Saudi Arabia does not issue one universal fintech licence. The correct regulatory route depends on what the product actually does: holding or moving customer money, issuing electronic money, initiating payments, displaying account information, extending credit, arranging finance, operating a debt-crowdfunding platform or providing technology to a regulated institution. The commercial label used by a founder or investor is not decisive.
The Saudi Central Bank, commonly known as SAMA, regulates banking, finance, payments, money exchange, credit information and activities within its statutory perimeter. Other models may fall under the Capital Market Authority, the Insurance Authority or another public body. A product can also engage privacy, cybersecurity, anti-money-laundering, consumer-protection and foreign-investment rules alongside its core financial licence.
This guide explains SAMA fintech licensing in Saudi Arabia as at 9 September 2026. It focuses on regulatory classification, the principal licensing routes, direct licensing versus the regulatory sandbox, application preparation, operational readiness and post-authorisation obligations. Requirements remain activity-specific, and SAMA may request additional information or impose conditions based on the applicant's ownership, risk, scale and business model.
Quick answer: classify every regulated function before incorporating or launching. If established rules already cover the activity, prepare the relevant direct licence application. Use SAMA's Regulatory Sandbox only when live testing is genuinely necessary for an innovative model. Neither an initial approval letter nor sandbox admission authorises unrestricted commercial operations.
Why regulatory classification comes first
Fintech is a business description rather than a licence category
Two products with similar customer interfaces may require different approvals. A wallet that receives and stores customer value may involve electronic money. An application that merely displays bank-account data may involve payment account information services. A platform that advances funds to customers may be conducting finance, while a software supplier that never contracts with customers or controls money may instead be an outsourced technology provider.
Classification should describe the end-to-end service rather than the app's marketing name. Map who contracts with the customer, who receives funds, where funds are held, who decides whether credit is granted, who bears repayment risk, whose name appears on statements and who can execute or reverse a transaction.
Marketing into Saudi Arabia can bring a service within scope
The Implementing Regulations of the Payments and Payment Services Law extend to persons that provide relevant payment services from an establishment in the Kingdom, hold themselves out as providing them in the Kingdom, invite Saudi users to enter a payment-services agreement, market the service to persons in the Kingdom or appoint a local person to provide the service on their behalf. An offshore company should therefore not assume that the absence of a Saudi office places its product outside the regulatory perimeter.
Separate functions may require separate permissions
A single customer journey can contain payments, credit, insurance distribution, investments and data services. The legal review should unbundle each function and identify the entity performing it. Partnerships with licensed banks or payment providers can change the operating model, but they do not automatically remove the fintech's own licensing or approval obligations.
Identifying the correct Saudi regulator
SAMA supervises banking, finance and payment activities
SAMA's rulebook is organised by regulated sector, including banking, finance, payment systems and payment service providers, money exchange, credit bureaus and the regulatory sandbox. Its statutory framework includes the Saudi Central Bank Law, the Finance Companies Control Law and the Law of Payments and Payment Services together with their implementing regulations.
Models involving customer funds, payment accounts, electronic money, payment initiation, account information, consumer or commercial financing, BNPL or debt-based crowdfunding should be assessed against the relevant SAMA rules before development and contracting are finalised.
The Capital Market Authority regulates securities activity
Equity crowdfunding, securities dealing, investment management, arranging securities transactions and advising on securities may fall under the Capital Market Authority rather than SAMA. Calling a product a funding platform does not resolve the issue: debt-based and equity-based crowdfunding have different regulatory homes.
Other regulators may remain relevant
Insurance activity may require the Insurance Authority. Personal-data processing engages the Personal Data Protection Law and the Saudi Data and Artificial Intelligence Authority framework. Telecommunications, cloud, digital identity, electronic transactions, e-commerce, competition and sector-specific rules can also apply. A regulatory matrix should identify both the lead financial regulator and every cross-cutting obligation.
Main SAMA licensing routes for fintech businesses
Payment institution licences
A payment institution provides one or more regulated payment services other than issuing electronic money. Relevant services include operating payment accounts, executing direct debits, card or device transactions and credit transfers, issuing payment instruments, acquiring payee transactions, payment aggregation, money remittance and other listed functions.
The regulations distinguish micro and major payment institutions. The appropriate class depends on the intended services and scale. Under Article 44 of the current implementing regulations, initial paid-up equity is at least SAR 1 million for a micro payment institution and SAR 3 million for a major payment institution. Ongoing capital requirements can exceed the initial amount, particularly for a major institution whose transaction value grows.
Electronic money institution licences
An electronic money institution issues stored monetary value, including through an electronic wallet or another permitted structure. The regulations distinguish micro and major electronic money institutions. Current initial paid-up equity requirements are at least SAR 2 million for a micro EMI and SAR 10 million for a major EMI.
