Saudi Arabia's financial regulators divide the market by product. The Saudi Central Bank (SAMA) licenses payments, e-money, open banking, BNPL, finance companies, money exchange and banks. The Capital Market Authority (CMA) licenses securities business, including equity and debt-instrument crowdfunding and robo-advisory, and the Insurance Authority licenses insurance. There is no Saudi licence for crypto exchanges or any other virtual asset service provider.
Around those three sit the bodies every fintech meets after licensing: SDAIA for personal data, the NCA and CST for cyber and cloud, the AML authorities, MISA and the Ministry of Commerce for set-up, ZATCA for tax and HRSD for Saudization. REGA runs the sandbox where real estate tokenization is piloted. For every licence guide, start at our licensing hub.
Saudi Arabia's financial regulators at a glance
| Regulator | Remit | Key licences and registrations | Official site |
|---|---|---|---|
| Saudi Central Bank (SAMA), البنك المركزي السعودي | Banks, payments, e-money, finance companies, money exchange | PI, EMI, AIS and PIS, BNPL, finance company, debt-based crowdfunding, aggregation, money changer, digital-only bank, sandbox | sama.gov.sa |
| Capital Market Authority (CMA), هيئة السوق المالية | Securities business, offerings, funds | Capital market institution licence; FinTech experimental permit | cma.gov.sa |
| Insurance Authority (IA), هيئة التأمين | Insurers and insurance service providers | Insurer and intermediary licences, Insurance Lab | ia.gov.sa |
| Real Estate General Authority (REGA), الهيئة العامة للعقار | Real estate sector | Sandbox Temporary Permit, real estate contribution licences | rega.gov.sa |
| Saudi Data & AI Authority (SDAIA), الهيئة السعودية للبيانات والذكاء الاصطناعي | Personal data protection | Controller registration | sdaia.gov.sa |
| National Cybersecurity Authority (NCA), الهيئة الوطنية للأمن السيبراني | National cyber controls | ECC and CCC compliance | nca.gov.sa |
| Communications, Space & Technology Commission (CST), هيئة الاتصالات والفضاء والتقنية | Telecoms and cloud | Cloud provider registration | cst.gov.sa |
| Permanent Committee for Combating Money Laundering, اللجنة الدائمة لمكافحة غسل الأموال, and SAFIU | AML policy; suspicious transaction reports | No licence; STR filing | aml.gov.sa |
| Ministry of Investment (MISA), وزارة الاستثمار | Foreign investment | Investment registration | misa.gov.sa |
| Ministry of Commerce, وزارة التجارة | Companies | Commercial registration, trade names | mc.gov.sa |
| Zakat, Tax and Customs Authority (ZATCA), هيئة الزكاة والضريبة والجمارك | Zakat, VAT, customs | VAT, e-invoicing | zatca.gov.sa |
| Ministry of Human Resources and Social Development (HRSD), وزارة الموارد البشرية والتنمية الاجتماعية | Labour, Saudization | Nitaqat compliance | hrsd.gov.sa |
| Fintech Saudi, فنتك السعودية | SAMA and CMA ecosystem initiative | None | fintechsaudi.sa |
| Dispute committees (banking and finance; securities) | Financial disputes | None | bfc.gov.sa, crsd.gov.sa |
SAMA licenses payments, lending, money exchange and banks
The Saudi Central Bank (SAMA, البنك المركزي السعودي) licenses any business that moves, stores or lends money outside the securities market. Its rules sit in the SAMA Rulebook, where the Arabic text prevails if versions differ.
Payments, e-wallets and open banking
The Law of Payments and Payment Services (Royal Decree M/26 dated 22/3/1443H) bars anyone from providing payment services in the Kingdom without a SAMA licence. Its Implementing Regulations of 13 June 2023 set the categories:
- Micro Payment Institution: average monthly payment value of SAR 10m or less, no services to people outside the Kingdom, SAR 1m capital.
- Major Payment Institution: above SAR 10m a month, SAR 3m capital.
- Micro Electronic Money Institution: e-wallets with average outstanding e-money and average monthly payment value each of SAR 10m or less, SAR 2m capital.
- Major Electronic Money Institution: above the micro limits, SAR 10m capital.
- Payment initiation (SAR 1m) and account information (SAR 500,000) licences for open banking.
Under the current licensing guidelines, applications go to SAMA by email, and SAMA decides within 90 calendar days of confirming a complete file. In-principle approval does not authorize activity; the applicant incorporates within 180 days and meets final conditions first. SAMA reported 33 licensed payment companies on 22 July 2026. See our payment institution and e-money licence guides.
