Application-to-Person (A2P) Messaging Explained: OTPs, Channels and Compliance

Application-to-Person (A2P) messaging is the method by which a software application, rather than a person typing on a phone, sends a message to a mobile user. It is the machinery behind the one-time passwords (OTPs), two-factor authentication (2FA) codes, login verifications, payment confirmations, delivery updates, appointment reminders and service alerts that arrive every day. A2P is also called business or enterprise messaging, and while SMS remains its backbone, the category now spans richer channels such as RCS and WhatsApp. This explainer sets out what A2P messaging is, how a message actually travels to a handset, the channels and rules that govern it, and what has changed for buyers and developers in 2026 — including Singapore's Sender ID rules.

Table of contents

• What is A2P messaging?
• Core concepts: A2P vs P2P, M2M and P2A
• Technical breakdown: how a message reaches the handset
• Key benefits and enterprise use cases
• Modern channels: RCS, WhatsApp and omnichannel
• Compliance and regulation, including Singapore
• Challenges, risks and limitations
• Market trends and technological developments
• Comparative analysis of A2P channels
• Future outlook
• Frequently asked questions
• SEO recommendations

What is Application-to-Person (A2P) messaging?

Application-to-Person (A2P) messaging describes traffic that originates from a system — a CRM, a banking platform, an e-commerce checkout or a verification service — and terminates on a mobile user's handset. The defining feature is the origin: no human is typing the message. Instead, an event triggers it. A login attempt requests a code; a shipment moves and a tracking update fires; a payment clears and a confirmation follows.

A2P traffic is typically high-volume, can be one-way or two-way, and is used for transactional, informational or promotional purposes. In markets such as the United States and Canada, carriers treat nearly all platform-mediated traffic — anything sent through a provider such as Twilio, Infobip or Sinch — as A2P, and price and police it accordingly. That classification matters, because A2P carries higher termination rates, stricter consent obligations and heavier content filtering than ordinary personal messaging.

Core concepts: A2P vs P2P, M2M and P2A

A2P sits within a family of four messaging types, and who originates a message decides its pricing, routing and the compliance regime it falls under. Understanding the boundaries prevents the single most common operational mistake: sending business traffic down a consumer path.

P2P (Person-to-Person) is the conversational messaging between individuals on personal devices. M2M (Machine-to-Machine) is direct device-to-device exchange common in IoT — smart meters, trackers, alarms and point-of-sale terminals — where SMS is valued as a low-power, coverage-independent channel for alerts, wake-ups and fallbacks. When an M2M alert reaches a human, such as an equipment-failure text to a technician, it effectively becomes A2P. P2A (Person-to-Application) is the reverse of A2P: a user texts a code with a keyword such as JOIN, STOP or BALANCE, or replies to an A2P message. In the United States, P2A is generally folded into A2P as inbound business traffic.

A2P technical breakdown: how a message reaches the handset

An A2P message follows a defined path from trigger to handset, and a status receipt returns along the way. Each hop is a place where the message can be delayed, filtered or lost, which is why route quality is the variable that separates a reliable OTP service from an unreliable one.

1. The application triggers a send. A CRM, banking system or verification service calls a REST API or opens an SMPP (Short Message Peer-to-Peer) bind session with a messaging provider.
2. The provider routes the message. An SMS gateway or CPaaS (Communications Platform as a Service) provider selects a path to the destination network through interconnect agreements, hubs or direct carrier links.
3. The terminating operator delivers it. The message reaches the mobile network operator's SMSC (Short Message Service Centre), which applies filtering and sender-ID checks before storing and forwarding it to the handset.
4. A delivery receipt returns. A Delivery Receipt (DLR) reports the outcome — delivered, failed or pending — back to the application, closing the loop.
5. Optional two-way support. A reply from the user travels back as a mobile-originated message, the P2A leg.

Sender types and route quality

The sender identity a business uses shapes cost, throughput and deliverability. The choices are most formalised in the United States, where alphanumeric sender IDs are not supported on A2P routes at all — a message always arrives from a number-type sender.

Route quality is the other half of the picture. White or direct routes run under commercial agreements with carriers, delivering high deliverability, accurate DLRs, sender-ID preservation and compliance. Grey routes bypass official A2P channels — often disguising A2P as P2P through SIM farms to dodge termination fees — and are cheaper but unstable, prone to filtering, fake DLRs and sudden blocking by the terminating carrier's SMS firewall. For OTPs, where latency and reliability decide whether a user can log in, grey routes are a false economy.

Key benefits and enterprise use cases

A2P messaging endures because SMS works on virtually every handset without an app or data connection, is read quickly, and delivers in near real time. Those properties suit a specific set of high-stakes, time-sensitive jobs.

