What the sandbox is for
The sandbox is for business models that SAMA's existing rules do not cover. SAMA's sandbox FAQ says that if a licensing path already exists for a model, sandbox applications are not accepted. A payment wallet, a BNPL product or a lending platform therefore goes straight to the matching licence: payments, BNPL or finance company.
Open banking shows how the route ends. Account information and payment initiation providers tested in the sandbox, and on 26 March 2026 SAMA announced that it had started licensing them after the sandbox phase was complete. See the open banking licence. The sandbox is SAMA's; securities-related products test through the CMA FinTech Lab instead (see CMA licences).
Who can apply
- Firms already licensed by SAMA
- Unlicensed local fintechs, directly through a Letter of Acceptance or by partnering with a licensed firm
- Unlicensed international fintechs, directly (registering with the Ministry of Investment and the Ministry of Commerce after acceptance) or through a licensed partner
Direct entry or through a licensed partner
An unlicensed firm has two ways in. It can apply directly and, once accepted, test under its own Letter of Acceptance. Or it can partner with a firm SAMA already licenses and test through that relationship. The partner route suits a product that plugs into an existing licensee's customers or infrastructure; the direct route gives the firm its own standing with SAMA and its own path to a licence at the end.
International fintechs can use either route. A direct applicant from abroad registers with the Ministry of Investment and the Ministry of Commerce after SAMA accepts it, so the Saudi entity can follow acceptance instead of preceding it. See incorporation for what that registration involves.
What SAMA assesses
- Genuine innovation
- Benefit to consumers and the market
- A minimum viable product and technology ready to test
- An exit plan for the end of testing, whatever the outcome
The sandbox lifecycle
| Stage | Duration | What happens |
|---|---|---|
| Application | 60 days | SAMA reviews the application. On acceptance it issues a No Objection Letter (NOL), which allows integration testing with dummy data. |
| Operational readiness | 120 days | The firm meets SAMA's assessment criteria and receives a Letter of Acceptance (LoA) for live testing. |
| Testing | 6 to 12 months | Live testing with real customers under the LoA conditions. SAMA expects the licence application to start after month 6 and by month 9. |
| Exit or graduation | At the end of testing | A full licence or licence amendment, the exit plan, or confirmation that no licence is needed. |
SAMA Rulebook, Regulatory Sandbox lifecycle. On these durations, a firm can expect roughly 12 to 18 months from application to the end of testing.
What SAMA can relax, and what it is unlikely to
| Can be relaxed | Unlikely to be relaxed |
|---|---|
| Licence fees | Consumer data protection |
| Capital and liquidity requirements | AML/CFT requirements |
| Board composition | Fitness and propriety |
| Non-mandatory guidelines | Laws, consumer disclosures and cyber security |
SAMA Rulebook, types of exemptions and waivers. The Letter of Acceptance may also include a No Enforcement Action Clause (NAC).
How waivers work in practice
The waivers lower the cost of testing: fees, capital and liquidity, and board composition can be relaxed while the model is proved. SAMA is unlikely to relax the controls that protect customers and the financial system. Expect AML/CFT, fit and proper standards, data protection, disclosures and cyber security to apply in full, so a sandbox firm needs a working AML programme, sanctions screening and a cyber security baseline before live testing starts.
SAMA may include a No Enforcement Action Clause (NAC) in the Letter of Acceptance. Whether a firm gets one, and what it covers, is set in that firm's LoA, so read its wording with your legal adviser before live testing begins.
Applying through eSAMA
The sandbox is always open, with no application windows. Applications are filed through SAMA's eSAMA e-services portal, which launched in trial on 13 January 2025, and SAMA launched an enhanced sandbox e-service on 28 June 2026. Questions go to sandbox@sama.gov.sa, per the sandbox FAQ. SAMA has not published a sandbox fee.
The exit plan matters from day one. SAMA expects the licence application to begin between months 6 and 9 of testing, so the licensing file, including capital, legal form and senior hires, has to be under way while the test is still running.
Common questions
Does the sandbox replace a licence?
No. It is a time-limited test. At the end, the firm gets a full licence or licence amendment, follows its exit plan, or receives confirmation that no licence is needed.
Can a foreign fintech apply without a Saudi company?
Yes, international fintechs can apply directly. After SAMA accepts them, they register with the Ministry of Investment and the Ministry of Commerce. They can also enter through a partnership with a SAMA-licensed firm.
Is there a fee?
SAMA has not published a sandbox fee, and licence fees are among the requirements SAMA can waive during testing.
Will SAMA accept a payments or BNPL product into the sandbox?
Not if an existing licence already covers the model. SAMA's FAQ says sandbox applications are not accepted where a licensing path exists, so a standard payments or BNPL product applies for the licence directly.
Do AML rules apply during testing?
Yes. AML/CFT, fit and proper standards, consumer data protection and cyber security are among the requirements SAMA is unlikely to relax. Build the compliance function before live testing.
Primary sources
Last reviewed: 11 October 2026
General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.
