Regulations of the Provision of the Short Messaging Service (SMS) RS29 Second Version April 2022 Disclaimer: English language text is not an official translation and is provided for information purposes only. It confers no rights and impose no obligation separate from those conferred or imposed by the original Arabic text formally adopted and published. In the event of any discrepancies between the English translation and the Arabic original, the Arabic original shall prevail. www.citc.gov.sa Version Control Table Version General and Special Terms and Conditions for the Provision of Short Messaging Service (SMS) Issuing Date - RS29 First Version Regulations of the Provision of the Short Messaging Service (SMS) April 2022 RS29 Second Version 2 TABLE OF CONTENTS 1. INTRODUCTION 4 2. DEFINITIONS 4 3. SCOPE OF APPLICATION 5 4. SCOPE OF PERMITTED SERVICES 5 5. SERVICE SPECIAL TERMS & CONDITIONS 5 6. REQUIREMENTS FOR OBTAINING THE SERVICE PERMIT 7 7. FEES 8 8. SERVICE PERMIT DURATION 8 9. GENERAL PROVISIONS 9 10 APPENDIX (A): BANK GUARANTEE LETTER FORM 3 1. Introduction Pursuant to the Telecommunications Act (Act), its Bylaw (Bylaw), and Communications and Information Technology Commission (CITC) Ordinance (Ordinance) and the powers granted thereby, including creating and promoting a fair and competitive environment in all telecommunication fields, and in accordance with the development of telecommunications markets in the Kingdom and experiences of other countries, CITC has issued this Regulation to regulate the provision of the Short Messaging Service in the Kingdom. 2. Definitions The terms and expressions defined in the Telecommunications Act, its Bylaw and other CITC's statutes shall have the same meanings when used in this document and its enclosed annexes. In addition, the following terms and expressions shall have the following meanings assigned thereto unless the context requires otherwise: 2-1 "Class License": A telecommunications license issued by CITC that authorizes all qualified telecommunications service providers within the class defined in the license to provide telecommunications services in accordance with the conditions specified in the license. 2-2 "General Class License (GCL)": A Class License that allows a service provider to provide any telecommunications services permitted under such license. 2-3 "Service Permit": CITC service permit to provide services specified in the respective (GCL). 2-4 "Permit Holder": A service provider holding a (GCL) issued by CITC with a Service Permit to provide services specified in this document. 2-5 "Short Messaging Services (SMS)": It is a service provided through public telecommunications networks licensed in the Kingdom; It allows service providers or their customers to send or exchange short messages (text, audio, video) directed directly to the beneficiary, for the purpose of promoting a specific product, providing them with information, notifying them of developments, answering their inquiries, and other similar services, including broadcasting General messages for a specific area. 2-6 "Beneficiary": The one who is receiving the text message. 2-7 "Subscriber": Any person/entity that is a party to a valid contract or similar agreement with a service provider for the purpose of sending text messages to the beneficiary. 4 3. Scope of Application This Regulation applies to (SMS) service providers authorized by CITC, and any other service provider holding a license or other permit to provide such services in the Kingdom. 4. Scope of Permitted Services Permit holder can provide (SMS) services, purchase and operate respective equipment. 5. Service Special Terms & Conditions 5-1 The Permit holder must comply with all the Regulations and Decisions issued by CITC related to (SMS). 5-2 The Permit holder must limit the provision of professional services (such as medical, legal, engineering, financial, educational or other consultations) to those licensed to practice these professions according to the regulations enforced in the Kingdom, with the approval of the related authorities as a condition for starting the provision of the service. 5-3 The Permit holder must use the messages centers and telecommunications networks of the licensed service providers in KSA when sending any messages. 5-4 The Permit holder may not prevent the Subscriber from sending any messages – not conflicting with CITC's Statutes– to the Beneficiary, and may not discriminate between Beneficiaries based on their telecommunications service provider to which the Beneficiary belongs. 5-5 All advertisements and/or promotional publications of the service must contain the service numbers allocated for the advertised service only. The price of the message must be written clearly and legibly and the price of the message should be displayed in the visual advertisement so that the beneficiaries are aware of their prices before obtaining the service. 