How to Choose an Enterprise SMS Gateway Provider in the UAE Before the TDRA Direct Model Deadline
NXTAA Team
Messaging Infrastructure Lead
To choose an enterprise SMS gateway provider in the UAE, confirm how its traffic reaches e& and du subscribers under TDRA's Direct Model, test real OTP delivery time on both networks, check that delivery receipts come from the operator, and agree failover and support terms. Price per SMS comes last. TDRA's corrective period for moving A2P traffic to the Direct Model ends on 31 December 2026.
Key Takeaways
- TDRA has asked businesses sending A2P SMS (OTPs, alerts, order updates, marketing) to move to the Direct Model; reports put the end of the corrective period at 31 December 2026
- The route your messages take matters more than the price per message, especially for OTPs
- "Delivered" in a dashboard means nothing unless the receipt comes from the operator
- Test latency on e& and du separately, at peak hours, before you sign
- Build a fallback, usually a WhatsApp authentication template, so a single SMS failure doesn't block a login or a payment
- Start migration now: contracts, sender IDs and testing take weeks, not days
Why This Decision Has a Deadline in 2026
Most years, changing SMS gateway is a procurement exercise you can put off. Not this year.
In July 2026, TDRA asked government entities, banks, healthcare providers, e-commerce and logistics businesses, and anyone else sending application-to-person (A2P) SMS to customers, to move that traffic to what it calls the Direct Model before the corrective period ends on 31 December 2026, according to reporting in Khaleej Times. The guidance covers OTPs, alerts, notifications, order updates and promotional messages alike. e& tells business customers connected through aggregators to move to direct operator connectivity and plan the end of those aggregator agreements so their service isn't interrupted.
So if your OTPs currently reach customers through a chain of resellers, aggregators or international routes, the question isn't whether to review your gateway. It's whether you can finish before the deadline.
We've been through a version of this already, for a different reason.
The Project: OTPs That Were "Delivered" and Never Arrived
Setup
In 2025 we worked with a Dubai e-commerce business selling electronics and home appliances across the UAE. Around 120,000 SMS a month, mostly OTPs for login and cash-on-delivery confirmation, plus order and delivery updates.
Their gateway was an international provider chosen for price. The dashboard showed a delivery rate above 98%. Nobody questioned it.
Conflict
The problem showed up in the wrong place: customer service. Agents kept hearing the same complaint. "I didn't get the code." Checkout data told the same story. A noticeable share of customers who requested an OTP at checkout never entered it, and the share was worse in the evenings.
When we pulled message-level logs, two things stood out. First, a slice of OTPs took more than 60 seconds to arrive, which for a checkout code is the same as never arriving; customers had tapped "resend" two or three times and given up. Second, some messages marked "delivered" had receipts generated by an intermediary, not by the operator. The gateway was reporting that it had handed the message on. Not that the phone had received it.
Here's what the measurements showed, broken down by network.
| Measure (2-week sample) | Network A | Network B |
|---|---|---|
| Dashboard "delivered" rate | 98.4% | 98.1% |
| OTPs arriving within 10 seconds | 91% | 76% |
| OTPs taking over 60 seconds | 2% | 9% |
| Receipts traceable to the operator | Most | Fewer than half |
As the data shows, the headline number was hiding a network-specific problem. One network was fine. The other was being reached through a longer route at busy times, and the receipts couldn't be trusted.
Resolution
We moved OTP and transactional traffic to a provider with direct connections to both UAE operators, kept marketing on a separate stream, and set a rule: if an OTP isn't confirmed delivered within 20 seconds, offer the code by WhatsApp authentication template instead. We also started tracking latency per network every week.
Within a month, "I didn't get the code" tickets fell to a handful, and OTP completion at checkout climbed back to where the product team expected it.
Lesson
Looking back, the mistake wasn't choosing a cheap provider. It was measuring the wrong thing. The dashboard counted messages leaving. The business needed to count codes arriving in time. Everything in the checklist below comes from closing that gap.
What an Enterprise SMS Gateway Does
An enterprise SMS gateway is the service that takes messages from your systems (through an API, an SMPP connection or a platform) and gets them to mobile phones through the operators' networks. In the UAE that means e& and du.
What makes a gateway "enterprise" isn't the volume. It's four things working together:
- Routes: how traffic reaches each operator, and how many hands it passes through
- Reliability: uptime, throughput and how quickly a failing route is switched
- Evidence: honest delivery receipts and message-level logs you can audit
- Compliance: registered sender IDs, consent handling and separation of promotional from transactional traffic
This article is about choosing the gateway. For the rules on consent, sender IDs and send times, see our guide to UAE SMS rules on consent, sender IDs and timing.
