The rules behind the licence
The licence rests on the Capital Market Law (Royal Decree M/30, 1424H), Articles 31 to 33, and the Securities Business Regulations, which define the five activities in Article 2 (new text in force since 1 January 2022). The detailed licensing rules are in the Capital Market Institutions Regulations (CMIR), first issued in 2005.
The CMA's website carries two English copies of the CMIR at different amendment levels. The current text, amended by Board Resolution 2-3-2026 of 7 January 2026, is the file ending "Regulations-en.pdf". The copy ending "Regulations_en.pdf" still shows the September 2025 amendment. Work from the 2026 text.
Each activity: scope, capital and fee
| Activity | Scope | Minimum capital (in force) | Study fee and annual renewal (SAR) |
|---|---|---|---|
| Dealing | Dealing in a security as principal or agent, including buying, selling, managing subscriptions and underwriting | SAR 50 million | 85,000 |
| Managing investments and operating funds | Discretionary management of securities and operating investment funds | SAR 20 million | 60,000 |
| Managing investments | Discretionary management of securities without operating funds | One year of expected expenses | 30,000 |
| Arranging | Introducing parties for offerings or underwriting, advising on corporate finance, and securities crowdfunding | One year of expected expenses | 20,000 |
| Advising | Advice on a security, including financial planning and wealth management | One year of expected expenses | 20,000 |
| Custody | Safeguarding assets that include a security, and the related administration | SAR 50 million | 15,000 |
Capital: CMIR Art 6(g). Fees: CMA circular of 27 October 2020 (Arabic only; amounts not confirmed as current). A May 2026 draft would lower dealing and custody capital; it is not in force.
Choosing the activities
Most fintech and wealth businesses fit a narrow set. A digital advice tool that recommends securities is Advising. A platform that runs discretionary portfolios, including robo-advisory, is Managing. A crowdfunding platform or a corporate finance boutique is Arranging. A brokerage app is Dealing, and holding client securities is Custody. The draft capital table and the full route map are on the CMA licences hub.
The choice has knock-on effects. Dealing, custody and managing require one of the restricted legal forms below and, for dealing and custody, SAR 50 million of paid-up capital. Arranging and advising accept any Saudi legal form and capital equal to a year of expected expenses. Firms limited to managing investments, arranging or advising also get lighter document and staffing rules, covered further down.
Client money is the other decision. An arranging CMI may hold securities crowdfunding client money itself within caps; otherwise client money is held through a custody-licensed CMI. See crowdfunding.
Legal form for dealing, custody and managing (CMIR Art 6(f))
- A subsidiary of a local bank.
- A joint stock company.
- A subsidiary of a Saudi joint stock company engaged in financial services.
- A fourth option in the CMA's English text covers subsidiaries of certain foreign financial institutions licensed under the Banking Control Law. The English is an unofficial translation, so check the Arabic before relying on it.
- In every case the applicant must be established in the Kingdom, with its management and head office in the Kingdom (Art 6(h)). There is no branch route.
What goes into the file
- The Authorisation Application, with the attachments listed in Annex 3.1 of the CMIR. Annex 3.1 covers both authorisation documents and commencement-of-business documents.
- Evidence for the Art 6(e) fit-and-proper test: adequate expertise and resources, management, systems, risk management and technology, and a qualified board and staff.
- A trade-name reservation from the Ministry of Commerce.
- Proof of payment of the study fee for each activity applied for.
- A Registration Application for each registrable function.
- Firms limited to managing investments, arranging or advising are excused some Annex 3.1 items. Robo-advisory applicants get a narrower exemption.
Application stages
Prepare
Read the Capital Market Law, the implementing regulations and the CMA circulars that apply to your activities, then build the Annex 3.1 file. Foreign shareholders need the Saudi entity in place; see incorporation.
File on the portal
Applications go through the Authorisation System on the CMA's Unified Business Sector Portal (eservices.cma.gov.sa), which also handles licence variations and registration of registrable functions. The CMA's service card gives 0 to 60 business days, varying by service.
Review and information requests
The CMA may ask for more information and may refuse the application if it is not provided within 30 days (Art 7). Quick, complete answers keep the file moving.
Licence resolution
The CMA Board issues a licence resolution. The firm cannot start business on the resolution alone.
Commencement of business
The firm completes the commencement-of-business requirements. The CMA then publishes a second announcement that the firm is licensed and has completed those requirements.
Registered persons and minimum staffing
Every CMI must have a registered CEO, CFO, Compliance Officer and MLRO at all times, plus a registered IT Officer if it offers robo-advisory (Art 20(b)). Other registrable functions include board members and partners, senior managers linked to securities business, and client-facing staff such as investment advisers, portfolio managers and brokerage professionals. The CEO, CFO and Compliance Officer must be different people unless the CMA approves otherwise, and the Compliance Officer may not carry out a client function.
Smaller licences can run lean. A CMI limited to managing investments or arranging needs at least two registered persons, one of them the CEO; an advising-only CMI needs one registered CEO, with other functions outsourced (Art 20(f)). Managing licensees need at least two registered portfolio managers (Art 20(g)). Firms limited to managing investments, arranging or advising may outsource the CFO function to a SOCPA-licensed accounting firm, and the Compliance Officer or MLRO function to another CMI, a SOCPA-licensed accounting firm or a Saudi law firm. The individuals assigned must still pass the CMA exams or hold an exemption.
Registered persons must be resident in the Kingdom unless exempted (Art 24(b)) and must pass the CMA qualification exams: CME-1A and CME-1B for general functions, CME-3A and 3B for brokers, CME-4A and 4B for managing, CME-5A and 5B for corporate finance, and CME-1B, 2A and 2B for the compliance and AML/CTF route.
Obligations once licensed
- Renew each activity every year: the renewal fee is due by 30 June, and renewal depends on continuing fitness, financial adequacy and minimum capital.
- Meet ongoing capital adequacy under the CMA Prudential Rules, which sit alongside the entry capital in Art 6(g).
- Keep the CEO, CFO, Compliance Officer and MLRO (and IT Officer where required) registered at all times, and file registration changes through the portal.
- Make or approve every securities advertisement aimed at people in the Kingdom (SBR Art 17).
- Run KYC and account opening under the Investment Accounts Instructions, most recently amended on 6 January 2026, and the KYC forms in the CMIR annexes.
- Comply with the AML Law and counter-terrorist financing law directly; the CMA's own AML rules were rescinded in 2018. See the compliance function.
- Follow the client money rules, including the client-money returns under Art 77 amended in 2024. Breaches of the Securities Business Regulations are offences under Article 60 of the Capital Market Law.
Common questions
Can a limited liability company hold a CMI licence?
Yes for arranging or advising, which accept any legal form established in the Kingdom. Dealing, custody and managing require one of the forms in Art 6(f), such as a joint stock company or a subsidiary of a local bank.
Can we outsource the Compliance Officer and MLRO?
Only if your activities are limited to managing investments, arranging or advising. The functions can then go to another CMI, a SOCPA-licensed accounting firm or a Saudi law firm, and the people doing the work must pass the CMA exams or hold an exemption.
How many CMIs are licensed?
The CMA said there were 215 capital market institutions in the fourth quarter of 2025, up from 86 in 2017.
Can we add an activity later?
Yes. The CMA portal handles licence variations as well as new applications. Fees and renewals are charged per activity, and the capital and legal form required for the new activity must be in place before it is added.
Primary sources
Last reviewed: 11 October 2026
General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.
