To enter Saudi Arabia as a foreign fintech, decide the regulated activity and the regulator first, then build the company around that licence. The working order is: confirm the licence, file with the regulator, incorporate at the Ministry of Commerce in the legal form and with the capital it requires, and complete the licence. SAMA gives in-principle approval before you incorporate, and foreign-owned companies register the investment with the Ministry of Investment (MISA) before the licence is issued. Once the company exists, it registers with ZATCA, GOSI and Qiwa.
The order matters because SAMA and the Capital Market Authority (CMA) each fix legal form, minimum capital and staffing for their licences, and a company formed the wrong way has to be amended while the regulator's deadlines run.
Decide the regulated activity before you register anything
Your product's regulated activity decides which regulator licenses you, and that licence decides most of the set-up:
- SAMA licenses payment and e-money institutions, open banking, BNPL, finance companies, debt-based crowdfunding and finance aggregation.
- The CMA licenses securities business (dealing, arranging, managing, advising and custody), including equity and debt crowdfunding under an arranging licence and robo-advisory under a managing licence.
- The Insurance Authority licenses insurers and insurance service providers; its website says it became the insurance regulator on 23 November 2023.
Serving Saudi customers from abroad does not avoid licensing. The Law of Payments and Payment Services bars unlicensed payment services in the Kingdom (Article 4) and lets SAMA decide when a provider residing abroad counts as one within the Kingdom (Article 5). The CMA's Securities Business Regulations presume that business done "with or for a person in the Kingdom" is carried on there (Article 4). Law firms report that foreign licences cannot be passported in.
Test your scoping early. Fintech Saudi, a joint SAMA and CMA initiative, runs 30-minute "Meet the Regulators" sessions with SAMA, the CMA and the Insurance Authority. Our guide to Saudi financial regulators and licensing overview map the options.
MISA registration has replaced the MISA licence for fintechs
The Investment Law, Royal Decree M/19, replaced the Foreign Investment Law of 2000 and took effect in February 2025, and Baker McKenzie and Clyde & Co report that its Implementing Regulations were issued by Ministerial Resolution 1086 dated 08/08/1446H. The old MISA licence is now an investment registration, reconfirmed every year, which foreign-owned fintechs complete before a SAMA, CMA or Insurance Authority licence is issued; our incorporation page covers the detail, including the open questions for GCC shareholders.
Fintech company formation in KSA: the Ministry of Commerce steps
According to law-firm summaries, the Companies Law (Royal Decree M/132), in force since 19 January 2023, introduced the Simplified Joint Stock Company (SJSC), and the Commercial Register Law (Royal Decree M/83), in force since 3 April 2025, made the CR number the national unified number, replaced CR expiry with an annual data confirmation and requires a linked bank account. Draft the articles of association and CR activities around the regulated activity, because SAMA's file includes draft articles and the CMA's checklist includes a Ministry of Commerce trade-name reservation; our incorporation page sets out each step.
The regulator's rules set legal form and capital
Most licence plans go wrong here. These are the minimum paid-up capital and legal form for the licences foreign fintechs most often target.
| Licence | Regulator | Minimum paid-up capital | Legal form |
|---|---|---|---|
| Micro payment institution | SAMA | SAR 1m | JSC, SJSC or LLC |
| Major payment institution | SAMA | SAR 3m, then the higher of SAR 3m or 1% of average monthly payment value | JSC |
| Micro e-money institution | SAMA | SAR 2m | JSC |
| Major e-money institution | SAMA | SAR 10m, then the higher of SAR 10m or 2% of average outstanding e-money | JSC |
| Payment initiation (alone or with account information) | SAMA | SAR 1m | Not separately stated |
| Account information only | SAMA | SAR 500,000 | Not separately stated |
| BNPL or debt-based crowdfunding | SAMA | SAR 5m | JSC |
| Finance aggregation | SAMA | SAR 2m | Not specified in the rules we reviewed |
| Other finance company activities | SAMA | SAR 10m to SAR 200m, by activity | JSC under the original law; 2025 wording suggests other forms, unconfirmed |
| Dealing or custody | CMA | SAR 50m | JSC, local bank subsidiary, subsidiary of a Saudi financial-services JSC, or subsidiary of a foreign financial institution licensed under the Banking Control Law |
| Managing investments and operating funds | CMA | SAR 20m | As for dealing |
| Managing investments only | CMA | One year of expected expenses | As for dealing |
| Arranging or advising | CMA | One year of expected expenses | Any legal form established in the Kingdom |
Finance company capital must be paid in full at incorporation. SAMA also asks for a bank guarantee with the application: its current guidelines say 20% of minimum capital, while Article 8 of the Payments Implementing Regulations and several sets of SAMA rules say 100%, so confirm the figure with SAMA. The CMA's May 2026 draft would lower dealing and custody capital, but it has not been adopted, and the Capital Market Law still sets a SAR 50m floor for brokers. See the payment institution licence and CMA licences for detail.
