← Regulations / Saudi Arabia / Operating Models / CEX

Centralized exchange in Saudi Arabia

Order-book exchange that takes custody of user assets and matches trades between users.

Conditional AI-Generated · Unreviewed

CEX is conditionally permitted in Saudi Arabia with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • Subject to Royal Decree M/20 (AML/CFT) general transaction reporting obligations
  • Entity must have AML systems in place for sandbox admission review
  • Ongoing AML/CFT compliance verification required post-sandbox
  • Travel-rule obligations: No specific Saudi legislation or regulatory guidance enacted; no effective implementation date, threshold amounts, or VASP coverage scope defined for Travel Rule

Key Restrictions

  • Public crypto trading, custody, and exchange services are illegal/unlicensed per the 2018 Standing Committee Declaration (SAMA/CMA/MOF) — virtual currencies declared illegal
  • SAMA and MOF have issued ongoing warnings that crypto activities fall outside the legal framework
  • No standardized VASP or crypto-specific license exists for retail exchanges; activities fall outside approved perimeters
  • Only route for potential approval is SAMA's Regulatory Sandbox — requires full application, up to 1 year review/testing, and post-sandbox operational approval
  • Must first register a local company (e.g., LLC), disclose UBOs, and define business objects before applying to sandbox
  • Foreign firms may operate only if activities align with SAMA approvals; must form local entity upon issuance
  • No custody segregation rules, insurance requirements, or cold-storage mandates apply due to lack of recognized custody framework
  • Institutional players advised to use offshore custodians in UAE or Bahrain

Key Risks

  • Fundamental regulatory ambiguity: public crypto exchanges have been declared illegal since 2018 — any sandbox approval is at SAMA's sole discretion and precedent is unclear
  • No recognized licensing framework means operators face legal action risk if they operate outside the sandbox or if sandbox approval is not granted
  • No travel-rule framework exists, creating compliance ambiguity for cross-border withdrawals
  • No asset segregation or custody rules means user assets lack legal protection structures
  • Ongoing SAMA and MOF public warnings create enforcement and reputational risk for any crypto activities

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 20% confidence

Custodial License Requirements: None exist, as no licenses are issued for cryptocurrency practices; entities claiming otherwise face legal action.

licensing 20% confidence

Segregation of Client Assets Rules: No rules apply, given the absence of recognized crypto custody services.

licensing 20% confidence

Insurance/Bonding Requirements: Not mandated, as crypto activities are unlicensed and prohibited.

licensing 20% confidence

Cold Storage Mandates: No mandates, due to the overall ban on public cryptocurrencies.

licensing 20% confidence

Qualified Custodian Definitions: No definitions provided in regulations, as crypto custody is not authorized.

licensing 60% confidence

No standardized licenses: There is no broadly public VASP (Virtual Asset Service Provider) or crypto-specific license for retail exchanges, custody, or payment processing; activities like crypto trading, wallet services, or brokerage fall outside approved perimeters without explicit regulatory approval.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Limited permitted activities: Under SAMA's 2023 Payment Service Provider Regulations (enabled by the 2022 Law of Payments and Payment Providers), related services such as digital banking, electronic payment processing, P2P lending/investment, asset/wealth investment, crypto/blockchain applications, and BNPL may qualify indirectly, but not pure crypto trading or custody.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Exchanges and custody: Require entry via SAMA's Regulatory Sandbox as the primary (and currently only recognized) route for testing and potential approval; full operations demand ongoing compliance verification.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Payment processors: Must align with payment regulations; foreign entities can apply pre-incorporation but must form a local entity upon issuance.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Primarily a licensing regime with sandbox entry: Business registration alone (e.g., via Ministry of Investment - MISA portal) is insufficient; it precedes a preliminary sandbox application to SAMA for crypto-related activities. No "one-click" registration substitutes for licensing, and unlicensed operations face administrative penalties, unannounced inspections, and potential legal action.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Entity setup first: Legally register a company (e.g., LLC), disclose UBOs/shareholding, define business objects, then seek sandbox admission; foreign firms may operate if activities align with SAMA approvals.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Register entity and obtain investment license via MISA portal (upload documents, select authorized activity).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Submit preliminary application to SAMA Regulatory Sandbox electronically (full documentation on solvency, audits, AML systems, business model).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Undergo review/testing (up to 1 year); meet ongoing reporting, security, and client protection standards.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Post-sandbox: Secure full operational approval; continuous audits required.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

SAMA Payment Service Provider Regulations (2023): https://www.sama.gov.sa (search regulations).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

SAMA Regulatory Sandbox: https://www.sama.gov.sa/en-US/FinTech/Pages/RegulatorySandbox.aspx

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

2018 Standing Committee Declaration (via SAMA/CMA): Virtual assets illegal/unlicensed.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

MISA Portal: https://misa.gov.sa

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 20% confidence

Asset segregation rules: No rules apply, as crypto custody lacks regulation; institutional players are advised to use offshore custodians in jurisdictions like UAE or Bahrain.

licensing 20% confidence

Insurance requirements: None specified, given the lack of a custody framework. [1-7]

licensing 20% confidence

2018 Standing Committee declaration (SAMA/CMA/MOF): Virtual currencies illegal. (https://www.lightspark.com/knowledge/is-crypto-legal-in-saudi-arabia)

licensing 20% confidence

SAMA warnings against Bitcoin (ongoing): No oversight or support. (https://zipmex.com/blog/is-crypto-mining-legal-in-saudi-arabia/) ; (https://freemanlaw.com/cryptocurrency/saudi-arabia/)

licensing 20% confidence

MOF 2019 warning: Outside legal framework. (https://timesofindia.indiatimes.com/world/middle-east/saudis-bitcoin-trading-laws-2025-what-traders-and-businesses-need-to-know/articleshow/124017628.cms)

licensing 20% confidence

Royal Decree M/20 (AML/CFT): General transaction reporting. (https://zipmex.com/blog/is-crypto-mining-legal-in-saudi-arabia/)

travel-rule 20% confidence

Whether Saudi Arabia has enacted specific legislation or regulatory guidance for the Travel Rule

travel-rule 20% confidence

An effective implementation date for Saudi Arabia

travel-rule 20% confidence

Applicable threshold amounts for transactions

travel-rule 20% confidence

Which types of VASPs are covered under Saudi Arabia's framework

travel-rule 20% confidence

URLs to relevant Saudi Arabian legislation or regulatory guidance

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — a centralized exchange can only potentially operate via SAMA's Regulatory Sandbox pathway, but faces fundamental legal headwinds since the 2018 Standing Committee declared virtual currencies illegal and no standardized VASP licensing framework exists.

Questions this verdict aims to answer

  • What exchange / VASP license applies?
  • What custody segregation rules apply to user assets?
  • What market-conduct and listing rules apply?
  • What travel-rule obligations apply on withdrawals?