Holding customer funds creates safeguarding, reconciliation, liquidity, redemption, governance and operational-resilience obligations. The legal structure and bank-account architecture should be designed with the licence application rather than added after the platform has been built.
Payment initiation and account information licences
Open-banking products may initiate a payment from an account held with another provider, aggregate account information or do both. The payment regulations recognise payment initiation services and payment account information services as regulated activities. Current initial paid-up equity is at least SAR 1 million for a standalone payment-initiation licence or a combined payment-initiation and account-information licence, and SAR 500,000 for an account-information-only licence.
These providers must also address professional indemnity insurance or a comparable guarantee, customer consent, authentication, data-access controls and the technical and customer-experience requirements of the Saudi Open Banking Framework. A commercial agreement with a bank or an API aggregator is not a substitute for the required authorisation.
Finance company licences
A business that grants credit, carries receivables or otherwise conducts a regulated financing activity may require a finance-company licence. The applicable route depends on the precise financing product and the Finance Companies Control Law, its implementing regulation and SAMA's activity-specific rules.
Applicants should not assume that a payment licence permits lending or that arranging a lender's product is unregulated. The credit decision, funding source, economic risk, customer agreement and collection process all influence classification. Capital and prudential requirements vary by activity and SAMA may impose additional conditions.
Buy now pay later companies
BNPL is regulated as a specialised financing model. SAMA's Rules for Regulating Buy-Now-Pay-Later Companies address licensing, permitted activity, consumer relationships, credit limits, disclosures, governance, technology, risk and reporting. A merchant payment plan can still fall within the rules even if the product is promoted as instalments rather than a loan.
The applicant should map merchant settlement, customer repayment, late-payment treatment, affordability and credit assessment, complaints, collections and credit-bureau reporting. Promotional language must not obscure the customer's financial obligation.
Debt-based crowdfunding platforms
Debt-based crowdfunding connects eligible funding participants and beneficiaries through a regulated lending structure. SAMA provides a dedicated licensing route and application guidance for this activity. The platform's role in originating, assessing, documenting, disbursing, servicing and collecting finance must be clear.
The application should address credit methodology, conflicts, disclosure, investor eligibility, concentration, defaults, complaints, technology, client money and orderly wind-down. Equity crowdfunding is different and should be assessed under the Capital Market Authority framework.
Technical service providers and outsourcing partners
A company providing software, cloud infrastructure, identity tools, fraud monitoring or back-office support may not itself need a financial licence if it does not perform a regulated activity. That conclusion must follow a functional analysis, not the wording of a technology contract.
Even without a standalone licence, the provider may be subject to due diligence, audit, access, cybersecurity, data-location, incident-reporting, subcontracting, business-continuity and exit requirements through SAMA's outsourcing rules and its contract with the regulated institution. Material outsourcing may require notification or prior regulatory engagement by the licensed customer.
Comparing the principal payment permissions
| Permission | Typical regulated function | Current minimum initial paid-up equity |
|---|---|---|
| Micro payment institution | Listed payment services other than electronic-money issuance within the applicable micro limits | SAR 1 million |
| Major payment institution | Listed payment services at major-institution scale | SAR 3 million |
| Micro electronic money institution | Issuing electronic money within the applicable micro limits | SAR 2 million |
| Major electronic money institution | Issuing electronic money at major-institution scale | SAR 10 million |
| Payment initiation service | Initiating a payment from an account held with another provider | SAR 1 million |
| Account information service | Consolidating or providing information from payment accounts | SAR 500,000 |
| Combined payment initiation and account information | Providing both regulated open-banking services | SAR 1 million |
The table states the minima in Article 44 of the payment implementing regulations reviewed on 9 September 2026. It does not replace an activity-specific capital assessment. Ongoing regulatory capital, safeguarding, guarantees, insurance and licence conditions may require additional resources.
Direct licensing and the SAMA Regulatory Sandbox
Direct licensing is appropriate when rules already exist
If the proposed activity is already governed by an established licensing framework, SAMA's sandbox guidance directs the applicant toward the ordinary licence process. A payment provider cannot use sandbox participation to avoid payment licensing requirements, and a lender cannot replace a finance licence with a test permission.
Direct licensing still benefits from early regulatory-perimeter work. The applicant should identify the requested activities and permissions, prepare its ownership and governance model, develop policies and technology controls and confirm that its funding plan meets both initial and ongoing requirements.
The sandbox is for innovation that genuinely needs live testing
The Regulatory Sandbox Framework uses four stages: application, operational readiness, testing and exit. Applicants must explain the innovation, customer benefit, risks, safeguards, testing objectives, indicators, thresholds and why live testing is necessary. The product should have a minimum viable version ready for controlled testing.