SAMA released its Open Banking Framework for account information in November 2022 and for payment initiation in September 2024, then began licensing open banking fintechs on 26 March 2026. The licences announced in March, May and July 2026 were all for account information. See our open banking licence guide.
BNPL, finance companies and aggregation
Lending sits under the Finance Companies Control Law (Royal Decree M/51, 1433H, amended by Royal Decree M/272 in June 2024). Its Implementing Regulation, amended by Governor's Decision 179/MFC and circulated on 22 December 2025, sets capital by activity:
| Finance activity | Minimum paid-up capital |
|---|---|
| Real estate finance | SAR 200m |
| Other finance activities (consumer, SME, leasing, credit card) | SAR 100m |
| SME finance only | SAR 50m |
| Consumer microfinance only | SAR 20m |
| Consumer microfinance through fintech only | SAR 10m |
| Microfinance only | SAR 10m |
| Debt-based crowdfunding only | SAR 5m |
| BNPL only | SAR 5m |
BNPL companies must be joint stock companies. Since a SAMA circular of 24 December 2025, a consumer's outstanding BNPL balance can reach SAR 10,000 (older summaries still say SAR 5,000), over no more than 12 instalments. Like other finance companies, BNPL firms start at 50% Saudization and add 5% a year up to 75%. Debt-based crowdfunding platforms fund loans to Saudi-registered businesses and may not lend to consumers. See our BNPL and finance company guides.
Aggregation, which SAMA also calls digital intermediation, links customers with finance companies through an electronic platform for a fee. The Rules of Licensing Finance Support Activities (22 December 2025) set SAR 2m capital and a three-year licence. SAMA dropped the licensing requirement for debt collection on 28 December 2025, according to its finance sector circulars, and draft supply chain finance rules went to consultation on 26 August 2026. See our finance aggregation licence guide.
Money exchange, digital banks and the sandbox
Money changers are licensed under the Rules Regulating Money Changing Business (11 July 2020): SAR 2m capital for currency dealing, SAR 7m for importing and exporting cash. Money transfer under these rules is limited to firms that held a transfer licence in 2020, so new entrants cannot get one. In our reading, a new account-based remittance business would need a Major PI or EMI licence instead; confirm with SAMA. See our money exchange licence guide.
Digital-only banks are licensed under the Banking Control Law and SAMA's digital-only bank guidelines of 24 February 2020. The applicant must be a locally incorporated joint stock company. No minimum capital is published; SAMA sets it case by case from the ICAAP and ILAAP. The Council of Ministers grants the licence, and operations need a separate SAMA no-objection. EZ Bank, licensed in September 2025, has SAR 2.5bn of capital. See our digital bank licence guide.
The SAMA Regulatory Sandbox is for models existing rules do not cover; its FAQ says SAMA will not accept an application where a licensing path already exists. Applications are always open through eSAMA, which gained an enhanced sandbox e-service on 28 June 2026. Testing lasts 6 to 12 months. Fees and capital can be relaxed; AML, fit and proper and data protection rules are unlikely to be. See our SAMA regulatory sandbox guide.
Every SAMA licensee needs written non-objection for its board and senior managers. Under SAMA's senior positions requirements, the Chief Compliance Officer and the AML/CTF Director must be Saudi nationals. An outsourced MLRO therefore cannot fill either role. Our compliance function page explains the staffing.
The CMA licenses securities business, securities crowdfunding and robo-advisory
The Capital Market Authority (CMA, هيئة السوق المالية) regulates anything involving a security: shares, debt instruments, fund units and rights in them. Article 31 of the Capital Market Law (Royal Decree M/30 dated 2/6/1424H) requires a CMA licence for securities business in the Kingdom. The Securities Business Regulations presume that business with a person in the Kingdom is done in the Kingdom, which catches foreign apps marketing to Saudi residents. In March 2026 a person was convicted and fined SAR 250,000 for giving unlicensed investment advice on social media.
