OTPs, fraud alerts, KYC flows, WhatsApp Banking and statement notifications — built for banks, fintechs and payment networks across MENA, Africa and Asia. SOC 2 Type II, ISO 27001, with sub-5-second OTP delivery, direct to the operator in 86 countries.
Banks routing OTPs and fraud alerts through BroadNet
The same authenticated REST endpoint powers OTP, ISO-20022 transaction alerts, KYC orchestration, and one-tap fraud actions — the API layer beneath AMS-Banks, BroadNet's two-way banking messaging platform. Compliance profile travels with the payload — sender ID, residency, and the regulator's rule set are applied at the edge.
# Banking OTP — one POST, Bearer token, JSON body.curl -X POST https://api.broadnet.me/sms/sendSms \ -H "Authorization: Bearer $BROADNET_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "senderId": "BANK", "destinationNumber": "447700900123", "message": "Your verification code is 812345. Never share it with anyone.", "messageType": "TEXT" }' # → 200 OK — the response body is the message ID, e.g. 2603121407537573731The same routes that move OTPs in 1.2 seconds also carry your transaction alerts, onboarding flows and conversational banking — with the regulatory guardrails that regulated finance demands.
Speed-tuned authentication codes on premium routes with SMS → WhatsApp → Voice failover. Critical for login, password reset, and step-up authentication.
Real-time push when a card swipes, a wire clears, or a balance drops below threshold. Anomaly events reach the customer in seconds, not hours.
Onboarding flows that combine OTP-binding, document upload links, liveness deep-links and biometric callbacks — orchestrated across SMS, WhatsApp and Voice.
Promotional sends with one-tap opt-out, frequency capping and quiet-hour windows enforced per-jurisdiction. PDPL, CCPA and CTPA consent ledgers built in.
Conversational banking on the official WhatsApp Business API — balance enquiries, statement retrieval, card controls and concierge routing to human agents.
Statement availability, scheduled-payment confirmations, salary-credit alerts, cheque clearance — every event routed through the cheapest channel that delivers reliably.
Illustrative example — sample content, not a real customer message.
Your MyBank one-time code — never share it with anyone:
Expires in 5 minutes. MyBank staff will never ask you for this code.
We stopped a card-not-present charge of AED 1,250.00 at an unverified merchant on the card ending 4421. If this wasn't you, freeze the card now.
Banks ship messages under the strictest data-protection regimes in the world. Every send is logged, retained and exportable to your regulator and internal audit on demand.
Security, availability and confidentiality criteria, audited continuously across a 12-month observation window.
Information security management certified across data centres in Dubai, Frankfurt and Singapore.
EU GDPR Article 28 DPA, UK GDPR, and California CCPA/CPRA addenda available on day one for regulated workloads.
UAE Federal Decree-Law 45/2021, KSA PDPL 2023, Bahrain PDPL 2019 — data-residency options in DXB and RUH.
Aligned to UAE Information Assurance Standards (T1–T4). Critical-infrastructure controls documented and attestable.
Brand reference available under NDA on request.
One REST call from your core banking, payment switch or fraud-decision engine. BroadNet handles operator selection, sender-ID rotation, failover and delivery-receipt reconciliation.
TLS 1.3 REST or SMPP 3.4 from your core. JSON payload, Bearer-token auth, message-class hint.
Fraud-scored routing, sender-ID rotation, channel selection. SMS-first with WhatsApp / Voice failover.
Direct MNO route. Delivery-receipt webhook back to your switch within seconds. Audit log.
SAMA, CBUAE, CBE, CBJ and QCB rule sets are evaluated as policy at the edge — not bolted on by application code. Sender ID, TTL ceilings, channel restrictions and data residency are enforced before a single packet hits an operator.
Switch, fraud engine or auth service emits a REST call or ISO-20022 webhook. Deduplicated by message id at the door.