An applicant may propose limited regulatory waivers or relaxations, but SAMA decides whether any are appropriate. Core protections relating to customer safety, financial crime, data and systemic risk should be built into the test plan.
Initial sandbox approval does not permit operations
SAMA's application guidance states that a Stage Two initial approval letter permits the applicant to establish or update a company as a fintech business but does not permit operations. The applicant must satisfy operational-readiness criteria. Only after the required readiness work and SAMA's no-objection letter may controlled sandbox testing begin within the approved parameters.
Every sandbox application needs an exit strategy
The applicant should plan for successful graduation, extension, modification and unsuccessful testing. The exit strategy should protect customers, address outstanding balances and complaints, preserve data and records and explain communications. Sandbox completion does not itself guarantee a full commercial licence.
Corporate structure and ownership preparation
Incorporation should follow regulatory classification
Company objects, legal form, ownership and capital should match the intended licensed activity. Incorporating a generic technology company before classification can create amendments, delays or a mismatch with SAMA's expectations. Ayqan's company formation guide explains the wider Saudi establishment process.
Foreign investors should also assess the Ministry of Investment registration framework, beneficial ownership, commercial registration and sector conditions. Corporate establishment and regulatory authorisation are connected processes, but a commercial registration alone does not authorise a regulated financial activity.
Controllers and senior managers must be fit and proper
SAMA applications require disclosure of controllers and fit-and-proper information for relevant owners, directors and senior positions. The review can include integrity, competence, experience, financial soundness, conflicts and time commitment. Changes in control and key appointments may require prior approval after licensing.
The proposed organisation chart should identify real decision-makers and control functions. Nominal appointments or roles shared too thinly across a group can undermine operational-readiness evidence.
Preparing the licence application
Build a precise regulatory business plan
The business plan should connect the legal permission requested to the customer journey, target market, revenue model, transaction flows, partners and three-year financial projections. It should explain which entity performs each function and identify anything performed by a bank, payment provider, cloud supplier or group company.
Financial projections should be consistent with volumes, staffing, capital, liquidity, safeguarding, technology and outsourced costs. An optimistic sales model that does not fund compliance and resilience is not a credible regulatory plan.
Document governance and the three lines of control
Prepare board and committee terms, delegated authorities, conflicts procedures and management reporting. Compliance, risk, internal audit and information-security responsibilities should be proportionate but independent enough to challenge the business. The board remains accountable when functions are outsourced.
Policies should match actual systems and staffing. A generic policy library copied from another jurisdiction is unlikely to prove readiness if product flows, reporting lines and Saudi legal references are inconsistent.
Design AML and counter-terrorist-financing controls
The applicant should conduct an enterprise-wide financial-crime risk assessment covering customers, products, channels, jurisdictions, merchants, transactions and partners. Controls normally include customer and beneficial-owner identification, sanctions screening, risk rating, enhanced due diligence, ongoing monitoring, suspicious-transaction escalation, recordkeeping, training and independent testing.
Digital onboarding should show how identity is verified, liveness and impersonation risks are controlled, exceptions are reviewed and high-risk cases are prevented from bypassing the system. The technology flow and the written procedure must say the same thing.
Embed customer protection into the product
Terms and disclosures should be clear, fair and available before commitment. Fees, exchange rates, repayment obligations, cancellation, errors, refunds, complaints, fraud allocation and service limitations should be visible in the customer journey. Consent should be specific and recorded.
Complaint handling needs ownership, service levels, escalation and root-cause analysis. Customer-support scripts and merchant materials should be reviewed with the contract because regulated communications extend beyond the formal terms.
Prepare technology, cybersecurity and resilience evidence
SAMA's sandbox readiness guidance expects a defined technology architecture, cyber controls, vulnerability assessment and penetration testing, data sovereignty, business continuity, incident response, monitoring and privacy controls. A direct licence application should be built to comparable regulatory expectations under the rules applicable to its sector.
Maintain an asset inventory, data-flow map, access model, secure-development process, logging standard, recovery objectives, backup tests and material-incident playbook. Critical third parties and single points of failure should be identified before go-live.
Control outsourcing, cloud and group services
List every material outsourced function, including cloud hosting, onboarding, screening, card processing, customer support, collections and intra-group services. Contracts should address service levels, security, confidentiality, audit and access rights, regulator access, subcontracting, data location, incident notification, continuity, termination assistance and data return or deletion.
Operational responsibility cannot be transferred by contract. The applicant should demonstrate how it selects, monitors and exits each critical provider.
Address privacy and data governance
Financial data is also personal data when it relates to an identifiable individual. The applicant should identify processing purposes, lawful bases, notices, retention, data-subject rights, processors, security, breach response and cross-border transfers under the Saudi Personal Data Protection Law. Ayqan's PDPL guide provides the broader framework.
