IoT-VNO: Licensing Internet of Things Virtual Network Operators in Saudi Arabia

In late 2018, the Communications and Information Technology Commission (the telecoms regulator in Saudi Arabia) issued the Rules and Conditions for Provision of Mobile Virtual Network Operator Services and Internet of Things Virtual Network Operator Services (the ‘Rules and Conditions’). As the name suggests, the Rules and Conditions address both Mobile Virtual Network Operator Services (‘MVNO’) and Internet of Things Virtual Network Operator Services (‘IoT-VNO’), although in this article we focus on the provision of IoT-VNO services.

Equipment and devices with embedded sensors and internet connectivity are becoming increasingly common. The ability for remote and automated monitoring and interaction between devices has endless potential to enhance modern life. Saudi Arabia’s new licensing regime for Internet of Things Virtual Network Operators provides greater clarity for businesses hoping to provide these types of services in the Saudi market.

IoT-VNO Services Licence

In the Rules and Conditions, the term ‘IoT-VNO services’ refers to services that enable the automated communication between machines and devices using data SIM cards, eSIM (embedded data SIM), or any other future functional equivalent. In order to provide IoT-VNO services, a service provider (that is not already licensed as a telecommunications service provider) must have first obtained a Class A IoT-VNO Services Licence from the CITC. This type of licence is intended for service providers who procure mobile network capacity from others, on a wholesale basis, so as to provide IoT-VNO services to their own customers without obtaining any frequency allocation or constructing any telecommunication networks.

The application process is set out in the Conditions for Obtaining a Licence for the Provision of IoT-VNO Services in Saudi Arabia, published by the CITC. Along with details of the applicant (including information on structure and ownership), the applicant must submit information on:

• strategy, and how the applicant will contribute to the communications market in Saudi Arabia;
• services, including products, services and sectors targeted, timing, and the proposed method for supply of innovative services;
• organisational structure, including administration, marketing, sales, subscriber care, operations and maintenance;
• a market study, setting out market segments and expectations, proposed services and pricing, contemplated customer attraction;
• a subscriber care plan, including information on aftersales service, service levels, and a plan for continuous improvement; and
• Human Resources plan, including anticipated Saudization levels.

The applicant is also required to submit a technical plan, including a description and design of any infrastructure, network operation processes, performance management, and continuous improvement.

The Rules and Conditions include a number of Special Conditions for IoT-VNO licensees. Despite what the name would suggest, these conditions are all fairly typical and many of them could be seen to be of general application to any business operating in Saudi Arabia. As well as the obligation to comply with the policies and instructions of the CITC (including by refraining from providing unlicensed services or using equipment not cleared for use in the Kingdom), IoT-VNO licensees must:

• not discriminate between customers, and ensure customer privacy (including by not spamming them or selling their contact details);
• respect intellectual property rights, and ensure that AV/media content has been cleared with the relevant local authorities;
• obtain approval from the local Chamber of Commerce before running any commercial promotions;
• comply with CITC’s instructions with regard to Saudization of the workforce; and
• act consistently with Islamic Shari’ah rules, good manners, morals, and public taste, and the laws and regulations of the Kingdom.

There are also requirements to publish service fees in advance of applying them, to provide billing and customer care services from launch date, and to have the technical capability to retain and identify user data for a minimum period of 12 months.

An IoT-VNO licensee needs to launch commercial services within 12 months of the issuance of its licence, failing which the CITC has the discretion to revoke the licence. An IoT-VNO licence typically lasts for ten years, and during that time the CITC is permitted to vary the terms of the licence, or to suspend or revoke it if circumstances warrant it. With the prior written approval of the CITC, an IoT-VNO licence can be subcontracted and assigned – provided the assignee meets all the requirements of holding the licence. Pursuant to the Telecoms Law (Royal Decree No. (M/12) of 12/03/1422H (3 June 2001); Council of Ministers Resolution No. (74) of 05/03/1422H (27 May 2001), the CITC has considerable power to investigate and take action in respect of violations of licence terms.

