A2P SMS compliance, country by country.
A2P SMS is regulated on six dimensions — sender-ID registration, content categories, time-of-day windows, DND and opt-out, data residency, and penalties. Get one wrong and messages are blocked, fined, or, on grey routes, referred for prosecution. This hub compares the rules that actually apply in each market and links to the full playbook per country. BroadNet's compliance engine enforces these at send time.
What regulators actually check.
Every country page below is organized around these dimensions. Learn them once and the per-market differences become easy to read.
Sender-ID registration
Most markets require an alphanumeric sender ID matching your registered brand, pre-approved per operator. The US instead uses number-based 10DLC brand + campaign registration.
Content categories
Regulators classify traffic — promotional vs. transactional/service (OTP) — and often prohibit political, religious, gambling and adult content. Category dictates which rules apply.
Time-of-day windows
Marketing SMS is boxed into permitted hours (e.g. UAE 7am–9pm, KSA 9am–10pm with a Ramadan shift). Transactional messages such as OTPs are typically exempt.
DND & opt-out
Prior, provable opt-in for marketing, a free and prompt opt-out (STOP), and suppression of do-not-disturb lists. Opt-out deadlines range from immediate to a few business days.
Data residency & privacy
PDPLs across the GCC and Egypt set lawful-basis, consent, breach-notification and cross-border transfer rules for the personal data behind every campaign.
Penalty exposure
Consequences run from sender-ID blocking and route suspension to administrative fines (e.g. SAR 5M in KSA) and, for grey routes, criminal referral.
The rules, side by side.
A qualitative snapshot per market. Rules change and details vary by operator and message category — click any country for the full, current playbook.
| Country | Regulator | Sender-ID registration | Registration lead time | DND / opt-out regime | Penalty exposure |
|---|---|---|---|---|---|
| United Arab Emirates | TDRA | Required — alpha, via Etisalat (e&) & du | Several business days (longer for intl.) | Opt-in + free STOP; "AD" prefix on marketing | PDPL administrative penalties; network blocking |
| Saudi Arabia | CST | Required — whitelist via Bulk SMS e-System | Varies (per-operator review) | Explicit opt-in; opt-out ≤ 24h; 330330 channel | PDPL fines to SAR 5M (SDAIA), doubled for repeat |
| Qatar | CRA | Required — per operator (Ooredoo, Vodafone) | Up to ~2 weeks per operator | Prior express consent; STOP honoured ≤ 2 business days | PDPPL fines QAR 1M–5M; criminal referral possible |
| Kuwait | CITRA | Required — CITRA + operators | Varies (confirm per operator) | Opt-in + free opt-out; DND registries on networks | DPPR enforcement; sender-ID & traffic blocking |
| Oman | TRA | Required — all 3 operators (alpha) | Varies (per operator) | Written consent (PDPL Art. 22); free opt-out; DNC | ~OMR 1k–5k per marketing breach; TRA blocking |
| Bahrain | TRA Bahrain | Required — whitelist via operators/aggregator | Varies (per operator) | Express consent; STOP/HELP AR/EN; object ≤ 10 working days | PDPA statutory penalties (fines; possible imprisonment) |
| Jordan | TRC | Required — pre-registration via TRC | 5–7 business days | Verifiable opt-in for marketing; records kept 12 months | Set by the TRC — see trc.gov.jo |
| Lebanon | TRA | Required — via operator (Alfa, Touch) | 3–5 business days | Consent for marketing; free opt-out | Set by the TRA — see tra.gov.lb |
| Egypt | NTRA | Required — all 4 networks; local routing only | ~2–3 weeks | Opt-in + free STOP; DND suppression; PDPC licence | PDPL EGP 200k–2M; criminal referral for grey routes |
| United States | TCR / carriers | Required — 10DLC brand + campaign (number-based) | Days to weeks (brand + campaign vetting) | TCPA prior express written consent; immediate STOP/HELP | TCPA statutory per-message damages |
| India | TRAI | Required — DLT header + content template (6-char) | Varies (DLT entity, header & template) | DND scrubbing; Consent Templates; promo 10am–9pm by default | Header/template scrubbing; blacklisting; DPDP Act |
