Saudi Arabia compliance map
SAMA payment and bank-money routes, CMA securities and SPE routes, Saudi infrastructure, and unsettled stablecoin, VASP, and tokenized-deposit treatment.
Overview
Saudi Arabia uses a national financial-regulatory perimeter rather than a financial-free-zone model. SAMA governs payment services, e-money, payment systems, open-banking access, and payment-side sandbox activity. The CMA governs securities business, offers, funds, custody, special purpose entities, and capital-markets fintech testing.
The live routes are conventional. SAMA licensing covers payment institutions, electronic-money institutions, payment initiation, account information, and payment-system operation under the Law of Payments and Payment Services and its Implementing Regulation. CMA authorization covers securities dealing, arranging, managing, advising, custody, offers, and SPE-based debt or fund structures under the CMA rule stack.
The unsettled routes stay visible. The public 2018 virtual-currency warning says virtual currencies are not approved as official currencies in the Kingdom and that no parties or individuals are licensed for those practices. The cited public sources do not create a Saudi VASP, crypto-exchange, native-crypto custody, blockchain-stablecoin, or tokenized-deposit production licence class.
Saudi payment and market infrastructure is material to the operating map. SARIE / RTGS, instant payments, mada, SADAD, Saudi Exchange, Edaa, and Muqassa are operating substrates; they do not by themselves create permission for virtual-asset, stablecoin, or DLT-native securities activity. Use the infrastructure route only with the relevant SAMA or CMA legal perimeter.
Shariah governance is an additive overlay rather than a separate licensing perimeter. SAMA's banking-side Shariah Governance Framework is live for banks conducting Shariah-compliant banking, while CMA capital-market Shariah materials should stay treated as draft or current authority dependent until final instructions are confirmed.
Saudi Arabia regulatory architecture
Operations under Saudi Arabia rules
| Operation | Current route | Boundary |
|---|---|---|
| Saudi bank-money payout | Live through licensed banks, PSPs, and payment systems under SAMA rules. | Crypto-side execution still lacks a public local VASP or crypto-custody route. |
| Wallet or e-money value | Live through PI / EMI categories under the SAMA payment-service regime. | Must remain inside licensing, capital, safeguarding, AML/CFT, data, complaint, and user-limit controls. |
| Open-banking AIS / PIS | Live as a SAMA-supervised licensing path after sandbox graduation. | Consent, secure-sharing, privacy, and supervised-entity requirements apply. |
| Tokenized sukuk, debt, fund unit, or security | Possible through legal-form analysis under CMA securities, offer, fund, custody, and SPE rules. | Token form does not create a separate public DLT-native securities route. |
| DLT-native securities issuance or settlement | Not codified as a separate public Saudi route in the cited sources. | Use CMA legal-form route and conventional Saudi market infrastructure unless regulator confirmation says otherwise. |
| Native-crypto exchange or custody | No public local production route identified. | 2018 warning remains the clearest public boundary. |
| SAR or foreign stablecoin for payment | No public Saudi stablecoin class identified. | Closest analytical comparison is e-money, but treatment remains unsettled and cannot be shown as an issuer licence. |
| Tokenized bank deposit | Publicly described through proof-of-concept work, not a production rulebook. | No standing public tokenized-deposit licence category was identified. |
| Wholesale CBDC / corridor settlement | Official pilot and platform-participation evidence exists through Aber and mBridge references. | No private-token licence effect; production access and governance require fresh verification. |
Activation paths
| Path | Status and prerequisites | Unlocks or key block |
|---|---|---|
| SAMA PI / EMI licence | Live under the LPPS and Implementing Regulation. | Payment services, wallets, e-money issuance, safeguarding, limits, and reporting. |
| SAMA payment-system operator | Live under the LPPS, Implementing Regulation, and updated payment-system oversight framework. | System operation, oversight, PFMI alignment, finality, and operator duties. |
| SAMA open-banking licence | Live after the 26 March 2026 open-banking licensing announcement. | Account-information and payment-initiation services under secure customer consent. |
| SAMA sandbox | Live testing route for payment-side innovation under SAMA acceptance and safeguards. | Testing route only; production requires the correct licence or no-objection. |
| CMA capital-market institution | Live authorization route for dealing, arranging, managing, advising, and custody. | Required unless an exclusion or exemption applies. |
