# A2P SMS compliance, country by country. - Canonical URL: https://www.broadnet.me/regulations - Language: en - Last updated: 2026-10-20 - Publisher: BroadNet (https://www.broadnet.me) - Markdown version of the page above, generated from the rendered page. Regulations A2P SMS is regulated on six dimensions — sender-ID registration, content categories, time-of-day windows, DND and opt-out, data residency, and penalties. Get one wrong and messages are blocked, fined, or, on grey routes, referred for prosecution. This hub compares the rules that actually apply in each market and links to the full playbook per country. BroadNet's compliance engine enforces these at send time. Compare countries [Talk to a compliance specialist](https://www.broadnet.me/contact?topic=compliance) 22 markets documented · Last updated July 2026 The six dimensions ## What regulators actually check. Every country page below is organized around these dimensions. Learn them once and the per-market differences become easy to read. ### Sender-ID registration Most markets require an alphanumeric sender ID matching your registered brand, pre-approved per operator. The US instead uses number-based 10DLC brand + campaign registration. ### Content categories Regulators classify traffic — promotional vs. transactional/service (OTP) — and often prohibit political, religious, gambling and adult content. Category dictates which rules apply. ### Time-of-day windows Marketing SMS is boxed into permitted hours (e.g. UAE 7am–9pm, KSA 9am–10pm with a Ramadan shift). Transactional messages such as OTPs are typically exempt. ### DND & opt-out Prior, provable opt-in for marketing, a free and prompt opt-out (STOP), and suppression of do-not-disturb lists. Opt-out deadlines range from immediate to a few business days. ### Data residency & privacy PDPLs across the GCC and Egypt set lawful-basis, consent, breach-notification and cross-border transfer rules for the personal data behind every campaign. ### Penalty exposure Consequences run from sender-ID blocking and route suspension to administrative fines (e.g. SAR 5M in KSA) and, for grey routes, criminal referral. Cross-country comparison ## The rules, side by side. A qualitative snapshot per market. Rules change and details vary by operator and message category — click any country for the full, current playbook. | Country | Regulator | Sender-ID registration | Registration lead time | DND / opt-out regime | Penalty exposure | |---|---|---|---|---|---| | [United Arab Emirates](https://www.broadnet.me/regulations/uae) | TDRA | Required — alpha, via Etisalat (e&) & du | Several business days (longer for intl.) | Opt-in + free STOP; "AD" prefix on marketing | PDPL administrative penalties; network blocking | | [Saudi Arabia](https://www.broadnet.me/regulations/saudi-arabia) | CST | Required — whitelist via Bulk SMS e-System | Varies (per-operator review) | Explicit opt-in; opt-out ≤ 24h; 330330 channel | PDPL fines to SAR 5M (SDAIA), doubled for repeat | | [Qatar](https://www.broadnet.me/regulations/qatar) | CRA | Required — per operator (Ooredoo, Vodafone) | Up to ~2 weeks per operator | Prior express consent; STOP honoured ≤ 2 business days | PDPPL fines QAR 1M–5M; criminal referral possible | | [Kuwait](https://www.broadnet.me/regulations/kuwait) | CITRA | Required — CITRA + operators | Varies (confirm per operator) | Opt-in + free opt-out; DND registries on networks | DPPR enforcement; sender-ID & traffic blocking | | [Oman](https://www.broadnet.me/regulations/oman) | TRA | Required — all 3 operators (alpha) | Varies (per operator) | Written consent (PDPL Art. 22); free opt-out; DNC | ~OMR 1k–5k per marketing breach; TRA blocking | | [Bahrain](https://www.broadnet.me/regulations/bahrain) | TRA Bahrain | Required — whitelist via operators/aggregator | Varies (per operator) | Express consent; STOP/HELP AR/EN; object ≤ 10 working days | PDPA statutory penalties (fines; possible imprisonment) | | [Jordan](https://www.broadnet.me/regulations/jordan) | TRC | Required — pre-registration via TRC | 5–7 business days | Verifiable opt-in for marketing; records kept 12 months | Set by the TRC — see trc.gov.jo | | [Lebanon](https://www.broadnet.me/regulations/lebanon) | TRA | Required — via operator (Alfa, Touch) | 3–5 business days | Consent for marketing; free opt-out | Set by the TRA — see tra.gov.lb | | [Egypt](https://www.broadnet.me/regulations/egypt) | NTRA | Required — all 4 networks; local routing only | ~2–3 weeks | Opt-in + free STOP; DND suppression; PDPC licence | PDPL EGP 200k–2M; criminal referral for grey routes | | [United States](https://www.broadnet.me/regulations/united-states) | TCR / carriers | Required — 10DLC brand + campaign (number-based) | Days to weeks (brand + campaign vetting) | TCPA prior express written consent; immediate STOP/HELP | TCPA statutory per-message damages | | [India](https://www.broadnet.me/regulations/india) | TRAI | Required — DLT header + content template (6-char) | Varies (DLT entity, header & template) | DND scrubbing; Consent Templates; promo 10am–9pm by default | Header/template scrubbing; blacklisting; DPDP Act | | [Türkiye](https://www.broadnet.me/regulations/turkey) | Ministry of Trade / BTK | Required — alpha via operators | Varies (per operator) | İYS-registered opt-in; free opt-out | Admin fines (missing İYS/opt-out); KVKK penalties | | [Pakistan](https://www.broadnet.me/regulations/pakistan) | PTA | Required — sender-ID mask via operators | Varies (per operator) | Consent + free opt-out; operator/PTA spam blocking | Mask/grey-route blocking; PECA for unlawful msgs | | [Bangladesh](https://www.broadnet.me/regulations/bangladesh) | BTRC | Required — branded mask via operators | Varies (per operator) | Consent + free opt-out; content approval | Mask/grey-route blocking; data law still draft | | [Nigeria](https://www.broadnet.me/regulations/nigeria) | NCC | Required — branded alpha via operators | Varies (per operator) | DND via 2442 short code; consent + free opt-out | NCC fines/blocking; NDPA penalties (NDPC) | | [United Kingdom](https://www.broadnet.me/regulations/united-kingdom) | Ofcom & ICO | Alpha; no gov registry; MEF anti-spoof registry | N/A (consent-based, not registry-based) | PECR opt-in consent; free STOP opt-out | ICO fines (PECR up to £500k; UK GDPR higher) | | [Germany](https://www.broadnet.me/regulations/germany) | BNetzA | Alpha; no gov registry (brand ID) | N/A (consent-based) | Prior express opt-in (double opt-in); free opt-out | GDPR to €20M/4%; UWG injunctions (Abmahnung) | | [France](https://www.broadnet.me/regulations/france) | ARCEP & CNIL | Alpha; no gov registry (brand ID) | N/A (consent-based) | Consent + STOP; 33700 | CNIL/GDPR to €20M or 4% of global turnover | | [Brazil](https://www.broadnet.me/regulations/brazil) | ANATEL | Required — via operators (Vivo, Claro, TIM) | Varies (per operator) | Consent + free opt-out; "Não Perturbe" registry | LGPD to 2% of BR revenue, cap R$50M (ANPD) | | [Indonesia](https://www.broadnet.me/regulations/indonesia) | Komdigi (Komdigi) | Required — "masking" via operators | Varies (per operator) | Consent + free opt-out; operator anti-spam | Masking/grey-route blocking; PDP Law sanctions | | [Philippines](https://www.broadnet.me/regulations/philippines) | NTC | Required — via operators (anti-scam controls) | Varies (per operator) | Consent + free opt-out; SIM Registration Act context | NTC/operator blocking; NPC Data Privacy Act | | [South Africa](https://www.broadnet.me/regulations/south-africa) | ICASA | Required — via operators (alpha/short code) | Varies (per operator) | POPIA §69 opt-in; sender ID; free opt-out | POPIA fines up to R10M; criminal (Info Regulator) | Timelines and penalties are indicative; confirm the current position per operator at onboarding. Transactional/OTP traffic is generally exempt from marketing timing windows but still requires a registered sender ID. ## Download the data Regulator, sender-ID lead time