Most conversations about fintech in Saudi Arabia start with the wrong question.
SAMA — the Saudi Central Bank — is the primary regulator for financial services in the Kingdom, licensing and supervising banks, payment businesses, open banking providers, fintech companies, BNPL operators and digital finance businesses.
The question most founders ask: "How do I get a SAMA licence?"
The question that actually determines the outcome: "Which SAMA licensing framework applies to what my business does — and does SAMA even govern it?"
Saudi Arabia's fintech sector reached 301 fintech companies by the end of 2025. The regulatory infrastructure supporting that growth is more complex than most market-entry guides acknowledge — SAMA governs some activities, the CMA governs capital-market activities, and the Insurance Authority regulates insurance activities. Within SAMA's perimeter, there are multiple distinct licensing pathways, each with different capital requirements, entity structures and conditions.
Getting the pathway wrong means applying for the wrong licence and discovering the error when it is most expensive to correct.
SAMA or CMA? The First Question to Answer
Before any licensing conversation begins, the regulatory perimeter must be established.
SAMA and the CMA govern different activities. Understanding which one applies to a specific fintech product is not always obvious — particularly for embedded finance, platform businesses and multi-function products.
SAMA-regulated areas relevant to fintech can include:
CMA-regulated fintech can include:
- Securities and investment activities
- Capital-market platforms
- Investment management and robo-advisory products
- Other activities falling within the capital-markets regulatory perimeter
These categories are not always mutually exclusive — a product combining payment and investment functions may require engagement with both regulators.
For a delivery platform, e-commerce marketplace or technology application that adds BNPL as a customer feature, this classification matters significantly. In Saudi Arabia, BNPL raises finance licensing, responsible lending, consumer protection and Sharia structuring issues — not payment services issues. The regulatory treatment must be confirmed before the product is built, not after.
Once the correct regulator is identified, the next question is which specific framework applies — and what it requires.
NIKKI ADVISORY Insight: The regulatory classification is not an administrative step — it determines the entity structure, the capital requirement, the applicable rules and the timeline. Getting this wrong at stage one is the most expensive error available. It belongs in the planning phase, not the application phase.
The Saudi Fintech Regulatory Landscape: Five Areas You Need to Understand
Within Saudi Arabia's fintech regulatory landscape, there are five areas founders need to understand. Here is what each covers and what it requires.
1. Payment Services
SAMA's Implementing Regulations of the Law of Payments and Payment Services establish several payment-service licensing categories. The four principal PI/EMI categories are:
Micro PI — Payment services without electronic money issuance · SAR 1 million minimum paid-up capital · Entity: LLC / Simplified JSC / JSC
Major PI — Payment services at a higher scale, including services that may be provided cross-border · SAR 3 million minimum paid-up capital · Entity: JSC
Micro EMI — Electronic money issuance and digital wallets, subject to applicable Micro EMI limits and conditions · SAR 2 million minimum paid-up capital · Entity: JSC
Major EMI — Electronic money issuance beyond the Micro EMI limits · SAR 10 million minimum paid-up capital · Entity: JSC
Payment Initiation Services (PIS) and Payment Account Information Services (PAIS) are separately licensed under the same regulatory framework.
All capital requirements, entity structures and applicable limits are sourced from SAMA's published regulations and should be verified against the current SAMA rules at the time of application, as requirements may be amended.
Micro PI in practice: A payment gateway, specialist merchant payment solution or other payment service without electronic money issuance — for example, a fintech processing consultation fees and pharmacy payments between hospitals and patients across Riyadh, subject to the applicable regulatory conditions and thresholds.
Major PI in practice: Lean Technologies received a Major Payment Institution licence from SAMA in March 2026, following completion of the regulatory sandbox phase. Its Saudi entity is licensed for open banking services as an Account Information Service Provider (AISP) — connecting customers, businesses and financial institutions through consent-based financial data access.
Micro EMI in practice: A digital wallet or stored-value product where customers hold a balance inside the application — subject to limits on outstanding electronic money, payment transaction values and individual user balances. Suitable for a focused wallet operation within the applicable Micro EMI thresholds.
Major EMI in practice: Electronic money issuance beyond the applicable Micro EMI limits.
The classification test: Does the product issue electronic money, or does it provide payment services without electronic-money issuance? Electronic-money issuance points towards the EMI framework; payment services without e-money generally fall within the PI framework. PIS and PAIS are separately licensed payment services. Getting this classification right before incorporation determines the entity structure, capital requirement and regulatory framework.
2. Open Banking
On 26 March 2026, SAMA commenced formal licensing for open banking services, following the successful completion of the regulatory sandbox phase. SAMA simultaneously issued the first two commercial open banking licences — both for account information services, allowing customers to securely share bank account data with authorised third-party providers.