| Türkiye | Ministry of Trade / BTK | Required — alpha via operators | Varies (per operator) | İYS-registered opt-in; free opt-out | Admin fines (missing İYS/opt-out); KVKK penalties |
| Pakistan | PTA | Required — sender-ID mask via operators | Varies (per operator) | Consent + free opt-out; operator/PTA spam blocking | Mask/grey-route blocking; PECA for unlawful msgs |
| Bangladesh | BTRC | Required — branded mask via operators | Varies (per operator) | Consent + free opt-out; content approval | Mask/grey-route blocking; data law still draft |
| Nigeria | NCC | Required — branded alpha via operators | Varies (per operator) | DND via 2442 short code; consent + free opt-out | NCC fines/blocking; NDPA penalties (NDPC) |
| United Kingdom | Ofcom & ICO | Alpha; no gov registry; MEF anti-spoof registry | N/A (consent-based, not registry-based) | PECR opt-in consent; free STOP opt-out | ICO fines (PECR up to £500k; UK GDPR higher) |
| Germany | BNetzA | Alpha; no gov registry (brand ID) | N/A (consent-based) | Prior express opt-in (double opt-in); free opt-out | GDPR to €20M/4%; UWG injunctions (Abmahnung) |
| France | ARCEP & CNIL | Alpha; no gov registry (brand ID) | N/A (consent-based) | Consent + STOP; 33700 | CNIL/GDPR to €20M or 4% of global turnover |
| Brazil | ANATEL | Required — via operators (Vivo, Claro, TIM) | Varies (per operator) | Consent + free opt-out; "Não Perturbe" registry | LGPD to 2% of BR revenue, cap R$50M (ANPD) |
| Indonesia | Komdigi (Komdigi) | Required — "masking" via operators | Varies (per operator) | Consent + free opt-out; operator anti-spam | Masking/grey-route blocking; PDP Law sanctions |
| Philippines | NTC | Required — via operators (anti-scam controls) | Varies (per operator) | Consent + free opt-out; SIM Registration Act context | NTC/operator blocking; NPC Data Privacy Act |
| South Africa | ICASA | Required — via operators (alpha/short code) | Varies (per operator) | POPIA §69 opt-in; sender ID; free opt-out | POPIA fines up to R10M; criminal (Info Regulator) |
United Arab Emirates
Saudi Arabia
Qatar
Kuwait
Oman
Bahrain
Jordan
Lebanon
Egypt
United States
India
Türkiye
Pakistan
Bangladesh
Nigeria
United Kingdom
Germany
France
Brazil
Indonesia
Philippines
South AfricaTimelines and penalties are indicative; confirm the current position per operator at onboarding. Transactional/OTP traffic is generally exempt from marketing timing windows but still requires a registered sender ID.
Download the data
Regulator, sender-ID lead time and formats, opt-in, opt-out and quiet-hour rules, official sources and review date for every country with a regulations page.
Gulf Cooperation Council (GCC)
The strictest, most consistent regime in the region: mandatory alphanumeric sender-ID registration on every operator, a firm line between promotional and transactional traffic, and enforced sending windows — all backed by newly-enforceable PDPLs.
United Arab Emirates
Required — alpha, via Etisalat (e&) & du. Opt-in + free STOP; "AD" prefix on marketing.
Saudi Arabia
Required — whitelist via Bulk SMS e-System. Explicit opt-in; opt-out ≤ 24h; 330330 channel.
Qatar
Required — per operator (Ooredoo, Vodafone). Prior express consent; STOP honoured ≤ 2 business days.
Kuwait
Required — CITRA + operators. Opt-in + free opt-out; DND registries on networks.
Levant
Sender-ID pre-registration through the regulator or operator, with direct-route delivery preferred. Penalty exposure is defined in local currency and enforced through operators.
Africa
Some of the region's toughest markets pair licensed local routing and sender-ID approval across every network with strong consumer controls — from Egypt's data-protection marketing licence to Nigeria's national Do-Not-Disturb facility on the 2442 short code and South Africa's POPIA section 69 consent rules.
Egypt
Required — all 4 networks; local routing only. Opt-in + free STOP; DND suppression; PDPC licence.
Asia-Pacific
Registration-heavy markets built on branded sender IDs and, in India, a full DLT (Distributed Ledger Technology) framework — entity, header and content-template registration on the operator portals. Indonesia's "masking" registration and the Philippines' anti-scam controls follow the same logic; grey routes and unregistered masks are blocked across the region.
