How to Apply for a SAMA Payment Licence: Steps and Timeline

Saudi Compliance editorial teamPublished: 2026-10-11Updated: 2026-10-1115 min read

To get a SAMA payment licence, match each product flow to a licence category under the Payments Implementing Regulations. Then plan the legal form and capital that category requires, from SAR 1 million for a Micro payment institution to SAR 10 million for a Major e-money institution, and email an in-principle application to SAMA. SAMA decides within 90 calendar days of confirming the file is complete, or tells you a revised timeline. You then have 180 days to incorporate before the final licensing stage.

The rules are the Law of Payments and Payment Services (Royal Decree M/26 dated 22/03/1443H) and its Implementing Regulations of 13 June 2023, which repealed SAMA's January 2020 PSP framework. SAMA said on 22 July 2026 that 33 licensed companies offer payment services in Saudi Arabia, up from 28 in November 2025. For how SAMA's remit sits next to the CMA's, see our guide to Saudi financial regulators; for every licence route in one table, see SAMA and CMA licences.

Any payment service in the Kingdom needs a SAMA licence

Article 4 of the Payments Law says no person may provide payment services or operate a payment system in the Kingdom without a SAMA licence. Article 5 lets SAMA decide when a person based abroad counts as providing payment services within the Kingdom, so a foreign wallet or acquirer with Saudi users should settle its position before launch.

Article 6 of the Implementing Regulations lists the regulated services, from placing funds on a payment account and executing transfers to issuing payment instruments, acquiring, payment aggregation, issuing e-money, payment initiation and account information. Article 7 sets out 17 exclusions, including cash-only payments, commercial agents, technical service providers, limited-network instruments, intra-group payments, finance company activity and cash-based money remittance. Licensed banks are exempt (Article 48). Limited network providers register with SAMA instead, and must notify it if transactions pass SAR 5 million in 12 months or SAR 2 million in any month, when SAMA may require a licence. Settle the exclusion analysis in writing first, because it decides whether you need a licence at all.

Which licence category fits your model

The Implementing Regulations create four payment and e-money categories, two open banking licence types and a licence for payment system operators.

Your model	Licence category	Main limits
Domestic payments, acquiring or aggregation at modest volume	Micro payment institution (PI)	No e-money; average monthly payment value SAR 10m or less; no services to persons outside the Kingdom
Payment services above the Micro limits	Major payment institution	No e-money; average monthly payment value above SAR 10m
Small e-wallet or stored-value product	Micro e-money institution (EMI)	Average outstanding e-money and monthly payment value each SAR 10m or less; SAR 20,000 per user held and per user per month
Larger e-wallet	Major EMI	Exceeds any Micro EMI limit; SAR 100,000 per user held and per user per month
Payment initiation (open banking)	PIS licence	Must never hold client funds or alter a transaction (Art 97); professional indemnity insurance or a comparable guarantee (Art 46)
Account information (open banking)	AIS licence	Professional indemnity insurance or a comparable guarantee (Art 46)
Operating a payment system	Payment system operator	Capital and licence term set case by case

Source: Implementing Regulations, Articles 42 to 46 and 97. SAMA may raise the per-user e-money limits on application.

Payment institution or e-money institution

The payment institution categories exclude e-money issuance, so a wallet that holds customer balances needs an e-money institution licence. A Micro EMI becomes Major as soon as it passes any one Micro limit, and for a consumer wallet the SAR 20,000 per-user holding cap can be the first to bite.

Micro is a domestic category. A remittance corridor, a payout product for people abroad or a merchant base outside Saudi Arabia rules it out. The regulations define a Major PI by volume above SAR 10 million a month, so a low-volume business that needs cross-border services should confirm its category with SAMA before filing. The payment institution licence page covers the Micro and Major choice in more detail.

Remittance, open banking and payment system operators

SAMA issues no new money-transfer licences under its money changing rules; only firms licensed when those rules were issued in 2020 may transfer money. Account-based transfers, including cross-border transfers from payment accounts, are Article 6 payment services. On our reading they are open to Major payment institutions and e-money institutions, and closed to Micro payment institutions.

On the official texts, open banking providers are licensed under the payments licence types; we found no separate open banking framework with its own capital or fees. SAMA began licensing them on 26 March 2026, and the licences it had announced by 11 October 2026 were all for account information. See the open banking licence page.

Payment system operators are the least documented route. Capital matches the system's size and complexity (Article 44(2)), the term is case by case (Article 17(2)), and SAMA's Oversight Framework on Payment Systems and their Operators (circular 472047719, 8 March 2026) is in Arabic only. We did not find the legal form, fees or process for operators in the English texts, and whether an international card scheme needs an operator licence depends on SAMA's determination under Article 5. Ask SAMA directly.