| CMA offer / fund / SPE route | Live route for securities offers, debt instruments, sukuk, securitization, funds, and SPE structures. | Token form does not displace offer, custody, registry, disclosure, or post-trade controls. |
| CMA FinTech ExPermit | Live experimental route for securities-business fintech under specified parameters. | Testing route only; continuation requires production authorization. |
| Payment or market infrastructure access | Available through licensed banks, PSPs, exchange members, custodians, brokers, CSD/CCP arrangements, or permitted counterparties. | Infrastructure access is not a separate crypto, stablecoin, or DLT-securities permission. |
| Native-crypto / stablecoin production route | No public Saudi route identified in the cited primary sources. | Not a live licensing path without fresh regulator confirmation. |
Settlement and market infrastructure
| Infrastructure | Role | Route boundary |
|---|---|---|
| SARIE / RTGS | Central-bank-money settlement infrastructure for Saudi-riyal payment obligations and interbank settlement. | Infrastructure only; it supports lawful bank-money and payment-system settlement but does not authorize private-token issuance. |
| Instant payments | Retail and account-to-account payment rail connected to Saudi bank-money payment flows. | Payment rail only; SAMA licensing still controls PSP, open-banking, and payment-service access. |
| mada / SADAD / Esal | Domestic card, bill-payment, and invoicing infrastructure relevant to merchant, biller, and payment flows. | Operating rails only; they are not stablecoin, VASP, or crypto-custody routes. |
| Saudi Exchange / Edaa / Muqassa | Trading, depository, settlement, and clearing infrastructure for capital-market instruments. | Securities legal form and CMA authorization still govern tokenized instruments. |
| Aber / mBridge / tokenized-deposit work | Official wholesale digital-money, cross-border, and tokenized-commercial-bank-money pilot or proof-of-concept evidence. | Pilot / project evidence only; do not present as a standing private-token or wholesale-access permission without fresh primary-authority confirmation. |
Current status
| Area | Status | Since / source date |
|---|---|---|
| Open-banking licensing | SAMA announced commencement of licensing for fintech companies providing open-banking services. | 2026-03-26 |
| First open-banking AIS licences | SAMA announced two companies licensed to provide account-information services associated with open banking. | 2026-03-26 |
| Payment-system oversight framework | SAMA announced the updated Oversight Framework of the Payment Systems and Their Operators; the rulebook instrument is dated 2026-03-08. | 2026-03-24 / 2026-03-08 |
| Tokenized-deposits project | SAMA Governor speech publicly described proof-of-concept work testing account-based and token-based tokenized commercial bank money. | 2025-11-16 |
| E-wallet rules | SAMA published rules for electronic-wallet activities under the Saudi payment-services perimeter. | 2024-11-13 |
| mBridge platform participation | SAMA announced participation in the mBridge platform phase for wholesale cross-border CBDC settlement. | 2024-06-05 |
| Payments implementing regulation | In force as the operative payment-services implementing layer. | 2023-06-13 |
| Payments law | In force as the main payment-services law. | 2021-10-28 |
| CMA FinTech ExPermit | Experimental capital-markets fintech route remains part of the cited CMA rule stack. | 2021-08-04 |
| Virtual-currency warning | Public warning remains the clearest cited boundary for unapproved virtual-currency practices. | 2018-08-12 |
Items awaiting regulatory confirmation
| Item | Authority | What it would clarify |
|---|---|---|
| Stablecoin classification and issuance | SAMA, CMA | Whether a payment-token, e-money, securities, or new regime applies to SAR or foreign stablecoin use in the Kingdom. |
| Local VASP / crypto-custody / exchange route | SAMA, CMA | Whether any native-crypto service can be licensed locally despite the 2018 warning. |
| Tokenized-deposit production treatment | SAMA | Whether tokenized commercial-bank money is treated as deposit, payment instrument, e-money, or a new supervised category. |
| DLT-native securities issuance and post-trade rules | CMA | Whether tokenized securities may use ledger-native issuance, registry, custody, clearing, or settlement arrangements beyond conventional legal-form routing. |
| Final capital-market Shariah governance instructions | CMA | Whether the draft CMI Shariah-governance materials become a final enforceable framework. |
| Wholesale CBDC and corridor production access | SAMA | Whether Aber, mBridge, or later programmes become standing settlement routes with specified participant access. |