CST License for Telecom and VoIP in Saudi Arabia
The Communications, Space and Technology Commission (CST) is the regulator that oversees all public telecommunications activities in the Kingdom. Any company that offers voice over Internet Protocol (VoIP), broadband connectivity, or related value‑added services to Saudi users must first determine whether its activities fall within the scope of a CST licence. Failure to obtain the appropriate authorisation can expose a business to regulatory sanctions, civil penalties and the risk of having its service blocked. This guide outlines the main categories of services that attract a licence, explains the distinction between facilities‑based and non‑facilities‑based authorisations, and highlights the practical implications of operating without clearance.
Services that require a CST license
Telecom operators that own or manage fixed‑line or mobile networks are required to hold a facilities‑based licence, as are Internet Service Providers that deliver broadband access over their own infrastructure. Providers of public VoIP termination, wholesale voice routing, and any platform that offers end‑users the ability to place calls to the public switched telephone network must also be licensed, regardless of whether they own the underlying circuit. Value‑added services such as SMS aggregation, multimedia messaging, mobile money platforms, and content delivery networks that are marketed directly to Saudi subscribers fall within the CST’s regulatory ambit. Even cloud‑based communications solutions that integrate voice or messaging functions for Saudi users are generally treated as licence‑requiring activities. In practice, the regulator evaluates the service’s technical characteristics and its target market to decide whether a licence is mandatory.
Facilities‑based versus non‑facilities‑based licenses
A facilities‑based licence is issued to entities that own, operate or control the physical network elements that carry communications traffic, such as base stations, fiber optic cables or switching equipment. Holders of this licence are subject to extensive technical and security obligations, including network‑level reporting, spectrum management and compliance with national standards. A non‑facilities‑based licence, sometimes called a service‑provider licence, applies to businesses that deliver communications services by leveraging infrastructure owned by a licensed carrier. These providers focus on the application layer – for example, a cloud‑hosted VoIP application that routes calls through a carrier’s network – and therefore face a lighter regulatory burden. The distinction matters because it determines the depth of CST oversight, the reporting frequency required, and the level of capital investment needed to maintain compliance.
When a non‑facilities‑based license is sufficient
If a company does not own any transmission facilities and instead resells capacity purchased from a licensed network operator, the CST typically treats it as a non‑facilities‑based service provider. This model is common for over‑the‑top (OTT) applications that provide messaging, video conferencing or hosted call‑centres to Saudi users while relying on third‑party broadband or mobile connections. The regulator expects the provider to register, demonstrate that it has a contractual relationship with a licensed carrier, and comply with consumer protection and data‑security rules. The licensing fee and reporting obligations are proportionate to the service scope rather than to network deployment costs. Nevertheless, the provider must maintain clear records of traffic routing and ensure that the underlying carrier’s licence remains valid throughout the service period.
Consequences of operating an unlicensed service
Operating a telecom or VoIP service that reaches Saudi users without the appropriate CST authorisation exposes the provider to administrative fines that can be substantial and are calculated based on the severity of the breach. The CST has the authority to issue cease‑and‑desist orders, block IP addresses or domain names, and, in repeated cases, pursue criminal prosecution against responsible individuals. Unlicensed operations also jeopardise business relationships, as partners and investors may view the regulatory risk as a material liability. In addition, customers may experience service interruptions if the regulator intervenes, leading to reputational damage that can be difficult to repair. Early detection of non‑compliance and prompt remediation are therefore essential to mitigate these outcomes.
Businesses that anticipate offering telecom, VoIP or value‑added services in Saudi Arabia should begin the compliance process well before launch. The first step is a detailed service audit to map technical features against CST licensing criteria, followed by preparation of the required documentation, which typically includes a business plan, technical architecture, and evidence of any carrier agreements. Application submission is conducted through the CST’s online portal, after which the regulator may request additional information or conduct site inspections. Throughout the review, maintaining open communication with CST officials can help resolve ambiguities and accelerate approval. Once the licence is granted, ongoing obligations such as periodic reporting, fee payments and adherence to security standards must be incorporated into the company’s operational procedures.
Key compliance considerations for businesses
Ensure that any service targeting Saudi residents is assessed for licensing requirements before any marketing or technical deployment. Keep detailed records of all carrier agreements and be prepared to demonstrate that the service does not interfere with public networks or breach data‑privacy rules. Align internal policies with CST reporting timelines and retain legal counsel to monitor regulatory updates that could affect the licence scope. Implement a compliance monitoring framework that flags changes in service delivery models, such as adding new features that might trigger additional licensing obligations. Regularly review the cost‑benefit of maintaining a facilities‑based licence versus transitioning to a non‑facilities‑based model as the business evolves.
If you are unsure whether your telecom or VoIP offering requires a CST licence, or need assistance navigating the application process, contact Northman Sterling Legal. Our team can assess your service model, guide you through compliance steps, and help protect your business from regulatory risk.
Contact Northman Sterling Legal to discuss your matter with our team.