SMS API in the UAE 2026: AD- Prefixes, TDRA, and the OTP Shift

One of the strictest SMS markets, with big catches

The UAE runs one of the strictest SMS regimes anywhere. Using an SMS API in the UAE means navigating rules that catch unprepared senders hard. Three stand out. International senders are flatly banned from promotional SMS to UAE recipients. This is a hard boundary, not a hurdle. Local promo must use an 'AD-' prefixed sender ID, per TDRA's refreshed October 2025 marketing policy. Bank OTPs are being phased out entirely: the Central Bank is mandating biometric and passkey approvals to replace SMS OTP by March 2026. Add fines reaching hundreds of thousands of dirhams per non-compliant message. For example, in 2023, the Telecommunications and Digital Government Regulatory Authority fined a company 500,000 AED for sending unsolicited promotional messages.

Here's what each rule means and how an international sender operates within them. Including where you simply can't.

SMSRoute's published route pages list direct-carrier delivery via Etisalat, du from $0.004/message with sub-100ms median submission and ~98.6% delivered success (smsroute.cc route pages, 2026).

The rules that catch senders

The international promo ban reshapes strategy. If you're a foreign company, you cannot send marketing SMS to the UAE, full stop. That traffic requires a local entity and an AD-prefixed, registered sender ID. Transactional and OTP traffic from international senders is permitted — that's the workable path. But even that is shifting for banks. The Central Bank's mandate is replacing SMS OTP with biometric and passkey

How an international sender operates in the UAE

1. Confirm your traffic is transactionalInternational senders can send transactional and OTP SMS to the UAE but NOT promotional. If it's marketing, you need a local entity and AD-prefixed registration — an international route won't carry it compliantly.
2. Register a sender ID if branding transactionalVia the Etisalat/DU portals; 5-10 business days for local companies, 20-25 for international. Budget the longer timeline as a foreign sender.
3. For banks, plan the OTP migrationIf you're a UAE financial institution, SMS OTP for customer transactions is now retired under the CBUAE mandate (deadline 31 March 2026, since passed) — the move is to biometric/UAE Pass/passkey approvals, with SMS kept only where still permitted. Banks now also carry full liability for OTP-linked fraud, which is the reason the rule has teeth.
4. Respect quiet hours and consent for any marketingIf you do have a local marketing path, no promo 9pm-7am, and consent documented with date, time, content, and signature — the UAE demands rigorous records.

Sending to the UAE in practice

SMSRoute is a no-KYC SMS API with crypto billing (BTC, ETH, USDT, XMR, LTC, and SOL) serving the international route to the UAE, with live pricing on the send SMS to UAE page. For international transactional and OTP traffic to UAE users, the route delivers reliably. For promotional SMS to the UAE, an international sender requires a local entity and AD-prefixed registered sender ID, which SMSRoute can facilitate on request for qualifying senders.

So the UAE is a market with clear compliance boundaries: transactional and OTP traffic flows smoothly via our international route, and promotional sending is available through local registration support. For banks specifically, the OTP phase-out means planning past SMS for authentication entirely. We'll deliver your transactional UAE traffic reliably and guide you on the best path for promotional needs. Because in a market with per-message fines this steep, knowing exactly what you can send and how to send it is the whole game. For how this market fits the wider picture, see the global SMS compliance map.

Related reading

FAQ