with its own registration and numbers, not one shared sender. Ready handles this with sub-accounts: each gets separate numbers and its own 10DLC registration, and everything runs through one REST API. 10DLC for SaaS platforms explains who registers the brand in that setup.

Consent: what you have to keep, and what Ready keeps

Consent in financial services texting is a record-keeping problem as much as a legal one. If a borrower disputes ever opting in, you need to show when they agreed, to what wording, and where.

That record has to live in your system. Ready records the sender's opt-in attestation on every bulk send and every API send that sets consent_attested: who sent, to how many, and when. That builds an audit trail of your promise. It is not a per-contact consent record. Ready does not store the recipient's opt-in time, the wording they saw or the page URL, and a keyword reply does not create one. Your core system, CRM or onboarding flow keeps that. (A contact who signs up on a Ready-hosted opt-in page is the exception: Ready stores that sign-up, with the time, IP address and exact wording, and support@tryready.com can send you a copy.)

Here is a single send through the messages API:

POST https://api.tryready.com/v1/messages
X-API-Key: <key>
Idempotency-Key: 6f1c2a0e-4b7d-4e2a-9a51-0c3d7e8f1b22

{"to": "+12125550199", "body": "Acme CU: Your loan payment of $412.18 is due Mar 5. Questions? Call the number on your card. Reply STOP to opt out.", "consent_attested": true}

The Idempotency-Key matters more in finance than almost anywhere else. If a retry ever sends a payment reminder twice, you get confused customers and support calls. Setting consent_attested is your promise that this person agreed to texts, so only set it when your records back it up.

Several controls run on every send:

• Opt-outs. STOP and UNSUBSCRIBE are honored automatically, and the opt-out applies across campaigns. You can read opt-outs with GET /v1/opt-outs and sync them back to your core system. That list holds only this account's opted-out contacts, so check GET /v1/opt-outs/:phone before another tool texts a number.
• Refused sends. Opt-outs, numbers on your Ban list and known landlines are refused up front and not charged.
• Litigator and DNC scrubbing. Numbers can be screened against known TCPA-litigator and DNC-complainer lists before a send. TCPA exposure runs roughly $500 to $1,500 per text, so this is cheap risk reduction, not immunity. The standalone scrub is $0.005 per contact.

Record-keeping for advisors and bankers

Broker-dealers and registered investment advisers have recordkeeping obligations that cover business communications, texts included. Regulators have fined firms heavily for "off-channel" messaging on personal phones. The fix is not to ban texting. It is to route business texts through a business system and keep the history.

On Ready, every advisor conversation sits in a shared inbox, not on a personal phone. The full message history is readable through GET /v1/messages, paged with before_id, so you can pull it into whatever archive your compliance team already uses. Ready is a messaging platform, not a regulatory archive. If your firm needs WORM storage or supervisory review, export to a tool built for that.

For calls, the Ready Dialer offers click-to-call from the dashboard with consented call recording and transcripts, billed at $0.025/min. It is manual calling from a dial pad, which suits a loan officer following up on a document request.

Smishing-safe message design

Your customers are told every week that texts from "their bank" are scams. A legitimate text has to look different from a fake one. These rules help:

1. No links to login pages, ever. Point people to your app or the number on their card. Fraud alerts should ask for a YES/NO reply only.
2. Never ask for a PIN, password, full account number or the code itself. Then say so in your texts: "We will never ask you for this code."
3. Lead with your registered brand name, spelled the same way every time.
4. Text from consistent numbers. Customers learn which number is really you. Rotating senders randomly undermines that.
5. Skip public link shorteners. Carriers filter them, and they look exactly like phishing. Messages can be filtered even after approval, usually for content reasons like this.
6. Keep it plain text. No emoji, no ALL CAPS urgency, no "act now or your account will be locked."

A blue line can help with recognition. It sends as iMessage, so iPhone users see the institution's name and photo instead of a bare number. It costs $99 a month per line plus 6 cents a segment, and replies are also 6 cents a segment. Each line can start up to 50 new conversations a day, so it suits advisor relationships, not bulk alerts. Campaigns send from regular numbers. Blue bubble texting for business covers the tradeoffs.

A worked cost example, and one honest limitation

Example assumptions: a credit union sends 10,000 payment reminders per month. Each is 150 plain characters, which is 1 GSM-7 segment. The Standard rate is $0.0075/segment plus a $0.0045 carrier fee per segment.

• 10,000 × 1 segment × $0.0075 = $75, plus 10,000 × $0.0045 in carrier fees.
• If scrubbing is switched on for the account, add 10,000 × $0.003 = $30.
• Add one emoji and stretch the text to 175 characters, and it becomes 3 unicode segments: 30,000 segments, or 30,000 × $0.0075 = $225 at the Standard rate plus 30,000 × $0.0045. Plain text matters for your bill as well as for trust.
• Replies are billed like sent texts, so a fraud alert that asks for YES/NO costs you the reply too.

Raw CPaaS APIs such as Twilio cost less per segment, at about $0.0083. If your team wants to build registration, scrubbing, opt-out sync and an inbox itself, that is a reasonable choice. What you pay for on Ready is that stack already built and switched on.

The limitation: quiet hours. Ready holds sends outside permitted local hours for the recipient's area. That is right for payment reminders and wrong for a 2 AM login code or a live fraud alert. Before routing time-critical codes through Ready, read the docs and talk to us about your traffic. Many institutions run OTPs through a dedicated verification provider and use a platform like Ready for everything else. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.

The practical takeaway

Separate your financial texts by use case, register each one honestly, keep consent records in your own system, archive advisor conversations, and write every message so a scammer would have a hard time copying it. If you want to test the setup, the quickstart walks through a first send. The first 20 texts are free one-to-one sends, so use them before you register. To send, you add a card and get a number, which is $2 a month with the first month charged when you get it. You can sign up here when you're ready to try it.

FAQ

Is a fraud alert text exempt from TCPA consent rules? Some may be. The FCC has narrow exemptions for certain financial fraud and breach alerts, with conditions on content, frequency and cost to the recipient. Have counsel confirm before relying on one.

Can we put a link in a payment reminder? You can, but we'd advise against it. Links in bank texts look like phishing and draw carrier filtering. Point customers to your app or a phone number they already trust.

Does Ready store proof that each customer opted in? Mostly no. Ready records your attestation per send: who sent, to how many, and when. The exception is a customer who signs up on a Ready-hosted opt-in page: Ready stores that sign-up (time, IP address and exact wording), and support@tryready.com can send you a copy. For every other customer, the opt-in time, wording and source must live in your own system.

How long does 10DLC registration take for a financial brand? Most approvals take 2 to 7 days. Financial brands get closer review, so clean sample messages and an accurate use case help.

Can advisors text clients from their personal phones? For regulated advisors, that creates off-channel recordkeeping risk. Route business texts through a shared business inbox and export the history to your archive.