The Fintech Company Setup Guide
to Saudi Arabia

Saudi financial-services regulation is split across two authorities. The Saudi Central Bank (SAMA) regulates banks, insurance, finance companies (BNPL, consumer finance, mortgage), payment service providers (PSPs), electronic money institutions (EMIs) and the Open Banking ecosystem. The Capital Market Authority (CMA) regulates investment activities, brokerage, robo-advisory, equity and debt crowdfunding, fund management and increasingly digital-asset frameworks.

The line is set by activity, not branding: a payments wallet is SAMA; an investment app that holds client assets is CMA; a BNPL platform is SAMA finance-company; a debt-crowdfunding platform is CMA. Operating without the right licence — or under a mis-classified one — is a criminal offence under the Banking Control Law and the Capital Market Law, with personal liability for the Managing Director.

For most foreign founders, the practical first stop is Fintech Saudi, the joint SAMA-CMA-MCIT industry-development arm based at KAFD. Fintech Saudi runs the sandbox referral pipeline, the talent matchmaking and the regulatory-navigation conversations that decide whether your model fits SAMA's path or CMA's path.

The SAMA Regulatory Sandbox is the supervised testing environment for innovative financial products. Cohorts run on rolling 12-month cycles. Sandboxed firms operate under restricted parameters: customer-volume caps (typically 5,000–25,000 customers), transaction-value caps, geographic restrictions, and full reporting against a SAMA-defined success-criteria framework.

At the end of the sandbox window, the firm either graduates to a full operating licence (PSP, EMI, finance company, banking, TPP), exits the market, or extends in the sandbox for a further period. Graduation rate has historically run above 70% for cohorts that complete the programme, which is the reason Saudi has out-paced the rest of the GCC on fintech licensing volume since 2020.

The sandbox is not the right route for a model that is already directly licensed elsewhere — for example, a foreign EMI extending to Saudi can apply directly for the SAMA EMI licence with the home-regulator file. The sandbox is for genuinely novel models or for first-time financial-services applicants without a home-jurisdiction precedent.

Payment Service Provider (PSP). Acquiring, processing, gateway services. Minimum paid-in capital SAR 25M. The full-strength payments licence — what stc pay, urpay, Geidea and Foodics Pay operate under.

Electronic Money Institution (EMI). Issuance of e-money, wallets, prepaid cards. Minimum paid-in capital SAR 7M. Lighter than PSP, narrower scope — used by neobank-style consumer wallets that don't acquire merchants.

Third-Party Provider (TPP) under the Open Banking Framework. Account Information Service Provider (AISP) and Payment Initiation Service Provider (PISP) permits, issued separately. Lower capital requirement, but full Open Banking technical-and-cybersecurity certification required.

Finance company. Consumer finance, BNPL, SME lending, mortgage. Minimum paid-in capital varies sharply by sub-activity — SAR 100M for consumer finance, SAR 200M for mortgage, SAR 100M for BNPL at the larger tiers. Heavily regulated leverage and provisioning regime.

Digital bank. Full banking licence with restricted physical-presence model. Minimum paid-in capital SAR 1.5bn for the full banking licence; SAR 200M+ for restricted-scope digital-bank variants. STC Bank, D360 and Vision Bank operate under this regime.

CMA-side licences (crowdfunding, robo-advisory, brokerage, fund management) carry their own capital floors — typically SAR 5–25M for fintech-style permits and SAR 50M+ for full brokerage.

SAMA's Open Banking Framework went live in 2023 with mandatory-participation banks (the major Saudi banks), a SAMA-operated central directory, and a phased rollout across Account Information Services (AIS, live), Payment Initiation Services (PIS, rolling through 2024–25) and Variable Recurring Payments (VRP, on roadmap).

For a fintech founder, three implications. (1) Account aggregation and PFM are unblocked. Consumer-finance, SME-finance and personal-finance use cases that depended on screen-scraping in 2022 are now built on standardised, regulated APIs. (2) Payments rails compete with cards. Account-to-account payment via PIS is on the roadmap to displace card-pay-at-checkout for high-value e-commerce — particularly attractive given Mada interchange constraints. (3) TPP licensing is a separate workstream. An EMI or PSP licence does not automatically grant TPP permission; the AISP and PISP permits are separate SAMA approvals.

All Open Banking participants must comply with SAMA's Cybersecurity Framework, the NCA Essential Cybersecurity Controls (ECC-1) and the NCA Cloud Cybersecurity Controls (CCC-1). PDPL data-residency for financial data is non-negotiable: in-Kingdom hosting in a SAMA-approved cloud region (Azure KSA, AWS Bahrain, STC Cloud, Mobily Cloud, Oracle Jeddah).

The geographic centre of gravity for Saudi fintech is unambiguously the King Abdullah Financial District (KAFD) in Riyadh — Fintech Saudi is headquartered there, SAMA's regulatory teams sit nearby, and the major operators (stc pay, Tabby, Tamara, Lendo, Hala, Sulfah, Foodics Pay) have anchor offices there. Office cost reflects this — KAFD Grade-A space runs SAR 1,800–2,800 per square metre per year.

Sector Saudization for financial services is the highest tier in the Nitaqat framework — 35–45% Saudi-national headcount weighted. The pipeline is real (Saudi Banking Institute, KFUPM finance graduates, KAUST quantitative talent) but the compensation curve is steep: Saudi-national risk and compliance professionals run SAR 30,000–55,000/month, senior product and engineering SAR 28,000–48,000/month. Plan compensation against London and Singapore benchmarks, not Cairo or Dubai. Costs of Saudi vs expat hiring are benchmarked in Cost of Hiring in Saudi Arabia.

Because the public-sector procurement regime applies to financial services indirectly (PIF-portfolio banks, government-owned giga-projects, public-payer demand), the RHQ Programme trade-off becomes relevant: an RHQ vehicle to qualify for public-sector engagement, plus an operating MISA Services-LLC and a SAMA-licensed financial-services subsidiary for live operation. The structural choice is covered in Volume 15 — The RHQ Programme.