Open banking account information services fall under the Payment Account Information Services (PAIS) framework — separately licensed under SAMA's Implementing Regulations, with a minimum paid-up capital of SAR 500,000. In plain terms: with customer consent, a licensed PAIS provider can access account information across multiple banks to support financial analysis, financial profiles and other permitted services. Payment initiation is a separate regulated payment service. Firms must meet requirements covering API performance, data security, consent management and governance standards before providing these services commercially.
3. Buy Now Pay Later (BNPL)
SAMA licenses BNPL as a finance activity, not a payment activity — a distinction most founders with a BNPL product miss. Tabby Finance and Tamara are both licensed under the finance company framework, not as payment institutions. A fintech offering BNPL at Saudi checkout requires a SAMA finance licence for that product, separately from any payment services licence it holds. Where a BNPL product is structured to comply with Sharia principles, this affects the contract terms, fee model and documentation.
4. Digital Banking
SAMA has licensed three digital banks in the Kingdom — D360 Bank, STC Bank and Vision Bank — all of which commenced operations in late 2024 and early 2025. Digital banking is subject to significantly higher capital, governance and prudential requirements than product-specific fintech licences. D360 Bank, for example, launched with an initial capital of SAR 1.65 billion. This pathway is relevant for fintechs building a full bank-like model — not for product-specific financial services applications.
5. Non-Bank Finance
SAMA licenses entities providing personal finance, SME finance, leasing and credit products through its finance company framework — the applicable pathway for lending, instalment and credit products that do not qualify as BNPL or payment services.
Knowing which framework applies is the first decision. What happens next is where most fintech market entries either gain momentum or stall.
The Complete Setup Journey: From Decision to Operational Readiness
A fintech company wanting to start and operate in Saudi Arabia under a SAMA licence goes through linked company-formation and regulatory workstreams. Their sequencing depends on the applicable licensing route, and certain activities can proceed in parallel.
Here is the full journey and how each step connects.
01 — Define the business model and identify the regulatory pathway:
Before any application begins, the fintech model must be clearly defined: what the product does, who the customers are, where money moves and where it is stored. This determines whether SAMA or the CMA governs the activity and which specific licence category applies.
The setup sequence then depends on the regulatory route chosen. Under a direct licensing route, SAMA's framework involves an in-principle approval, followed by entity establishment, followed by final licensing. Under the sandbox route, an accepted innovator proceeds with MISA and Ministry of Commerce registration as part of the entity setup process. A finance-company route may follow a different sequence again. The applicable sequence should be confirmed for the specific regulatory route — direct licensing, sandbox or finance-company — before any entity formation is initiated. There is no single universal sequence that applies to every SAMA licensing route.
02 — MISA Investment Registration:
For a non-GCC foreign investor, MISA Investment Registration is a required part of establishing the Saudi investment structure. The precise sequencing depends on the applicable SAMA licensing route and should be confirmed before entity formation is initiated. MISA registration must be completed before the investor begins investment activities, after which the investor can proceed with the Commercial Registration and obtain the necessary licences from the competent authorities. Current MISA service standards indicate 10 working days for Investment Registration, subject to the application meeting the relevant requirements.
03 — Entity formation and Commercial Registration:
The Saudi entity is established through the Ministry of Commerce. For payment-service licences, the entity type must match the SAMA licence category — LLC / Simplified JSC / JSC for Micro PI, and JSC for Micro EMI, Major PI and Major EMI. BNPL and other finance activities follow separate finance-company requirements. The Commercial Registration records the entity's approved activities. Regulated fintech activity cannot commence until the applicable SAMA authorisation and other required approvals are in place.
04 — Chamber of Commerce membership:
Chamber of Commerce subscription is part of the commercial setup process, where applicable. This should be assessed alongside the Commercial Registration.
05 — Corporate banking activation:
Corporate banking is frequently one of the longer workstreams in the Saudi entity setup and should be initiated as early as practicable alongside entity formation. Banks will require completion of their own KYC, authorised-signatory and identity requirements. Saudi banks typically require identity and documentation verification for the General Manager and other authorised signatories as part of their KYC and account-opening process — the specific requirements and timelines vary by institution. These requirements should be assessed early and in parallel with entity formation, rather than treated as a post-incorporation task. The licensing process requires the applicant to demonstrate the required capital in the manner prescribed by SAMA, including the applicable bank guarantee and subsequent paid-up capital requirements.
06 — ZATCA registration:
ZATCA registration covers the entity's applicable tax obligations. The key areas:
- Corporate Income Tax (CIT): 20% on the non-Saudi share of profits where applicable.
- Zakat: Applies to the Saudi and GCC-owned portions, calculated on the Zakat base per ZATCA rules — not simply as 2.5% of the ownership percentage.
