In short
- Authorisation: CST's anti-spam regulations tell senders not to buy bulk SMS from providers CST has not authorised. Ask for the document. Interkey holds CST's permit to provide short message services (SMS).
- Sender name: messages must carry a registered sender name; promotional names carry the suffix "-AD".
- Traffic types: OTP, service and promotional messages follow different rules and are usually priced differently.
- Connection: a web platform for your team, and an API (REST, SMPP or SOAP) for your systems.
- Control: per-message delivery receipts, spending limits and country blocking.
10 questions to ask every SMS provider
| # | Ask the provider | Why it matters |
|---|---|---|
| 1 | Are you authorised by CST to provide SMS services? Which legal entity holds the authorisation? | CST's regulations say senders must not buy or send bulk SMS through providers CST has not authorised (clause 4.6.3). |
| 2 | Who registers our sender name, and what do you need from us? | Operators filter bulk messages that carry an unauthorised sender name (clause 4.4.3). |
| 3 | How do you keep OTP, service and promotional traffic apart? | Promotional messages have their own rules on consent, opt-out, sending hours and the "-AD" suffix. |
| 4 | Which integration methods do you support? | Your developers need to know whether they will use REST, SMPP or SOAP, and how access is secured. |
| 5 | How is the sending platform protected? | The regulations expect providers to protect logins to bulk SMS systems with a one-time password and a pre-registered IP address (clause 4.5.4). |
| 6 | What do we see after each message? | Without per-message delivery receipts you cannot tell a delivered OTP from a lost one. |
| 7 | What stops fraud or a script from running up our bill? | SMS endpoints such as OTP and password reset are a known target for scripted abuse; spending limits and country blocking cap the damage. |
| 8 | Who approves message templates before they go out? | An approval step catches wrong or non-compliant content before customers see it. |
| 9 | How is the price built? | Volume, traffic type and Arabic message length all change the cost. |
| 10 | Where is support, in which languages, on which days? | Sender-name questions and delivery issues need answers during the Saudi working week. |
What CST authorisation means for a buyer
Two CST documents shape business SMS in the Kingdom.
The SMS permit. CST lists a business service called "Permit to provide short message services (SMS)". According to CST's service page, the applicant submits, among other items, a valid Saudi commercial registration that includes the permitted activity, the structure and workflow of its system with the encryption method used, its mechanism for connecting to telecom providers licensed by CST, and a bank guarantee. The listed fee is SAR 5,000.
The anti-spam regulations. CST's "Regulations for Curbing SPAM Messages & Calls" (version three, October 2022, approved by CST decision 493/1444) set what operators, SMS providers and senders must do, from sender-name registration to promotional sending hours. As a sender, you carry obligations too: explicit consent for promotional messages, a working opt-out and respect for the restricted hours.
How to check: ask each provider on your shortlist for its authorisation document and the name of the entity that holds it, and confirm that entity is the one you will contract with. CST updated its SMS service regulations by decision 515/1445 (8 February 2024); read the current text on cst.gov.sa before you sign.
CST: Permit to provide short message services (SMS) · CST: Regulations for Curbing SPAM Messages and Calls · Saudi SMS compliance guide
Sender names: settle this before launch
- A sender name is the name customers see instead of a number. CST defines it as the name through which bulk SMS are sent.
- Operators filter bulk messages with an unauthorised sender name, so registration has to be complete before your first send.
- Sender names classified as promotional carry the suffix "-AD".
- Promotional SMS may not be sent from a mobile number.
- Ask who submits the request, which documents you supply and who owns renewals and changes. Expect to provide your commercial registration, a brand-owner authorisation if the brand and the legal entity differ, the traffic types and sample messages.
With Digital Connect, Interkey handles sender-name registration during onboarding and follows it up through approval. We do not quote a fixed timeline, because it depends on the entity, the name and the traffic type.
