Product Feature
defines the regulator

01

One platform can affect multiple modes

A Wallet with an investment feature, a marketplace with installations or a corporate treasury platform can simultaneously include payment, credit, securities, data and outsourcing. Perimeter memorandum decomposes the customer journey and cash flow into individual regulated functions before creating the technology.

SAMA

Banks, payments, finance, money exchange and open banking

CMA

Dealing, managing, arranging, advising, custody, offers and funds

Insurance Authority

Insurance and related regulated functions

SDAIA / PDPL

Personal data, processing and transfers

CST / cybersecurity

Technology, cloud and sector controls if applicable

02

SAMA: first the exact license category

Acceptance of deposits or refunds, account issuance, payment execution, acquiring, remittance, lending, finance brokerage and other functions have different regulatory outcomes. Using a licensed partner is possible, but outsourcing or white labeling should not turn an unlicensed platform into an actual provider of a regulated service.

Applicant

Saudi entity and acceptable ownership/legal form

Controllers

Source of funds, fitness, reputation and regulatory history

Management

Fit and proper, competence and local accountability

Capital

By license category and risk model

Systems

AML/CFT, cyber, data, safeguarding, complaints and continuity

03

Payment Institution and Electronic Money Institution are not synonyms

SAMA publishes PI and EMI as different types of licensed payment service providers. Product analysis covers issuance, loading, holding value, transfer, acquiring, merchant settlement, cross-border component, safeguarding and redemption. Client money is not mixed with operating funds.

04

Lending, BNPL and debt crowdfunding - different finance models

Lending from own balance sheet, consumer finance, SME finance, leasing, mortgage, credit-card finance, BNPL, debt crowdfunding and digital brokerage qualify separately. Before launch, lender of record, underwriting, pricing, collection, credit reporting, disclosures and consumer protection are determined.

05

Open banking moved to licensing

In March 2026, SAMA announced the start of licensing fintech companies for open-banking services after the sandbox phase. The model is built around customer consent, secure API, supervised entities, data minimisation, authentication, third-party risk and incident response. Access to data does not automatically grant the right to initiate a payment or provide advice.

AIS

Account-information functionality and consent perimeter

PIS

Payment initiation and separate money-flow analysis

Consent

Specific, recorded, revocable and purpose-linked

Security

API, authentication, monitoring and incident controls

Partner

Verification of bank license and third-party provider

06

The CMA regulates securities business by function

Capital Market Institutions Regulations cover authorization, controllers, close links, registered persons, conduct, client money and assets. The business model is checked for dealing, managing, arranging, advising and custody. Calling an instrument a “project share”, a “digital right” or a “membership” is not enough if its economic content is security.

Dealing

Principal/agent and underwriting in the permitted scope

Managing

Investments and operating funds

Arranging

Bringing together the parties and organizing securities transactions

Advising

Personal or other regulated recommendation

Custody

Storage and administration of client assets

07

Private placement does not mean private Telegram advertising

Rules on the Offer of Securities and Continuing Obligations distinguish between exempt offers, private placements, public offers and crowdfunding routes. Before contacting investors, issuer, instrument, offeree category, capital market institution, offering document, notification, advertising, transfer restrictions and secondary-market outcome are recorded.

1. 01

   Qualify instrument and issuer corporate capacity.

2. 02

   Select exempt, private, crowdfunding or public route.

3. 03

   Appoint a licensed intermediary if required.

4. 04

   Prepare an information memorandum and risk factors.

5. 05

   Limit marketing and check each offeree.

6. 06

   Add selling restrictions of countries to foreign investors.

08

Fund vehicle does not replace a licensed fund manager

Public and private investment funds are regulated by the CMA Investment Funds Regulations. Fund type, manager, custody, administrator, terms and conditions, valuation, conflicts, borrowing, eligible assets, offering category and investor reporting are checked. Foreign fund marketing in the Kingdom has a separate route.

09

Sandbox is a controlled test, not a circumvention of the law

SAMA Sandbox allows eligible local and international applicants to test innovations in a live environment under limited conditions. CMA uses FinTech Lab / ExPermit for capital-market models. In each case, test users, limits, safeguards, disclosures, exit and the path to full authorization are agreed upon in advance.

Purpose

Test innovation and risks in a limited environment

Scope

Only approved use case, users, volume and period

Customer

Informed consent, protection and complaints

Exit

Stop, modify or move to full license

Marketing

The permit cannot be presented as a general license

10

Route from idea to licensed launch

1. 01
   Product map

   Users, money, assets, data, decisions and contractual roles.

2. 02
   Perimeter memo

   SAMA, CMA, Insurance, PDPL and foreign-country triggers.

3. 03
   Route selection

   Own license, regulated partner, sandbox or non-regulated technology.

4. 04
   Applicant design

   Entity, ownership, capital, governance, people and policies.

5. 05
   Regulator engagement

   Application, questions, systems evidence and testing.

6. 06
   Controlled launch

   Conditions, reporting, monitoring and change management.