Capital, fees and legal form for each category

Category	Initial capital (Art 44)	Ongoing capital (Art 45)	Legal form (Art 14)	Issue fee (Art 23)
Micro PI	SAR 1,000,000	The initial amount	JSC, simplified JSC or LLC	SAR 20,000
Major PI	SAR 3,000,000	Higher of SAR 3m or 1% of average monthly payment value	Joint stock company	SAR 50,000
Micro EMI	SAR 2,000,000	The initial amount	Joint stock company	SAR 20,000
Major EMI	SAR 10,000,000	Higher of SAR 10m or 2% of average outstanding e-money	Joint stock company	SAR 50,000
PIS (alone or with AIS)	SAR 1,000,000	Not stated in the texts reviewed	Not stated; confirm with SAMA	SAR 20,000
AIS	SAR 500,000	Not stated in the texts reviewed	Not stated; confirm with SAMA	SAR 20,000
Payment system operator	Case by case	Case by case	Not published	Not published

Licences run for up to five years, with renewal due at least six months before expiry (Article 17). The SAMA Rulebook says the Arabic text prevails, so check figures against it before they go into a board paper.

Ongoing capital for the Major categories rises with volume. A Major PI needs more than its SAR 3 million floor once average monthly payment value passes SAR 300 million, and a Major EMI needs more than SAR 10 million once average outstanding e-money passes SAR 500 million.

Only a Micro PI may be an LLC or simplified JSC, so a Micro PI that grows into the Major category faces a change of legal form as well as more capital. Commercial registration and articles at the Ministry of Commerce must be completed within 180 days of approval in principle; see incorporation.

The bank guarantee: 100% or 20% of capital

The published texts conflict on the bank guarantee filed with the application, and we have not seen SAMA resolve it. Article 8 of the Implementing Regulations asks for an irrevocable guarantee equal to the required minimum capital. The current Licensing Guidelines (Appendix A, item 9) ask for 20%. For a Major PI that is SAR 3 million against SAR 600,000; for a Major EMI, SAR 10 million against SAR 2 million. Neither text has been withdrawn, so ask SAMA which figure applies before you approach your bank, and budget for both until you have an answer.

The senior positions SAMA must approve

SAMA's Requirements for Appointments to Senior Positions apply to payment and fintech companies. Article 4 reserves certain posts for Saudi nationals, including the Chief Compliance Officer, the AML/CTF Director, the HR Director, the IT Director and the Information or Cyber Security Director. Appendix 6 lists the posts at payment and fintech companies that need SAMA's written non-objection: board and committee members, the CEO and deputy, CFO, CRO, Head of Internal Audit, CCO, AML/CTF Director, the other named directors and any executive reporting directly to the CEO.

A candidate may not act or be announced before SAMA's non-objection (Article 8).
Interim appointments over 20 business days need non-objection and last up to six months, renewable once (Article 9).
Saudi candidates have priority, and a non-Saudi nomination must be justified (Article 3).
SAMA must be notified within five days of a start or departure, and non-objection requests go through the eSAMA portal.

The English rulebook page says it is not the latest version, so work from the Arabic. An outsourced MLRO cannot replace the Saudi-national CCO or AML/CTF Director at a SAMA licensee; our guide on outsourcing the MLRO in Saudi Arabia explains what outside providers can do.

We found no fixed Saudization percentage in the Implementing Regulations and have not confirmed whether a separate ratio applies to payment companies. Article 29 requires enough qualified staff and compliance with the rules on non-Saudi employment, and the business plan must show the planned share of non-Saudi staff by department and level.

How to apply for a SAMA payment licence, step by step

Map each product flow to the Article 6 services and Article 7 exclusions, and choose the category.
Work from the current Guidelines to Apply for Payment Service Providers License; the older guidelines are marked "No longer applicable".
Complete SAMA's License Application Form and the Fit and Proper Form for shareholders, board and committee members, and every senior position.
Email the in-principle file to NBFI-LIC@SAMA.GOV.SA, with enquiries to NBFI-LIC-INFO@SAMA.GOV.SA (Guidelines section 5).
SAMA confirms when the file is complete (Article 11(1)). Answer any request for more information within 30 calendar days (Article 11(2)).
SAMA decides within 90 calendar days of the completeness notice, or notifies a revised timeline (Article 11(4) to (5)).
Incorporate within 180 days of approval in principle (Article 14(3)). The approval lasts up to one year, extendable by 180 days, and does not authorise you to operate (Article 15).
Meet the final requirements and pay the fee before the licence issues (Article 23). SAMA enters you in its public online register (Article 16).

SAMA's eSAMA portal handles sandbox applications, open banking access requests and senior-position non-objection requests. We found no official statement that payment licence applications have moved onto it, and the guidelines still name email.

