A2P SMS regulations in Saudi Arabia.
Compliance with the CST.
In Saudi Arabia, A2P SMS is governed by the Communications, Space & Technology Commission (CST, formerly CITC) under its Regulations for Curbing SPAM Messages & Calls. Every alphanumeric sender name must be pre-registered and whitelisted through the operator Bulk SMS e-System, promotional messages require documented prior opt-in consent, and marketing is prohibited between 10:00pm and 9:00am.
Who regulates A2P SMS in Saudi Arabia?
A2P messaging is regulated by the Communications, Space & Technology Commission (CST) — renamed from the Communications and Information Technology Commission (CITC) in 2022. The binding rules are CST's Regulations for Curbing SPAM Messages & Calls (Version Three, October 2022), issued under the Telecommunications and Information Technology Law.
- Regulator: CST, cst.gov.sa (formerly CITC).
- Core rulebook: Regulations for Curbing SPAM Messages & Calls (V3, Oct 2022).
- Governing law: Telecommunications & IT Law (Royal Decree M/106).
Sender-name registration and whitelisting
All bulk A2P senders must register their alphanumeric "sender name" in the operator-run Bulk SMS e-System before sending; only approved sender names and pre-approved message forms are allowed through. Operators filter and block any message whose sender is not registered, and no two senders may hold the same name. Numeric sender IDs are not used for A2P.
- Registration/whitelisting is mandatory via the Bulk SMS e-System.
- CST maintains a banned/blocked sender-name list.
- Government entities get name priority; otherwise first-come-first-served.
- A registered sender name may be used only for its classified purpose.
Message classification: five categories
CST classifies SMS into five types: Promotional, Service, Awareness, Warning, and Personal. "Service" messages — OTPs, confirmations, appointment and authentication notices tied to a contracted service — are effectively transactional and are not subject to marketing time limits. A service sender name cannot send promotional content, and vice versa; only private entities may send promotional SMS.
- Five categories; cross-use (a service name sending ads) is prohibited.
- Service/OTP messages are exempt from promotional timing rules.
- International inbound messages may only be Service or Personal.
- OTP messages must state the reason the OTP was sent.
Content and timing rules (the -AD tag and Ramadan window)
Promotional and awareness messages may only be sent between 9:00am and 10:00pm KSA time; they are banned from 10:00pm to 9:00am daily. During Ramadan the permitted window shifts, with sending banned from 1:00am to 12:00pm (noon). Sender names classified as advertisements carry the suffix "-AD", and promotional SMS must not be sent from a mobile phone number.
- Marketing window: 9:00am–10:00pm; Ramadan bans 1:00am–12:00pm.
- Advertisement sender names carry the "-AD" suffix.
- Awareness messages: max one per recipient per day.
- Content must not be scam, spoofing, false or misleading.
Consent, opt-out and unsolicited-message rules
Promotional messages require explicit, provable opt-in; consent buried in a privacy policy or service contract does not count. Recipients must be able to unsubscribe at any time through easy, free channels, and the sender must stop within 24 hours and send a confirmation. Promotional traffic is blocked by default until the end user opts in to receive it.
- Explicit opt-in required; sender must hold proof of consent.
- Opt-out honoured within 24 hours, plus a confirmation notice.
- End users report spam via the 330330 protection channel.
- Promotional traffic is blocked until the user opts in.
Data protection: PDPL and SDAIA
Beyond telecom rules, senders processing personal data must comply with Saudi Arabia's Personal Data Protection Law (PDPL), enforced by SDAIA. The PDPL became fully enforceable on 14 September 2024. It requires a lawful basis for processing, explicit consent for direct marketing, clear opt-out mechanisms, and prohibits using sensitive personal data for marketing.
- PDPL enforced by SDAIA; fully in force since 14 Sep 2024.
- Opt-in consent required for direct-marketing processing.
- Data-subject rights: access, correction, deletion, withdraw consent.
- Cross-border transfer and breach-notification obligations apply.
- Legal basis: Royal Decree No. M/19 of 2021, amended by Royal Decree No. M/148 of 2023.
Enforcement and practical compliance
Two enforcement regimes overlap: CST can suspend sender names and block non-compliant traffic under the telecom law, while SDAIA can levy PDPL fines up to SAR 5 million (doubled for repeat violations). International grey routes carrying a sender name are actively blocked, and international sender names can be blocked for 90 days after valid spam reports. Terminate through a CST-authorized local aggregator on STC, Mobily and Zain KSA.
