Saudi Arabia - SAMA, CMA and Insurance Authority perimeter

Saudi Arabia financial permissions and regulator dossier

Saudi Arabia divides banks, payments, finance and money exchange through SAMA, securities and investment funds through CMA, and insurance through the Insurance Authority. This dossier maps every material route as of July 2026.

Talk to an advisor

Route facts

Jurisdiction facts

Regulator map

SAMA for banking, PI and EMI, finance companies, debt crowdfunding and money exchange; CMA for securities, funds, markets and equity crowdfunding; Insurance Authority for insurance and reinsurance.

Legal-status warning

SAMA in-principle approval, a CMA FinTech Experimental Permit and commercial registration are not operating licences. Only the final recorded permission supports regulated activity.

Permission coverage

Banking, payments, e-money, FX, finance, leasing, crowdfunding, securities, funds, insurance, digital-asset perimeter, administration and special routes.

Capital basis

Activity-specific under the Banking Control Law, Payments Law, finance laws, Capital Market Law and Insurance Authority requirements.

Territorial reach

Saudi permissions are domestic and service-specific. They create no GCC-wide or foreign passport and do not legalise solicitation in another country.

Review date

Regulatory summary reviewed as of 11 July 2026.

Read the perimeter first

Saudi market entry follows three core regulators, not one fintech label

The Saudi Central Bank licenses banks, payment institutions, electronic money institutions, finance companies, debt-based crowdfunding providers, finance-support companies and money changers. Its public records distinguish the permission and exact activity. The Capital Market Authority authorises capital market institutions for dealing, arranging, managing investments and operating funds, advising and custody, and separately oversees exchanges, depositories, counterparties, offers and equity crowdfunding. The Insurance Authority now owns insurance and reinsurance company, branch, intermediary, aggregator and service-provider licensing. A SAMA payment institution cannot issue electronic money unless its EMI status permits it. A CMA arranging authorisation can support securities crowdfunding only within the amended rules. Neither a sandbox admission nor an approval in principle is authority to trade. No comprehensive Saudi virtual-asset service-provider licence was confirmed in the reviewed SAMA, CMA or Insurance Authority permission catalogues as of July 2026; token, custody, payment and investment models must be tested against existing laws rather than marketed under a generic crypto licence.

