The sequence for a foreign fintech
Confirm the target licence
The licence decides legal form, capital, staffing and permitted activities. We fix it before anything is filed. See licensing.
Apply to the regulator and get approval in principle
The licence application goes in before the company exists, with draft articles of association. SAMA decides on a payment licence file within 90 calendar days of confirming it is complete, and on a finance or BNPL file within 60 working days. A payments approval in principle does not authorise you to operate.
Register the investment with MISA
Foreign-owned companies register with the Ministry of Investment, and the registration must be in place before SAMA, the CMA or the Insurance Authority issues the licence.
Incorporate in the required form and capital
Commercial registration and articles of association at the Ministry of Commerce, in the legal form and with the capital the licence requires: within 180 days of approval in principle for a payment licence, or six months for finance and BNPL companies.
Tax, social insurance, labour and banking
ZATCA for zakat, tax and VAT, GOSI for every employee, Qiwa for employment contracts, and the bank account the commercial registration must be linked to.
Complete the licence
Meet the regulator's final requirements, including paid-up capital, senior hires, systems and premises, and pay the licence fee. SAMA then issues the licence; at the CMA, the equivalent stage is the commencement-of-business requirements.
MISA: the investment licence is now an investment registration
The Investment Law, Royal Decree M/19, was issued in July 2024, published in the Umm Al-Qura gazette on 16 August 2024 and took effect in February 2025. It replaced the Foreign Investment Law of 2000. Its Implementing Regulations were issued by Ministerial Resolution 1086 dated 08/08/1446H, according to law-firm reporting.
The practical change is that the old MISA investment licence has been replaced by investment registration, evidenced by an Investment Registration Certificate that is reconfirmed every year. A list of activities remains excluded from foreign investment. Sources differ on the exact effective date (7 or 12 February 2025) and on whether registration applies to all foreign investors or only non-GCC investors, so we confirm the position for your shareholders before filing.
The Companies Law and choosing a legal form
The Companies Law, Royal Decree M/132 dated 1/12/1443H, took effect on 19 January 2023, with Implementing Regulations under Minister Resolution 284. It introduced the Simplified Joint Stock Company, a lighter form of joint stock company.
Legal form is where licence plans most often go wrong. Some regulator rules fix the form, and converting after registration means amending documents, registrations and sometimes capital while the licence clock is running.
The Commercial Register Law since 3 April 2025
| Change | What it means for a new fintech |
|---|---|
| Unified number | The CR number is now the national unified number, starting with 7 |
| No expiry | Commercial registrations no longer expire; an annual data confirmation is required instead |
| One CR nationwide | A single registration is valid across the Kingdom; sub-registers have a five-year transition |
| Activity licences | Required activity licences must be obtained within 90 days |
| Bank account | The entity must have a linked bank account |
| Penalties | Fines range from SAR 500 to SAR 10,000 |
Commercial Register Law and Law of Trade Names, Royal Decree M/83 dated 19/03/1446H, with Implementing Regulations under Ministerial Decision 288. Details are from law-firm reporting; SAMA has issued a circular on implementing the CR and trade-name changes.
ZATCA: VAT on fees and Fatoora e-invoicing
Register with the Zakat, Tax and Customs Authority (ZATCA). According to published commentary, financial services priced through a margin are exempt from VAT, while explicit fees and commissions are standard-rated at 15%. Most fintech revenue models, such as payment, wallet and platform fees, are therefore likely to be taxable, and pricing should include VAT from the first day.
Phase 2 of e-invoicing (Fatoora), the integration phase, is being rolled out in waves. Wave 23 covered taxpayers with revenue above SAR 750,000, with a deadline of 31 March 2026. Wave 24 covered those above SAR 375,000, with a deadline of 30 June 2026. Wave 25, announced on 24 July 2026, covers taxpayers whose revenue exceeded SAR 187,500 in any year from 2022 to 2025, and they must integrate by 1 February 2027, as reported by KPMG and EY.
A newly incorporated entity has no revenue history, but a group moving an existing business into Saudi Arabia may. Either way, choose invoicing software that can integrate with Fatoora before you issue your first invoice.
GOSI, Qiwa and Nitaqat from April 2026
Every employee must be registered with the General Organization for Social Insurance (GOSI). A clean GOSI file is a prerequisite for work permits and for your Nitaqat rating.
A new Nitaqat phase applies from 16 April 2026 through 2028, with higher targets, according to EY, Clyde & Co and Al Tamimi. Since April 2026 a Saudi employee counts only if the contract is documented on Qiwa. A Saudi earning at least SAR 4,000 counts as one person, and one earning SAR 3,000 to 4,000 counts as half.
Profession quotas matter for a fintech's finance team. Accounting and finance professions must be 40% Saudi at establishments with five or more such staff, rising to 70% by 2028. Some administrative roles are reserved entirely for Saudis, and there are quotas for sales, marketing and procurement. SAMA, the CMA and the Insurance Authority may add localisation requirements of their own for licensees, which we cover under the compliance function.
What we handle
- Licence-led structuring: legal form, shareholding and capital
- MISA investment registration
- Commercial registration, articles of association and activities drafted around the regulated activity
- ZATCA, GOSI and Qiwa registrations, coordinated with your accountants and HR provider
- A hiring and Saudization plan that fits Nitaqat and your regulator's expectations
- A handover file the licensing work builds on directly
Common questions
Do foreign fintechs still need a MISA investment licence?
The Investment Law, in force since February 2025, replaced the investment licence with investment registration and an Investment Registration Certificate that is reconfirmed annually. Foreign-owned fintechs must complete it before SAMA, the CMA or the Insurance Authority issues their licence.
Does a commercial registration still expire?
No. Since the Commercial Register Law took effect on 3 April 2025, registrations have no expiry date. The company confirms its data annually instead.
When does a fintech have to join Fatoora Phase 2?
It depends on revenue. Wave 25 covers taxpayers with revenue above SAR 187,500 in any year from 2022 to 2025, with integration due by 1 February 2027.
Which legal form should a fintech choose?
The one your target licence requires. SAMA's BNPL rules require a joint stock company, for example. We confirm the form before anything is filed.
Primary sources
Last reviewed: 11 October 2026
General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.
