Guide
Setting Up a VoIP, CPaaS or Cloud-Communications Company
The short answer
The Telecommunications and Digital Government Regulatory Authority (TDRA) regulates the ICT sector, and it decides whether a communications service sits inside the telecom perimeter. A commercial licence from a licensing authority registers the company. It does not give the right to carry voice, assign numbers or interconnect with networks. The thing that most often decides the route is whether a licensed carrier performs the regulated functions under contract, leaving the company as a software or channel business, or whether the company performs them itself.
The traffic path decides the classification
Two products with the same app can sit on opposite sides of the telecom boundary. What matters is the path of a call or message from the customer's handset or API call to the terminating network.
Draw it. For each hop, write down who assigns the number, who routes the traffic, and whose licence covers that function. Where every hop belongs to a licensed carrier, the company is selling software on a network it does not run. Where the company routes calls, assigns numbers or interconnects directly, it is performing the function itself, and a white-label interface does not change that.
TDRA states that it provides regulations and rulings across the ICT sector. Its site also shows that it licenses telecom operators, trust service providers, accredited domain registrars and issues wireless authorisations, and that manufacturers and suppliers of telecommunications equipment register with it. So the first call, before any entity is registered, is to TDRA or to the licensed carrier you intend to build on. Ask which functions your model performs and which authorisations, if any, attach to them. The answer for your call flow has to come from the authority.
Four models, four dependency profiles
- Communications API software provider. Carriers carry traffic and assign numbers. The company owns the developer platform.
- Licensed-carrier reseller or channel partner. The company sells the carrier's service under a commercial agreement, with the carrier's compliance undertakings passed down.
- Enterprise contact-centre platform. Software for customer teams, usually sitting on someone else's voice layer.
- Provider controlling voice routing, numbers or interconnection. The company performs the regulated function and needs the authority's answer on what that requires.
If more than one applies, the usual answer is a split: a platform company on the software side, and either a carrier partnership or a separately authorised entity on the other. Mixing carriage and software in one company means every carrier negotiation, security review and bank conversation opens with the hardest question.
Roadmap features move the line. Adding your own numbering, direct interconnection or consumer calling can turn a software company into a provider. Decide at the outset which features you will build, and revisit the authority question before launching any of them.
Recording, content and personal data
Call recording and message content are personal data. The official government page on data protection sets out Federal Decree Law No. 45 of 2021 (the PDPL), in force from 2 January 2022. It prohibits processing personal data without the owner's consent, with stated exceptions, requires companies holding data to keep it secure and confidential, gives data owners the right to correct inaccurate data and to restrict or stop processing, and sets rules for cross-border transfers. The UAE Data Office is the federal data regulator.
For a communications platform this has practical consequences. A recording feature needs a documented legal basis and a customer-facing position on consent. Storage location matters when your hosting, support team or sub-processor sits outside the UAE, because the cross-border rules apply to that movement. Enterprise customers will ask where recordings live, how long they are kept and who can access them. Write the answers down before the first security questionnaire arrives.
Enterprise and government-linked buyers will ask about security standards. Confirm with the UAE Cyber Security Council which expectations apply to your hosting model and customer base before you commit to certification spend.
What the bank and the carrier look at
Banks and carriers underwrite the same thing: that the traffic is lawful and the carrier chain is real. Grey-routing and fraud questions follow this sector, and a thin file invites them. Prepare:
- A service and network-flow diagram, hop by hop.
- Carrier and partner agreements, with the compliance undertakings they impose.
- A numbering and geographic plan: which numbers, from whom, for which countries.
- Security and recording controls.
- Customer terms and an acceptable-use policy.
Every destination the sales deck promises should map to a carrier agreement. Every recording feature should map to a privacy position. A complete chain removes most questions and still guarantees no account, contract or approval. Velarozone's work on corporate bank account readiness is built around that kind of file.
Choosing the entity
The entity that signs the customer contract must be able to deliver every call leg it promises, through its own authorisation or a named carrier's. Group structure can hold platform IP, support operations and any regulated function in separate entities, but each needs a real role.
Where the entity sits comes after this. A company on the software side can sit comfortably in many places, whereas a provider performing a regulated function needs the authority's view first. The free-zone versus mainland comparison and the route for a mainland company are worked through per entity once the boundary is fixed. Cost depends on the route, and the carrier decision is the fork. Velarozone's own fee is itemised in the engagement letter, as set out in how Velarozone works. Carrier commitments, numbering charges and any authority fees come from the carrier and the authority, so confirm them before filing.
What goes wrong
- Selling unapproved voice as generic SaaS. A product that routes calls is a communications service whatever the website calls it.
- Using virtual numbers without documenting the provider chain. The first fraud query from a carrier asks who issued the number.
- Recording calls without a clear legal and customer position. This surfaces in an enterprise security review, usually after the contract is agreed.
- Promising geographic coverage unsupported by carriers. Sales commits to countries the carrier chain cannot reach.
- Comparing setup quotes for what is really a carrier decision. The formation fee is the smallest number in the model.