Route types compared
When a provider says "direct routes," it could mean several things. Here's how we sort the options.
| Route type | How it reaches the customer | OTP suitability | Direct Model position |
|---|---|---|---|
| Direct with a licensed operator | Your contract and connection run to e& or du | Strong | The model TDRA is moving traffic toward |
| Provider with direct operator connections | One provider between you and the operators, contracted directly with them | Strong, if the provider is connected to both | Confirm in writing how the provider fits the Direct Model |
| Multi-hop aggregator chains | Several aggregators pass traffic along before an operator | Variable; latency and receipt quality suffer | The arrangement businesses are being asked to move away from |
| Grey or international routes | Traffic enters from abroad or through unauthorised paths | Poor; filtering and blocking risk | Not acceptable |
The synthesis is short. If a provider can't tell you, in writing, which row of this table its UAE traffic sits in, that's your answer.
The TDRA Direct Model Deadline: What to Do Before 31 December
The reporting so far gives the direction without every operational detail, so treat your licensed operator as the final word. What's clear is what businesses are being asked to do:
- Contact your licensed telecom provider (e& or du) to start the transition.
- Complete the migration process with them.
- Review your third-party contracts, including aggregators and resellers you send through today.
- Review how your messages are submitted, meaning which systems send SMS and through which connections.
That fourth point catches people out. In a typical mid-sized business, SMS is sent by the e-commerce platform, the CRM, the marketing tool, the HR system and a payment provider, each with its own gateway account. Here's the plan we're running with clients now.
| Week (from mid-November) | Task | Owner |
|---|---|---|
| Week 1 | List every system that sends SMS, its provider and its monthly volume | IT |
| Week 1 to 2 | Ask each provider in writing how its UAE traffic will comply with the Direct Model | Procurement |
| Week 2 to 3 | Contact e& or du; confirm sender IDs and contract requirements | Operations |
| Week 3 to 5 | Connect the new route; test OTP latency and receipts on both networks | IT |
| Week 5 to 6 | Switch traffic in stages: alerts first, OTPs next, marketing last | IT and Marketing |
| Before 31 Dec | Close or amend old aggregator agreements | Procurement |
Six weeks is tight but workable. Starting in December isn't.
The Enterprise SMS Gateway Scorecard
Ask each shortlisted provider the same questions and score them 0, 1 or 2. The first five carry double weight.
| # | Question | Good answer | Weight |
|---|---|---|---|
| 1 | How does your UAE traffic reach e& and du, and how does that fit the Direct Model? | A written description naming the operators | x2 |
| 2 | Are delivery receipts generated by the operator? | Yes, with sample logs | x2 |
| 3 | What is your median and 95th-percentile OTP delivery time per network? | Numbers per network, plus agreement to a trial | x2 |
| 4 | How quickly do you detect and reroute a failing route? | Minutes, with alerting | x2 |
| 5 | Who handles sender ID registration and renewals? | A named process and reminder schedule | x2 |
| 6 | Do you keep promotional and transactional traffic separate? | Separate sender IDs and streams | x1 |
| 7 | What uptime and throughput do you commit to in the contract? | Written SLA with credits | x1 |
| 8 | Can we get message-level logs by API or export? | Yes, with retention period | x1 |
| 9 | Does the platform integrate with our CRM and marketing tools? | Native connectors or a clean API | x1 |
| 10 | Can you fail over to WhatsApp or another channel? | Built in, or documented | x1 |
| 11 | Can you support other GCC countries? | Real answers per country | x1 |
| 12 | What is the support contact for a live outage? | 24/7 named route, not a form | x1 |
A few notes on these.
Question 3 needs a trial, not a slide. Send a few thousand real OTPs through each finalist, split across both networks, at your peak hours. Compare median and slowest-5% delivery times. Weekday evenings and sale days matter most.
Question 9 decides how painful daily life is. If SMS is part of a wider set of channels, it pays to be running SMS alongside WhatsApp and email in one CRM rather than through a separate portal. And if your marketing team will trigger SMS from campaigns, make sure the gateway connects cleanly to your marketing automation platform.
Question 11 matters if you sell regionally. Each GCC country has its own rules. In Saudi Arabia, where sender IDs and templates are registered with the CST, a UAE-only provider can leave you stuck.
What to Measure Once You're Live
A short list of numbers worth a weekly look:
- Latency per network: median and the slowest 5% of OTPs, for e& and du separately
- Receipt match rate: share of receipts that are final operator receipts
- OTP completion: share of OTP requests followed by a successful code entry
- Resend rate: how often users tap "resend"; a rising rate is your earliest warning
- Failover rate: how often the backup channel was used
OTP completion and resend rate are the two that matter to the business. The rest explain why they move.
