Saudi Fintech License: SAMA Sandbox & Authorization 2026

Fintech in Saudi Arabia is regulated by the Saudi Central Bank (SAMA) and, for certain activities, the Capital Market Authority (CMA). This guide covers the regulatory sandbox, payment and financing authorizations, requirements, capital, and ongoing compliance. See AML compliance, data protection, annual audit, and branch vs subsidiary.

Overview

Fintech firms offering payment services, financing, digital banking, or other regulated financial services in Saudi Arabia must obtain authorization from SAMA (or, for securities and investment activities, the CMA). SAMA runs a Regulatory Sandbox that allows eligible participants to test innovative products and services with real users under supervision before applying for full licensing. Vision 2030 has prioritised fintech; the regulatory framework continues to evolve. Ensure you classify your activity correctly and apply to the right authority. See AML and sanctions. For regional context, fintech ranks among the fastest-growing industries across MENA and aligns with Vision 2030 priority sectors; compare licensing routes in healthcare and logistics.

SAMA and CMA

The Saudi Central Bank (SAMA) regulates payment institutions, financing companies, and banks. The Capital Market Authority (CMA) regulates securities, investment, crowdfunding (in some forms), and capital market conduct. Depending on your product (e.g. e-wallet, remittance, buy-now-pay-later, crowdfunding), you may need a SAMA and/or CMA license. Check the current SAMA and CMA rules and draft regulations to confirm which regime applies. Some activities may require both or may fall under a dedicated fintech framework. See insurance for SAMA's role in insurance.

Regulatory Sandbox

SAMA's Regulatory Sandbox allows fintechs to test innovative financial services with a limited number of customers and within defined boundaries. Participants receive guidance and temporary relief from certain regulatory requirements. Successful sandbox testing can support an application for full authorization. Application criteria, duration, and exit conditions are published by SAMA. The sandbox is a practical path for new entrants to validate their model and engage with the regulator before full licensing. See SAMA's website for current sandbox rounds and application deadlines.

Payment and Financing Authorizations

SAMA issues authorizations for payment service providers (e.g. payment aggregation, e-wallets, remittance) and for financing companies (e.g. consumer or SME lending). Requirements include minimum capital, fit-and-proper assessment of management and shareholders, business plan, risk and compliance frameworks, and IT and security standards. Application is made to SAMA with supporting documents; the process can take several months. CMA may license crowdfunding platforms and other investment-related fintech. Ensure your legal structure (e.g. Saudi subsidiary) and governance meet the regulator's expectations. See branch vs subsidiary and UBO.

Requirements and Capital

Typical requirements include: a Saudi legal entity (often required for full authorization); minimum paid-up capital as set by SAMA or CMA for the license type; a clear business plan and financial projections; fit-and-proper directors and senior management; AML/CFT policies and procedures; and IT and cybersecurity controls. Capital and ongoing prudential requirements (e.g. capital adequacy, reporting) apply once licensed. Prepare a robust application and allow time for the regulator's review and any follow-up. See AML compliance and PDPL for data and privacy.

Ongoing Compliance

Licensed fintechs must comply with SAMA or CMA rules on reporting, capital, conduct of business, and AML/CFT. Annual and periodic reporting, audits, and inspections are required. Breach can result in fines, restrictions, or license revocation. Implement compliance and risk functions from day one and keep abreast of regulatory updates. See AML, annual audit, and corporate governance.

Fintech License Checklist

Classify your activity and determine whether SAMA, CMA, or both apply; consider the sandbox as a first step.
Establish a Saudi entity and meet capital and fit-and-proper requirements; prepare business plan and policies.
Submit a complete application with all required documents; respond promptly to regulator queries.
Implement AML/CFT, data protection, and prudential compliance before and after authorization.
Maintain ongoing reporting and governance; monitor regulatory changes. See AML.

Frequently Asked Questions

Can we operate under the sandbox only?

The sandbox is time-limited and scope-limited. To scale and operate indefinitely, you need full authorization. Use the sandbox to test and then apply for the appropriate license.

Do we need a bank partnership?

Some payment or lending models require a partnership with a licensed bank (e.g. for settlement, custody, or funding). SAMA rules may specify when a bank partnership is required. Check the applicable framework.

Is there a minimum capital for payment providers?

SAMA sets minimum capital for each authorization type. The amount is published in the relevant regulation or circular. Ensure your capital is paid up and maintained. See SAMA's current requirements.

Can a foreign fintech apply?

Foreign-owned entities can apply; often a Saudi subsidiary is required for full authorization. The sandbox may allow foreign applicants in some rounds. Check SAMA and CMA eligibility criteria. See branch vs subsidiary.

How does fintech licensing interact with VAT?

Financial services may be exempt or partially exempt from VAT. Registration and reporting still apply when you exceed the threshold. See VAT guide and ZATCA guidance for financial services.

What about buy-now-pay-later (BNPL)?

BNPL is typically a financing activity regulated by SAMA. BNPL providers need to comply with the financing company or payment rules as applicable. SAMA has issued or proposed specific rules for BNPL; check the current regime.

Saudi Arabia Fintech License: SAMA Sandbox & Authorization 2026