Permission families

Saudi Arabia licence, authorisation and registration routes

Family	Official instrument and authority	Activities and exclusions	Entry, capital and reach
Family Banking and deposit taking	Official instrument and authority Bank licence from SAMA under the Banking Control Law, including the applicable conventional, digital or foreign-bank route	Activities and exclusions Accept deposits, provide credit and conduct only banking operations allowed by the licence and SAMA approvals. A finance, EMI, PI or CMA authorisation cannot accept deposits.	Entry, capital and reach SAMA reviews the Saudi legal form or branch, founders and controllers, capital, governance, Shariah arrangements where relevant, risk, systems and recovery. Current prudential rules determine capital and liquidity.
Family Payment institutions and electronic money	Official instrument and authority Micro or major Payment Institution licence, or micro or major Electronic Money Institution licence, under the Law of Payments and Payment Services and Implementing Regulations	Activities and exclusions A PI provides only licensed payment services and cannot issue electronic money. An EMI may issue e-money and provide the recorded payment services; virtual assets are excluded from the e-money definition.	Entry, capital and reach SAMA applies category-specific legal form and capital, ownership, safeguarding, governance, security, AML/CFT and operational requirements. In-principle approval only permits establishment steps.
Family Money exchange and remittance	Official instrument and authority Money-changing business licence from SAMA under the Rules Regulating Money Changing Business; cross-border transfer requires the recorded activity	Activities and exclusions Buy, sell and exchange foreign currency and conduct remittance only where the licence includes it. A commercial registration, PI or travel-business status does not substitute.	Entry, capital and reach Applicants submit founder fit-and-proper material, feasibility study, business plan, AML controls and establishment evidence. Use the live SAMA form, capital rule and fee schedule for the requested activity.
Family Investment dealing, arranging, advice and custody	Official instrument and authority Capital market institution authorisation from CMA under the Capital Market Law and Capital Market Institutions Regulations	Activities and exclusions Deal, arrange, advise, manage investments, operate funds or provide custody only within the permitted business profile. Associated business cannot require another regulator's permission.	Entry, capital and reach CMA tests Saudi establishment, qualifying owners, financial resources, responsible officers, systems, conduct, client-assets and prudential requirements. Legal form and capital differ between dealing, custody, managing, arranging and advising.
Family Markets and financial infrastructure	Official instrument and authority CMA authorisation for an exchange, securities depository centre, central counterparty or other capital-market infrastructure under the applicable regulations	Activities and exclusions Operate organised trading, clearing, settlement or depository functions only in the authorised category. A broker or technology vendor is not an exchange.	Entry, capital and reach Infrastructure governance, ownership, default resources, participant rules, market surveillance, technology resilience and reporting are category-specific and subject to CMA oversight.
Family Investment funds and asset management	Official instrument and authority CMA authorisation for managing investments and operating funds, plus fund establishment, offering and continuing obligations under the Investment Funds Regulations	Activities and exclusions Manage public or private funds, discretionary portfolios and permitted ancillary services only within the CMA profile. Manager authorisation and fund approval are separate.	Entry, capital and reach The manager must evidence organisation, responsible persons, capital, valuation, custody, conflicts, risk, disclosure and reporting. Each fund has its own terms, board or oversight and offer conditions.
Family Insurance, reinsurance and intermediation	Official instrument and authority Insurance Authority licence for insurers, reinsurers, foreign branches, brokers, agents, aggregators and specified insurance service providers	Activities and exclusions Underwrite only authorised insurance or reinsurance business, or intermediate and service policies in the recorded capacity. An intermediary cannot carry insurance risk.	Entry, capital and reach The Insurance Authority applies registered-office, capital or professional-cover, management, actuarial, governance, product, claims and reporting requirements according to category.
Family Consumer, real-estate, leasing and SME finance	Official instrument and authority SAMA finance-company licence under the Finance Companies Control Law and specialist real-estate finance, finance lease and related rules	Activities and exclusions Provide only the licensed consumer, real-estate, SME, production-asset, lease, microfinance, credit-card, BNPL or refinance activity. Deposit taking remains prohibited.	Entry, capital and reach The public register records activity combinations. Capital, responsible lending, credit assessment, contracts, collections, governance, AML and product non-objection requirements continue after licensing.
Family Debt and equity crowdfunding	Official instrument and authority SAMA finance-company licence for debt-based crowdfunding; CMA-authorised arranging activity and offering rules for equity crowdfunding	Activities and exclusions Debt platforms facilitate finance within SAMA rules; equity platforms arrange securities offers under CMA rules. A sandbox permit is not final authorisation.	Entry, capital and reach Identify whether the investor receives debt or equity and who holds client money. The platform needs the correct authority, capital, governance, due diligence, disclosures, technology and reporting.
Family Digital assets and virtual-asset models	Official instrument and authority No general SAMA or CMA VASP licence confirmed as of July 2026; existing payment, securities, custody, AML and experimental frameworks apply according to the model	Activities and exclusions A token platform, exchange, custody or stable-value model cannot rely on a commercial registration or fintech permit. Securities and payment characteristics can trigger CMA or SAMA permission.	Entry, capital and reach Obtain written perimeter analysis and verify any post-review framework. Do not claim crypto trading, custody or issuance authority unless the final Saudi permission and official register expressly show it.
Family Trust, company and fiduciary administration	Official instrument and authority CMA custody, managing or arranging authorisation where securities or client assets are involved; ordinary company administration remains under commercial and professional law	Activities and exclusions Provide fiduciary investment or custody functions only under the CMA profile. Company formation, nominee or bookkeeping work is not a general SAMA financial licence.	Entry, capital and reach Map beneficial ownership, client money, investment discretion and AML obligations. A specialist professional registration cannot be marketed as banking, payment, fund or trust-company authority.
Family Pensions and retirement arrangements	Official instrument and authority State social-insurance and pension arrangements operate through statutory bodies; financial managers and insurers serving them retain their CMA or Insurance Authority permissions	Activities and exclusions There is no general private pension-company licence in the reviewed SAMA and CMA catalogues. Managing pension assets or issuing retirement insurance remains within the relevant financial permission.	Entry, capital and reach Confirm the statutory scheme, asset manager, custodian, insurer and employer obligations separately. A CMA fund or insurance product is not itself a state pension authorisation.
Family Gambling and other special activities	Official instrument and authority No gambling authorisation exists in the reviewed SAMA, CMA or Insurance Authority financial permission schedules	Activities and exclusions A banking, payment, finance, securities or insurance licence does not permit betting, gaming or prize products. Payment processing cannot cure an unlawful underlying activity.	Entry, capital and reach Treat any game, prize, staking or chance-based model as a separate Saudi legal-perimeter issue and do not launch from a financial permission alone.

Entry conditions

Saudi applications separate establishment approval from operating authority

A Saudi file begins by identifying the final regulator and licence category for each activity. The applicant then chooses the legal form allowed by the specific SAMA, CMA or Insurance Authority rules and documents its registered office, head office, local management and operational substance. Founders, qualifying owners, ultimate beneficiaries, directors and senior officers are reviewed for integrity, competence, financial soundness and source of funds. The business plan must connect products and customer journeys to forecasts, category-specific capital, governance, Shariah arrangements where relevant, AML/CFT, safeguarding or client assets, cyber security, outsourcing, complaints, continuity and wind-down. SAMA payment and money-exchange routes expressly distinguish in-principle approval from the final licence. CMA uses its authorisation forms and permitted business profile, while the Insurance Authority maintains separate company, intermediary and service-provider applications. Exact capital, fees and timeframes come from the current rulebook. A regulator may ask for additional information, and no adviser can promise the final decision or timing.

Regulator-facing process

A Saudi authorisation mandate, stage by stage

The critical discipline is to keep SAMA, CMA and Insurance Authority evidence aligned while preserving their separate legal decisions.

