← Regulations / Saudi Arabia / Operating Models / Custodial SaaS

Custodial wallet / SaaS in Saudi Arabia

Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).

Conditional AI-Generated · Unreviewed

Custodial SaaS is conditionally permitted in Saudi Arabia with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • AML/CFT obligations under Royal Decree M/20 apply generally to financial transactions; custodial wallet providers must comply with transaction reporting requirements.
  • Preliminary sandbox application requires submission of full AML system documentation to SAMA.
  • Ongoing AML compliance monitoring and reporting required during and after sandbox testing period.
  • AML obligations likely fall on the licensed operator (SaaS provider), not the white-label client, as SAMA regulates the payment/custody service provider.

Key Restrictions

  • No dedicated crypto custody license framework exists — entry is only via SAMA's Regulatory Sandbox (1-year testing + post-sandbox full operational approval).
  • Virtual assets were declared illegal/unlicensed by the 2018 Standing Committee (SAMA/CMA/MOF); only sandbox-approved entities may operate.
  • Entity must be locally registered (e.g., LLC via MISA) before sandbox application; foreign firms must form a local entity post-approval.
  • No segregation-of-assets, insurance/bonding, cold-storage, or proof-of-reserves rules exist — custodial safeguards are not regulated.
  • White-label clients would not be separately licensed; the SaaS provider bears the regulatory burden as the SAMA-regulated entity.

Key Risks

  • 2018 Standing Committee declaration and ongoing SAMA warnings classify virtual asset activities as illegal/unlicensed — unapproved operations face legal action.
  • No recognized custody framework means no regulatory guidance on key operational issues (segregation, insurance, reserve proofs), creating legal uncertainty even for sandbox participants.
  • SAMA warnings against Bitcoin (no oversight or support) and MOF 2019 warning indicate active enforcement posture.
  • Mismatch between factual illegality statements and the existence of a sandbox pathway creates ambiguity about scope of permissible activities post-sandbox.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 20% confidence

Custodial License Requirements: None exist, as no licenses are issued for cryptocurrency practices; entities claiming otherwise face legal action.

licensing 20% confidence

Segregation of Client Assets Rules: No rules apply, given the absence of recognized crypto custody services.

licensing 20% confidence

Insurance/Bonding Requirements: Not mandated, as crypto activities are unlicensed and prohibited.

licensing 20% confidence

Cold Storage Mandates: No mandates, due to the overall ban on public cryptocurrencies.

licensing 20% confidence

Qualified Custodian Definitions: No definitions provided in regulations, as crypto custody is not authorized.

licensing 60% confidence

No standardized licenses: There is no broadly public VASP (Virtual Asset Service Provider) or crypto-specific license for retail exchanges, custody, or payment processing; activities like crypto trading, wallet services, or brokerage fall outside approved perimeters without explicit regulatory approval.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Limited permitted activities: Under SAMA's 2023 Payment Service Provider Regulations (enabled by the 2022 Law of Payments and Payment Providers), related services such as digital banking, electronic payment processing, P2P lending/investment, asset/wealth investment, crypto/blockchain applications, and BNPL may qualify indirectly, but not pure crypto trading or custody.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Exchanges and custody: Require entry via SAMA's Regulatory Sandbox as the primary (and currently only recognized) route for testing and potential approval; full operations demand ongoing compliance verification.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Payment processors: Must align with payment regulations; foreign entities can apply pre-incorporation but must form a local entity upon issuance.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Primarily a licensing regime with sandbox entry: Business registration alone (e.g., via Ministry of Investment - MISA portal) is insufficient; it precedes a preliminary sandbox application to SAMA for crypto-related activities. No "one-click" registration substitutes for licensing, and unlicensed operations face administrative penalties, unannounced inspections, and potential legal action.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Entity setup first: Legally register a company (e.g., LLC), disclose UBOs/shareholding, define business objects, then seek sandbox admission; foreign firms may operate if activities align with SAMA approvals.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Register entity and obtain investment license via MISA portal (upload documents, select authorized activity).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Submit preliminary application to SAMA Regulatory Sandbox electronically (full documentation on solvency, audits, AML systems, business model).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Undergo review/testing (up to 1 year); meet ongoing reporting, security, and client protection standards.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Post-sandbox: Secure full operational approval; continuous audits required.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

2018 Standing Committee Declaration (via SAMA/CMA): Virtual assets illegal/unlicensed.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 20% confidence

Asset segregation rules: No rules apply, as crypto custody lacks regulation; institutional players are advised to use offshore custodians in jurisdictions like UAE or Bahrain.

licensing 20% confidence

Insurance requirements: None specified, given the lack of a custody framework. [1-7]

licensing 20% confidence

2018 Standing Committee declaration (SAMA/CMA/MOF): Virtual currencies illegal. (https://www.lightspark.com/knowledge/is-crypto-legal-in-saudi-arabia)

licensing 20% confidence

SAMA warnings against Bitcoin (ongoing): No oversight or support. (https://zipmex.com/blog/is-crypto-mining-legal-in-saudi-arabia/) ; (https://freemanlaw.com/cryptocurrency/saudi-arabia/)

licensing 20% confidence

MOF 2019 warning: Outside legal framework. (https://timesofindia.indiatimes.com/world/middle-east/saudis-bitcoin-trading-laws-2025-what-traders-and-businesses-need-to-know/articleshow/124017628.cms)

licensing 20% confidence

Royal Decree M/20 (AML/CFT): General transaction reporting. (https://zipmex.com/blog/is-crypto-mining-legal-in-saudi-arabia/)

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — custodial wallet/SaaS is only permissible via SAMA's Regulatory Sandbox pathway, with no dedicated custody license framework, a local entity requirement, and significant regulatory ambiguity given the 2018 declaration that virtual assets are illegal/unlicensed.

Questions this verdict aims to answer

  • What custody license / qualified-custodian status applies?
  • What segregation, insurance, and proof-of-reserves rules apply?
  • What AML obligations attach to the SaaS vs the white-label client?