and formats, opt-in, opt-out and quiet-hour rules, official sources and review date for every country with a regulations page. - [Regulations data (CSV)](https://www.broadnet.me/data/regulations.csv) - [Regulations data (JSON)](https://www.broadnet.me/data/regulations.json) - [Coverage data (CSV)](https://www.broadnet.me/data/coverage.csv) - [Coverage data (JSON)](https://www.broadnet.me/data/coverage.json) Region ## Gulf Cooperation Council (GCC) The strictest, most consistent regime in the region: mandatory alphanumeric sender-ID registration on every operator, a firm line between promotional and transactional traffic, and enforced sending windows — all backed by newly-enforceable PDPLs. [TDRA United Arab Emirates Required — alpha, via Etisalat (e&) & du. Opt-in + free STOP; "AD" prefix on marketing. Read the United Arab Emirates playbook](https://www.broadnet.me/regulations/uae) [United Arab Emirates coverage & routing](https://www.broadnet.me/coverage/uae) [CST Saudi Arabia Required — whitelist via Bulk SMS e-System. Explicit opt-in; opt-out ≤ 24h; 330330 channel. Read the Saudi Arabia playbook](https://www.broadnet.me/regulations/saudi-arabia) [Saudi Arabia coverage & routing](https://www.broadnet.me/coverage/saudi-arabia) [CRA Qatar Required — per operator (Ooredoo, Vodafone). Prior express consent; STOP honoured ≤ 2 business days. Read the Qatar playbook](https://www.broadnet.me/regulations/qatar) [Qatar coverage & routing](https://www.broadnet.me/coverage/qatar) [CITRA Kuwait Required — CITRA + operators. Opt-in + free opt-out; DND registries on networks. Read the Kuwait playbook](https://www.broadnet.me/regulations/kuwait) [Kuwait coverage & routing](https://www.broadnet.me/coverage/kuwait) [TRA Oman Required — all 3 operators (alpha). Written consent (PDPL Art. 22); free opt-out; DNC. Read the Oman playbook](https://www.broadnet.me/regulations/oman) [Oman coverage & routing](https://www.broadnet.me/coverage/oman) [TRA Bahrain Bahrain Required — whitelist via operators/aggregator. Express consent; STOP/HELP AR/EN; object ≤ 10 working days. Read the Bahrain playbook](https://www.broadnet.me/regulations/bahrain) [Bahrain coverage & routing](https://www.broadnet.me/coverage/bahrain) Region ## Levant Sender-ID pre-registration through the regulator or operator, with direct-route delivery preferred. Penalty exposure is defined in local currency and enforced through operators. [TRC Jordan Required — pre-registration via TRC. Verifiable opt-in for marketing; records kept 12 months. Read the Jordan playbook](https://www.broadnet.me/regulations/jordan) [Jordan coverage & routing](https://www.broadnet.me/coverage/jordan) [TRA Lebanon Required — via operator (Alfa, Touch). Consent for marketing; free opt-out. Read the Lebanon playbook](https://www.broadnet.me/regulations/lebanon) [Lebanon coverage & routing](https://www.broadnet.me/coverage/lebanon) Region ## Africa Some of the region's toughest markets pair licensed local routing and sender-ID approval across every network with strong consumer controls — from Egypt's data-protection marketing licence to Nigeria's national Do-Not-Disturb facility on the 2442 short code and South Africa's POPIA section 69 consent rules. [NTRA Egypt Required — all 4 networks; local routing only. Opt-in + free STOP; DND suppression; PDPC licence. Read the Egypt playbook](https://www.broadnet.me/regulations/egypt) [Egypt coverage & routing](https://www.broadnet.me/coverage/egypt) [NCC Nigeria Required — branded alpha via operators. DND via 2442 short code; consent + free opt-out. Read the Nigeria playbook](https://www.broadnet.me/regulations/nigeria) [Nigeria coverage & routing](https://www.broadnet.me/coverage/nigeria) [ICASA South Africa Required — via operators (alpha/short code). POPIA §69 opt-in; sender ID; free opt-out. Read the South Africa playbook](https://www.broadnet.me/regulations/south-africa) [South Africa coverage & routing](https://www.broadnet.me/coverage/south-africa) Region ## Asia-Pacific Registration-heavy markets built on branded sender IDs and, in India, a full DLT (Distributed Ledger Technology) framework — entity, header and content-template registration on the operator portals. Indonesia's "masking" registration and the Philippines' anti-scam controls follow the same logic; grey routes and unregistered masks are blocked across the region. [TRAI India Required — DLT header + content template (6-char). DND scrubbing; Consent Templates; promo 10am–9pm by default. Read the India playbook](https://www.broadnet.me/regulations/india) [India coverage & routing](https://www.broadnet.me/coverage/india) [PTA Pakistan Required — sender-ID mask via operators. Consent + free opt-out; operator/PTA spam blocking. Read the Pakistan playbook](https://www.broadnet.me/regulations/pakistan) [Pakistan coverage & routing](https://www.broadnet.me/coverage/pakistan) [BTRC Bangladesh Required — branded mask via operators. Consent + free opt-out; content approval. Read the Bangladesh playbook](https://www.broadnet.me/regulations/bangladesh) [Bangladesh coverage & routing](https://www.broadnet.me/coverage/bangladesh) [Komdigi (Komdigi) Indonesia Required — "masking" via operators. Consent + free opt-out; operator anti-spam. Read the Indonesia playbook](https://www.broadnet.me/regulations/indonesia) [Indonesia coverage & routing](https://www.broadnet.me/coverage/indonesia) [NTC Philippines Required — via operators (anti-scam controls). Consent + free opt-out; SIM Registration Act context. Read the Philippines playbook](https://www.broadnet.me/regulations/philippines) [Philippines coverage & routing](https://www.broadnet.me/coverage/philippines) Region ## Europe & Türkiye Consent-centric regimes. Across the UK, Germany and France, marketing needs prior opt-in under PECR/UK GDPR, the GDPR/UWG and the CNIL's rules — with Germany's double opt-in among the EU's strictest. Türkiye requires opt-in to be recorded in the national İYS (Message Management System) before any commercial message, with daytime-only marketing and KVKK obligations layered on top. [Ofcom & ICO United Kingdom Alpha; no gov registry; MEF anti-spoof registry. PECR opt-in consent; free STOP opt-out. Read the United Kingdom playbook](https://www.broadnet.me/regulations/united-kingdom) [United Kingdom coverage & routing](https://www.broadnet.me/coverage/united-kingdom) [BNetzA Germany Alpha; no gov registry (brand ID). Prior express opt-in (double opt-in); free opt-out. Read the Germany playbook](https://www.broadnet.me/regulations/germany) [Germany coverage & routing](https://www.broadnet.me/coverage/germany) [ARCEP & CNIL France Alpha; no gov registry (brand ID). Consent + STOP; 33700. Read the France playbook](https://www.broadnet.me/regulations/france) [France coverage & routing](https://www.broadnet.me/coverage/france) [Ministry of Trade / BTK Türkiye Required — alpha via operators. İYS-registered opt-in; free opt-out. Read the Türkiye playbook](https://www.broadnet.me/regulations/turkey) [Türkiye coverage & routing](https://www.broadnet.me/coverage/turkey) Region ## Americas Divergent models: the US uses number-based registration (10DLC brand + campaign vetting) governed by carrier rules and the TCPA, while Brazil pairs operator sender-ID registration with the LGPD and the national "Não Perturbe" do-not-disturb registry. [TCR / carriers United States Required — 10DLC brand + campaign (number-based). TCPA prior express written consent; immediate STOP/HELP. Read the United States playbook](https://www.broadnet.me/regulations/united-states) [United States coverage & routing](https://www.broadnet.me/coverage/united-states) [ANATEL Brazil Required — via operators (Vivo, Claro, TIM). Consent + free opt-out; "Não Perturbe" registry. Read the Brazil playbook](https://www.broadnet.me/regulations/brazil) [Brazil coverage & routing](https://www.broadnet.me/coverage/brazil) How we keep this current ## Living guidance, not a snapshot. ### Sourced at the