SAMA approves in principle before you incorporate
SAMA's first stage comes before the company exists. For payment and e-money licences, SAMA decides within 90 calendar days of confirming the file is complete, or sets a revised timeline. In-principle approval lasts up to one year (extendable by 180 days), authorises no activity, and must be followed by incorporation within 180 days. Finance and BNPL applicants get an initial decision within 60 working days of the completeness notice and incorporate within six months. Finance companies then have 12 months from the CR to reach readiness before SAMA's licensing visit. Applications go to SAMA's licensing team by email.
The CMA works through its Unified Business Sector Portal. You file with the study fee and a registration application for each registrable function, answer information requests within 30 days, and complete commencement-of-business requirements after the licence is granted. The CMA's service card gives 0 to 60 business days, depending on the service.
Bank accounts, residency and a head office in the Kingdom
Payment providers must safeguard client funds, and money still held at the end of the business day after receipt goes into a segregated account at a licensed bank or into secure liquid assets with SAMA approval. SAMA's application list includes the safeguarding policy with the bank agreement, so open the banking conversation before you file. Law firms report that the CR itself needs a linked bank account.
Key people must be in the Kingdom. A CMA firm needs its management and head office there (CMIR Article 6(h)), and registered persons must be resident unless the CMA exempts them. SAMA requires the management of BNPL, debt crowdfunding and aggregation companies to be permanent residents. It also reserves posts such as Chief Compliance Officer and AML/CTF Director for Saudi nationals, and payment and fintech companies need its written non-objection before senior appointees act. An outsourced provider cannot fill those Saudi-only posts; our guide to outsourcing the MLRO explains what can be bought in.
The SAMA sandbox and CMA FinTech Lab are entry routes for new models
If no licence covers your model, you can test it first. SAMA does not accept sandbox applications where a licensing path exists, and the CMA expects a mature product to apply for a full licence.
| SAMA Regulatory Sandbox | CMA FinTech Experimental Permit | |
|---|---|---|
| Scope | Business models not covered by existing rules | Innovative products related to securities activities |
| Foreign applicants | Apply directly and register with MISA and the Ministry of Commerce after acceptance, or partner with a licensed firm | Anyone may apply; a Saudi commercial entity is a commencement requirement |
| Stages | Application (60 days), operational readiness (120 days), testing (6 to 12 months), exit | Batch assessment, permit, commencement requirements, CMA approval to operate |
| Path to licence | Licence application expected after month 6 and by month 9 of testing | Permit lasts up to 2 years from commencement; extensions only in exceptional cases |
| How to apply | eSAMA portal, always open | Application form emailed to the CMA |
SAMA can relax licence fees, capital and liquidity, and board composition in the sandbox. It is unlikely to relax AML/CFT, fit and proper, consumer data protection or cyber security requirements. An April 2026 CMA draft would allow year-round Lab assessment and a fee; it has not been adopted. Debt crowdfunding now runs under an arranging licence, so the Lab takes new applications for it only where there is an innovative element. See the SAMA regulatory sandbox and the CMA FinTech experimental permit.
After set-up: ZATCA, GOSI, Qiwa and Nitaqat
Once the company exists, register with ZATCA for VAT and Fatoora e-invoicing, register every employee with GOSI, and document Saudi staff contracts on Qiwa so they count under Nitaqat; our incorporation page covers each step.
Regulators add a layer. Finance, BNPL and debt crowdfunding companies start at 50% Saudi and add 5% a year until 75%, and aggregation companies need at least 50%. The Payments Implementing Regulations set no fixed ratio, but the business plan must show planned non-Saudi staffing by department and level. The CMA's institution rules contain no quota.
