SIM Registration KYC Compliance – What the UAE and Saudi Arabia Actually Require

On this page

• What the UAE requires for SIM registration KYC
• What Saudi Arabia requires for SIM and eSIM registration
• UAE and Saudi Arabia side by side
• Why the rules exist: the cost of weak SIM verification
• The hardware question hiding inside the regulation
• The enterprise platform behind the kiosk
• How compliance gets monitored, not just built
• Security and governance: proving compliance after the fact
• Already running under these rules
• Where AI fits
• Frequently asked questions

Why It Is a Procurement Question and Not a Best Practice

SIM registration compliance in the UAE and Saudi Arabia is no longer a matter of best practice. Both markets now have specific, current regulation that spells out exactly what a compliant identity check has to include, and telecom operators evaluating self-service kiosks are increasingly being asked to prove their platform actually meets it, not just describe it in general terms.

Neither market is acting in isolation. GSMA’s own Mobile Policy Handbook confirms that some 160 governments worldwide now mandate prepaid SIM registration, up sharply over the past decade, with biometric data increasingly part of that requirement in a growing number of countries. The UAE and Saudi Arabia sit at the stricter end of that global trend, not the exception to it.

Wavetec builds self-service and queue management platforms across more than 80 countries, from 11 offices spanning the Americas, Europe, Africa, and the Middle East, which means the company is not reading UAE and Saudi telecom regulation from the outside. Wavetec is already operating retail hardware inside dozens of regulatory environments at once, each with its own identity, data, and biometric rules. That footprint is what makes a regional compliance question like this one answerable with real deployment data instead of theory.

What the UAE Requires for SIM registration KYC

The direct rule is simple: TDRA, the UAE telecom regulator, requires a valid Emirates ID or passport to register any SIM, with every card traceable to a verified identity.

Separately, a broader identity-verification framework is tightening across the UAE’s regulated sectors. Federal Decree-Law No. 30 of 2024 established a mandatory National Digital KYC Platform for the financial sector, and Federal Decree-Law No. 10 of 2025, together with Cabinet Resolution 134 of 2025, require regulated financial entities to demonstrate that “the person claiming to be a customer is, in reality, that person,” including biometric verification with passive liveness detection and protection against deepfake injection attacks.

That framework governs banks and financial institutions today, not telecom SIM registration directly. It matters anyway, because it signals the direction UAE identity verification is moving in overall, and telecom operators serving the same customers, often through the same retail footprint as banking partners, are watching it closely.

What Saudi Arabia Requires for SIM and eSIM Registration

In Saudi Arabia the requirement is more direct still. Any SIM or eSIM that connects to a Saudi network must be tied to a government-issued ID, a passport for visitors, a national ID or Iqama for residents, and full activation requires either an in-person check or a video KYC process.

Saudi Arabia is also one of a small group of countries that requires fingerprint capture specifically for SIM registration. That single line is the one that changes a hardware specification rather than a process document, and it is covered in detail further down.

UAE and Saudi Arabia Side by Side

The two markets overlap on identity and diverge on biometrics. This is the comparison to put in front of a regulator or a procurement committee.

Why the Rules Exist: The Cost of Weak SIM Verification

Regulation like this does not appear in a vacuum. In 2020, a Dubai Court of Appeal ruling upheld a judgment against a UAE bank over a SIM swap fraud case dating back to 2017. The bank was ordered to reimburse a customer Dh4.7 million after court-appointed experts found it lacked double-factor authentication and adequate controls around SIM and card replacement.

Around the same time in Saudi Arabia, police in the Hail region seized 2,695 SIM cards from two residents found trading SIM cards registered under the identities of Saudi citizens and expatriates without their knowledge.

Both cases are older, and the specific gaps they exposed have since been addressed. They are still exactly the kind of incident that pushes regulators toward mandating stronger identity verification at the point of SIM registration or replacement, not as a hypothetical risk but as a demonstrated one.

The risk has not disappeared, it has shown up in a different form. Regula’s Deepfake Trends 2024 research found that deepfake fraud alone cost surveyed UAE organizations an average of $379,000 in 2024. That is a general business figure, not a SIM-registration statistic, but it is a direct match to the exact threat, deepfake and injection attacks, that Cabinet Resolution 134/2025 explicitly names as something regulated entities must defend against.

The Hardware Question Hiding Inside the Regulation

Read closely, these are not abstract compliance principles, they are a specification. Passive liveness detection, deepfake protection, document authentication, fingerprint capture: each one describes a specific capability a kiosk either has or does not.

Wavetec’s SIM Dispensing Kiosk is built around exactly this set of capabilities: multi-modal biometric verification covering fingerprint, iris, and facial scanning, OCR-based document reading, and counterfeit or photocopy detection built into the ID scanner. That is not a coincidence, it is the same underlying requirement showing up in both the regulation and the hardware.

Saudi Arabia’s fingerprint requirement is where this stops being a checkbox and becomes a hardware decision. A kiosk needs a fingerprint reader physically built in, not bolted on as an afterthought, and it needs to be paired with a screen large enough and a flow simple enough that a walk-in customer can complete the capture without staff assistance. Kiosks are available in multiple form factors, including 19-inch, 32-inch, and 55-inch screens, with modular options including a biometric fingerprint reader, facial recognition camera, passport scanner, and barcode scanner, configured to match what a given market’s regulation actually requires rather than a single fixed hardware SKU.

The Enterprise Platform Behind the Kiosk

A compliant kiosk is not a standalone device sitting in a retail store, it is the front end of a three-layer architecture: channel apps covering kiosk, web, or mobile, a middleware and API layer, and the operator’s own telecom back-end systems.