- Operators: STC, Mobily, Zain KSA.
- PDPL fines up to SAR 5M (doubled for repeat offenses), via SDAIA.
- International grey routes are blocked; use a licensed local aggregator.
- Register separate sender names per classification (service vs. promotional).
- Submit your KYC packTrade licence, authorisation letter and sample messages
- BroadNet files the applicationWith the operators or the regulator, as the market requires
- Review and approvalTypical lead time5-10 business days
- Send under your brandYour approved sender ID on every message
Technical facts for Saudi Arabia
Network codes, message lengths and sender-ID rules in one table. Segment lengths are the GSM standard values (3GPP TS 23.038).
| Mobile country code (MCC) | 420 |
|---|---|
| Dialling code | +966 |
| Operators (MCC-MNC) |
|
| SMS length, GSM-7 (Latin alphabet) | 160 characters in a single SMS; 153 per part when concatenated |
| SMS length, UCS-2 (Arabic, Cyrillic and other scripts) | 70 characters in a single SMS; 67 per part when concatenated |
| Regulator | CST (Communications, Space and Technology Commission) |
| Sender-ID rules | Alphanumeric IDs require CST + operator approval; one ID per legal entity per use case. Foreign senders must bind through a CST-licensed local aggregator. Arabic and Latin scripts both supported. |
| Sender-ID lead time | 5-10 business days |
How to register a sender ID in Saudi Arabia
What to prepare, who approves it and how long it takes. Send us the documents below and BroadNet coordinates the registration with the operators, the regulator or the registry, as the market requires.
- Who approves
- CST, together with the operators STC, Mobily and Zain KSA. Approved sender names are whitelisted in the operator-run Bulk SMS e-System.
- Typical lead time
- 5–10 business days once the paperwork is in
- Renewal
- Annual, handled automatically
Document checklist
- Saudi commercial registration (CR)
- Authorisation letter on company letterhead
- Sample message templates in English and Arabic
- Traffic-type declaration
- Binding to a CST-licensed aggregator (foreign senders bind through BroadNet's KSA entity)
Steps
- 1
Choose the sender name: alphanumeric, Latin or Arabic, up to 11 characters, matching your CR. Numeric sender IDs are not used for A2P, and no two senders may hold the same name.
- 2
Classify it. A service (transactional) sender name cannot send promotional content, and vice versa; only private entities may send promotional SMS.
- 3
Send BroadNet the documents. Foreign senders cannot bind directly to STC or Mobily; they bind through BroadNet's KSA entity on a CST-licensed route.
- 4
BroadNet files with CST and with STC, Mobily and Zain KSA in parallel. Approval typically takes 5–10 business days.
- 5
Send only within the registered purpose. Promotional SMS needs documented opt-in and is prohibited between 10:00pm and 9:00am.
Common reasons for rejection
- A foreign sender trying to bind directly, without a CST-licensed aggregator
- Generic IDs such as INFO or ALERT
- Missing Arabic templates for regulated categories
- A brand that does not match the CR
Official sources
Requirements are set by the regulator and the operators and can change. Check the official sources, or ask our team, before you file.
Last reviewed
More on Saudi Arabia
Compare A2P SMS rules across the region.
Each market pairs a regulatory playbook with its live coverage and operator-direct routing detail.
KSA rules: promotional vs. service (transactional) SMS
| Capability | Promotional / awareness | Service (OTP, transactional) |
|---|---|---|
| Sender-name registration required | ||
| "-AD" suffix required | — | |
| 9am–10pm window (Ramadan 1am–12pm ban) | — | |
| Prior opt-in consent required | — | |
| Open to international inbound senders | — |
Common questions
Do transactional OTP messages need sender-name registration in Saudi Arabia?
What are the allowed promotional SMS hours in Saudi Arabia?
Is explicit consent required, or is a privacy-policy notice enough?
Can we send Saudi A2P SMS over international routes?
What is the "-AD" tag and when is it required?
Which law governs personal data in SMS marketing, and who enforces it?
Keep exploring
Test first. Go live with confidence.
Test access on request, reply within one business day. Pay-as-you-go in production. Volume pricing from 1M messages/month.