Pricing: Why Cost per SMS Misleads
SMS pricing in the UAE is usually quoted per message, sometimes with sender ID fees, setup fees and monthly minimums. Comparing the per-message price alone is the trap our e-commerce client fell into.
The real cost of a failed OTP isn't the fils you paid to send it. It's the abandoned checkout, the support ticket, and the second and third resend you also paid for. A slightly higher per-message price on a direct route often costs less overall because each customer needs fewer messages to get through.
When comparing quotes, ask for:
- Price per message, split by promotional and transactional
- Sender ID registration and renewal fees
- Monthly minimums or commitments
- Charges for failed or undelivered messages
- Any change in pricing tied to the Direct Model migration
Not sure where your SMS traffic actually goes? We'll audit your current senders, test OTP delivery on both UAE networks and give you a migration plan for the 31 December deadline. Request an SMS route audit.
Failover: SMS Is No Longer Your Only OTP Channel
For a growing number of UAE businesses, SMS is the default OTP channel but not the only one. WhatsApp authentication templates can carry one-time codes with a copy-code button, and many customers in the UAE already have WhatsApp open.
A sensible setup for most businesses looks like this:
- Send the OTP by SMS through a direct route.
- If the operator receipt doesn't arrive in 15 to 20 seconds, offer "Get the code on WhatsApp."
- Log which channel delivered, so you can see trends by network and time of day.
UAE banks have been moving away from SMS OTPs for many transactions, but most other sectors still rely on them, and SMS reaches every phone without an app. Keep both.
If you add WhatsApp for OTPs, think about keeping operational messages on a separate WhatsApp number from your sales and support line, and understand how the WhatsApp Business API is priced and used in the UAE before you budget.
What We'd Do Differently Next Time
In hindsight, two things.
We'd test latency per network from the very first week of any SMS project, not after complaints arrive. And we'd write the receipt question into every contract: a receipt that doesn't come from the operator is a status update, not proof of delivery.
The Direct Model deadline makes both easier to insist on. Every provider is having this conversation with its customers right now. Make sure yours gives you written answers.
How NXTAA Can Help
NXTAA helps UAE businesses run OTP, alert and marketing SMS through compliant routes, alongside WhatsApp and email.
- SMS route audit: we list every system sending SMS, where its traffic goes and what has to change for the Direct Model
- Migration planning: working with your licensed operator on sender IDs, contracts and a staged switch before 31 December
- Delivery testing: OTP latency and receipt checks on e& and du, at your peak hours
- Failover setup: WhatsApp authentication templates as a backup channel, with reporting by channel and network
See our enterprise SMS service for what's included, or talk to our team about your migration timeline.
Related Reading
- UAE SMS guidelines 2026: dos, don'ts and compliance
- Omnichannel CRM for UAE businesses
- One WhatsApp number or two?
- Marketing automation for Dubai businesses
- Enterprise SMS solutions from NXTAA
Frequently Asked Questions
What is an enterprise SMS gateway? It's the service that sends SMS from your systems to customers' phones through the mobile operators, with the routes, logs, receipts and support a business needs for OTPs and alerts. In the UAE the operators are e& and du.
What is the TDRA Direct Model for A2P SMS? It's TDRA's model for business-to-customer SMS that moves traffic onto direct arrangements with licensed operators and away from chains of intermediaries. e& is asking aggregator-connected businesses to move to direct operator connectivity.
Do UAE businesses have to switch SMS providers by December 2026? Businesses sending A2P SMS are being asked to complete the move to the Direct Model before the corrective period ends on 31 December 2026. Whether you need a new provider depends on how your current one connects, so ask them in writing and confirm with e& or du.
What is the difference between direct and grey SMS routes? A direct route reaches the operator through an authorised connection, while a grey route enters through unauthorised or international paths. Grey routes are cheaper but slower, less reliable and liable to be blocked.
How much does an enterprise SMS gateway cost in the UAE? Pricing is usually per message, with sender ID fees, possible setup fees and monthly minimums. Compare the cost per successfully delivered OTP rather than the cost per message sent.
Can I send OTPs in the UAE without a registered sender ID? UAE operators require registered sender IDs for business SMS, and unregistered IDs risk being blocked. Ask your provider which sender ID your OTPs will use and who keeps it renewed.
Should I use WhatsApp or SMS for OTPs in the UAE? Use both. Send by SMS first through a direct route and offer WhatsApp as a fallback when the SMS isn't confirmed quickly.