Capital market institution licences
CMA-licensed firms are capital market institutions (CMIs). The Capital Market Institutions Regulations, last amended by Resolution 2-3-2026, set capital by activity; fees come from the CMA's 2020 fee circular.
| Activity | Minimum paid-up capital (in force) | Study and annual fee |
|---|---|---|
| Dealing | SAR 50m | SAR 85,000 |
| Custody | SAR 50m | SAR 15,000 |
| Managing investments and operating funds | SAR 20m | SAR 60,000 |
| Managing investments only | One year of expected expenses | SAR 30,000 |
| Arranging | One year of expected expenses | SAR 20,000 |
| Advising | One year of expected expenses | SAR 20,000 |
Applicants must be established in the Kingdom with management and head office there; the regulations offer no branch route for foreign firms. Dealing, custody and managing need one of the forms set out in Article 6(f), such as a joint stock company or a subsidiary of a local bank, while arranging and advising may use any Saudi legal form. Applications go through the CMA's e-services portal after a trade-name reservation at the Ministry of Commerce. In May 2026 the CMA consulted on cutting dealing-as-agent capital to SAR 10m and custody to SAR 20m. Those proposals had not been adopted as of 11 October 2026, and the Capital Market Law still sets a SAR 50m floor for brokers. See our CMA licences overview and capital market institution licence guide.
FinTech Lab, crowdfunding and robo-advisory
The FinTech Experimental Permit (Resolution 1-4-2018, updated 2021) lets a firm test a securities-related product that no existing licence covers, for up to two years from commencement. At expiry the firm exits or applies for a full licence. The CMA's list of test companies showed 45 firms in July 2026. A draft update from April 2026 had not been adopted. See our CMA FinTech experimental permit guide.
Equity crowdfunding has been an arranging activity since September 2022: issuers can raise up to SAR 10m per 12 months, and retail investors can put in up to SAR 25,000 per offering. Debt-instrument crowdfunding followed in September 2025 under the same licence, with an issuer cap of SAR 20m (SAR 80m if asset-backed). See our crowdfunding licence guide.
Robo-advisory became a regulated service on 5 March 2026, available only to CMIs licensed for managing investments. The firm must register an IT Officer, notify the CMA of its strategies in advance and test algorithms at least 10 days before launch. See our robo-advisory licence guide.
The CMA has issued no regulation, consultation or Board resolution on crypto-assets, stablecoins, tokenization or security tokens, and its March 2026 Glossary defines none of them. Its definition of a security is technology-neutral, so in our reading a tokenized share or sukuk would still need a CMI licence to deal in. The CMA has not confirmed that reading.
SAMA vs CMA: what the customer ends up holding decides
If the customer ends up with money, a payment, a stored balance or a loan, SAMA licenses the business. If they end up with a security, the CMA does. Three areas cause most confusion:
- Crowdfunding splits three ways. Crowd-funded business loans are a SAMA debt-based crowdfunding licence; share offerings and debt-instrument offerings are a CMA arranging licence.
- Fund distribution can involve both. Under the CMA's Investment Funds Regulations, a SAMA-licensed e-money institution may distribute public fund units through its app, but the fund manager needs a CMA licence.
- The sandboxes are separate. SAMA's sandbox and the CMA FinTech Lab each take only products in their own remit.
The Insurance Authority took over insurance from SAMA
The Insurance Authority (IA, هيئة التأمين) was created by Council of Ministers Decision No. 85 dated 28/1/1445H. On 22 November 2023 SAMA's Governor congratulated it on commencing its duties, and the IA states it became the insurance regulator from 23 November 2023. The core law is still the Cooperative Insurance Companies Control Law (Royal Decree M/32, 1424H), and SAMA-era insurance rules apply until the IA replaces them.
An insurtech that distributes insurance will usually need IA licensing as an intermediary (law-firm summaries list brokers, agents and online aggregators), or a place in the IA's Insurance Lab sandbox, launched in September 2024. The insurance aggregation rules SAMA issued in 2020 remain on the SAMA Rulebook. A draft new Insurance Law was consulted on until July 2025, and we have found no evidence of its enactment. See our Insurance Authority licence guide.
REGA runs the proptech sandbox, including tokenization pilots
The Real Estate General Authority (REGA, الهيئة العامة للعقار) was established under Council of Ministers Resolution No. 239 dated 25/04/1438H. Its sandbox framework (2025 version) grants a time-limited Temporary Permit, with testing lasting 6 to 24 months.
The framework does not name tokenization, but REGA's second sandbox edition, launched in February 2026, was reported to include a fractional ownership and tokenization track. Tokenization pilots therefore run on a REGA sandbox permit, which the CMA does not issue. If a property token pays yield or carries investment rights, the CMA's securities rules may also apply. REGA separately licenses real estate contributions under the Law of Collective Real Estate Investment Schemes (Royal Decree M/203, 2023). Our real estate tokenization guide has the detail.
