Getting messages into the Gulf: sender IDs, licensed aggregators and the AD- prefix

Teams that have shipped messaging in Europe or North America consistently underestimate this. The technical integration is the same. The path to being allowed to send is not.

Business SMS is regulated by the Telecommunications and Digital Government Regulatory Authority. In practice this means:

• Registered sender IDs, with both major operators, rather than one central registry.
• The AD- prefix on promotional traffic. Mandatory since November 2020. A promotional message without it is non-compliant, regardless of content.
• Category pre-approval. Promotional traffic is classified — banking, real estate, health, education, retail, tourism, charity — and the category is approved rather than self-declared.
• Documented consent under the UAE's data protection framework.

The separation of promotional from transactional is enforced, not advisory. They do not share a sender ID.

The Communications, Space and Technology Commission — formerly CITC — oversees the sector. Two constraints matter most:

• Licensed aggregators. A2P traffic goes through a licensed party. This is the constraint that most often surprises a global platform: coverage is not a commercial matter alone.
• Approved sender IDs, with meaningful restrictions on international alphanumeric senders, which frequently pushes a foreign business toward a registered brand or a local number.

"Global coverage" is a claim to interrogate. Ask specifically: are you a licensed aggregator in this market, or do you reach it through a partner? Both answers can be fine. Only one of them is what most buyers assume they are getting.

Registration timelines are procurement timelines. Sender ID approval and category classification take weeks in some cases. A launch plan that treats this as configuration will slip.

A regional provider's advantage is real and specific. It is not better software. It is standing with operators and regulators, which cannot be bought quickly and is genuinely difficult to replicate.

Notice how much of this mirrors 10DLC: identified senders, declared categories, registered content. Different regulators reached similar conclusions independently, because they were solving the same problem — an open channel that had been overrun.

If you are building for multiple regions, model registration as a first-class concept — sender identities, approved categories, per-market status — rather than as a spreadsheet somebody maintains. Every market you add will want the same fields.

The order matters more than the effort, because several steps only start once the one before them has finished.

Ask one question and listen carefully to the shape of the answer: are you the licensed party in this market, or do you reach it through someone who is?

Both answers can be perfectly good. A provider reaching Saudi Arabia through a licensed partner may deliver excellently. But the two answers have different failure modes, and you should know which one you have bought.

A direct licence means the provider owns the regulatory relationship, can escalate, and carries the consequence of getting it wrong. A partner route means there is a party in the path you have no contract with, whose priorities are not yours, and whose problems arrive at your desk as unexplained delivery failures.

The tell is a provider who answers the question with a coverage map. A map is not a licence.

The integration is the easy half. The path to being allowed to send is regional, serial and slow, and it is the half that decides your launch date. Model registration as data — sender identities, approved categories, per-market status — because the next market wants the same fields, and the market after that will too.