Skip to content

Rules and checklists

SMS for OTPs and alerts in the UAE: what the 31 December Direct Model deadline means for your business

TDRA wants every business that sends A2P SMS (codes, alerts, order updates, offers) on the Direct Model by 31 December 2026. What to ask your provider, which messages can move to WhatsApp, and how MonoChat handles both.

30 October 2026

If your business sends a text message when someone signs in, books, pays or orders, you have a date to put in the calendar: 31 December 2026. On that day the corrective period ends for the UAE’s A2P SMS Direct Model, and the Telecommunications and Digital Government Regulatory Authority (TDRA) has asked every company and government entity that sends application-to-person SMS to have moved by then.

This post explains what the change is, who it reaches, the questions to ask your providers this month, and which of your messages are better sent on WhatsApp in the first place. It is a guide to plan with, not legal advice.

What TDRA asked for

Khaleej Times reported TDRA’s advice on 22 July 2026. In short:

  • What the Direct Model is. “The Direct Model sends messages directly from an SMS aggregator to the end user, without intermediaries.” Messages should no longer pass through a chain of resellers before they reach a UAE mobile number.
  • Who it covers. Government entities, companies, banks and financial institutions, e-commerce businesses, healthcare providers, logistics companies and “any entity using SMS to communicate with customers”.
  • Which messages. One-time passwords, notifications, alerts, marketing and promotional messages, order updates and any other customer-facing A2P SMS.
  • The deadline. The corrective period ends on 31 December 2026. TDRA advises moving within it to avoid interruptions to the service.
  • The steps. Contact your licensed telecom provider, such as e& or du; complete the transition process; review your third-party contracts and your service submission process; finish within the period.

The report gives no penalty figures and no technical detail beyond this. That is a reason to start early rather than a reason to wait: when a login code fails to arrive, the customer does not care which part of the chain was at fault.

The SMS rules that already apply

The Direct Model comes on top of rules UAE senders already live with. Twilio’s UAE guidelines, opened on 30 October 2026, list them clearly:

RuleWhat it means for you
Registered Sender ID onlyCarriers accept SMS only from a registered Sender ID; alphanumeric IDs need pre-registration, which takes about two weeks
AD- prefix on promotionsA promotional Sender ID starts with “AD-”, and the prefix counts toward the 11 characters
No promotions at nightPromotional messages are not sent between 9:00 PM and 7:00 AM local time; they wait in a queue until the morning
Domestic senders only for promotionsPromotional content is supported for domestic entities only
No links, chat links or phone numbersA message with a URL, a WhatsApp or LINE chat link, or a phone number in the body is not allowed
No repliesTwo-way SMS is not supported for the UAE; long codes and short codes are not supported either
Health sendersA health-related Sender ID needs an approval letter from the UAE health authorities

Two of these shape everything else. SMS in the UAE cannot carry a link, so “track your order here” or “pay here” does not work by text. And customers cannot answer, so every SMS is a one-way notice.

Five questions to ask before December

Put these to your operator and your SMS provider in writing, and keep the answers:

  1. Is our current route to UAE numbers a Direct Model route? If you send through a reseller or a global platform, ask which aggregator delivers your messages to e& and du, and whether there is anyone between them.
  2. Are our Sender IDs registered under our own trade licence? A Sender ID registered by a reseller may need to move. Allow two weeks for a new registration.
  3. What changes in our contracts? TDRA names third-party arrangements explicitly. Check who is responsible for delivery and for consent records.
  4. What is the cut-over plan? Pick a date well before the holidays, test OTPs and alerts on both networks, and keep the old route available until the new one has carried real traffic.
  5. Which messages do we still need to send by SMS? This is the question most teams skip, and it is where the savings are.

Which messages belong on WhatsApp

SMS reaches every phone, which is why it stays the safe choice for some messages. Many others work better in a chat, because WhatsApp can carry buttons, links, documents and replies, and the customer can answer.

MessageBetter onWhy
Bank and insurance OTPsSMS or your own appLicensed financial institutions may not send OTPs over messaging apps (CBUAE, April 2026)
Sign-in codes for shops, apps and clinicsWhatsApp or SMSWhatsApp Authentication templates have a copy-code button; keep SMS as the fallback
Order confirmations and delivery updatesWhatsAppA tracking link and a “Talk to us” button are allowed; in UAE SMS they are not
Appointment remindersWhatsAppThe customer can confirm or change the time with one tap
Offers and campaignsWhatsApp, to customers who opted inImages, a catalogue and replies, and no AD- Sender ID to register
Service outage or emergency alertsSMSReaches phones without data or without WhatsApp

What it costs on WhatsApp: Meta charges per delivered template message, and MonoChat adds no markup. Meta’s AED rate card for UAE numbers, as listed on our pricing page (checked 29 October 2026), showed AED 0.0576 for an authentication message, AED 0.1872 for an authentication message to a number outside the UAE, AED 0.0576 for a utility message (AED 0.0432 at the highest volumes) and AED 0.2115 for a marketing message. Replies inside the customer’s 24-hour window are free.

Message examples

SMS one-time password (from a registered Sender ID, no link, no phone number)

482913 is your YourBrand sign-in code. It expires in 5 minutes. Never share it with anyone.