5-6 Must coordinate with licensed telecommunications network operators in the Kingdom when using their own (SMS) centers within the Kingdom to send (SMS) messages to beneficiaries outside the Kingdom. The licensee shall bear any legal or financial consequences to which the operator may be exposed if the licensee violates the international agreements governing the relationship of the operator inside the Kingdom with operators outside the Kingdom such as the ‘GSM Association (AA) 19’ for messages between international operators and others. 5 5-7 Messages shall be sold directly to clients only by the Permit holder (Holding a (GCL) with Service Permit to provide (SMS) service), and the Permit holder may not provide (SMS) service through subcontractors. 5-8 The Permit holder (Holding a (GCL) with Service Permit to provide (SMS) service) and their clients may not resell (SMS) messages to any person, whether to a Licensee, an individual or a legal person. 5-9 The Permit holder shall not resell the short messages to any entity outside the Kingdom. 5-10 The server must be inside the Kingdom and the data must be stored internally. 5-11 The service should not be used as a mean of collecting amounts due to other services such as subscription service on a website or any other service. 5-12 The Permit holder must verify that the content of the message does not violate the laws in force in the Kingdom, as the Permit holder is fully responsible for the content of the messages sent thereby. 5-13 The Permit holder must Saudize (appoint Saudis in) the following jobs: 5-13-1 The person in charge of the company (General Manager/CEO). 5-13-2 The person responsible for communicating with CITC and shall be obliged to meet regulatory requirements. 5-13-3 The representative of the Licensee before governmental authorities/entities or other Licensees. 5-14 Access to systems – used to send (SMS) – shall be via One Time Passwords (OTP), in addition to the username and password. 5-15 When providing (SMS) service to governmental and semi-governmental entities, authorities and banks, the service provider shall comply with this Article (5-15), and inform such entities benefiting from the service to do so, in addition to meeting the following requirements: 5-15-1 Before sending any text message, the content of the message must be prepared electronically by the entity's employee (Responsible for preparing the content of the message) and then approved electronically by the person in charge of the entity (Responsible for content approval). The sender using the system has no right to 6 modify the text of the message after approval. In case of modifying the message content before being sent, it shall be approved by the person in charge. 5-15-2 However, exceptions may be made to the following: Service messages sent automatically frequently from systems (e.g. Two-step verification for login, and etc.), where only the first form of the message must be approved, and any modification to such form must be re-approved. 5-15-3 The authority to prepare and approve message content shall not be granted to a single user. 5-15-4 The user of (SMS) system must be a Saudi national. 5-15-5 User data, device data, operating system type, and (IP) address through which (SMS) system is accessed, shall be maintained. 5-15-6 Any instructions issued by National Cybersecurity Authority shall be adhered to, especially related to remote communication. 6. Requirements for Obtaining the Service Permit 6-1 An application must be submitted through the e-Licensing System. 6-2 The applicant shall have a valid (GCL) from CITC, and its validity period should not be less than (6) six months. 6-3 The applicant must submit a commercial registration valid in the Kingdom for not less than three months, indicating the activity to be permitted. 6-4 The applicant must provide a description of services to be rendered in the Kingdom under such Service Permit. 6-5 The applicant must submit technical specifications of systems and equipment to be used in rendering service under such Service Permit. 6-6 The applicant must provide a list of beneficiaries/entities intended for such services. 6-7 The applicant must provide the detailed mechanism for rendering the service in the Kingdom through such Service Permit. 6-8 The applicant must provide the detailed system structure and work flow, along with encryption method used. 7 6-9 The applicant must provide a mechanism for linking with CITC-licensed telecommunication service providers. 6-10 The applicant must submit owners and managers data in the commercial registration, including (Full name, ID, ID copy). 6-11 The applicant must submit employees data for the following positions, including (Full name, ID, ID copy): 6-11-1 The person in charge of the entity (General Manager/CEO). 