SDAIA, the NCA and CST set the data, cyber and cloud rules
The Saudi Data & AI Authority (SDAIA, الهيئة السعودية للبيانات والذكاء الاصطناعي) enforces the Personal Data Protection Law (Royal Decree M/19 dated 9/2/1443H), fully enforceable since 14 September 2024. The National Data Governance Platform handles controller registration, and breaches must be reported to SDAIA within 72 hours. Law firms report that draft amendments to the Implementing Regulations, open for comment until 5 November 2026, would make in-Kingdom storage the default and controller registration mandatory more widely. See our PDPL compliance guide.
The National Cybersecurity Authority (NCA, الهيئة الوطنية للأمن السيبراني) issues the Essential Cybersecurity Controls (ECC-2:2024) and Cloud Cybersecurity Controls (CCC-2:2024). The ECC binds government entities and operators of critical national infrastructure, and the CCC extends those controls to cloud providers and tenants. Most fintechs meet cyber duties through SAMA's Cyber Security Framework or CMA rules, but bank and government clients often ask for ECC alignment, and SAMA's digital-only bank guidelines require compliance with NCA rules.
The Communications, Space & Technology Commission (CST, هيئة الاتصالات والفضاء والتقنية) registers cloud providers under the Cloud Computing Services Provisioning Regulations (fourth version, in force since 10 October 2023), in a Qualifying Category and Classes A, B and C under its registration guide. Fintechs should buy from registered providers whose tier and data location fit their outsourcing approval. See our cybersecurity compliance guide.
AML: the Permanent Committee sets policy and SAFIU receives reports
The Anti-Money Laundering Law (Royal Decree M/20 dated 5/2/1439H), amended by Royal Decree M/223 in April 2026, and the counter-terrorist financing law (Royal Decree M/21 dated 12/2/1439H) apply to every licensee. Two national bodies sit above the sector regulators:
- The Permanent Committee for Combating Money Laundering (اللجنة الدائمة لمكافحة غسل الأموال) publishes the national risk assessment, guidance and mutual evaluation material on aml.gov.sa. Law-firm summaries say the 2026 amendment gives it a statutory role in setting national AML policy.
- SAFIU, the General Directorate of Financial Intelligence under the Presidency of State Security, receives and analyses suspicious transaction reports, which SAMA requires in SAFIU's approved form.
SAMA licensees follow SAMA's AML/CTF Guide and Targeted Financial Sanctions Rules (December 2025). The CMA rescinded its own AML rules in 2018, so CMA firms apply the national law directly. Our 2026 AML amendments guide covers the changes. Saudi Arabia is a FATF member whose last mutual evaluation was adopted in 2018; FATF's assessment calendar provisionally lists the next onsite visit for November or December 2026.
MISA, the Ministry of Commerce, ZATCA and HRSD handle set-up and operations
These bodies handle company set-up, tax and staffing, and a sector licence application depends on them. A foreign-owned fintech normally registers with MISA before obtaining a sector licence, and SAMA's sandbox requires accepted foreign innovators to register with MISA and the Ministry of Commerce.
| Body | What it handles | Main laws |
|---|---|---|
| MISA (وزارة الاستثمار) | Investment registration, which replaced the old MISA licence | Investment Law, Royal Decree M/19 (2024) |
| Ministry of Commerce (وزارة التجارة) | Commercial registration and trade names; since April 2025 the CR number is the unified national number | Companies Law M/132; Commercial Register Law M/83 |
| ZATCA (هيئة الزكاة والضريبة والجمارك) | VAT at 15% on explicit fees and commissions; e-invoicing Wave 25 integration due 1 February 2027 for revenue above SAR 187,500 | VAT Law; e-invoicing regulations |
| HRSD (وزارة الموارد البشرية والتنمية الاجتماعية) | Nitaqat quotas; a new phase runs from 16 April 2026, and Saudi staff count only with contracts documented on Qiwa | Labour Law; Nitaqat |
The ZATCA and HRSD details come from adviser summaries, so confirm current figures before relying on them. Sector Saudization applies on top of Nitaqat: SAMA's finance company, BNPL and aggregation rules start at 50%. The CMA sets no quota but requires registered persons to live in the Kingdom unless exempted. See our incorporation guide.
Fintech Saudi and the dispute committees
Fintech Saudi (فنتك السعودية) is a joint SAMA and CMA initiative that issues no licences. Its website offers office hours, 30-minute "Meet the Regulators" sessions with SAMA, the CMA and the Insurance Authority, a regulatory assessment tool and an accelerator. A Meet the Regulators slot is a cheap way to test a model before a formal pre-application meeting.