- VAT: Registration becomes mandatory when taxable supplies exceed SAR 375,000 annually.
- E-invoicing (Fatoorah): Obligations depend on entity size and transaction volume — assess as part of the operating setup.
CIT and Zakat interaction in mixed-ownership entities should be assessed with a tax adviser at incorporation. This workstream runs in parallel with banking.
07 — Workforce registrations:
Workforce setup includes the applicable registrations and employment platforms, including GOSI (General Organisation for Social Insurance), Qiwa (employment contracts platform) and the Wage Protection System. Saudization requirements depend on the establishment, workforce size, activity and applicable occupational requirements, including profession-specific localisation rules where applicable. These requirements should be assessed before recruitment begins.
08 — SAMA application preparation and regulatory engagement:
The SAMA licence application is a regulatory engagement, not an administrative submission. The application package depends on the applicable SAMA framework and licensing route. Depending on the activity, it may include:
Early engagement with SAMA before formal submission can help confirm the regulatory pathway and identify potential gaps before submission.
09 — SAMA review and licence issuance:
Following submission, SAMA reviews the application and may request additional information or clarification. For payment-service applications, SAMA's regulations provide for a decision within 90 calendar days after confirming the application is complete. The actual timeline depends on the licence category and the completeness of the submission.
10 — Operational readiness and go-live:
The SAMA licence authorises commercial activity. The business is not yet operational until AML/CFT systems are live, technology infrastructure meets SAMA's standards, required regulatory reporting arrangements are in place, and all operational staff are in position. The timing between licence issuance and first transaction depends on operational readiness and the applicable regulatory requirements.
11 — Ongoing compliance from day one:
Once the Saudi entity and regulated operations are activated, ongoing compliance obligations apply. Filing and monitoring requirements depend on the applicable framework. Key examples include:
- ZATCA: Monthly withholding tax returns where applicable; VAT filing monthly or quarterly; annual CIT filing within 120 days of fiscal year-end.
- SAMA: Periodic regulatory reporting; capital adequacy monitoring; AML/CFT transaction monitoring; technology change notifications.
- Workforce: Monthly GOSI contributions; Qiwa employment contract maintenance; Saudization compliance monitoring from the first hire.
- Commercial: Annual Commercial Registration data confirmation; Chamber of Commerce renewal; annual MISA Registration Update, where applicable.
These are ongoing obligations, with timing and frequency depending on the entity, regulated activity and applicable framework.
NIKKI ADVISORY Insight: The SAMA licence and the Saudi entity are two different things that must be designed together. The entity structure determines which SAMA licence is available. The SAMA licence conditions determine what the entity must maintain after approval. Banking, ZATCA, workforce and operational readiness run in parallel — not sequentially. A fintech that treats these as separate projects will spend significantly longer reaching its first transaction than one that plans the full journey as a coordinated programme from the outset.
Sandbox or Direct Licence: The Decision That Changes Everything
SAMA operates a regulatory sandbox that allows eligible fintech companies to test innovative products in a controlled regulatory environment before pursuing a full commercial licence.
BayanPay — a digital payments company offering e-wallets, e-commerce payment solutions and SME payment gateways — graduated from the SAMA sandbox and received a full Payment Services Provider licence. This is the model the sandbox was designed to produce: a supervised testing period, followed by a full commercial licence, followed by market deployment.
The sandbox is appropriate when:
- The product is genuinely innovative and does not fit cleanly within an existing licence category.
- The founder needs to validate the product in a Saudi regulatory environment before committing to full licensing.
- The applicable regulatory treatment needs to be clarified through supervised testing.
The sandbox is not appropriate when:
- The product fits clearly within an existing SAMA licence category.
- The business is ready for commercial deployment — in this case, direct licensing is faster and more efficient.
The sandbox is a testing environment. A company in the sandbox cannot hold itself out as SAMA-licensed. Graduation marks the transition towards commercial licensing and market deployment — not authorisation to conduct regulated activity before the required licence is obtained.
Common Mistakes in SAMA Fintech Licensing:
1. Classifying the product incorrectly: BNPL is a finance activity — not a payment service. Open banking account information services fall within SAMA's payment-services framework. A product combining payment services with e-money issuance may require an EMI licence. The classification determines the entity structure, capital and regulatory framework.
2. Beginning before MISA registration is properly sequenced: The regulatory route determines when MISA registration occurs relative to entity formation and SAMA engagement. Confirm the sequence before initiating any step.
3. Underestimating the banking timeline: Identity and documentation requirements for the General Manager and authorised signatories vary by bank and should be planned early — not started after MISA registration is complete.
4. Treating technology readiness as a post-licence task: SAMA assesses technology infrastructure and cybersecurity posture at application stage — not after approval.