• Authentication and security. OTPs, 2FA and login verification are the highest-volume A2P segment, accounting for roughly 40 to 41 per cent of enterprise A2P SMS traffic. These need sub-ten-second delivery, near-total reliability and fraud controls.
• Transactional notifications. Payment confirmations, appointment reminders, delivery and shipping updates and service alerts. Transactional messages generally enjoy higher deliverability and lighter consent rules than pure marketing.
• Customer engagement. Promotional campaigns and loyalty programmes, which carry the strictest consent and opt-out obligations.
• Machine-originated alerts. The M2M intersection, where IoT devices send temperature spikes, meter readings or vehicle telematics that notify a human or trigger a system action, using SMS as a wake-up or fallback in low-connectivity environments.

For authentication specifically, delivery hygiene matters as much as the code itself. The widely used reference pattern is a six-digit single-use code with a short expiry, a per-number send throttle, a clear "do not share this code" line, and no links in the message body — carriers frequently filter OTP messages that contain URLs as suspected phishing.

Modern channels: RCS, WhatsApp and omnichannel

A2P has expanded well beyond classic SMS, while keeping SMS as the universal fallback. The modern pattern is omnichannel orchestration: a platform attempts the richest channel a recipient can receive, then cascades to SMS, and to voice as a last resort.

RCS (Rich Communication Services) adds branded senders, images, carousels, buttons and read receipts, verified through a business profile. It runs on the GSMA-maintained Universal Profile, which reached version 4.0 in March 2026 and 4.1 in July 2026. The channel's reach widened once Apple added consumer RCS in iOS 18 (September 2024) and began rolling out RCS for Business from iOS 18.1, though business RCS on the iPhone remains carrier- and market-dependent rather than universal. Google reported more than a billion RCS messages sent daily in the United States by May 2025.

WhatsApp Business Platform offers high engagement and rich media for conversational service and, where opt-in exists, utility and authentication messages. Its billing changed on 1 July 2025 from per-conversation to per-message pricing across four template categories — marketing, utility, authentication and service. Authentication is the cheapest category, and Juniper Research notes WhatsApp authentication rates run 50 to 90 per cent below traditional SMS OTPs, a direct pricing threat to SMS's largest segment. WhatsApp is not a full SMS replacement, however, because it depends on the app and a data connection. Voice OTP, email and push notifications round out the fallback options.

Compliance and regulation, including Singapore

A2P is tightly regulated because it is a vector for spam and fraud. Rules cluster around three demands: proof of consent, registration of the sender, and control of message content. The specifics vary sharply by market, and sending into a country without meeting its regime usually means filtering or outright blocking.

Singapore: SSIR, the Spam Control Act and the PDPA

Singapore runs one of the stricter sender-registration regimes in the region. The SMS Sender ID Registry (SSIR), operated by the Singapore Network Information Centre (SGNIC), an IMDA subsidiary, was set up in March 2022. Under the Full SSIR regime, mandatory since 31 January 2023, any organisation sending SMS to Singapore mobile users with an alphanumeric Sender ID must register that ID. Messages from non-registered Sender IDs are stamped with a "Likely-SCAM" header so recipients can spot them. The originally planned move from labelling to outright blocking has been held in abeyance, so as of 2026 unregistered IDs are labelled rather than dropped.

Registration needs a local Unique Entity Number (UEN) and costs roughly S$500 as a one-time fee plus about S$200 a year per protected Sender ID, submitted through IMDA-licensed participating aggregators that feed the mobile networks — Singtel, StarHub and M1. The approach appears to be working: the Singapore Police Force's Annual Scam and Cybercrime Brief 2025 reported that scams using SMS as the first point of contact fell about 65 per cent year on year, part of an overall drop in scam cases of 27.6 per cent to 37,308, with losses of about S$913.1 million.

Two further rules shape marketing traffic into Singapore. The Spam Control Act 2007 requires bulk unsolicited commercial SMS to carry an <ADV> label and an unsubscribe facility, with opt-outs honoured within ten business days. The Personal Data Protection Act (PDPA) adds the Do Not Call Registry, whose "No Text Message" register must be checked before marketing to a Singapore number, with breaches attracting penalties of up to S$1 million or 10 per cent of Singapore turnover. On the consumer side, the ScamShield app, with around 1.53 million users and the 1799 helpline, lets the public verify and report scam SMS.

United States, India and the European Union

Challenges, risks and limitations

The same reach that makes A2P useful also attracts abuse, and several risks now sit at the centre of any serious deployment.

