Fraudulent AIT traffic makes up 5 to 40 percent of international A2P SMS traffic depending on the region, and businesses lost an estimated $1.6 billion to AIT in 2023, according to MEF (Mobile Ecosystem Forum). The global CPaaS market is separately forecast to grow at a 14% CAGR between 2024 and 2029, reaching $27.4 billion, according to Gartner, and global business messaging traffic is projected to grow from 2 trillion messages in 2025 to nearly 3 trillion by 2030, according to Juniper Research. Enterprises choosing an A2P SMS provider are choosing who protects that growth from fraud and who keeps messages compliant, not just who offers the lowest per-message rate.

Most provider comparisons focus on price per message and country coverage lists. Those matter, but they miss the questions that determine whether a provider actually protects a messaging program: how fraud is detected, whether compliance tooling is built in or bolted on, and what happens when a campaign gets flagged by a carrier.

This article covers the evaluation criteria that matter for US enterprise buyers selecting an A2P SMS provider, with specific criteria for finance, healthcare, and retail buyers, and the compliance credentials a provider should have before a contract is signed.

Monty Mobile's A2P Messaging service is built around these evaluation criteria directly: fraud detection at the routing layer and compliance tooling included, not sold separately.

What Is an A2P SMS Provider

An A2P SMS provider is a company that sells application-to-person messaging services, ranging from software-layer aggregators that resell access to multiple carrier connections, to wholesale carriers that hold their own direct carrier interconnect agreements. The distinction matters for evaluation: a provider without direct carrier relationships depends on intermediary aggregators for delivery, which adds a layer the buyer cannot see into. Buyers evaluating SMS Firewall and fraud-detection capabilities should ask specifically whether the provider's routes are direct or resold, since that affects both delivery reliability and fraud accountability.

Why It Matters: Provider Selection Is a Fraud and Compliance Decision

Under CTIA's Messaging Principles and Best Practices, carriers classify and filter Consumer and Non-Consumer traffic based on registered use case and sender behavior, which means a provider's traffic hygiene practices directly affect whether a buyer's own legitimate messages get filtered as collateral damage. A provider with a history of carrying low-quality or fraudulent traffic on shared routes creates risk for every enterprise sending through that provider's infrastructure, even enterprises with clean campaigns of their own. Evaluating a provider means evaluating the traffic it already carries, not just the features listed on its pricing page.

Questions worth asking directly in an RFP: does the provider disclose its route mix (direct carrier versus resold), does it publish delivery rate benchmarks by destination, and does it provide audit logs a buyer can review rather than summary dashboards alone.

Finance: Fraud Detection and Audit Trail Requirements

Financial institutions evaluating an A2P SMS provider should weight fraud detection heavily, since Artificially Inflated Traffic (AIT) fraud works by using bots to trigger fraudulent OTP sends and intercepting that traffic through a rogue party who shares in the resulting carrier revenue, according to Juniper Research. Because the traffic mimics legitimate authentication requests, it is largely invisible to standard monitoring unless the provider builds detection into the routing layer itself. A provider that only reports fraud after the fact, in a monthly summary, has already let the cost land on the buyer's account.

Fraud detection depth: Ask whether the provider's fraud detection operates at the routing layer in real time or only in post-send analytics. Real-time detection can block or reroute suspicious OTP traffic before it generates carrier charges, while post-send reporting only confirms the damage after the invoice arrives. Monty Mobile's SMS Firewall applies traffic analysis before delivery rather than after. Institutions should request a live demonstration of flagged-traffic handling, not just a feature list, and should ask specifically how the provider distinguishes legitimate authentication spikes from AIT activity, since both can look similar in raw volume terms.

Audit trail and documentation: Financial institutions need to reconstruct consent, delivery, and opt-out history on request, whether for an internal audit or a regulatory inquiry. A provider should offer exportable, timestamped logs covering consent capture, message content by campaign, and delivery status, not just aggregate volume reports. Providers that cannot produce this on request are a compliance liability regardless of their pricing or coverage claims. Ask specifically how far back the provider retains this data and whether retention periods can be adjusted to match the institution's own internal audit cycle.

