The legal basis
Banking business in Saudi Arabia is governed by the Banking Control Law (Royal Decree M/5, 22/2/1386H). SAMA's Licensing Guidelines and Minimum Criteria of 1 December 2018 set the general requirements for a bank licence, and the Additional Licensing Guidelines and Criteria for Digital-Only Banks of 24 February 2020 adapt them for banks with no branch network. A digital-only bank meets the same prudential requirements as any other bank, and the banking consumer protection principles apply to it.
A new Banking Law to replace the Banking Control Law went to public consultation in early 2023, and law-firm and press reports say it was submitted to the legislative authorities in August 2025. We found no evidence that it had been enacted as of October 2026, so applications still run under the existing law and guidelines.
What SAMA requires
| Area | Requirement |
|---|---|
| Legal form | A locally incorporated joint stock company |
| Promoters | Experience in the financial industry and in technology, and the financial capacity to back the bank |
| Capital | Assessed case by case from the ICAAP and ILAAP submitted with the application; no fixed minimum is published |
| Physical presence | Head office in Saudi Arabia; branches are not expected, though SAMA may require customer service centres |
| Governance | The same corporate governance principles as conventional banks; risk management and compliance under the bank Licensing Guidelines |
| AML/CFT | Controls designed for a fully digital environment |
| Technology | SAMA Cyber Security Framework, Business Continuity Management Framework and National Cybersecurity Authority rules |
| Independent assessment | SAMA may require a third-party assessor to review technology and AML at the design phase and again at implementation, before go-live |
| Outsourcing | Under SAMA's Rules on Outsourcing |
| Exit plan | Mandatory |
Additional Licensing Guidelines and Criteria for Digital-Only Banks (24 February 2020), read with the Licensing Guidelines and Minimum Criteria (1 December 2018).
How the licensing process runs
Pre-application consultation
Discuss the proposal with SAMA before filing.
Formal application
Submit in hard copy and by email, signed by two authorised directors, including the ICAAP, ILAAP and the mandatory exit plan.
Acknowledgement
SAMA acknowledges receipt and names a case officer within 15 business days.
Assessment
SAMA reviews the application and may appoint an independent assessor for the design phase. The guidelines set no fixed decision deadline.
Council of Ministers decision
Bank licences are granted by Council of Ministers decision. EZ Bank's licence, for example, followed Cabinet approval announced by SAMA.
Build and no-objection to commence
Incorporate, build and test, with an implementation-phase assessment if SAMA requires one. Operations start only after a separate SAMA no-objection to commence.
Digital banks licensed so far
| Bank | What is reported | Basis |
|---|---|---|
| EZ Bank | Cabinet approval announced by SAMA on 30 September 2025, with SAR 2.5bn of capital | SAMA announcement |
| STC Bank (formerly STC Pay) | Licensed by Cabinet in June 2021 | Press reports |
| Vision Bank (formerly Saudi Digital Bank) | Licensed by Cabinet in June 2021; SAMA no-objection to start full operations in September 2025 | Press reports |
| D360 Bank | Licensed by Cabinet in February 2022; SAMA no-objection in December 2024 | Press reports |
Only the EZ Bank details come from an official SAMA release. After EZ Bank, SAMA counted 39 licensed banks: 15 Saudi banks and 24 branches of foreign banks. We have not confirmed whether EZ Bank had launched by October 2026.
What the capital figure tells you
SAMA does not publish a minimum, but the one official figure, SAR 2.5 billion for EZ Bank, shows the scale involved. The ICAAP and ILAAP drive the number, so the capital discussion depends on how well those assessments are built. Promoters must also show financial capacity.
For most fintechs a bank licence is more than the model needs. If the model does not need to take deposits, a payment institution, e-money or finance company licence has published capital figures and decision deadlines.
People and senior roles
Banks are within the scope of SAMA's Requirements for Appointments to Senior Positions. Article 4 reserves roles such as the Chief Compliance Officer, AML/CTF Director, Anti-Fraud Director, IT Director and Information or Cyber Security Director for Saudi nationals, and senior appointments need SAMA's written non-objection before the person acts. The English rulebook page states it is not the latest version, so work from the Arabic text. See compliance function.
Common questions
What is the minimum capital for a digital bank in Saudi Arabia?
SAMA does not publish one. Capital is assessed case by case from the applicant's ICAAP and ILAAP. EZ Bank, licensed in 2025, was approved with SAR 2.5 billion.
Does a digital bank need branches?
No branches are expected, but the bank needs a head office in Saudi Arabia, and SAMA may require customer service centres.
Who grants the licence?
The Council of Ministers, on SAMA's assessment. Operations then need a separate SAMA no-objection to commence.
How long does SAMA take to decide?
SAMA acknowledges the application and names a case officer within 15 business days. The guidelines set no deadline for the decision itself.
Is there a new Banking Law?
A draft went to consultation in 2023 and was reportedly submitted to the legislative authorities in August 2025. We found no evidence of enactment as of October 2026.
Primary sources
Last reviewed: 11 October 2026
General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.
