In short
- Messages: OTP, transaction alerts, account and security notifications, instalment reminders, and offers to customers who opted in.
- Regulatory context: SAMA's rulebook sets SMS notification requirements for banks; CST's regulations govern sender names and promotional messages.
- Connection: REST API, SMPP for sustained high volume, SOAP for existing core or middleware systems.
- Access: API access from whitelisted IP addresses or a VPN; platform sign-in with two-factor authentication.
- Records: a delivery receipt for each message, and reports you can export.
SMS for banks: the messages banks and finance companies send
| Message | Triggered by | Type | Example |
|---|---|---|---|
| Login or transaction OTP | Customer signs in or approves a payment | OTP | Your code is 482913 to approve a transfer of SAR 2,500. Valid 3 minutes. Do not share it. |
| Card transaction alert | Card purchase or withdrawal | Transactional | Purchase SAR 245.50 at SUPERMARKET, card ending 4821, 14 Dec 18:42. Not you? Call 800XXXXXXX |
| Account credit or debit | Transfer, salary, standing order | Transactional | Account ending 7710 credited SAR 12,000 (salary) on 27 Dec 09:15. |
| Security notification | New device, password or contact change | Transactional | A new device signed in to your account on 14 Dec 21:03. Not you? Call 800XXXXXXX |
| Instalment reminder | Instalment due date | Transactional | Your finance instalment of SAR 1,840 is due on 27 Dec. Ref 8834. |
| Customer data update | Expiring ID or KYC record | Transactional | Your ID on file expires on 5 Jan. Please update it in the app to avoid service interruption. |
| Branch notice | Branch closure or relocation | Transactional | Our Olaya branch moves to King Fahd Road on 1 Mar. Details: example.com/branches |
| Card or finance offer | Bank campaign | Promotional | Only to customers who opted in, from your "-AD" sender name, inside the permitted hours |
"800XXXXXXX" stands for your own customer care number and "example.com" for your own domain. Each example message above fits one SMS segment.
What SAMA's rulebook says about SMS
SAMA's rulebook contains several instructions that involve SMS. The points below are context for planning; your compliance team decides how your messages meet them.
| Instruction | What it says | Reference |
|---|---|---|
| Instant SMS Notification Service | Banks implement an automated SMS notification service for all transactions on personal bank accounts and credit card accounts, credits and debits. The text includes the date, time, amount and type of transaction, excludes the current balance, and masks the full card or account number in line with PCI DSS. The service is activated automatically for all customers at no extra charge, and customers can cancel it in writing. | Document 321000009006, 23 March 2011 |
| SMS alerts for mada card transactions | SAMA sets the information a bank's SMS alert for a mada card transaction must contain. The 2017 circular was updated in November 2020. | Circular 381000060893, updated by circular 42023876 |
| Communication to customers | Banks inform customers by SMS and email at least two months before closing or relocating a branch, service centre or remittance centre. | Document 43089486 (24 May 2022), section 9 "Communication to Customers" |
| Debt collection for individual customers | SMS is among the authenticated means for contacting a customer or guarantor; collection messages carry minimum contact details. | Document 106889333, 6 March 2025 (first issued by circular 391000083340, 2018) |
Check the current text of each instruction in the SAMA Rulebook before you design message templates. This is a summary, not legal advice.
SAMA Rulebook: Instant SMS Notification Service
CST rules that apply to a bank's SMS
The Communications, Space and Technology Commission (CST) "Regulations for Curbing SPAM Messages & Calls" (version three, October 2022, approved by CST decision 493/1444) apply to every sender, banks included:
- Bulk checks: providers pause identical messages sent to more than 50 numbers within one minute while content and links are checked. Government entities and banks are exempt from this check.
- Promotional messages: a card or finance offer needs the customer's explicit consent, a sender name with the "-AD" suffix, and sending outside 10:00 pm to 9:00 am (during Ramadan, outside 1:00 am to 12:00 noon).