A realistic sequence for a foreign fintech
The timings below are only those set in the rules or reported by law firms. Our sources give no fixed timetable for MISA registration, incorporation or bank onboarding, so treat those as variable.
| Step | What happens | Timing |
|---|---|---|
| 1. Scope | Fix the regulated activity, regulator and licence category; test it with the regulator | No set period |
| 2. MISA | Register the investment and obtain the Investment Registration Certificate | Before the licence issues; reconfirmed yearly |
| 3a. SAMA file | Apply as a company under establishment, with draft articles, fit and proper forms, business plan and bank guarantee | Decision within 90 calendar days (payments) or 60 working days (finance, BNPL) of completeness |
| 3b. CMA file | Portal application with trade-name reservation, study fee and registration applications | Information requests answered within 30 days |
| 4. Incorporate | Articles and CR, with a linked bank account | Within 180 days (payments) or six months (finance, BNPL, aggregation) of SAMA approval |
| 5. Registrations | Activity licences, ZATCA, GOSI and Qiwa | Activity licences within 90 days, per law-firm reporting |
| 6. Readiness | Hire, finalise policies and systems, and meet any outstanding capital requirement; SAMA visit or CMA commencement requirements | Finance companies: within 12 months of the CR |
| 7. Every year | Reconfirm MISA registration and CR data; renew CMA activities | CMA renewal fees due by 30 June |
Common mistakes foreign founders make
- Incorporating as an LLC when the licence needs a JSC, then converting while SAMA's incorporation clock runs.
- Building the business plan on the CMA's May 2026 draft capital figures, which have not been adopted.
- Serving Saudi customers from an offshore entity while the local set-up is pending.
- Applying to the sandbox when a licence category already fits the model.
- Planning a non-Saudi or outsourced Chief Compliance Officer or AML/CTF Director at a SAMA licensee.
- Raising a round without checking SAMA's circular of 18 May 2026, which requires notification before investment rounds.
- Assuming a payment licence can stretch to crypto. Saudi Arabia has no licence for virtual asset service providers, and no payment licence carries a crypto endorsement.
- Missing the annual MISA reconfirmation or CR data confirmation. An ongoing compliance calendar catches both.
Where to start
Write down the regulated activity, the regulator and the licence category before you spend money on the entity, and test that view with the regulator. The MISA registration, the articles and the licence file should all be built from the same facts. Saudi Compliance helps foreign founders sequence incorporation and market entry with the licence application; contact us to map the order for your model.
Sources
- Ministry of Investment (MISA)
- Ministry of Commerce
- ZATCA: Zakat, Tax and Customs Authority
- ZATCA: E-invoicing (Fatoora)
- GOSI: General Organization for Social Insurance
- HRSD: Ministry of Human Resources and Social Development
- Fintech Saudi: Meet the Regulators and office hours
- Insurance Authority: Home
- SAMA Rulebook: Law of Payments and Payment Services
- SAMA Rulebook: Implementing Regulations of the Law of Payments and Payment Services
- SAMA Rulebook: Guidelines to Apply for Payment Service Providers License
- SAMA Rulebook: Payments sector circulars
- SAMA Rulebook: Finance Companies Control Law Implementing Regulation (as amended)
- SAMA Rulebook: Rules Regulating Buy-Now-Pay-Later Companies
- SAMA Rulebook: Rules for Engaging in Debt-Based Crowdfunding
- SAMA Rulebook: Rules of Licensing Finance Support Activities
- SAMA Rulebook: Requirements for Appointments to Senior Positions (English)
- SAMA Rulebook: Requirements for Appointments to Senior Positions (Arabic, latest)
- SAMA Rulebook: Regulatory Sandbox Framework
- SAMA Rulebook: Regulatory Sandbox lifecycle
- SAMA Rulebook: Who can apply to the Regulatory Sandbox
- SAMA Rulebook: Sandbox exemptions and waivers
- SAMA Rulebook: Regulatory Sandbox FAQ
- SAMA: Enhanced Regulatory Sandbox e-service (news-1154)
- CMA: Capital Market Law
- CMA: Capital Market Institutions Regulations
- CMA: Securities Business Regulations
- CMA: Authorisation e-services
- CMA: Unified Business Sector Portal service card
- CMA: Draft amendments to the Capital Market Institutions Regulations (CMA_N_4054)
- CMA: FinTech Experimental Permit Instructions
- CMA: FinTech Lab
- CMA: Draft update to the FinTech Experimental Permit Instructions (CMA_N_4030)
- CMA: Debt crowdfunding framework approved (CMA_N_3862)
General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.