Saudi Arabia operating obligations

Operating duties are concurrent; no single authority pipeline replaces cross-cutting controls.

Control matrix

Operating duties are concurrent. SAMA and CMA duties sit beside AML/CFT, data, tax, and Shariah overlays where the route triggers them.

SAMA payment and system obligations

Licence perimeter: The LPPS prohibits operating a payment system or providing payment services in the Kingdom without SAMA licensing; the Implementing Regulation contains the operative categories and conditions.
Capital and licensing: The payment-service regime distinguishes payment institutions, electronic-money institutions, payment initiation, account information, and payment-system operators. Verify exact current capital thresholds before relying on rate or amount tables.
Safeguarding: SAMA payment rules require safeguarded funds to be protected and segregated in the relevant payment-service and e-money routes.
AML / CFT: Payment firms must maintain AML/CFT policies and comply with applicable Saudi AML/CFT law and SAMA requirements.
Data and technology: Payment and open-banking routes require data, technology, cyber, outsourcing, and secure-sharing controls under the SAMA payment rule stack and Saudi data law.
Open-banking access: Open-banking access depends on secure customer-authorized sharing with SAMA-supervised entities and the open-banking framework.
Payment-system oversight: The updated oversight framework aligns payment-system operator oversight with the LPPS, Implementing Regulation, supervisory tools, self-assessment, assessment, and international standards.
Complaints and disputes: The payment-services rulebook includes complaint-handling and payment-services dispute handling; verify current forum labels and procedural references before detailed public wording.

CMA securities and custody obligations

Authorization: Article 5 of the Securities Business Regulations requires a person carrying on securities business in the Kingdom to be a CMA-authorized capital market institution or exempt person.
Territorial scope: Article 4 of the Securities Business Regulations captures activity from a permanent place in the Kingdom or with or for a person in the Kingdom.
Securities advertisements: Securities advertisements available to persons in the Kingdom are controlled under the Securities Business Regulations.
Offers: The Offer Rules govern public offers, private placements, exempt offers, registration, disclosure, and continuing-obligation pathways.
SPE structures: The SPE Rules require licensing and prescribe sponsor, trustee, custodian, auditor, by-law, bank-account, and record arrangements for covered SPEs.
Custody: Securities custody is a CMA securities activity; this is separate from native-crypto custody, for which no public Saudi route was identified.
Experimental permit: The ExPermit Instructions allow securities-business fintech testing within set parameters and do not replace production authorization.

Cross-cutting obligations

Financial integrity: Use the AML Law, sector-supervisor materials, and SAFIU routing for suspicious-transaction / financial-intelligence handling. Do not present SAFIU as an ordinary consumer complaint body.
Privacy: Use PDPL, the implementing regulation, and transfer rules for personal-data processing and cross-border transfer.
Tax: Use ZATCA VAT, income-tax, zakat, and withholding-tax sources. Tokenized instruments should be characterized by legal form before tax treatment.
Shariah: Use SAMA's banking-side Shariah Governance Framework where the route is through a bank conducting Shariah-compliant banking; treat CMA capital-market Shariah materials as draft unless a final source is verified.
Unlicensed virtual currency: The public 2018 warning remains the operative boundary for virtual-currency practices not approved or licensed by Saudi regulators.