• Carrier filtering. Unregistered or non-compliant traffic is filtered or blocked. Registration is no longer optional in major markets.
• Artificial inflation of traffic (AIT), or SMS pumping. Bots trigger mass fake OTP requests to destinations with high termination rates, so intermediaries collect the interconnect fees. Enea estimates AIT at around 5 per cent of international A2P traffic, costing brands roughly US$2.4 billion between 2022 and 2024. The best-known case is Elon Musk's February 2023 claim that Twitter lost about US$60 million a year to fake 2FA SMS from some 390 operators — a self-reported figure, but an illustrative one.
• Grey-route instability. Cheaper paths produce unreliable DLRs and can degrade or stop without warning.
• OTP latency and security. SMS OTPs can be intercepted through SS7 and Diameter signalling attacks or SIM-swap fraud.

The security caveat now carries formal weight. In July 2025, NIST SP 800-63B (Revision 4) classified SMS and PSTN one-time passwords as a "restricted" authenticator — still permitted, but only where the service also offers a non-restricted alternative, warns users, and watches for SIM-change signals. Defences against AIT are practical: allow-list only the destination countries you serve, apply velocity limits per number and IP, verify numbers before sending, and monitor OTP conversion rates by geography, since pumped traffic shows collapsing completion rates. For accounts that warrant it, phishing-resistant methods such as passkeys complement SMS rather than depending on it.

Market trends and technological developments

The broad business-messaging market — SMS together with RCS, over-the-top channels such as WhatsApp, push and email — was valued at roughly US$74 to 77 billion for 2025 and 2026, growing around 7 per cent a year. Estimates for the A2P SMS slice alone vary widely by methodology, from about US$20 to 30 billion on an enterprise-spend basis to figures above US$80 billion on an operator-revenue basis, so a single precise number should be treated with caution.

The clearer signal is a shift in the mix. Pure A2P SMS volume is flat to declining, which an Enea and Mobilesquared study in November 2025 attributed largely to rising international termination fees. Over-the-top business messaging, by contrast, is growing about 45 per cent in two years, from roughly 390 billion messages in 2025 toward 560 billion in 2027, per Juniper Research. Authentication traffic — the largest SMS segment — is the most exposed to substitution as RCS and WhatsApp take share. Transactional and authentication use cases still grow faster than pure marketing, cloud and CPaaS deployment dominates, and fraud prevention, compliance tooling and omnichannel routing have become the main points of difference between providers.

Comparative analysis of A2P channels

No single channel wins on every axis. The practical choice weighs reach, richness, cost and how time-sensitive the message is.

For most enterprises the answer is not one channel but orchestration: attempt a rich, branded channel where the recipient supports it, and fall back to SMS so the message still lands. For a time-critical login code, deliverability and latency outrank richness, which is why SMS remains the dependable floor beneath the newer channels.

Future outlook

A2P messaging is not disappearing; it is diversifying. SMS will remain the reliability backstop that makes rich-channel-first strategies safe, even as its share of traffic slips. RCS and WhatsApp will absorb more branded, interactive and authentication volume, and omnichannel platforms with automatic fallback will become the default rather than a premium feature. Sender registration, carrier firewalls and anti-fraud tooling will keep expanding, and telco network APIs — number verification, silent authentication and identity checks under the GSMA Open Gateway — will give businesses ways to verify a user without a code travelling at all.

For buyers, the durable lesson is unchanged by the channel churn. Classify traffic correctly, register where the destination market requires it, prefer accountable direct routes over grey ones, and build monitoring and multi-channel fallback into the design. Those choices decide whether OTPs and notifications arrive in time far more than the logo on the sender does.

Decision rule

Use SMS on a registered direct route for OTPs and critical alerts, and add RCS or WhatsApp where recipients support them and richer content earns its cost. Register your Sender ID or campaign in every market that demands it — SSIR in Singapore, The Campaign Registry in the United States, DLT in India — and treat compliance, route quality and fallback as part of the architecture, not an afterthought.

Frequently asked questions

Sources and further reading

• SGNIC — Overview of the SMS Sender ID Registry (SSIR)
• IMDA — Enhanced Measures Against Scam SMS (press release, 25 January 2023)
• Singapore Police Force — Annual Scam and Cybercrime Brief 2025
• PDPC — Do Not Call Registry and your business
• NIST SP 800-63B — Digital Identity Guidelines (Authentication)
• Grand View Research — A2P Messaging Market Report
• Enea and Mobilesquared — A2P SMS revenue study (November 2025)
• Juniper Research — OTT business messaging traffic to grow 45%
• Enea — Artificial Inflation of Traffic: the US$2.4 billion problem
• Telnyx — What is 10DLC (US A2P registration)
• CTIA — Messaging Principles and Best Practices (2023)
• GSMA — RCS Universal Profile 4.0