What does not exist in October 2026
- A VASP, CASP or crypto exchange licence, or any licence category for crypto custody or brokerage
- A published crypto-asset rulebook from SAMA or the CMA
- A SAMA or CMA consultation on a VASP framework on either regulator's official website
- A CMA security-token or tokenised-fund rulebook
- A payment institution licence "with a crypto endorsement"
- Passporting of a foreign VASP licence into the Kingdom
The 2018 warning is still the official position
On 12 August 2018 the Standing Committee for Awareness on Dealing in Unauthorized Securities Activities in the Forex market warned that virtual currencies are not regulated inside the Kingdom. The committee is chaired by the CMA, with members from SAMA, the Ministry of Interior, the Ministry of Media and the Ministry of Commerce & Investment.
The statement says virtual currencies, including Bitcoin, are not approved as official currencies in the Kingdom and that no parties or individuals are licensed for such practices. It remains published on both the SAMA and CMA websites. The CMA's separate February 2018 investor warning on digital currencies and initial coin offerings is also still on its site.
FATF lists Saudi Arabia as having prohibited virtual assets
FATF's Seventh Targeted Update on virtual assets and VASPs, published in July 2026, includes a country table in Annex A. The Saudi Arabia row records that the national risk assessment covers virtual assets and VASPs, and that the Kingdom has explicitly prohibited their use. Licensing or registration law, stablecoin issuer licensing, supervisory inspection, enforcement and the Travel Rule are all marked not applicable, and the Recommendation 15 rating is shown as not yet assessed against the revised standard.
These entries are taken from the FATF report as republished by Malta's Financial Intelligence Analysis Unit (FIAU), because the FATF site blocks automated access. Check the FATF original before relying on the exact wording. Saudi Arabia is a FATF member, and its next mutual evaluation onsite visit is provisionally scheduled for late 2026.
Where crypto models touch existing perimeters
| Activity | Position in October 2026 |
|---|---|
| Running an exchange, brokerage or custody service in or into Saudi Arabia | Cannot be licensed, because no licence category exists |
| Fiat top-ups, balances, withdrawals, acquiring or remittance for a crypto platform | Payment activity; a crypto front end does not take it outside SAMA payment licensing (law-firm commentary, February 2026) |
| Banks or payment firms routing riyals to exchanges | Reported as not permitted without approval |
| Marketing an offshore platform to Saudi residents | Within the remit of the 2018 committee warning; can draw regulatory scrutiny |
| Token giving equity, debt or profit rights | Treated as a security under the Capital Market Law; existing CMA licensing and offering rules apply |
| Real-estate token | REGA sandbox, with possible CMA overlap where the token carries yield or investment features |
| Individual holding of crypto | Not expressly criminalised by statute, according to published commentary |
The CMA has no tokenisation rules
The CMA's definition of a security, in the Capital Market Law and its Glossary, covers shares, debt instruments, fund units and any right to or interest in them. It is technology-neutral, so a tokenised share or sukuk would be a security, and dealing in, arranging or holding custody of it would need a capital market institution licence. That is a reading of the text; the CMA has issued no guidance confirming it.
The words token, crypto, virtual asset, digital asset, distributed ledger and blockchain do not appear in the CMA's current regulations or its March 2026 Glossary, and we found no CMA consultation on these topics. By October 2021 the CMA had granted a FinTech Lab permit to a platform that uses distributed ledger technology to arrange and offer securities and provide custody, but that is a test permit under existing rules. See CMA permits and licences.
Tokenisation runs through REGA's sandbox
Real-estate tokenisation sits with the Real Estate General Authority (REGA). Its Regulatory Framework for Experimental Regulatory Environment (2025 version) gives participants a time-limited Temporary Permit and runs in phases: application (30 working days), readiness assessment (up to 120 working days), testing for 6 to 24 months, and exit. The framework does not name tokenisation itself. Trade press reports that the second sandbox edition, launched in February 2026, includes a fractional ownership and real-estate tokenisation track. No standalone tokenisation statute has been confirmed.
A REGA permit covers the property side. If a token carries yield, profit or investment features, it is likely to fall inside the CMA's securities perimeter as well, and the permit does not settle that. Our real estate tokenisation guide covers the sandbox in detail.
Stablecoins and SAMA's digital currency work
In October and November 2025 the Minister of Municipal, Rural Affairs and Housing, who also chairs REGA, said the government was working with the CMA and SAMA to launch regulated stablecoins, according to Argaam and Al Arabiya. No rulebook had been published by mid-2026.
SAMA's own work is on central bank digital currency at wholesale level. It joined Project mBridge as a full participant in June 2024, as reported, and runs Project Aber with the UAE. There is no launch date for a retail digital riyal.
How we help digital-asset firms
Perimeter analysis
We map each flow in your product to the payment, securities and REGA perimeters and write it up as an opinion you can give investors, banks and partners.
GCC VASP licensing
If you need a licence to serve the region, we structure and prepare it in the UAE (VARA in Dubai, or the FSRA in ADGM) or in Bahrain with the CBB, with a clear line on what you may do toward Saudi residents.
Crypto AML and the Travel Rule
AML/CFT programmes for VASPs: risk assessment, wallet screening, transaction monitoring, Travel Rule procedures and sanctions controls, built to FATF standards.
Licensed fintechs with crypto exposure
For SAMA and CMA licensees, controls that keep customer funds away from unlicensed platforms, and a position paper you can share with your regulator.
Common questions
Is crypto legal in Saudi Arabia?
No licence exists for crypto services, and the official 2018 warning says no party is licensed to deal in virtual currencies. Published commentary notes that individual holding is not expressly criminalised by statute. Operating an exchange, broker or custodian for Saudi customers cannot be licensed today.
Can a SAMA payment licence cover crypto activity?
No. There is no payment institution licence with a crypto endorsement. A payment licence authorises payment services and does not authorise dealing in virtual assets.
Is Saudi Arabia about to launch a crypto framework?
Nothing official has been published. Ministers spoke about regulated stablecoins in late 2025, but no rulebook had appeared by mid-2026, and we found no SAMA or CMA consultation on a VASP framework.
Where can a Gulf crypto business get licensed instead?
The routes we work with are the UAE (VARA in Dubai or the FSRA in ADGM) and Bahrain (CBB). None of these licences passports into Saudi Arabia.
Primary sources
Last reviewed: 11 October 2026
General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.