Send SMS under your company name · Sender ID registration: who does what
OTP, service and promotional traffic are different products
| Traffic type | Examples | What changes |
|---|---|---|
| OTP | Login codes, payment confirmation, password reset | The message must say why the code was sent (clause 4.6.2). Delivery speed and per-message receipts matter most. |
| Service | Order and delivery updates, appointment reminders, account alerts | Sent to a specific customer about their own service. |
| Promotional | Offers, announcements, loyalty campaigns | Explicit consent, an opt-out honoured within 24 hours, no sending between 10:00 pm and 9:00 am (during Ramadan, 1:00 am to 12:00 noon), and the "-AD" sender-name suffix. Promotional messages start out blocked for each recipient until the recipient chooses to receive them. |
Interkey quotes OTP traffic and marketing traffic separately because they are different products. Ask every provider to quote them separately as well.
OTP SMS · Transactional SMS · SMS marketing and promotional SMS
Integration and security questions for your IT team
- Web platform: your team sends campaigns and reviews reports in the browser, with no coding. Online SMS platform
- REST API: for application traffic such as OTP and notifications.
- SMPP: for sustained high-volume sending.
- SOAP: where an existing business system requires it.
- Access: API access limited to whitelisted IP addresses or a VPN connection; platform login with a two-factor email verification code; admin and user permission levels.
- Certificates: Interkey holds ISO 9001:2015 and ISO/IEC 27001:2022 certificates issued by AQC. Each certificate states its scope; ask us for copies.
Planning your SMS integration · SMPP vs REST SMS API
How Interkey Digital Connect answers the checklist
| Question | Digital Connect |
|---|---|
| Authorisation | Interkey holds CST's permit to provide short message services (SMS). |
| Sender name | Interkey handles registration during onboarding and follows it up through approval. No fixed timeline is promised. |
| Traffic types | OTP, account alerts and notifications, service updates and mass notifications, promotional campaigns, loyalty messages, announcements and offers. |
| Integration | Web platform, REST API, SMPP and SOAP. |
| Platform security | Two-factor login with an email verification code; admin and user permission levels; API access limited to whitelisted IPs or VPN. |
| After sending | Per-message delivery receipts, delivery and performance reporting, exportable reports and webhook delivery callbacks. |
| Fraud and cost control | Fraud protection, country blocking and spending limits, set for your account during onboarding. |
| Templates | Message templates are approved by your team and by Interkey. |
| Price | Quote only, built on volume and traffic type. OTP and marketing traffic are priced separately. |
| Support | From Interkey's team in Riyadh, in Arabic and English. |
| Background | Interkey was founded in 1999 and has worked in SMS and value-added services since 2004. |
When Digital Connect is not the right fit
- Your traffic goes almost entirely to numbers outside Saudi Arabia.
- You send very low volumes, such as a few hundred messages a month.
Questions buyers ask
How do I know whether an SMS provider is authorised in Saudi Arabia?
Ask the provider for its CST authorisation to provide SMS services and the name of the entity that holds it, and check that the entity matches your contract. CST lists the "Permit to provide short message services (SMS)" among its business services. Interkey holds this permit.
Can we send SMS under our company name?
Yes, once the sender name is registered; bulk messages with an unauthorised sender name are filtered. With Digital Connect, Interkey handles the registration during onboarding.
What hours are allowed for promotional SMS in Saudi Arabia?
CST's anti-spam regulations ban promotional and awareness messages from 10:00 pm to 9:00 am every day. During Ramadan the restricted window runs from 1:00 am to 12:00 noon, Saudi time.
How much does business SMS cost?
It depends on volume, traffic type and message length. An Arabic message fits 70 characters in one SMS, or 67 per part when it is longer; a message in the GSM-7 alphabet fits 160, or 153 per part. Digital Connect is priced by quote. SMS segment calculator
Do we need developers to start sending?
No. Your team can send from the web platform. Developers connect your systems through REST, SMPP or SOAP when you are ready.