SAMA payment institution licence

Who needs a payment institution licence

Article 4 of the Law of Payments and Payment Services (Royal Decree M/26) says no person may provide payment services in the Kingdom without a SAMA licence. Article 5 lets SAMA decide when a provider based abroad counts as providing services in the Kingdom, so a foreign wallet or acquirer serving Saudi users should check its position before launch.

The Implementing Regulations (SAMA No. 000044093096, 13 June 2023) replaced SAMA's January 2020 PSP framework. They list the regulated payment services in Article 6. A payment institution licence covers those services except the issuing of electronic money, which needs an e-money institution licence. Payment initiation and account information have their own licence types, covered on the open banking licence page.

Payment services listed in Article 6

• Services that let funds be placed on a payment account, and cash withdrawals from one
• Executing payment transactions: direct debits, card or device payments and credit transfers, including where funds are covered by a credit line
• Issuing payment instruments, such as cards
• Acquiring payment transactions for merchants
• Payment aggregation services
• Issuing electronic money (an e-money licence, not a PI licence)
• Payment initiation and payment account information services (their own licence types)
• Payment account services, and any other service SAMA designates

What falls outside the licence

Article 7 lists 17 exclusions. They include cash-only payments, commercial agents, cash-in-transit, cheques and paper vouchers, technical service providers, limited-network instruments, intra-group payments, some independent ATM deployers, banking business under the Banking Control Law, finance company activity under the Finance Companies Control Law, and money remittance, which the regulations define as funds received without a payment account being created for the payer or payee.

Licensed banks are exempt from payment licensing (Article 48). Limited network service providers register with SAMA instead of applying for a licence, and must tell SAMA if their transactions pass SAR 5 million in 12 months or SAR 2 million in any month. SAMA may then require a licence. Settle the exclusion analysis in writing early, because it decides whether you need a licence at all.

Micro or Major payment institution

Implementing Regulations of the Law of Payments and Payment Services, Arts 14, 17, 23 and 42 to 45. Professional indemnity insurance is mandatory only for payment initiation and account information providers (Art 46).

Choosing between Micro and Major

The Micro category suits a domestic product with modest volumes. Two limits decide it: SAR 10 million of average monthly payment value and no services to persons outside the Kingdom. A remittance corridor, a cross-border payout product or a merchant base outside Saudi Arabia rules Micro out from the start.

Major capital scales with the business. At SAR 500 million of average monthly payment value, 1% is SAR 5 million, so own funds rise above the SAR 3 million floor. Build that into the financial model SAMA reviews, because the ongoing requirement is checked after licensing. A Micro PI can also be an LLC, while a Major PI must be a joint stock company, so moving up later can mean a change of legal form as well as more capital.

Safeguarding and the bank guarantee

Client funds must be safeguarded as soon as they are received. Any funds still held at the end of the business day after receipt go into a segregated account at a licensed bank named "Deposit and Safeguard of Funds of a Payment Service Provider's Clients", or into secure liquid assets approved by SAMA and held by an authorised custodian. Safeguarded funds cannot be used for anything else, including lending. SAMA wants the safeguarding policy and the signed bank agreement in the application file.

On the bank guarantee, the texts disagree. Article 8 of the Implementing Regulations asks for an irrevocable guarantee equal to the required minimum capital; the current Licensing Guidelines (Appendix A, item 9) ask for 20% of it. Neither text has been withdrawn, so ask SAMA which figure applies before you approach your bank, and budget for both until you have an answer.

The application, stage by stage

1. Prepare the forms

   Read the Implementing Regulations, then complete SAMA's License Application Form and the Fit and Proper Form for shareholders, board and committee members, and every senior position.

2. Submit the in-principle file

   Send the Appendix A documents to NBFI-LIC@SAMA.GOV.SA: board resolution, draft articles, organisation chart, shareholder list, feasibility study, bank guarantee, a three-year business plan with ICAAP, liquidity assessment and a Saudization and recruitment plan, draft policies, key contracts, the business continuity plan and IT architecture.

3. Completeness and questions

   SAMA confirms when the file is complete (Art 11(1)). Answer any request for more information within 30 calendar days (Art 11(2)).

4. Decision within 90 days

   SAMA decides within 90 calendar days of the completeness notice, or tells you a revised timeline (Art 11(4) to (5)).

5. Approval in principle

   Valid for up to one year, extendable by 180 days, and it does not authorise you to operate (Art 15). Complete commercial registration and articles at the Ministry of Commerce within 180 days (Art 14(3)).

6. Licensing stage

   Meet the final conditions, pay the fee and receive the licence (Art 23). SAMA enters the licensee in its public online register (Art 16).

What SAMA expects once you are licensed

• SAMA non-objection for material outsourcing, with the licensee still liable (Art 27)
• Risk management and compliance functions, an annual policy review and fraud detection (Art 28)
• Internal audit reporting quarterly to the audit committee (Art 31); an external auditor approved by SAMA and rotated every five years (Art 32)
• Compliance with SAMA's Business Continuity Management and Cyber Security Frameworks and its data and technology governance rules (Arts 33 to 35)
• A risk-based AML/CTF programme (Art 36), plus data protection and client confidentiality (Art 37)
• SAMA non-objection for agents, and an annual agent report (Arts 24 and 26)
• SAR transfers credited by the end of the next business day (Art 76); payer liability for lost or stolen instruments capped at SAR 150 (Art 88)
• A controller register, change-in-control notices, and notice to SAMA before any investment round (circular 472056382, 18 May 2026)
• A renewal application at least six months before the licence expires (Art 17)

Common questions