Regulatory note: Financial institutions selecting an A2P SMS provider should confirm the provider supports documented consumer consent under the TCPA and can produce audit-ready records on request, in addition to any GLBA or state-level data handling requirements that apply to the underlying customer data.

Healthcare: Vendor Contract and BAA Requirements

Healthcare organizations evaluating an A2P SMS provider face a procurement question most other buyers do not: a covered entity must obtain satisfactory written assurances, in the form of a signed business associate agreement, from any vendor that creates, receives, maintains, or transmits protected health information on its behalf, according to HHS.gov. This applies to SMS providers handling appointment, prescription, or care-related content, even when the message text itself looks generic. A provider without a standard BAA template ready at procurement time is a signal to slow down, not a formality to skip.

BAA readiness: Ask for the provider's standard business associate agreement template during the RFP stage, not after the contract is signed. Providers accustomed to healthcare clients should have this ready immediately; providers unfamiliar with the request often reveal that healthcare is not a market they serve seriously. Confirm the BAA covers subcontractors and downstream infrastructure the provider itself relies on, not just the provider's own systems, and ask how the provider handles a subcontractor change mid-contract, since that is a common gap in vendor BAA coverage.

Two-way messaging and scheduling integration: Providers should support keyword-based reply routing for appointment confirmation and rescheduling, integrated with the buyer's scheduling system rather than requiring a separate portal. Evaluate how replies route back into existing systems during a proof-of-concept period before committing to a full rollout, since integration gaps discovered post-signature are expensive to fix and often surface only after patient volume ramps up. Monty Mobile's Healthcare solutions approach treats BAA coverage as a procurement default, not an add-on negotiation.

Regulatory note: Healthcare organizations selecting an A2P SMS provider should confirm business associate agreement coverage in writing before any traffic is sent, and should evaluate whether message content and associated metadata fall under HIPAA on a per-campaign basis.

Retail and E-Commerce: SLA and Burst Capacity Guarantees

Retailers evaluating an A2P SMS provider face a different failure mode than finance or healthcare buyers: the risk is not a single flagged message but a provider that cannot absorb a traffic spike during the highest-revenue weeks of the year. Marketing SMS sent during that same peak period carries the same consent requirements as any other campaign: TCPA's prior express written consent standard applies at holiday volume the same as any other week. The FCC attempted to add a sender-specific "one-to-one" consent requirement in 2023, but the Eleventh Circuit vacated it in January 2025 before it took effect. A provider's consent-capture tooling should still support sender-level granularity as a best practice, since that positions the buyer well regardless of whether a one-to-one requirement is reinstated.

SLA specificity: Ask for a written SLA that specifies delivery rate and latency commitments by destination carrier, not a single blended average across all traffic. A provider quoting one number for delivery rate across every carrier and message type is masking variance that shows up exactly when volume spikes. Request the SLA's remedy terms as well: what the provider owes the buyer when the SLA is missed, how that is tracked, and whether remedies are automatic or require the buyer to file a claim after the fact.

Campaign separation for burst periods: Confirm the provider supports separate registered campaigns for transactional and promotional traffic under the 10DLC framework, since mixing them risks carrier throttling on order confirmations during a marketing-driven traffic spike. Retailers should request a peak-load reference case from the provider covering a comparable prior promotional period, not a theoretical capacity number. Providers unwilling to share performance data from a real peak period are asking buyers to take capacity claims on faith, and that gap tends to show up at the worst possible moment. Monty Mobile's Retail and E-Commerce solutions approach is built around this separation by default.

Deployment Example: Retail Provider Evaluation Ahead of Peak Season

A US direct-to-consumer apparel retailer was preparing to switch A2P SMS providers ahead of its Black Friday and holiday promotional period after its incumbent provider experienced delivery delays during the prior year's peak week.