TLS 1.3 termination, signature verify, PII tokenisation, template render, fraud-score rule eval.
SAMA · CBUAE · CBE · CBJ · QCB rule set applied. Sender-ID, quiet-hours, content class, residency enforced.
Direct SMPP bind to the destination MNO in 86 countries, labelled partner routes elsewhere. Premium A2P routes only — no grey routes.
OTP delivered, customer authenticates. DLR pushed back to your fraud/auth service.
Switch, fraud engine or auth service emits a REST call or ISO-20022 webhook. Deduplicated by message id at the door.
TLS 1.3 termination, signature verify, PII tokenisation, template render, fraud-score rule eval.
SAMA · CBUAE · CBE · CBJ · QCB rule set applied. Sender-ID, quiet-hours, content class, residency enforced.
Direct SMPP bind to the destination MNO in 86 countries, labelled partner routes elsewhere. Premium A2P routes only — no grey routes.
OTP delivered, customer authenticates. DLR pushed back to your fraud/auth service.
Yes. We hold direct A2P interconnects approved by the Saudi Communications, Space & Technology Commission (CST) and SAMA for KSA banking traffic, by TDRA for the UAE, and by the NTRA for Egypt. Bahrain (TRA), Jordan (TRC) and Qatar (CRA) are similarly covered. Sender-ID registration, content templates and quiet-hours policy are managed by our in-region compliance team — your team files nothing.
OTP flows pass through a compliance gate that applies the relevant SCA rule set per regulator — channel restrictions, TTL ceilings, replay windows and binding requirements. The gate is configuration, not code, so when SAMA tightened TTL to 180 seconds in 2025 customers got the new behaviour without redeploying. Audit evidence is exported in regulator-accepted format on request.
Within the TTL window we re-pin to the next operator route, escalate channel (SMS → WhatsApp Business → Voice IVR) if your fraud profile allows, and emit a 'delivery degraded' webhook to your auth service so it can offer the customer an in-app alternative. No duplicate billing — failover de-duplicates on the OTP ID.
Standard sender IDs land in 5-10 business days in UAE, KSA, Bahrain and Qatar; 7-15 business days in Egypt and Jordan. We pre-clear bank brand names with regulators on annual cycles, so re-registrations and minor variants are typically same-week. Emergency sender ID rotation (incident response) is supported on a 24-hour SLA for enterprise contracts.
Every send produces a tamper-evident log line, from the TLS edge to the DLR webhook. 90-day standard retention, 7-year banking tier, with SIEM export to Splunk, QRadar, Sentinel and Elastic. Fraud-flagged messages are quarantined within the rule-eval stage and surfaced in a dedicated webhook your fraud team subscribes to.
Yes. We operate in-country edge and storage regions in Riyadh (KSA), Dubai (UAE) and Cairo (Egypt). Routing, template render, logging and DLR storage stay on-shore. Cross-border replication is opt-in and per-workload — never default. Data-residency attestations are part of the standard banking compliance pack.
Templates carry tokenised references — never raw PAN or CVV. The handoff payload contains only the conversation ID, the customer's verified MSISDN and a signed deep link to the bank's hosted card-control surface. WhatsApp Business templates are pre-approved by Meta and the regulator; conversational replies are routed back to your core via webhook.
Typical timeline: week 1 — security review, DPA, API access token issued, sender-ID filings begin. Weeks 2-3 — integration build, fraud-rule import, ISO-20022 webhook wiring. Week 4 — staged cutover, parallel-run against legacy vendor, signed SLA goes live. Most banks are in full production within four weeks; complex multi-jurisdiction estates take 6-8.
Need a deeper compliance review? Talk to financial messaging expert →
Compliant, reliable messaging tuned to your sector — across MENA, Africa and Asia.
Talk to our banking team about AMS-Banks, routing, residency, certification packs and pricing for 10M+ message workloads. Most banks are integrated within four weeks.
Go deeper on the concepts behind this product.