WhatsApp authentication template (Meta writes the text)

482913 is your verification code. For your security, do not share this code. [Copy code]

WhatsApp utility template for an order update

Hi {{1}}, your order {{2}} left our Dubai warehouse and should reach you on {{3}}. [Track order] [Talk to us]

WhatsApp appointment reminder

Hi {{1}}, a reminder of your appointment tomorrow, {{2}}, at {{3}}. [Confirm] [Change time]

Set it up in MonoChat, step by step

1. Keep an SMS channel for what must stay on SMS. Go to Settings › Chat › Channels, select SMS, choose Twilio SMS and click Connect. In Sender type choose Alphanumeric Sender ID to send from your registered name (1 to 11 letters and digits, at least one letter), or Messaging Service to use a Twilio Messaging Service. Enter the Account SID and Auth Token and save. Since MonoChat 3.8.36 this is how a Twilio channel sends from a Sender ID, and since 3.8.37 the inbox shows a notice on a channel that cannot receive replies, so your team knows answers will not come back there. Before 31 December, ask Twilio how its route to UAE numbers meets the Direct Model, as you would ask any provider.

2. Connect WhatsApp through the Cloud API. MonoChat is an official Meta Business Partner, and the WhatsApp number you connect becomes a WhatsApp Business (Cloud) channel under Settings › Chat › Channels.

3. Create your templates in MonoChat. Open the ⋮ menu of the WhatsApp channel and choose Template Messages, then Create. Pick the category:

  • Authentication for codes. Choose One-time password and the Code delivery: Copy code, One-tap autofill or Zero-tap (the last two for Android apps, with your package name and app signature hash). Set how long the code stays valid, from 1 to 90 minutes.
  • Utility for order, booking, account and payment updates.
  • Marketing for offers, and only for customers who opted in.

Meta reviews each template. A wrong category is the most common reason for rejection.

4. Send codes and alerts from your own system. Install WhatsApp Template API from Settings › MonoStore › Apps and create an API token under Profile › API Tokens. One request names the WhatsApp number to send from, the customer’s phone number, the template and its variables. When the customer replies, the conversation lands in your MonoChat inbox.

5. Or let your store start the flow. In Flows, a Webhook Received node starts a flow when your store or booking system calls its URL, and finds or creates the customer by phone. A Send Template Message node then sends the order update, and a Question Answer node can wait for a reply.

6. Ask for opt-in in the chat. Add an Opt-in node to your welcome flow. It asks the question you write and stores the customer’s Yes or No in the Opt-in profile field. Filter your marketing sends on Opt-in = Yes, and change a customer’s Opt-in to No when they ask you to stop.

7. Keep promotions in daytime. A Within Working Hours condition in a flow checks your working hours before a message goes out. TDRA’s night rule is written for SMS, but a WhatsApp offer at 11 PM is rarely welcome either.

A checklist for November

  • List every automated SMS you send, with its purpose and monthly volume.
  • Ask your operator and SMS provider the five questions above, in writing.
  • Check that every Sender ID is registered under your own licence.
  • Move order updates and reminders to WhatsApp utility templates.
  • Keep SMS for bank OTPs, emergency alerts and customers without WhatsApp.
  • Test the new SMS route on e& and du numbers before mid-December.

The short version

The Direct Model is about how your SMS reaches the networks, and the deadline is close. Use the work as a chance to send each message where it serves the customer best: codes and alerts by SMS where they must be, and conversations, links and confirmations on WhatsApp, where the customer can answer you.

MonoChat’s Basic plan is free, and Growth is AED 440.70 a month, taxes included. See pricing for the full plans and Meta’s AED rates.

FAQ

Frequently asked questions

Short answers to the questions we hear most.

What is the A2P SMS Direct Model in the UAE?

It is the way TDRA wants application-to-person SMS delivered: from an SMS aggregator straight to the person, without intermediaries in between. TDRA advises government entities and companies to move to it before the corrective period ends on 31 December 2026.

Which messages does the deadline cover?

Any customer-facing A2P SMS, according to Khaleej Times’ report of TDRA’s advice: one-time passwords, notifications, alerts, marketing and promotional messages, order updates and any other automated message sent to customers by text.

I send SMS through a global provider. Do I need to do anything?

Ask. The reports do not say how the Direct Model applies to traffic that reaches UAE networks through a global provider. Start with your licensed operator (e& or du), as TDRA advises, and ask your SMS provider in writing how its route to UAE numbers meets the Direct Model before 31 December.

Can I send one-time passwords on WhatsApp instead of SMS?

Most businesses can: WhatsApp has an Authentication template category made for codes, and MonoChat can create and send it. Licensed financial institutions cannot: the Central Bank’s April 2026 circular bars banks, insurers, exchange houses and finance companies from sending one-time passwords over messaging apps.

Can customers reply to my SMS in MonoChat?

Only when you send from a number. A Twilio SMS channel connected with an alphanumeric Sender ID is send-only, and MonoChat shows a notice on such a channel in the inbox. Twilio’s UAE page also says two-way SMS is not supported for this locale, so ask customers to reply on WhatsApp instead.

Headquartered in Dubai

Bring every customer conversation into one place.

Connect your first channel in minutes. Basic is free for 1,000 outgoing messages a month.

No credit card required · Prices in AED, taxes included