Everything worth knowing, nothing that isn't.
Documents CST requires
A Saudi Commercial Registration (CR) number, the corporate Maroof verification, the requested sender ID (max 11 characters, GSM-7 or Arabic — Arabic sender IDs are supported and increasingly preferred), full content samples in Arabic, opt-in proof for marketing senders, and a content-classification statement (transactional vs marketing). Foreign brands without a CR must onboard through a local sponsor or use the brand's regional licensee's CR.
PDPL 2023 implications
Saudi Arabia's Personal Data Protection Law took full effect in 2024. SDAIA (Saudi Data and AI Authority) is the regulator. Every sender ID registration must now include a PDPL processing-purpose statement, and recipient consent records must be retained for 5 years. Cross-border transfer of recipient MSISDNs requires either adequacy or an explicit SDAIA permit. BroadNet's KSA SMS infrastructure is hosted in-kingdom (Riyadh DC) to keep data resident.
Arabic sender IDs
Arabic alphanumeric sender IDs are not just permitted but increasingly required for consumer-facing brands. Recipients in KSA tend to respond better to Arabic sender IDs than to transliterated Latin ones. The challenge: not every aggregator's stack handles RTL sender-ID rendering correctly across all operator MSCs. BroadNet ships Arabic sender ID support end-to-end across STC, Mobily, and Zain KSA.
Common rejection reasons
Brand-name mismatch with the CR. Promotional content under a transactional registration. Sender ID too generic (CST rejects `INFO`, `ALERT`, `OTP` as standalone — it must be brand-tied). Inadequate opt-in documentation. We pre-flight every registration against the latest CST rejection patterns before submission.