India
Required — DLT header + content template (6-char). DND scrubbing; Consent Templates; promo 10am–9pm by default.
Pakistan
Required — sender-ID mask via operators. Consent + free opt-out; operator/PTA spam blocking.
Bangladesh
Required — branded mask via operators. Consent + free opt-out; content approval.
Europe & Türkiye
Consent-centric regimes. Across the UK, Germany and France, marketing needs prior opt-in under PECR/UK GDPR, the GDPR/UWG and the CNIL's rules — with Germany's double opt-in among the EU's strictest. Türkiye requires opt-in to be recorded in the national İYS (Message Management System) before any commercial message, with daytime-only marketing and KVKK obligations layered on top.
United Kingdom
Alpha; no gov registry; MEF anti-spoof registry. PECR opt-in consent; free STOP opt-out.
Germany
Alpha; no gov registry (brand ID). Prior express opt-in (double opt-in); free opt-out.
Americas
Divergent models: the US uses number-based registration (10DLC brand + campaign vetting) governed by carrier rules and the TCPA, while Brazil pairs operator sender-ID registration with the LGPD and the national "Não Perturbe" do-not-disturb registry.
Living guidance, not a snapshot.
Sourced at the operator
Rules are tracked from the regulators (TDRA, CST, NTRA and peers) and confirmed against what the operators actually enforce at registration and send time.
Enforced in the platform
BroadNet's compliance engine applies sender-ID, category, timing and consent rules at send time, so guidance and product stay in step.
Reviewed continuously
This hub is reviewed as regulations and operator policies change. Last updated July 2026. Always confirm the current position with your provider before launch.
This page is general guidance, not legal advice. Confirm the current requirements with your operator, regulator or counsel before sending.
The questions we hear most.
Do I need to register a sender ID in the UAE?
Yes. Any business sending A2P SMS to UAE numbers must register an approved alphanumeric sender ID — matching its registered trade name — through Etisalat (e&) and du before traffic will deliver; unregistered IDs are blocked at network level. Promotional messages additionally require the "AD" prefix, documented opt-in, and delivery only between 7am and 9pm UAE time. Transactional messages such as OTPs still need a registered sender ID but are exempt from the prefix and timing window.
What are the A2P SMS penalties in Saudi Arabia?
Two regimes overlap. CST can suspend sender names and block non-compliant or grey-route traffic under the telecom law, while SDAIA can levy Personal Data Protection Law fines of up to SAR 5 million per violation, doubled for repeat offences. International sender names can also be blocked for 90 days following valid spam reports. Terminate through a CST-authorized local aggregator on STC, Mobily and Zain KSA to stay compliant.
How long does sender-ID registration take across MENA?
It varies by market and operator. UAE approvals for local companies typically take several business days (longer for international senders); Egypt commonly runs around two to three weeks across all four networks; Qatar can take up to about two weeks per operator; and KSA, Kuwait, Oman and Bahrain depend on each operator's review queue. Plan lead time into any launch, and confirm current timelines with your provider.
What's the difference between promotional and transactional SMS?
Promotional (marketing) messages require prior opt-in consent, carry timing restrictions and marketing tags, and must offer a free opt-out. Transactional/service messages — OTPs, delivery and appointment alerts, banking notifications — are generally exempt from the timing windows and marketing tags because they relate to a service the recipient already has, but they still require a registered sender ID. Keep the two flows on separate sender IDs with separate consent records.
Can I use a cheaper international (grey) route?
Not safely. Markets such as Saudi Arabia and Egypt actively block grey routes and, in Egypt, refer unlicensed bulk senders for prosecution. Grey routes damage deliverability, expose you and any intermediary to enforcement, and often bypass the sender-ID and consent controls the regulator requires. A carrier-grade licensed route protects deliverability and keeps you inside the rules.
Is US A2P messaging regulated the same way as MENA?
No. The US uses number-based registration — you register a brand and each campaign through The Campaign Registry (10DLC), or verify toll-free numbers / lease short codes — rather than alphanumeric sender IDs. Content follows the CTIA Messaging Principles (including SHAFT restrictions) and consent follows the TCPA, which requires prior express written consent for marketing and immediate STOP/HELP handling.
Ship compliant SMS
in every market.
BroadNet handles sender-ID registration and enforces category, timing and consent rules at send time — so your traffic clears the regulators instead of getting blocked.