audi Arabia is one of the most tightly governed A2P SMS markets in the world, and also one of the most valuable — high smartphone penetration, high engagement, strong enterprise demand. The regulator, now the Communications, Space and Technology Commission (CST, the successor to CITC), enforces a strict sender-ID and routing regime. Sending into Saudi without understanding it leads to blocked traffic, not just fines.
Sender IDs must be registered
Every alphanumeric sender ID used to message a Saudi MSISDN must be pre-registered and approved before any traffic flows under it. Registration ties the sender ID to a verified legal entity. Unregistered sender IDs are not merely penalised — they are blocked at the operator, so messages sent under an unapproved ID simply do not arrive. There is no grey area to exploit; the enforcement is at the network layer.
Documentation the regulator expects
- Valid Saudi commercial registration (CR), or for foreign entities, an authorised local representative or aggregator acting on their behalf.
- A sender ID that genuinely reflects the registered brand — generic or misleading strings are rejected.
- A clear declaration of message category (transactional, OTP, or promotional/marketing).
- For marketing traffic, demonstrable opt-in consent and a working opt-out mechanism.
Transactional, OTP, and marketing are treated differently
OTP and transactional traffic — verification codes, banking alerts, government notifications, delivery updates — face the lightest restrictions and are expected to be available around the clock. Marketing traffic is more constrained: it requires explicit consent, must honour opt-out, and is subject to time-of-day expectations consistent with consumer-protection norms. Misclassifying marketing as transactional to dodge those constraints is a serious violation that the CST actively looks for.
Routing matters as much as registration
Saudi A2P traffic is expected to terminate through approved channels into STC, Mobily, and Zain KSA. Traffic that arrives via international grey routes is increasingly intercepted by operator SMS firewalls — and the Saudi operators have invested heavily in firewalls. A correctly registered sender ID delivered over a grey route can still be blocked. Compliance is registration plus routing, not registration alone.
BroadNet holds direct, approved interconnects with the Saudi operators and manages CST sender-ID registration as part of onboarding. Expect about 5-10 business days for approval, depending on documentation completeness.
The cost of getting it wrong
The headline penalties are real, but for most enterprises the bigger cost is operational: a marketing or OTP campaign that silently fails to deliver in Saudi because the sender ID was not approved or the route was not compliant. By the time that is noticed, the campaign window — or worse, the user's login attempt — has already passed. Register early, route correctly, classify honestly.