Restricted Industries & SHAFT on Business Messaging: A Vertical Buyer Guide

"Can I send alcohol promos over SMS?" and "What are the texting rules for a political campaign on 10DLC?" are two questions every business-messaging buyer asks early, and the honest answer to both has the same shape: it depends on the vertical, the channel, and the carrier family underneath it. This guide is the buyer-side reference for that answer: the SHAFT baseline the US carriers enforce, a per-vertical playbook for the eight restricted verticals buyers ask about most, the way WhatsApp, SMS, and RCS give different answers to the same vertical, and a pre-launch checklist that catches problems before a carrier does.

Every control named here is a tenant-owned setting in Devotel Orbit. The final decision on any message still belongs to the carrier, aggregator, or platform reviewing your traffic, and this guide is not legal advice.

What SHAFT means, carrier family by carrier family

Across US A2P messaging — 10DLC, short code, toll-free — the carriers enforce a shared content standard known as SHAFT. The Orbit docs' Restricted & Prohibited Industries reference puts it in a table, and the rows are worth quoting directly, because the same five categories show up in every carrier family's automated filters:

Cannabis and CBD ride along as an extension of SHAFT: the carriers prohibit cannabis on US A2P messaging — including CBD, even where it is legal at the state level — and content that promotes it fails 10DLC vetting.

How the baseline is enforced varies by carrier family:

• US A2P SMS applies SHAFT twice: once at brand and campaign vetting, where TCR reviews your stated use case and sample messages, and again at dispatch through the carriers' automated content filters.
• WhatsApp applies Meta's Commerce and Business Messaging policies, which are stricter than SMS in several verticals and global in scope. Firearms, for example, are blocked on WhatsApp everywhere, not merely on most US carriers.
• RCS layers each carrier's own rules plus Google's agent-verification requirements on top of the same baseline.

What a violation actually costs

A blocked message is the cheap outcome. The expensive ones compound:

• Sender de-registration. A suspended 10DLC campaign or a brand rejected mid-program stops every message on that sender, transactional traffic included.
• WABA ban. A WhatsApp Business Account banned for policy violation is banned across providers, not just on the platform that caught it. You cannot route around it by switching vendors.
• Vetting history. A re-file after a rejection carries the prior rejection with it. Repeated misclassification of a restricted vertical reads as intent.

This is why the winning posture is catching restricted content before filing, before scheduling, ideally before the template leaves your editor, rather than arguing with a carrier afterwards.

The per-vertical playbooks

For each vertical: what is allowed with documented consent, what is prohibited outright, and which Orbit controls to configure. The controls repeat because they are the same tenant-owned surfaces every restricted program runs on — the restricted-industries gate, the content policy scanner, the per-campaign 10DLC class, quiet hours, and the consent-required gate — tuned differently per vertical.

Political & advocacy

Allowed for registered campaigns and issue advocacy with documented registration in the relevant jurisdiction. The posture that survives review is an FEC-style documented-consent posture: every recipient on a political list traces to a signed opt-in that names the campaign, and the consent record is retained and bound to the messages it authorizes. Prohibited outright: election misinformation, impersonation of officials, and sending through the temporary blackouts some platforms impose during election windows.

Controls: file the traffic under the 10DLC POLITICAL campaign class — routing political traffic through a generic marketing class is a vetting rejection when caught at filing and a de-registration when caught after. Turn on the consent-required gate so nothing sends without a consent record on file, and set quiet hours to the recipient's local time. If the program has a voice leg, Orbit's FCC AI-voice disclosure guard covers AI-generated voice calls with the disclosure the FCC expects, on top of the federal calling window Orbit enforces at dial time.

Alcohol

Allowed with age-gating — 18+ or 21+ depending on the market — and never targeting minors; blocked outright in dry markets. Prohibited: youth-targeted creative, health or fitness claims, and any send into a market whose country rules block alcohol.

Controls: check the per-country content restrictions for every destination before launch; Orbit re-reads them at send time, so a market that tightens later stops passing without any action from you. Hold an age-attested consent list — the opt-in captures the attestation and the consent-required gate keeps everyone else out. Run the content policy scanner in strict mode on the alcohol sender, so a promo that drifts into a prohibited claim is rejected at dispatch instead of filtered downstream.

Gambling, betting & lottery

Allowed for licensed operators in regulated markets only, with the license produced at onboarding. Prohibited outright in any jurisdiction where gambling is illegal, and prohibited everywhere for "guaranteed win" claims and for messaging anyone on a self-exclusion list.

Controls: load self-exclusion and do-not-call lists into your suppression surface before the first send — honouring self-exclusion is a licensing condition, not a preference. Set quiet hours and frequency caps; gambling programs are exactly where a burst of late-night sends turns a licensed program into a complaint file. Scope the campaign to the markets where the license holds, per the country rules.

