Who needs a CMA licence
Article 31 of the Capital Market Law says no person may carry on securities business in the Kingdom, or claim to, without a CMA licence. That holds even when the security is listed or traded on a foreign regulated market. The Securities Business Regulations add that only a CMA-authorised capital market institution (CMI) or an exempt person may carry on securities business.
The perimeter reaches firms based abroad. Under Article 4 of the Securities Business Regulations, activity carried on with or for a person in the Kingdom is presumed to be carried on in the Kingdom, and securities advertisements aimed at people in Saudi Arabia, online ones included, must be made or approved by a CMI.
The CMA prosecutes unlicensed activity. In March 2026 a person was convicted and fined SAR 250,000 for providing advisory services on social media without a licence.
Four routes for fintech and investment firms
FinTech Experimental Permit
A time-limited permit to test a new securities-related product with real clients through the CMA FinTech Lab, for up to two years from commencement. See the FinTech Experimental Permit guide.
Capital market institution licence
The full licence for dealing, arranging, managing, advising or custody, with capital, legal form and registered persons set per activity. See the CMI licence guide.
Crowdfunding under an Arranging licence
Equity crowdfunding since 2022 and debt-instrument crowdfunding since September 2025, both run by a CMI authorised for Arranging. See the crowdfunding licence guide.
Robo-advisory under a Managing licence
A regulated service since 5 March 2026, open only to CMIs licensed for Managing. See the robo-advisory guide.
The five securities activities and the capital in force
| Activity | What it covers | Minimum paid-up capital | Legal form |
|---|---|---|---|
| Dealing | Dealing in a security as principal or agent, including buying, selling, managing subscriptions and underwriting | SAR 50 million | Restricted forms (Art 6(f)) |
| Custody | Safeguarding assets that include a security, and the related administration | SAR 50 million | Restricted forms (Art 6(f)) |
| Managing investments and operating funds | Discretionary management of securities plus operating investment funds | SAR 20 million | Restricted forms (Art 6(f)) |
| Managing investments only | Discretionary management of securities, no fund operation | One year of expected expenses | Restricted forms (Art 6(f)) |
| Arranging | Introducing parties for an offering or underwriting, and advising on corporate finance; also the activity for securities crowdfunding | One year of expected expenses | Any legal form established in the Kingdom |
| Advising | Advice on a security, including financial planning and wealth management | One year of expected expenses | Any legal form established in the Kingdom |
Capital Market Institutions Regulations, Art 6(g), English text amended by CMA Board Resolution 2-3-2026 (7 January 2026). Ongoing capital adequacy is governed separately by the CMA Prudential Rules. Restricted forms include a joint stock company and a subsidiary of a local bank.
May 2026 draft capital figures (proposed, not in force)
| Activity | In force today | Proposed in the May 2026 draft |
|---|---|---|
| Dealing as principal, underwriting, managing subscriptions and margin | SAR 50 million | SAR 20 million |
| Dealing as agent | SAR 50 million | SAR 10 million |
| Custody | SAR 50 million | SAR 20 million |
| Arranging that holds client money for securities crowdfunding | One year of expected expenses | One year of expected expenses, and at least SAR 2 million |
| Managing investments and operating funds | SAR 20 million | Unchanged |
| Managing investments only, arranging (other), advising | One year of expected expenses | Unchanged |
Consultation CMA_N_4054, published 18 May 2026 and closed 17 June 2026. Our scan of CMA news up to 5 October 2026 found no approval. Article 33 of the Capital Market Law still sets a SAR 50 million floor for brokerage companies.
What else the May 2026 draft would change
The draft would also cut the licensing and commencement documents, extend IT Officer registration to every CMI that uses a technology platform, link KYC to each client's money-laundering risk rating through three new forms, and let advising-only CMIs carry on other businesses. None of this applies until the CMA publishes an approved text.
Licence fees: study fee and annual renewal
| Activity | Application study fee (SAR) | Annual renewal fee (SAR) |
|---|---|---|
| Dealing | 85,000 | 85,000 |
| Managing investments and operating funds | 60,000 | 60,000 |
| Managing investments | 30,000 | 30,000 |
| Arranging | 20,000 | 20,000 |
| Advising | 20,000 | 20,000 |
| Custody | 15,000 | 15,000 |
CMA circular ص/1/6/5989/20 dated 27 October 2020, based on a Board decision of 24 August 2020. The circular is a scanned Arabic PDF with no English version. It is still linked from the CMA Forms page, but we cannot confirm the amounts are unchanged since 2020. Check before you pay.