Banking and financing disputes go to SAMA's committees, whose General Secretariat runs bfc.gov.sa and launched a Banking and Financial Disputes Ombudsman Center. Securities disputes go to the Committee for Resolution of Securities Disputes (لجنة الفصل في منازعات الأوراق المالية), established under Article 25 of the Capital Market Law, with an appeal committee above it; its FAQ sets out the legal basis.
Which regulator do I need? A decision guide by business model
Who regulates fintech in Saudi Arabia depends on the activity the product performs. Use this table as a first cut.
| Business model | Regulator | Licence or route | Our guide |
|---|---|---|---|
| Payments app | SAMA | Micro or Major PI | Payment institution licence |
| Digital wallet | SAMA | Micro or Major EMI | E-money licence |
| Open banking (account data, payment initiation) | SAMA | AIS or PIS licence | Open banking licence |
| BNPL | SAMA | BNPL company, SAR 5m | BNPL licence |
| Lending marketplace matching borrowers with finance companies | SAMA | Finance aggregation, SAR 2m | Finance aggregation licence |
| Direct consumer or SME lending | SAMA | Finance company | Finance company licence |
| Crowd-funded business loans | SAMA | Debt-based crowdfunding, SAR 5m | Crowdfunding licence |
| Equity or debt-instrument crowdfunding | CMA | Arranging licence | Crowdfunding licence |
| Investment or trading app | CMA | Dealing, advising or managing licence | Capital market institution licence |
| Robo-advisor | CMA | Managing investments licence | Robo-advisory licence |
| New securities product with no licence fit | CMA | FinTech experimental permit | CMA FinTech permit |
| New payments or lending model with no licence fit | SAMA | Regulatory sandbox | SAMA regulatory sandbox |
| Currency exchange | SAMA | Money changer licence | Money exchange licence |
| Digital bank | SAMA and Council of Ministers | Digital-only bank licence | Digital bank licence |
| Insurtech | Insurance Authority | Intermediary licence or Insurance Lab | Insurance Authority licence |
| Proptech or property tokenization | REGA (CMA if securities features) | REGA sandbox Temporary Permit | Real estate tokenization |
| Crypto exchange, broker or custodian | None | No Saudi licence exists | Digital assets |
Combined models need combined permissions. In our reading, a BNPL provider that also holds customer balances in a wallet needs an EMI licence alongside its BNPL licence. A Micro PI cannot serve people outside the Kingdom, so a cross-border plan points to a Major licence from the start.
Crypto in Saudi Arabia: no licence exists
Saudi Arabia has no licensing regime for virtual asset service providers. No SAMA or CMA rulebook, consultation or licence category covers crypto exchanges, brokers or custodians, and there is no payment institution licence with a crypto endorsement.
The official position dates from 2018. In February 2018 the CMA warned that digital currencies and ICOs carry high risk and fall outside Saudi regulatory protection. On 12 August 2018 a standing committee chaired by the CMA, with SAMA as a member, said virtual currencies including Bitcoin "are not approved as official currencies in the kingdom and no parties or individuals are licensed for such practices". Both SAMA and the CMA still publish that statement.
FATF's Seventh Targeted Update on virtual assets and VASPs (July 2026) lists Saudi Arabia in its Annex A table as having explicitly prohibited virtual assets and VASPs, with the licensing, supervision and Travel Rule entries marked not applicable. In practice:
- A crypto exchange, brokerage or custody business serving Saudi residents has no licence route, and a foreign licence does not passport in.
- Payment flows to and from crypto platforms remain payment services under the Payments Law, and a PI or EMI licence does not authorize crypto activity.
- Press reports in late 2025 quoted officials saying work had begun with the CMA and SAMA on regulated stablecoins, but no rulebook has been published.
Our digital assets page explains how to test where a product sits against this perimeter.
Settle the licence and the sandbox question first
Before anything else, a founder needs to know which licence the model needs and whether a sandbox or experimental permit would be faster. Saudi Compliance is an independent advisory firm, not affiliated with any regulator, that helps fintechs with licence selection, incorporation and the compliance function behind an application. Begin with our licensing overview or contact us.