- Blocked by default: operators must let users block or allow promotional messages; promotional messages start out blocked until the recipient allows them.
- Sender-name classification: each sender name is classified by message type and promotional names carry "-AD", so OTP and alerts do not go out under the name you use for offers.
What Digital Connect provides for a bank's review
| Area | What Digital Connect provides |
|---|---|
| Integration | REST API for application traffic, SMPP for sustained high-volume SMS, SOAP where an existing business system requires it |
| System access | API access limited to whitelisted IP addresses or a VPN connection |
| Platform sign-in | Two-factor authentication with a verification code sent by email |
| User rights | Admin and user permission levels |
| Content | Templates approved by your team and by Interkey before use |
| Traffic | Fraud protection, country blocking and spending limits on your account |
| Sender names | Registered by Interkey with the operators through CST's central bulk-SMS system during onboarding |
| Records | A delivery receipt for each message; reports you can export |
| Company certifications | ISO/IEC 27001:2022 and ISO 9001:2015, issued by AQC and valid until 12 February 2029; each certificate states its scope |
| Permit | Interkey holds CST's permit to provide short message services (SMS) |
| Support | From Interkey's team in Riyadh, in Arabic and English |
Secure SMS gateway: the controls your security review will check
Questions to settle in writing before go-live
Get these answers in writing for your setup:
- Data location and retention for message content, delivery receipts and any customer data your systems send through the integration.
- Masking: how card and account numbers stay masked from your template to the provider's logs.
- Credentials: how API credentials are issued, stored and replaced, and what happens when a whitelisted IP address changes.
- Traffic separation: which sender names carry OTP, alerts and offers.
- Incident contact: who you call and how an incident is reported to you.
Send us your questionnaire with the inquiry below, and we will answer it in writing for the services you plan to use.
OTP for banking apps
- Keep the code message short: the code, what it approves, how long it is valid, and "do not share it".
- Give the code a short expiry, and limit how many codes one number, device or session can request.
- Put the transaction amount in an approval code where your process allows, so the customer knows what they are approving.
- Watch for SMS pumping: bots requesting codes for numbers that earn the attackers money. Your account's fraud protection, country blocking and spending limits are a second barrier behind your own limits.
OTP SMS for customer verification
SMS pumping protection for OTP senders
Who this page is for
Banks, finance companies, BNPL and payment providers, fintechs and insurance companies that send OTP, alerts and notices to customers in Saudi Arabia.
When Digital Connect is not a good fit: if almost all of your recipients are outside Saudi Arabia, or you send only a few hundred messages a month.
Pricing: by quote. OTP traffic and marketing traffic are priced differently, based on your volume.
Questions from banks and finance companies
Does SAMA require banks to send SMS alerts?
SAMA's "Instant SMS Notification Service" instruction (2011) requires banks to notify customers by SMS of transactions on personal bank accounts and credit card accounts. Check the current text in the SAMA Rulebook.
Does using Digital Connect make our SMS compliant with SAMA rules?
No provider can make that decision for you. Your compliance team decides how your messages meet SAMA's instructions; we provide the sending platform and answer your review questions in writing.
Is Interkey permitted to provide SMS services?
Yes. Interkey holds CST's permit to provide short message services (SMS).
Can we connect our core banking or middleware system?
Yes, over the REST API, SMPP or SOAP. SOAP is there for existing business systems that need it, and SMPP for sustained high-volume traffic.
Are bank messages paused by the bulk content check?
CST's regulations exempt government entities and banks from the provider check on identical messages sent to more than 50 numbers within one minute.
Can we send card offers by SMS?
Yes, as promotional messages: to customers who explicitly opted in, from a sender name with the "-AD" suffix, outside 10:00 pm to 9:00 am (during Ramadan, outside 1:00 am to 12:00 noon).
Do you hold ISO/IEC 27001?
Interkey holds ISO/IEC 27001:2022 certification, issued by AQC and valid until 12 February 2029. Ask us for a copy; the certificate states its scope.