IoT-VNO licensees need to ensure that the SIM cards they use in the provision of IoT-VNO services are configured solely for automated Machine-to-Machine communication, and for no other purposes without the CITC’s prior written approval. The
IoT-VNO licensees must also keep a register of all SIM cards (the IMSI (International Mobile Subscriber Identity)) numbers and the MSISDN (Mobile Subscriber Integrated Services Digital Network) numbers used in their IoT-VNO services, and make such records available to the CITC upon request.

Agreements with Host Service Providers

IoT-VNO licensees can enter agreements with host service providers to access the infrastructure necessary to provide the IoT-VNO services. A host service provider is typically a licensed mobile telecommunications operator that has infrastructure in Saudi Arabia and can provide the IoT-VNO licensee with capacity on its network on a wholesale basis. The Rules and Conditions set out the general basis for agreements between IoT-VNO licensees and host service providers.

If a host service provider receives a written approach from an IoT-VNO licensee seeking wholesale infrastructure services, the host service provider is required to enter into ‘good faith’ negotiations with the IoT-VNO without delay. The Rules and Conditions set out types of conduct that would indicate a host service provider is not acting in good faith. Besides general delaying tactics, these include:

• refusing to provide necessary information;
• requiring advance or simultaneous negotiations or agreement for other services;
• demanding that the licensee sign a non-disclosure agreement preventing disclosure of information to the CITC;
• offering terms less favourable than those offered by the host service provider to its retail customers;
• offering terms that do not provide for a reasonable margin for the licensee;
• offering terms inconsistent with the terms of the licensee’s IoT-VNO licence; and/or
• refusing to permit amendment of the proposed agreement to comply with any changes to the law or regulations.

The terms ultimately agreed also need to be consistent with the host service provider’s telecoms licence obligations. If the host service provider wishes to reject proposed terms on the basis that they are not consistent with its obligations pursuant to its own licence or to the law, then it needs to set this out in a written response to the would-be IoT-VNO licensee.

The Rules and Conditions contemplate mechanisms by which the CITC can influence the development of terms between IoT-VNO licensees and host service providers. These include issuance of decisions and guidelines, as well as requiring host service providers to publish reference offers to the market. The Rules and Conditions also impose an obligation on IoT-VNOs and host service providers to provide the CITC with copies of their agreements if requested.

Whilst the expectation in the Rules and Conditions is that agreements between
IoT-VNO licensees and host service providers are determined freely on a commercial basis, the Rules and Conditions contain a variety of provisions aimed at ensuring agreements between IoT-VNO licensees and host service providers do not lessen competition in the market, such as by preventing the IoT-VNO from changing its business model, issuing its own SIM cards, providing certain services, or using licensed third parties for other technical infrastructure. There are also restrictions that prevent a host service provider from acting in an obstructive manner (either technologically or commercially) in the event that the IoT-VNO licensee wishes to transfer its business to another host service provider.

What’s next?

There is still some degree of ambiguity regarding the application of the IoT-VNO licence requirements, including whether they apply to any entity that is operating an IOT virtual network (even for its own, internal purposes) – or only to those that are offering an IoT virtual network service to others. Additionally, the CITC has recently held a consultation on a draft Regulatory Framework on Internet of Things and draft Special Conditions for a Class Licence to Provide IoT Services Using Licence-Exempt Frequencies. Those active in the IoT space would be well advised to undertake a proper review of the licensing landscape to make sure that they are compliant.

Al Tamimi & Company’s Technology, Media & Telecommunications team regularly advises on Industry 4.0 and Internet of Things related legal issues in Saudi Arabia and the Middle East. For further information please contact Nick O’Connell (n.oconnell@tamimi.com) or Amy Land-Pejoska (a.pejoska@tamimi.com).