Guide · Setup · For the owner whose provider did it all and kept the PIN

Registering a WhatsApp business number: the PIN, where your data is kept, and the 72-hour lock

Before a business number can send a single message through the WhatsApp Business Platform it has to be registered, and registration is where three things owners later ask about are decided: the six-digit PIN that protects the number, the country where Meta keeps the number's data at rest, and a limit that can lock a number out for three days if someone keeps retrying. Meta's pages are written for developers; here is what they mean for the business that owns the number.

Published 1 October 2026

Three steps, and only the last one is done by software

Add the number in WhatsApp Manager. Meta's page says WhatsApp Manager is now entered through a Messaging account: choose the Messaging account first, then manage the numbers of the WhatsApp accounts linked to it.
Prove you own it, in WhatsApp Manager. The usual code by call or text, to a number that is yours and reachable.
Register it, by an API call. Meta is explicit that this step cannot be done in WhatsApp Manager or the App Dashboard; whoever runs your system does it. The same call is repeated after an approved display name change, and only after the approval arrives, because repeating it earlier does nothing. The display name guide covers that approval.

The 72-hour lock

Meta allows 10 registration attempts per number in any 72-hour window. The eleventh is refused and the number cannot be registered for the next 72 hours. The same limit applies separately to deregistering. A system that retries on failure can lock a number out of service for three days; that is a setup fault, not a Meta outage.

The PIN

What it is: A six-digit two-step verification PIN, required every time the number is registered. Meta's page says two-step verification is enforced at account creation and that there is no way to switch it off.
Who sets it: If the number already has a PIN, registration needs that PIN. If it does not, the six digits given at registration become its PIN from then on. Whoever registers your number for the first time is choosing your PIN; make sure the business, not only the provider, has it.
If it is lost: Meta's page gives a click path: Business settings, the business, Messaging Accounts, the account, Settings, WhatsApp Manager, the number's Settings, Two-step verification, Change PIN.
It is going away: Both pages carry the same notice: the six-digit PIN is being deprecated for eligible Cloud API numbers, with eligibility rolling out gradually. When a number becomes eligible, the Two-step verification tab disappears from WhatsApp Manager and there is no PIN to change. If the tab is still there, the number is not yet eligible.

Where the data is kept

Registration is also the only moment to choose local storage. Meta's page describes it as storing the number's data at rest in a country you pick from its list, and the list includes the United Arab Emirates, Bahrain and South Africa in the Middle East and Africa, alongside India, Singapore, Indonesia, Japan, South Korea and Australia; Germany, Switzerland and the United Kingdom; Brazil; and Canada.

Set at registration, or not at all: The country is given in the registration call. A number already registered without it has to be deregistered and registered again with it.
Changing or removing it is the same operation: Meta says local storage cannot be switched off or moved directly. Deregister, then register again without the country to remove it, or with a different country to move it.
What Meta says, and only that: Meta's page describes the feature as the location of data at rest. Whether that satisfies a particular contract or regulator is a question for whoever advises you on it, not something the setting answers by itself.

The other extreme: keep nothing at rest

Meta also documents a setting it calls No Storage, a variant of local storage in which messages and media pass through Meta's servers for at most an hour and nothing is kept at rest anywhere, neither in Meta's data centres nor in an in-country store. It is chosen before registration, cannot be combined with a storage country, and is undone the same way as everything else on this page: deregister and register again. Meta is candid about the price. A message that fails to decrypt on the customer's phone can be retried only within that hour, after which the business gets an error notice instead of a delivery; updates and incoming messages that the provider's servers could not receive are retried for an hour instead of the usual seven days and are then lost for good; and a photo or document a customer sends is deleted after an hour unless the system has already fetched it. Meta says this puts a small fraction of messages at risk of never arriving. It is a setting for a business whose advisers have asked for it, not a default.

Deregistering

What it does: Makes the number unusable with the Cloud API and switches off local storage if it was on. The number and its message history are not deleted; deleting is a separate action.
What it needs: The same 10-per-72-hours limit, and the account-management permission; without it the request fails.
When it is refused: Meta's page says a number that is in use with both the Cloud API and the WhatsApp Business app cannot be deregistered this way.

Questions

Our provider set everything up. Should we have the PIN?

Yes. The PIN is attached to your number, not to the provider, and it is needed every time the number is registered, including after a display name change or a move to a different system. Ask for it, or change it yourself through the WhatsApp Manager path above while the tab still exists.

Can we keep our customers' WhatsApp data in the UAE?

Meta's registration page lists the United Arab Emirates as a supported country for local storage of data at rest, chosen when the number is registered. A number already registered without it has to be deregistered and registered again. What that does and does not satisfy legally is for your adviser, not this page.

The number says it cannot be registered for 72 hours. What happened?

Ten registration attempts were made within 72 hours, so Meta locked it for the next 72. Usually a system retrying automatically. Stop the retries, wait out the lock, and fix the cause before trying once more.

Can Meta keep none of our messages at all?

Close to it. Meta's No Storage setting holds messages and media in transit for at most an hour and keeps nothing at rest. The trade is reliability: retries for undeliverable messages and missed webhooks stop after an hour instead of seven days, and incoming media vanishes after an hour. It must be set before registration and cannot be combined with a storage country.

The two-step verification tab has vanished from WhatsApp Manager. Were we hacked?

Meta's pages say that is what happens when a number becomes eligible for the PIN's deprecation: the tab is removed and there is no PIN to manage. If the tab is still present, the number is not yet eligible.

Sources

Meta's developer documentation: Registration, read 1 October 2026.
Meta's developer documentation: Two-step verification, read 1 October 2026.
Meta's developer documentation: No Storage, read 1 October 2026.

More plain-language notes like this one are on the guides page.

Want your number registered with the PIN in your hands and the data where you chose?

We set up a business's WhatsApp number on a proper system, register it once and correctly, hand the business its own PIN, and set local storage at registration when the business wants it, so nothing has to be torn down and redone later. A short call is the easiest way to see whether it fits your business.

Book a demo