5. Assuming another GCC licence transfers: No GCC licence — from Bahrain, the UAE or anywhere else — substitutes for a SAMA licence.
6. Not planning for ongoing compliance from the start: Monthly ZATCA filings, GOSI contributions, Saudization monitoring and SAMA reporting begin when commercial activity starts — not after a post-launch review.
GCC Architecture: How a SAMA Licence Connects to the Wider Structure
For fintech businesses planning a multi-jurisdiction GCC presence, the SAMA licence sits within a wider architecture decision.
A Bahrain CBB licence does not substitute for SAMA authorisation. A UAE CBUAE or DFSA licence does not substitute for SAMA. Each is a separate application, a separate entity and a separate ongoing compliance obligation.
The group structure questions that must be answered before any entity is established:
- Where does the intellectual property sit?
- Which entity employs the team?
- How do intercompany payments flow?
- Which entity holds the client relationships?
All of these must be considered with the SAMA licence requirements in mind from the outset. A group that builds a UAE entity first and adds a Saudi entity later sometimes discovers that the UAE holding structure creates complications in the Saudi equity and governance requirements. The architecture decision belongs at the beginning.
At NIKKI ADVISORY, we work with fintech founders, investors and international businesses evaluating Saudi Arabia as a licensing destination. Our engagement covers:
For businesses planning a Bahrain-first or UAE-first structure with Saudi Arabia as the next step, we help assess the wider GCC architecture before the first entity is established.
The right Saudi fintech structure starts with the right regulatory conversation — before the formation documents are signed.
Most relevant for: Fintech founders, payment businesses, open banking platforms, BNPL operators and financial services businesses evaluating Saudi Arabia as a licensing destination.
Less relevant for: Technology businesses with no regulated financial services component and no Saudi-facing financial product.
Frequently Asked Questions
01. What does it cost to obtain a SAMA fintech licence — separate from the capital requirement?
SAMA charges licence issuance and renewal fees that are separate from the minimum paid-up capital. Capital is held in a Saudi-licensed bank and is not paid to SAMA. The applicable fee schedule should be confirmed directly from SAMA's published materials at the time of application, as fees vary by licence category and are subject to revision.
02. Can I operate in Saudi Arabia without a SAMA licence — what happens if I do?
No. Providing regulated financial services in Saudi Arabia without SAMA authorisation is unlawful and can result in mandatory cessation of operations and regulatory enforcement action. Fintechs already serving Saudi customers through an overseas entity should treat this as a priority matter, not a planning one.
03. Can I upgrade from a Micro PI or Micro EMI to a Major licence as my business grows?
Yes. A business that outgrows the Micro PI transaction threshold or the Micro EMI outstanding e-money conditions would apply to SAMA to upgrade to the relevant Major category. This involves meeting the higher capital requirement, restructuring the entity to a JSC if it is not already one, and demonstrating the governance and operational readiness appropriate to the Major licence level. Planning this transition before the limits are reached avoids operating outside licence conditions during the upgrade process.
04. Does my fintech product need to be Sharia-compliant to obtain a SAMA licence?
SAMA does not impose a general Sharia-compliance requirement on payment-services licensing. Where a fintech offers an Islamic finance product, the applicable Sharia governance and product-structuring requirements should be assessed alongside the relevant SAMA licensing requirements. Commercially, Sharia compliance is often expected by Saudi consumers and partners regardless of whether it is technically required.
05. Can I partner with a Saudi bank instead of obtaining my own SAMA licence?
Yes, and many fintechs use bank partnerships as a market-entry strategy or an ongoing distribution model. However, a banking partnership does not substitute for a SAMA licence if the fintech itself is conducting licensed activities — issuing electronic money, processing payments in its own name or holding customer funds. The partnership model works cleanest when the bank is the licensed entity and the fintech provides technology.
06. Can a SAMA-licensed fintech accept customer deposits?
No. Only licensed banks can accept deposits. A Major EMI can hold outstanding electronic money across customer accounts — but electronic money is legally and regulatorily distinct from a deposit. Structuring a product to resemble deposit-taking without a banking licence creates significant regulatory risk regardless of what the product is called.
07. What happens if SAMA rejects a fintech licence application?
SAMA may reject an application where the licensing requirements are not satisfied. The Implementing Regulations provide for a reconsideration request after 12 months from the date of rejection, or within a shorter period specified by SAMA — not simply after addressing the identified gaps. Early regulatory engagement is important precisely because it can help identify material issues before formal submission, rather than after a rejection has been issued.
08. What is the SAMA regulatory sandbox and who can apply?
The SAMA sandbox is a supervised testing environment open to Saudi and international fintechs with genuinely innovative products intended for deployment in Saudi Arabia. Sandbox participation is not the same as holding a SAMA licence — it is a pathway toward licensing, not a substitute for it.