Sources
- SAMA: Saudi Central Bank website
- SAMA Rulebook: All financial institutions
- SAMA Rulebook: Law of Payments and Payment Services
- SAMA Rulebook: Implementing Regulations of the Law of Payments and Payment Services
- SAMA Rulebook: Guidelines to Apply for Payment Service Providers License
- SAMA: 33 licensed payment companies (22 July 2026)
- SAMA: Open Banking Framework release (2 November 2022)
- SAMA: Open Banking Framework payment initiation release (September 2024)
- SAMA: SAMA commences open banking licensing (26 March 2026)
- SAMA Rulebook: Finance Companies Control Law
- SAMA Rulebook: Implementing Regulation of the Finance Companies Control Law
- SAMA Rulebook: Rules Regulating Buy-Now-Pay-Later (BNPL) Companies
- SAMA Rulebook: Rules for Engaging in Debt-Based Crowdfunding
- SAMA Rulebook: Rules of Licensing Finance Support Activities
- SAMA Rulebook: Finance sector circulars
- SAMA: Draft Rules for Engaging in Supply Chain Finance consultation (26 August 2026)
- SAMA Rulebook: Rules Regulating Money Changing Business
- SAMA Rulebook: Banking Control Law
- SAMA Rulebook: Additional Licensing Guidelines and Criteria for Digital-Only Banks
- SAMA: EZ Bank digital bank licence (30 September 2025)
- SAMA Rulebook: Regulatory Sandbox Framework
- SAMA Rulebook: Regulatory Sandbox FAQ
- SAMA: Enhanced Regulatory Sandbox e-service (28 June 2026)
- SAMA Rulebook: Requirements for Appointments to Senior Positions (Arabic)
- SAMA Rulebook: Anti-Money Laundering Law
- SAMA Rulebook: Guidance on Anti-Money Laundering and Combating Terrorist Financing
- SAMA Rulebook: Rules for the Implementation of Targeted Financial Sanctions
- SAMA: Governor congratulates the Insurance Authority on commencing its duties (22 November 2023)
- SAMA Rulebook: Rules Governing Insurance Aggregation Activities
- SAMA: Banking and Financial Disputes Ombudsman Center
- SAMA: Virtual currencies are not regulated in the Kingdom (12 August 2018)
- CMA: Capital Market Authority website
- CMA: Capital Market Law
- CMA: Securities Business Regulations
- CMA: Capital Market Institutions Regulations (amended by Resolution 2-3-2026)
- CMA: Fee circular (27 October 2020, Arabic)
- CMA: Authorisation e-services
- CMA: Draft amendments to the Capital Market Institutions Regulations consultation (May 2026)
- CMA: Unlicensed social media advisory conviction (March 2026)
- CMA: Financial Technology Experimental Permit Instructions
- CMA: Authorized FinTech test companies
- CMA: Draft update to the FinTech Experimental Permit Instructions (April 2026)
- CMA: Equity crowdfunding framework approved (September 2022)
- CMA: Debt-instrument crowdfunding approved (September 2025)
- CMA: Robo-advisory framework approved (March 2026)
- CMA: Glossary of Defined Terms (March 2026)
- CMA: Investment Funds Regulations (2025)
- CMA: AML/CTF Rules rescinded (November 2018)
- CMA: Warning on digital currencies (February 2018)
- CMA: Virtual currencies are not regulated in the Kingdom (August 2018)
- Insurance Authority: Website
- Insurance Authority: Insurance Regulatory Sandbox Framework (Insurance Lab)
- REGA: Website
- REGA: Regulatory Framework for Experimental Regulatory Environment (2025)
- REGA: Law of Collective Real Estate Investment Schemes
- SDAIA: Website
- SDAIA: National Data Governance Platform
- NCA: Website
- NCA: Essential Cybersecurity Controls (ECC-2:2024)
- NCA: Cloud Cybersecurity Controls (CCC-2:2024)
- CST: Website
- CST: Cloud computing guide (Decision 506/1445)
- CST: Cloud registration guide, Qualifying Category
- Anti-Money Laundering Permanent Committee: Website
- Anti-Money Laundering Permanent Committee: Law on Combating Terrorism and its Financing
- Umm Al-Qura: Royal Decree M/223 amending the Anti-Money Laundering Law
- FATF: Saudi Arabia country page
- FATF: Seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets/VASPs (July 2026)
- Ministry of Investment: Website
- Ministry of Commerce: Website
- ZATCA: Website
- ZATCA: E-invoicing (Fatoora)
- HRSD: Website
- Fintech Saudi: Website
- Banking and Finance Disputes Committees: General Secretariat
- CRSD: Committee for Resolution of Securities Disputes
- CRSD: FAQs
General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.