Renewal every year, per activity
Each amount is charged as the study fee with the application and again every year as the renewal fee for that activity, due by 30 June. Renewal depends on the CMA having no concerns about the firm's capability and fitness, and on the firm still meeting financial adequacy and minimum capital. The FinTech Experimental Permit has no fee under the current Instructions.
Registered persons every CMI needs
- At all times: a registered CEO, CFO, Compliance Officer and MLRO (CMIR Art 20(b)).
- An IT Officer, registered at all times, where the CMI offers robo-advisory. The IT Officer is also a registrable function for CMIs arranging securities crowdfunding.
- The CEO, CFO and Compliance Officer must be separate people unless the CMA approves otherwise, and the Compliance Officer may not perform a client function.
- A CMI limited to managing investments, arranging or advising may outsource the CFO, Compliance Officer or MLRO function within limits; see the CMI licence guide.
- Registered persons must be resident in the Kingdom unless the CMA grants an exemption (Art 24(b)), and must pass the CMA qualification exams or hold an exemption (Art 21(d)).
CMA qualification exams by function
| Function | Exams |
|---|---|
| General registrable functions | CME-1A and CME-1B |
| Compliance and AML/CTF route | CME-1B, CME-2A and CME-2B |
| Securities brokers | CME-3A and CME-3B |
| Managing activity (asset managers) | CME-4A and CME-4B |
| Corporate finance | CME-5A and CME-5B |
The new exam series has been mandatory since 1 February 2023 and was developed with the Financial Academy and CISI. Holders of the old certificates can still register. The CMA guide names the route "Compliance and AML/CTF"; confirm with the CMA which route it expects for your MLRO.
Foreign firms need a Saudi entity
The CMIR have no branch route for a foreign securities firm. An applicant must be established in the Kingdom, and a CMI must keep its management and head office in the Kingdom. For dealing, custody and managing, a foreign group therefore needs a Saudi entity in one of the permitted legal forms. Arranging and advising can use any Saudi legal form, including a limited liability company. Entity set-up comes first; see incorporation.
Foreign groups do use this route. In 2026 the CMA licensed Standard Chartered Capital Saudi Arabia, Brookfield Arabia and Neuberger Berman Saudi as Saudi entities.
A separate Offshore Securities Business Licence, for CMIs holding a Ministry of Investment regional headquarters licence, was put out for consultation in May 2025 (CMA_N_3796, closed 28 June 2025). We found no approval through early October 2026, so it is not available today.
AML: the national law applies directly
The CMA's own Anti-Money Laundering and Counter-Terrorist Financing Rules (Board Resolution 1-39-2008, last amended in 2017) were rescinded in November 2018. The CMA gave the new AML Law (Royal Decree M/20, 1439H), its Implementing Regulations and the Combating Terrorism and its Financing Law as the reason. The 2017 text is still hosted on aml.gov.sa without a rescission notice, so check the date of anything you are handed.
Today a CMI's obligations come from the AML Law and its Implementing Regulations (the law was amended in April 2026), the counter-terrorist financing law, and the CMA's Investment Accounts Instructions on KYC and account opening. See building the compliance function.
Common questions
Can a foreign firm serve Saudi clients from abroad without a CMA licence?
Usually not. Business carried on with or for a person in the Kingdom is presumed to be carried on in the Kingdom, so the firm needs a licence or an exemption.
Are the lower May 2026 capital figures in force?
No. The consultation closed on 17 June 2026 and we found no CMA approval up to early October 2026. The dealing figures also depend on amending the SAR 50 million floor in Article 33 of the Capital Market Law.
How long does CMA licensing take?
The CMA's service card gives 0 to 60 business days, varying by service. The full path is longer: information requests (with a 30-day window to respond), the Board's licence resolution, then commencement-of-business requirements before the firm starts.
Does the CMA require Saudi nationals in compliance roles?
The CMIR contain no Saudization quota. They require registered persons to be resident in the Kingdom unless the CMA grants an exemption.
Primary sources
Last reviewed: 11 October 2026
General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.