operator Rules are tracked from the regulators (TDRA, CST, NTRA and peers) and confirmed against what the operators actually enforce at registration and send time. ### Enforced in the platform BroadNet's compliance engine applies sender-ID, category, timing and consent rules at send time, so guidance and product stay in step. ### Reviewed continuously This hub is reviewed as regulations and operator policies change. Last updated July 2026. Always confirm the current position with your provider before launch. This page is general guidance, not legal advice. Confirm the current requirements with your operator, regulator or counsel before sending. Regulatory FAQ ## The questions we hear most. **Do I need to register a sender ID in the UAE?** Yes. Any business sending A2P SMS to UAE numbers must register an approved alphanumeric sender ID — matching its registered trade name — through Etisalat (e&) and du before traffic will deliver; unregistered IDs are blocked at network level. Promotional messages additionally require the "AD" prefix, documented opt-in, and delivery only between 7am and 9pm UAE time. Transactional messages such as OTPs still need a registered sender ID but are exempt from the prefix and timing window. **What are the A2P SMS penalties in Saudi Arabia?** Two regimes overlap. CST can suspend sender names and block non-compliant or grey-route traffic under the telecom law, while SDAIA can levy Personal Data Protection Law fines of up to SAR 5 million per violation, doubled for repeat offences. International sender names can also be blocked for 90 days following valid spam reports. Terminate through a CST-authorized local aggregator on STC, Mobily and Zain KSA to stay compliant. **How long does sender-ID registration take across MENA?** It varies by market and operator. UAE approvals for local companies typically take several business days (longer for international senders); Egypt commonly runs around two to three weeks across all four networks; Qatar can take up to about two weeks per operator; and KSA, Kuwait, Oman and Bahrain depend on each operator's review queue. Plan lead time into any launch, and confirm current timelines with your provider. **What's the difference between promotional and transactional SMS?** Promotional (marketing) messages require prior opt-in consent, carry timing restrictions and marketing tags, and must offer a free opt-out. Transactional/service messages — OTPs, delivery and appointment alerts, banking notifications — are generally exempt from the timing windows and marketing tags because they relate to a service the recipient already has, but they still require a registered sender ID. Keep the two flows on separate sender IDs with separate consent records. **Can I use a cheaper international (grey) route?** Not safely. Markets such as Saudi Arabia and Egypt actively block grey routes and, in Egypt, refer unlicensed bulk senders for prosecution. Grey routes damage deliverability, expose you and any intermediary to enforcement, and often bypass the sender-ID and consent controls the regulator requires. A carrier-grade licensed route protects deliverability and keeps you inside the rules. **Is US A2P messaging regulated the same way as MENA?** No. The US uses number-based registration — you register a brand and each campaign through The Campaign Registry (10DLC), or verify toll-free numbers / lease short codes — rather than alphanumeric sender IDs. Content follows the CTIA Messaging Principles (including SHAFT restrictions) and consent follows the TCPA, which requires prior express written consent for marketing and immediate STOP/HELP handling. ## Ship compliant SMS in every market. BroadNet handles sender-ID registration and enforces category, timing and consent rules at send time — so your traffic clears the regulators instead of getting blocked. [Talk to a compliance specialist](https://www.broadnet.me/contact?topic=compliance) [Trust & compliance](https://www.broadnet.me/trust)