6-11-2 The person responsible for communicating with CITC and shall be obliged to meet regulatory requirements. 6-11-3 The representative of the Licensee before governmental authorities/entities or other Licensees. 6-12 An original copy of the bank guarantee in Arabic (SAR 500,000) must be submitted to CITC after accepting it electronically for the first Service Permit application. The bank guarantee shall be in the form shown in Appendix (A), and valid for not less than one year, renewable for other terms. 6-13 The applicant must fulfill all regulatory requirements of the service. 6-14 The applicant must submit all required documents and information in Arabic. Supporting documents (if any) may be submitted in English. 6-15 The applicant shall pay CITC licensing fees in accordance with the "Regulations of the Fees for the Telecommunications Services" published on CITC website, through a SADAD system within a month from invoicing. 7. Fees The fees payable by the Permit Holder to CITC shall be determined according to the "Regulations of the Fees for the Telecommunications Services" published on CITC website. 8. Service Permit Duration The duration of the service permit shall be related to the validity period of the (GCL) unless the service permit is canceled. 8 9. General Provisions 9-1 The approval of permit application is subject to CITC's absolute discretion. 9-2 These Regulations are subject to CTIC periodic review and subject to update, as CTIC deems appropriate in accordance with its statutes. Updates are approved by CITC Governor. 9 Appendix (A): Bank Guarantee Letter Form The approved language of the bank guarantee is Arabic, and it has been translated for the purpose of clarification Communications and Information Technology Commission Al-Nakheel District P.O. 75606 | Riyadh 11588 Kingdom of Saudi Arabia [Date] Applicant's Name ……………………………….. Dear, Regarding the service permit for the provision of [Please Insert Service Name] in Kingdom of Saudi Arabia. Whereas [Applicant's Name], will be granted a service permit to provide [ …Service Name…] in the Kingdom of Saudi Arabia, We, […Issuer bank name…] hereby, pledge an unconditional and irrevocable undertaking to pay the amount of [SR………………] (………………………. Saudi Riyals) according to the following conditions: 1. We shall pay you immediately upon your written request, regardless of any abjection on the part of the Licensee or any other party, the amount(s) you demand, which will not exceed in aggregate the above mentioned amount, either by wire transfer to your account with any bank in the Kingdom of Saudi Arabia or via any other method acceptable to you. 2. All payments made upon your written request shall be unrestricted, free of any deductions at present or in the future, and not be eligible for any taxes, fees, expenses, deductions, withholdings or levies, regardless of the their type or the authority imposing them. 3. The undertakings stated herein shall constitute direct, substantial, unconditional and irrevocable obligations to us, and we will not be relieved from these obligations or any part thereof for any reason whatsoever, such as change or extension of the service permit process; change of the scope or the nature of the work to be performed; or any negligence or act on your part or any other party, which may relieve or release us from the obligations and responsibilities provided for herein. 4. This Guarantee shall remain valid and in full force until the end of the day ………….. of the month of …………….. of the year …………….., pursuant to the terms and conditions included herein. In the event that you serve on us a duly singed notice in writing on or before the date specified herein for the expiration of the validity of this guarantee (or any extension thereof as per the terms and conditions herein) to extend the validity of this guarantee, we undertake to: 10 a) automatically extend the term of this guarantee for a similar period, commencing from the date of the expiration of its original term or any subsequent extension thereof; or b) pay you the amount of the guarantee. 5. We acknowledge and confirm that the amount of this guarantee does not exceed 20% of the total issued capital and reserves of the bank. 6. Any dispute arises in relation to this guarantee shall be settled exclusively by the competent authorities in the Kingdom of Saudi Arabia according to the laws, regulations, orders, rules and instructions applicable in the Kingdom of Saudi Arabia. Kind Regards, [Signature(s) of authorized signatory(ies)] [Name(s) of authorized signatory(ies)] [Name of the issuing bank] [Date] Note: The wording of the bank guarantee must not contain the word "contract" or "contractor" for the company/institution seeking CITC service permit. Any bank guarantee containing such words will not be accepted. 11 12