Open-banking consent should be granular, time-bound where required and capable of withdrawal. Product analytics and artificial-intelligence models need documented purposes, data provenance, access controls and human oversight proportionate to their impact.
From application to operational readiness
Submit a complete and internally consistent package
The application form, constitutional documents, ownership chart, financial model, policies, contracts and technical diagrams should use the same product description and legal entities. Contradictions create regulatory questions and delay. Maintain a controlled data room and a response log for every SAMA request.
The payment regulations permit SAMA to request further documents and information. Applicants should treat completeness as a continuing obligation rather than a one-time upload.
Treat conditional approval as a build phase
An approval in principle or similar conditional decision is not the end of the process. Conditions may require capital payment, key appointments, system testing, policy completion, contract execution, premises, insurance, integrations and evidence that remediation items are closed.
Create a condition tracker with an owner, evidence, due date and dependency for each item. No product launch or public claim of being licensed should occur before the legal permission actually allows it.
Run evidence-based testing before launch
Test customer onboarding, authentication, transaction processing, reconciliation, safeguarding, refunds, complaints, suspicious-activity escalation, access revocation, cyber incidents, outages, recovery and wind-down. Keep results, defects and approvals. A successful user-interface demonstration is not proof that finance, compliance and operational controls work end to end.
Post-licence obligations
Capital, safeguarding and prudential monitoring continue
Payment firms must maintain ongoing regulatory capital. Major payment institutions and major electronic-money institutions may need capital above the initial minimum based on transaction value or outstanding electronic money. Firms should monitor thresholds, forecasts and escalation triggers rather than wait for a breach.
Customer funds must be handled according to the applicable safeguarding and reconciliation rules. Finance firms have their own capital, liquidity, provisioning and reporting requirements according to their activity.
Regulatory reporting and notifications must be governed
Build a regulatory calendar covering periodic returns, audited financial statements, controller information, complaints, incidents and any sector-specific reporting. Material outsourcing, control changes, senior appointments, new products, security incidents and other events may require prior approval or notification.
Reporting data should reconcile to core systems and finance records. Assign preparation, review and board oversight rather than depending on one employee's calendar.
The licence perimeter must be monitored as the product changes
New features can change regulatory status. Adding a wallet, instalment option, investment element, insurance product, cross-border service or new customer segment may require a variation, another licence or another regulator. Marketing language and partner arrangements should be reviewed before release.
Common licensing mistakes
- Starting with a generic fintech label instead of mapping regulated functions and fund flows.
- Assuming a licensed partner covers every activity performed by the fintech itself.
- Using the regulatory sandbox as a substitute for a licence when established rules already apply.
- Treating initial sandbox approval as permission to operate before operational readiness and a no-objection letter.
- Incorporating with unsuitable objects, ownership or capital before confirming the regulatory route.
- Underfunding compliance, technology and resilience in the three-year financial model.
- Submitting generic policies that do not match Saudi rules or the actual product.
- Leaving controllers and senior appointments unresolved until late in the application.
- Ignoring outsourced and intra-group dependencies in contracts and risk assessments.
- Treating cybersecurity as a final penetration test instead of an operating control framework.
- Launching marketing that implies authorisation before the licence or approved test permission is effective.
- Adding new regulated features after licensing without perimeter review or SAMA engagement.
SAMA fintech licensing checklist
- Describe the customer proposition without marketing terminology.
- Map every contract, funds flow, data flow and regulated decision.
- Identify the lead regulator and cross-cutting regulators.
- Determine the exact SAMA activity and licence class.
- Decide whether direct licensing or genuine sandbox testing is appropriate.
- Confirm the Saudi legal entity, ownership and foreign-investment route.
- Verify initial and ongoing capital, funding and guarantee requirements.
- Identify controllers, directors and senior managers.
- Prepare fit-and-proper evidence and conflicts disclosures.
- Build a three-year business plan and financial model.
- Finalise governance, risk, compliance and internal-audit arrangements.
- Complete AML, sanctions, fraud and customer-risk assessments.
- Design customer terms, disclosures, consent and complaint processes.
- Document technology architecture, cybersecurity and data governance.
- Review outsourcing, cloud and intra-group contracts.
- Prepare business-continuity, incident-response and wind-down plans.
- Run operational-readiness testing and retain evidence.
- Track licence conditions, regulatory reporting and product changes after launch.
When legal review may be useful
Licensing classification turns on the actual product, fund flows, contracts and ownership structure, and SAMA's expectations continue to evolve. A review is most valuable before the product architecture and partner contracts are fixed, when early classification can still prevent a costly rebuild and align the commercial model with the permission actually available.
Ayqan's banking and finance practice covers regulatory classification, licence applications and ongoing compliance for payment, finance, BNPL, crowdfunding and open-banking models, and the contact page is available for anyone who wishes to discuss a proposed model.