What goes in the in-principle file

Appendix A of the Guidelines lists the documents:

the application form, a board resolution, draft articles and an organisation chart
a shareholder list and fit and proper forms for shareholders, senior positions, and board and committee members
a feasibility study and a three-year business plan with an ICAAP, a liquidity assessment and a Saudization and recruitment plan
the bank guarantee
draft policies on AML/CTF, business continuity, data protection, cyber security, consumer protection, fraud, settlement, account opening and risk-based limits
a safeguarding policy with the safeguarding bank agreement
key contracts, the business continuity plan, the IT architecture and, where applicable, three years of audited accounts

How long a SAMA payment licence takes

Stage	Time limit	Source
Preparing the file	No regulatory deadline; set by your hiring, bank and policy work	n/a
Completeness check	No fixed period stated in the texts reviewed	Art 11(1)
Answering SAMA's questions	30 calendar days from each request	Art 11(2)
SAMA's decision	90 calendar days from the completeness notice, or a revised timeline SAMA notifies	Art 11(4) to (5)
Approval in principle	Valid up to 1 year, extendable by 180 days	Art 15
Incorporation	Within 180 days of approval in principle	Art 14(3)
Licensing stage	No fixed period stated; fee paid before the licence issues	Art 23

The 90-day clock starts when SAMA confirms the file is complete, so an incomplete submission adds time before it runs. Because preparation, completeness and the licensing stage have no fixed length in the texts, any total you are quoted is an estimate. Have shareholders, capital and incorporation documents ready before the decision arrives, since the 180-day window starts with it.

The sandbox is an alternative only for models no licence covers

SAMA's Regulatory Sandbox FAQ says that where a licensing path already exists, sandbox applications are not accepted. A standard payment, acquiring or wallet business applies for the licence directly.

For a genuinely new model, the sandbox is always open and applications go through eSAMA, where SAMA launched an enhanced sandbox e-service on 28 June 2026. Licensed firms and unlicensed local or international fintechs can apply, directly or through a licensed partner; a direct international applicant registers with the Ministry of Investment and the Ministry of Commerce after acceptance. The application stage takes 60 days and ends in a No Objection Letter, operational readiness takes 120 days and ends in a Letter of Acceptance, and live testing runs 6 to 12 months. SAMA expects the licence application to start after month 6 and by month 9.

SAMA can relax licence fees, capital and liquidity, board composition and non-mandatory guidelines. It is unlikely to relax AML/CFT, fitness and propriety, consumer data protection, disclosures, cyber security or the laws themselves. Open banking providers tested this way before SAMA began licensing them. See the SAMA regulatory sandbox page.

What you must do once you are licensed

Client funds must be safeguarded from receipt; the payment institution licence page sets out the segregated-account rule.

Article 36 requires a risk-based AML/CTF programme, written to the AML Law (Royal Decree M/20), the CTF Law (Royal Decree M/21) and SAMA's AML/CTF Guide. The AML Law was amended by Royal Decree M/223, published in April 2026, so check the programme against the amended text; our guide to the 2026 AML Law amendments covers the changes. SAMA's Rules for the Implementation of Targeted Financial Sanctions (7 December 2025) govern sanctions screening. See building the compliance function.

The payment institution licence page lists the main recurring obligations. Four more are easy to miss:

a controller register and change-in-control notices (Articles 40 to 41)
SAMA's consumer protection principles (Article 50)
beneficial ownership checks through the Wathq service (circular 472047799, 9 March 2026)
integration with the Security Council Resolutions Notification System (circular 482028988, 1 October 2026)

Common reasons applications stall

We found no SAMA publication on why payment licence files are delayed or refused, so these points come from the requirements themselves. Each is a place where a file can fall short, and the decision period does not start until the file is complete.

The category does not fit the model, such as a Micro PI plan with cross-border flows or an e-money business planned as an LLC.
No Saudi-national candidates for the CCO and AML/CTF Director posts, missing fit and proper forms, or a hire who acts before non-objection.
The safeguarding bank agreement is not signed.
The bank guarantee is issued before SAMA confirms whether it should be 100% or 20% of minimum capital.
The business plan lacks the ICAAP, liquidity assessment or Saudization and recruitment plan.
Policies are generic and do not match the actual product flows.
Answers to SAMA's questions miss the 30-day deadline.
The team works from outdated texts: the repealed 2020 framework, the superseded guidelines, or the English senior positions page.
A standard payments model is sent to the sandbox.
Incorporation is not completed within 180 days of approval in principle.

Planning your application

Work in this order: confirm the category and legal form, open talks with the safeguarding bank, confirm the guarantee amount with SAMA, shortlist Saudi-national candidates for the CCO and AML/CTF Director posts, then write the business plan and policies around the real product flows. Saudi Compliance prepares payment and e-money licence files for founders entering the Kingdom; to talk through your model, get in touch.

Sources

General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.