Stage 01 - Perimeter

Choose the regulator and final permission

Classify deposits, e-money, payment execution, exchange, lending, debt or equity crowdfunding, securities, fund management, custody, insurance and any token function.

Document why SAMA, CMA or the Insurance Authority owns each activity and why an approval in principle, experimental permit or commercial registration is not enough.

Stage 02 - Establishment

Prove Saudi eligibility and substance

Form the permitted Saudi company or branch, disclose controllers and responsible officers, and evidence the activity-specific capital, governance, AML, safeguarding and technology.

Reconcile the constitutional documents and commercial registration with the exact regulated activity, but do not begin operations until the final licence is granted.

Stage 03 - Assessment

Answer the authority against one operating model

Submit through the current regulator channel and keep ownership, forecasts, policies, systems, products and outsourcing consistent through questions and inspections.

Only a final licence or CMA authorisation and public register entry evidence operating scope. Information requests and establishment conditions remain authority-controlled.

Stage 04 - Activation

Launch within the recorded business profile

Verify the licence expiry, approved managers, client-money arrangements, product non-objections, reporting calendar and material counterparties before onboarding.

New activities, controller changes, key appointments and material outsourcing can require advance approval even after the initial licence.

After entry

Saudi permissions remain conditional on prudential, conduct and control compliance

Licensed firms maintain capital, liquidity, safeguarding or client-asset controls, governance, AML/CFT, sanctions screening, customer records, responsible lending or suitability, complaints, cyber security, outsourcing oversight, audit, regulatory reporting and business continuity under their sector rules. A SAMA EMI, finance company and money changer have different returns and product-approval obligations. CMA institutions must remain within their permitted business profile and protect client assets; Insurance Authority firms follow class, solvency, claims and intermediary rules. Direct and indirect ownership changes, changes in control, mergers, constitutional amendments and appointments of many board or senior functions can require prior non-objection or approval. A share acquisition does not transfer a licence away from the company. Buyer diligence must verify the final licence, activities, expiry, capital, enforcement, customer funds, AML record, technology and contracts. Saudi status gives no foreign passport and does not guarantee bank, card-scheme, custody or market access. Any future virtual-asset framework must be checked after the July 2026 review date.

Verify it yourself

Primary official sources

SAMA licensed entities directory
The official register separates banks, digital banks, payment institutions, electronic money institutions, finance companies, money exchange and credit-information entities - sama.gov.sa.
SAMA payment services FAQ and rulebook
Official guidance distinguishes PI from EMI, regulated payment services, legal forms, capital categories and the effect of in-principle approval - sama.gov.sa.
SAMA finance-company directory
The current register records consumer, real-estate, leasing, BNPL, microfinance, debt-crowdfunding and finance-support activities by company - sama.gov.sa.
CMA Capital Market Institutions Regulations
The official regulations define permitted business profiles, authorisation, prudential duties, client assets and activity restrictions - cma.org.sa.
CMA equity crowdfunding framework
The official decision allocates equity crowdfunding to appropriately authorised arranging institutions and securities-offering rules - cma.org.sa.
Insurance Authority licensing catalogue
The official pages list insurer, reinsurer, foreign branch, intermediary, aggregator and insurance-service-provider licences and application materials - ia.gov.sa.

FAQ

Saudi Arabia regulator dossier questions

01 Can a Saudi payment institution issue e-money?

Only an Electronic Money Institution may issue e-money. A Payment Institution provides the payment services in its licence but does not gain e-money issuance merely from the PI label.

02 Is SAMA in-principle approval an operating licence?

No. It permits the applicant to complete establishment conditions. The company must receive the final licence and satisfy activation requirements before regulated activity begins.

03 Which regulator owns crowdfunding?

SAMA licenses debt-based crowdfunding as a finance activity. CMA regulates equity crowdfunding through an institution authorised for the relevant arranging and offering activity.

04 Does Saudi Arabia have a general crypto or VASP licence?

No comprehensive operating VASP licence was confirmed in the reviewed official permission catalogues as of July 2026. Test each token, payment, custody and investment feature under SAMA and CMA rules and recheck later developments.

05 Who regulates insurance now?

The Insurance Authority regulates and licenses insurance, reinsurance, branches, intermediaries, aggregators and specified service providers. Do not rely on historic SAMA-only descriptions.

Reviewed by the SKY7 advisory team. Last reviewed: 11 July 2026. Regulatory statements are made as of July 2026. This page is general information only, not legal, regulatory, tax, investment or financial advice. The allocation of digital assets and any post-review regulation is time-sensitive; no generic crypto licence is asserted. Verify the current legislation, official register, application forms, capital method, fee schedule and transition notices before relying on any Saudi permission or market-access statement.

Tell us what you need

Scope a regulated route in Saudi Arabia

Bring the products, ownership, Saudi structure, customer locations and complete flow of funds. SKY7 will separate SAMA, CMA and Insurance Authority permissions and evidence. Advisory fees and entity prices are on request.