Cannabis & CBD

The honest playbook is short: promotional cannabis and CBD content is prohibited on US A2P messaging — including CBD, even in states where the product is legal — and Meta's policies close the WhatsApp door as well. No consent posture, campaign class, or scanner setting makes it sendable. What the controls are good for here is defense against accident: teams with a mixed catalog run the policy scanner in strict mode so a cannabis reference cannot slip into an otherwise-clean template.

Crypto

Allowed: informational and account-security messaging — login alerts, price alerts, KYC prompts. Restricted to prohibited: promotional crypto — token sales, airdrops, leveraged products, "get rich quick" framing — which US 10DLC blocks outright and Meta's commerce policies treat more strictly still on WhatsApp.

Controls: separate the senders. Transactional account alerts and promotional content belong in different campaigns with different 10DLC classes, because the vetting verdicts differ and a promotional rejection should not take the security alerts down with it. Keep the scanner in strict mode on the promotional sender.

Tobacco

Restricted to prohibited: cigarettes, cigars, vapes, and other nicotine products are blocked on most messaging channels; cessation services are the usually-allowed slice. Controls: scope the campaign to cessation programming at filing, and run strict scanning so product promos cannot ride along inside a cessation sender.

Debt collection

Allowed with clear APR disclosure and FDCPA-style disclosure language in the message body. Prohibited on US carriers: high-cost and payday lending above the roughly 36% APR threshold. Controls: quiet hours matter more here than in any other vertical — collection windows are narrow and complaint-driven. Pair them with frequency caps, keep consent and suppression current, and lint every template against the disclosure rules before scheduling.

Pharmaceuticals & health

Allowed: appointment reminders, refill notifications, OTC and wellness products. Prohibited: direct-to-consumer sale of prescription drugs, controlled substances, and weight-loss or HRT drug promotion. Controls: the consent-required gate for reminder traffic, per-campaign separation of refill-transactional from wellness-promotional traffic, and strict scanning on the promotional side.

Channel-layer deltas: same vertical, different answers

The mistake buyers make is assuming a vertical verdict transfers across channels. It does not:

• Cannabis is prohibited on US A2P SMS and on WhatsApp; there is no channel where promotional cannabis passes.
• Firearms are "restricted to prohibited" on SMS but banned globally on WhatsApp under Meta policy.
• Crypto informational messaging passes 10DLC vetting, while the same brand's promotional angle faces Meta's stricter commerce rules on WhatsApp.
• Alcohol is age-gated on both, but the mechanics differ: carrier country rules and CTIA guidance on the SMS side, Meta's commerce policy on the WhatsApp side.
• RCS adds a third answer set — the carrier's own rules plus Google's agent verification — so a vertical that passes on SMS can still fail RCS agent approval.

Plan per channel, not per brand. A multi-channel restricted program is several compliance postures that happen to share a contact list.

The pre-launch checklist

1. Declare the vertical honestly at KYC onboarding. The vertical you select during sender-ID and brand KYC drives the documents you are asked for and the scrutiny the registration receives.
2. Run the 10DLC pre-flight wizard before filing. It checks your vertical and sample content against the restricted-content categories before the registration reaches TCR, and a failed pre-flight returns a fix card naming the blocking category. Re-scope on the fix card; it is cheaper than a TCR rejection that travels with your brand.
3. Pick the per-campaign 10DLC class to match the traffic — POLITICAL for campaigns, transactional classes for alerts — never a generic class for a restricted vertical.
4. Turn on the consent-required gate, and load double opt-in where the vertical earns extra scrutiny.
5. Set quiet hours to recipient local time and frequency caps to the program's complaint budget.
6. Load suppression — DNC, self-exclusion, and opt-outs — before the first send.
7. Set the content policy scanner to strict on restricted senders and lint every template at compose time, so restricted content fails in your editor, not at dispatch.
8. Check the country rules for every destination market. Orbit re-reads them per send, but you want the surprise at planning time, not at send time.

The longer manual version of this loop, with the documents each step asks for, is the KYC sender-ID compliance loop checklist.

Honest limits: what Orbit enforces and what it cannot

Orbit enforces your tenant posture and the floors you set: the gates above run on your traffic at compose time and at dispatch, in the modes you choose. What Orbit cannot do is override the reviewer downstream of it. The final decision on any campaign or message belongs to the carrier, aggregator, or platform — a message that passes every Orbit check can still be filtered, delayed, or rejected by the carrier's own systems, and a campaign suspension or WABA ban is the carrier's or Meta's decision to make. This guide is not legal advice, and the rules change frequently; when a vertical or market is ambiguous, ask before you send.

Related reading

• One-Click Vertical Compliance Bundles — the pre-wired healthcare, fintech, e-commerce, and payments packs that provision these controls as drafts.
• Consent-Proof-First Messaging — binding a consent record to every message, so the documented-consent posture is retrievable, not asserted.
• The KYC Sender-ID Compliance Loop Checklist — the manual loop for sender registration and vertical documents.
• The Restricted & Prohibited Industries reference in the Orbit docs — the plain-language table this guide quotes from, kept current as carrier posture drifts.