Every fintech licence in Saudi Arabia, mapped

Which regulator licenses what

SAMA licenses most fintech activity under five sets of rules. The Law of Payments and Payment Services (Royal Decree M/26) and its Implementing Regulations of June 2023 cover payment institutions, e-money institutions, open banking providers and payment system operators. Article 4 of that law says no person may provide payment services or operate a payment system in the Kingdom without a SAMA licence, and Article 5 lets SAMA decide when a firm based abroad is treated as providing services in the Kingdom.

The Finance Companies Control Law (Royal Decree M/51, amended by M/272 in June 2024) covers lending: real estate, SME, consumer, leasing, credit card and microfinance, plus BNPL, debt-based crowdfunding and finance support activities such as aggregation. Its Implementing Regulation was replaced by Governor's Decision 179/MFC of 23 October 2025, circulated on 22 December 2025, which reset the capital tiers. Money exchange sits under the Rules Regulating Money Changing Business (2020), credit bureaus under the Credit Information Law, and banks, including digital-only banks, under the Banking Control Law.

Securities business, including investment platforms, equity crowdfunding and robo-advice, belongs to the CMA. Insurance left SAMA's remit when the Council of Ministers established the Insurance Authority by Decision No. 85 (28/1/1445H); SAMA's Governor congratulated the Authority on commencing its duties in November 2023. See the Insurance Authority licence page for that route.

SAMA licences: capital, fees and status

Capital: Payments Implementing Regulations Art 44 to 45; FCCL Implementing Regulation as amended by Governor's Decision 179/MFC (2025) Art 8; Rules of Licensing Finance Support Activities Art 6; Money Changing Rules Art 7; Credit Information Law Implementing Regulations Art 3. Fees: Payments IR Art 23; FCCL IR Art 24; Money Changing fee regulation. SAMA may set higher or lower capital for finance companies. The Arabic text of the SAMA Rulebook prevails over the English.

CMA licences and permits

Capital figures are those in force under the Capital Market Institutions Regulations. A CMA consultation in May 2026 proposed lower capital for several activities; it had not been adopted at the time of review, so plan on the figures above.

How long SAMA takes to decide

The clock starts when SAMA confirms the file is complete, so an incomplete submission adds time before any of these periods run.

What the fees and guarantees look like

Issue fees run from SAR 5,000 for BNPL and debt crowdfunding to SAR 200,000 for a standard finance company. Payment and e-money licences cost SAR 20,000 for Micro categories and the two open banking licences, and SAR 50,000 for Major categories. Renewals are cheaper where the rules set them: SAR 100,000 for a finance company (SAR 50,000 to amend), SAR 2,000 for BNPL and debt crowdfunding, SAR 5,000 or SAR 10,000 for money exchange, and 0.5% of paid-up capital for a credit bureau. Fees are paid at the licensing stage, before the licence issues.

The bank guarantee is where the published texts disagree. Article 8 of the Payments Implementing Regulations asks for an irrevocable bank guarantee equal to the required minimum capital, while the current PSP Licensing Guidelines (Appendix A, item 9) ask for 20% of it. The BNPL, debt crowdfunding and finance support rules have the same split: the rules say the full capital for a company under establishment, and the later guidelines and the amended FCCL Implementing Regulation say 20%. The later documents point to 20%, but neither text has been withdrawn, so ask SAMA which figure applies and budget for both until it does. Money exchange is the exception, with a guarantee equal to the capital.

The people SAMA approves

Every SAMA regime runs through the Requirements for Appointments to Senior Positions. Article 4 reserves certain roles for Saudi nationals, including the Chief Compliance Officer, the AML/CTF Director, the HR Director, the IT Director and the Information or Cyber Security Director. Board members, the CEO and other senior roles need SAMA's written non-objection before they act or are announced. An outsourced MLRO cannot stand in for the Saudi-national CCO or AML/CTF Director at a SAMA licensee.

The English rulebook page for these requirements says it is not the latest version, and the Arabic text prevails. Work from the Arabic version (linked in the sources below) when you plan appointments. Saudization targets vary: finance companies, BNPL and debt crowdfunding firms start at 50% Saudi staff and add 5% a year until 75%; aggregation companies need at least 50% at start; the Payments Implementing Regulations set no fixed percentage, though the business plan must show the planned share of non-Saudi staff by department and level. See building the compliance function.

How a SAMA application runs

1. Map the activity to a licence

   Match each product flow to the regulated activities: the payment services listed in Article 6 of the Payments Implementing Regulations, the finance activities in Article 10 of the FCCL, or money exchange. Check the exclusions too; licensed banks, for example, are exempt from payment licensing.

2. Fix the legal form and capital

   Major payment institutions and all e-money institutions must be joint stock companies; a Micro payment institution may be a JSC, simplified JSC or LLC. BNPL and debt crowdfunding companies are JSCs. Capital for finance companies must be paid in full at incorporation. See incorporation.

3. Build the file

   Business plan (three years for payments, five for finance companies), feasibility study, draft articles, organisation chart, shareholder list, fit and proper forms for owners and senior roles, the bank guarantee, and draft policies for AML/CTF, business continuity, cyber security, data protection, consumer protection, fraud and, for payments, safeguarding.

4. Submit and answer questions

   Payment and finance applications go by email to NBFI-LIC@SAMA.GOV.SA. SAMA confirms when the file is complete and the decision period starts; additional information is due within the deadline for your regime.

5. Approval in principle and set-up

   An approval in principle for payments does not authorise you to operate (Art 15). Incorporate, pay up capital, appoint senior staff with SAMA's non-objection, obtain an LEI where the FCCL rules require one, and host SAMA's licensing visit.

6. Licence and public register

   Pay the fee, receive the licence and appear on SAMA's public register. Renewal is due at least six months before expiry for payment and finance licences, and three months for BNPL, debt crowdfunding and aggregation under their own rules.

After the licence: fundraising and control changes

Licensing is the start of supervision. Payment licensees must keep a register of controllers and notify SAMA of changes in control (Payments IR Articles 40 to 41), and since circular 472056382 of 18 May 2026 payment and finance licensees must notify SAMA before conducting an investment round. Founders planning a raise in the first year should build that notice into the timetable. Finance companies also need SAMA's no-objection before offering shares in the capital market.

Common questions