The middleware layer is what makes compliance auditable at scale. It handles journey orchestration for services like SIM registration and replacement, API abstraction so the kiosk integrates against a single layer instead of many, and reusable services covering authentication, receipts, and auditing.

This layer connects to an operator’s existing systems, including enterprise and telecom platforms such as Oracle NetSuite, Oracle Communications BRM/BSS, Amdocs, and Netcracker, rather than requiring a rip-and-replace of what is already running. Operators can choose their level of ownership too: Wavetec can deliver the platform end to end, provide an open SDK for an operator-owned frontend, or split responsibility across a hybrid model, whichever fits how much of the compliance and user-experience layer the operator wants to control directly.

How Compliance Gets Monitored, Not Just Built

A KYC process that is compliant on paper but unmonitored in practice is still a risk. Wavetec’s operations layer includes live dashboards covering kiosk completion rate, KYC pass rate, and fallback-to-attended rate, the two numbers that show most directly whether identity checks are being cleared correctly or escalated appropriately, alongside real-time alerts for maintenance needs and fault notifications.

Support runs on the same real-time model: 24/7 remote support with defined escalation paths and on-ground support where required, so a compliance-critical device going offline does not sit unresolved.

Security and Governance: Proving Compliance After the Fact

Meeting the requirement at the point of registration is only half the problem. Regulatory practice across both the telecom and financial sectors increasingly expects an operator to be able to demonstrate, after the fact, that a given registration was handled correctly.

Wavetec’s platform architecture is built around this. SOC 2 Type II, ISO 27001, and GDPR-aligned data protection practices sit at the company level, supported by role-based access control, structured audit trails, and encrypted data transport at the deployment level.

That combination is what lets an operator answer the actual question a regulator asks: not “is your system secure,” but “can you show me, for this specific registration, why it was accepted.”

Already Running Under these Rules

This is not theoretical. In the UAE, du’s self-service kiosks already handle more than 10 customer journeys under this exact regulatory environment, with transactions that once took 30 to 40 minutes at a staffed counter now completed in 2 to 4 minutes, a more than 13x reduction, and customer satisfaction consistently above 88%, up to 98% on some journeys.

In Saudi Arabia, Zain runs Wavetec’s queue management platform across flagship retail and customer service centers in major Saudi cities, with dual-printer kiosks supporting more than 60 service categories, fully bilingual in English and Arabic. That is the same market where SIM registration now requires a government-issued ID and, in many cases, fingerprint capture.

Built In-house, End to End

This kind of compliance depth only holds together when the hardware, the software, and the deployment come from the same place. Wavetec designs, builds, and deploys its self-service kiosks, KYC software, and reporting platform in-house, rather than assembling third-party components, and supports the rollout from 11 offices across more than 80 countries, including a dedicated presence in the UAE and Saudi Arabia.

Where AI Fits

Wavetec’s broader platform includes AI-driven capabilities such as Nexia-Q, an AI digital human that guides customers by voice through the registration process, and AI-powered routing that assigns customers to the right counter or service point automatically.

McKinsey’s research on Responsible AI for telecom operators is explicit that use cases handling customers’ personal information warrant the most advanced level of AI oversight, not the least. That is exactly the logic behind pairing AI-guided convenience with the biometric and audit controls described above, rather than treating them as separate concerns.

Meeting these requirements is one question. Deciding which specific registrations can be completed unattended versus needing a staff member is a related but separate one, covered in Knowing When to Hand Off, Wavetec’s framework for assisted versus unattended telecom KYC.

Frequently asked questions

What is KYC in SIM registration?

KYC in SIM registration means verifying and recording the identity of the person a SIM is issued to, before the SIM is activated. In practice that is a government-issued ID check, increasingly paired with a biometric capture, plus a stored record that lets the operator prove later that the check was done correctly.

What does UAE law require for SIM registration KYC?

The direct rule, from TDRA, the telecom regulator, is that a valid Emirates ID or passport is required to register any SIM. Separately, a financial-sector law, Federal Decree-Law 10/2025 and Cabinet Resolution 134/2025, requires regulated financial entities to demonstrate a customer’s identity using biometric liveness detection and deepfake protection. That framework governs banking today, not telecom SIM registration directly, but it signals where UAE identity verification is heading overall.

What does Saudi Arabia require for SIM or eSIM registration?

Any SIM or eSIM connecting to a Saudi network must be tied to a government-issued ID, a passport for visitors or a national ID or Iqama for residents, with activation completed in person or via video KYC. Fingerprint capture is specifically required.

Is biometric SIM registration required everywhere?

No. GSMA’s Mobile Policy Handbook confirms roughly 160 governments worldwide now mandate prepaid SIM registration, with biometric data increasingly required in a growing number of them. The UAE and Saudi Arabia are on the stricter end of that global trend rather than the norm.

What kiosk capabilities actually meet these requirements?

Multi-modal biometric verification covering fingerprint, iris, and facial capture, OCR-based document reading, and counterfeit or photocopy detection in the ID scanner, paired with role-based access control and audit trails to demonstrate compliance after the fact.

Does a compliant kiosk require replacing existing telecom back-end systems?

No. The platform is built to integrate with existing systems, including Oracle NetSuite, Oracle Communications BRM/BSS, Amdocs, and Netcracker, through a middleware and API layer, rather than requiring a full system replacement.

How is SIM registration compliance monitored on an ongoing basis?

Through live dashboards tracking KYC pass rate and fallback-to-attended rate, the two clearest signals of whether identity checks are being handled correctly, backed by 24/7 remote support and defined escalation paths.

See how Wavetec’s SIM Dispensing Kiosk meets KYC requirements across the region. Explore Wavetec’s SIM Dispensing solution, or book a demo to see KYC-compliant self-service running live.