Pre-deployment setup: The retailer ran a structured RFP requesting written SLA terms by carrier, a peak-period reference case from each finalist, and separate campaign registration for transactional versus promotional traffic before selecting a provider.

Campaign execution: Over a 45-day period spanning Black Friday through Cyber Monday and into December, the retailer sent approximately 2.8 million promotional messages and 640,000 transactional order and shipping notifications through campaigns registered separately from the start.

Results: The retailer reported that transactional message delivery times stayed consistent throughout the peak period, with no carrier throttling events affecting order confirmations, since promotional and transactional traffic were isolated on separate registered campaigns from day one.

Note: This is an anonymized deployment scenario based on typical implementation outcomes. Specific results vary by implementation, audience quality, and market conditions.

This article focuses on provider evaluation criteria specifically. A companion piece on business SMS gateway infrastructure covers the technical routing layer in more depth; that article exists in the Monty Mobile blog pipeline, and this piece will link to it once it is live.

Compliance Requirements for A2P SMS Providers Serving the United States

A US-focused A2P SMS provider should meet the frameworks below as a baseline, not as an upsell. The table summarizes what to require and how to verify it during procurement.

Monty Mobile pairs 10DLC campaign management with its SMS Management Platform so consent and opt-out tracking are visible to the buyer directly, not held internally by the provider.

Getting Started: Evaluating and Onboarding an A2P SMS Provider

1. RFP with specific evaluation criteria: Request written answers on fraud detection method, route mix (direct versus resold), SLA terms by carrier, and compliance credentials before any pricing discussion begins.

2. Compliance documentation review: Collect the provider's standard BAA template, 10DLC registration process, and consent-capture tooling documentation during procurement, not after signature.

3. Proof-of-concept with real traffic: Run a limited campaign through the provider before full migration, and test reply routing, opt-out handling, and delivery reporting against your actual systems.

4. Peak-period reference validation: For retail and seasonal buyers specifically, request and verify a reference case covering the provider's performance during a comparable prior high-volume period.

To evaluate Monty Mobile's A2P Messaging infrastructure directly, contact Monty Mobile to request an RFP response.

About the Author

Daniel El Dib is Senior Brand Manager at Monty Mobile, a global telecom solutions provider with 25+ years of MNO relationships across 120+ countries. Daniel leads GTM strategy and campaign execution across Monty Mobile's CPaaS, A2P messaging, and enterprise communication product lines.

Frequently Asked Questions

What is the difference between an A2P SMS provider and an A2P SMS aggregator?

An A2P SMS provider is the umbrella term for any company selling application-to-person messaging services. An aggregator is a specific type of provider that consolidates access to multiple carrier connections behind a single API, rather than holding its own direct carrier interconnect agreements. Enterprises evaluating providers should ask which category a vendor falls into, since it affects route visibility and fraud accountability.

How do I evaluate an A2P SMS provider's fraud protection?

Ask whether fraud detection happens at the routing layer or only in post-send reporting, whether the provider can show AIT and grey-route detection specifically, and whether flagged traffic is blocked automatically or requires manual review. A provider that can only report fraud after the fact offers less protection than one that blocks it in real time.

Does an A2P SMS provider need to sign a HIPAA business associate agreement?

If the provider will handle SMS content that references patient appointments, prescriptions, or care details, most healthcare organizations should require a signed business associate agreement before sending any traffic. Confirm this during procurement rather than after the contract is signed, since retrofitting a BAA after go-live creates unnecessary compliance exposure.

What compliance credentials should an A2P SMS provider have for the US market?

At minimum, a US-focused A2P SMS provider should support TCPA-compliant consent capture, CTIA Messaging Principles adherence, and 10DLC campaign registration through The Campaign Registry. Healthcare and finance buyers should additionally confirm business associate agreement availability and audit-ready consent documentation.