← Regulations / Saudi Arabia / Operating Models / On-shore VASP

On-shore VASP in Saudi Arabia

Locally-incorporated VASP that operates under full local jurisdiction, holding all required licenses and registrations.

Conditional AI-Generated · Unreviewed

On-shore VASP is conditionally permitted in Saudi Arabia with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • AML/CFT obligations under Royal Decree M/20 apply, including general transaction reporting requirements
  • SAMA sandbox entry requires documented AML systems and controls as part of the preliminary application
  • Ongoing compliance verification and reporting during and after sandbox period
  • UBO disclosure required at entity setup stage

Key Restrictions

  • Virtual assets declared illegal/unlicensed by the 2018 Standing Committee (SAMA/CMA/MOF) — no standardized VASP or crypto-specific license exists
  • Crypto activities (trading, wallet services, brokerage) fall outside approved perimeters without explicit regulatory approval
  • The only recognized route for crypto-related activities is entry via SAMA's Regulatory Sandbox
  • Full operational approval requires post-sandbox verification; continuous audits mandated
  • No custody, insurance, or cold storage regulatory framework exists — institutional players advised to use offshore custodians (e.g., UAE, Bahrain)
  • SAMA has issued ongoing warnings that it provides no oversight or support for Bitcoin/crypto

Key Risks

  • Significant regulatory ambiguity — the 2018 declaration deems virtual assets illegal, yet a sandbox path exists, creating legal uncertainty
  • Enforcement risk: entities claiming to operate under crypto licenses face legal action
  • SAMA warnings against Bitcoin signal continued hostility; regulator could restrict or close sandbox exits
  • No recognized custody framework — operator cannot legally safeguard client crypto assets under local rules
  • Travel Rule has no enacted legislation, guidance, or implementation date — compliance gap for cross-border transfers

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 20% confidence

Custodial License Requirements: None exist, as no licenses are issued for cryptocurrency practices; entities claiming otherwise face legal action.

licensing 60% confidence

No standardized licenses: There is no broadly public VASP (Virtual Asset Service Provider) or crypto-specific license for retail exchanges, custody, or payment processing; activities like crypto trading, wallet services, or brokerage fall outside approved perimeters without explicit regulatory approval.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Limited permitted activities: Under SAMA's 2023 Payment Service Provider Regulations (enabled by the 2022 Law of Payments and Payment Providers), related services such as digital banking, electronic payment processing, P2P lending/investment, asset/wealth investment, crypto/blockchain applications, and BNPL may qualify indirectly, but not pure crypto trading or custody.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Exchanges and custody: Require entry via SAMA's Regulatory Sandbox as the primary (and currently only recognized) route for testing and potential approval; full operations demand ongoing compliance verification.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Primarily a licensing regime with sandbox entry: Business registration alone (e.g., via Ministry of Investment - MISA portal) is insufficient; it precedes a preliminary sandbox application to SAMA for crypto-related activities. No "one-click" registration substitutes for licensing, and unlicensed operations face administrative penalties, unannounced inspections, and potential legal action.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Entity setup first: Legally register a company (e.g., LLC), disclose UBOs/shareholding, define business objects, then seek sandbox admission; foreign firms may operate if activities align with SAMA approvals.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Register entity and obtain investment license via MISA portal (upload documents, select authorized activity).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Submit preliminary application to SAMA Regulatory Sandbox electronically (full documentation on solvency, audits, AML systems, business model).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Undergo review/testing (up to 1 year); meet ongoing reporting, security, and client protection standards.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Post-sandbox: Secure full operational approval; continuous audits required.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

2018 Standing Committee Declaration (via SAMA/CMA): Virtual assets illegal/unlicensed.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 20% confidence

2018 Standing Committee declaration (SAMA/CMA/MOF): Virtual currencies illegal. (https://www.lightspark.com/knowledge/is-crypto-legal-in-saudi-arabia)

licensing 20% confidence

SAMA warnings against Bitcoin (ongoing): No oversight or support. (https://zipmex.com/blog/is-crypto-mining-legal-in-saudi-arabia/) ; (https://freemanlaw.com/cryptocurrency/saudi-arabia/)

licensing 20% confidence

MOF 2019 warning: Outside legal framework. (https://timesofindia.indiatimes.com/world/middle-east/saudis-bitcoin-trading-laws-2025-what-traders-and-businesses-need-to-know/articleshow/124017628.cms)

licensing 20% confidence

Royal Decree M/20 (AML/CFT): General transaction reporting. (https://zipmex.com/blog/is-crypto-mining-legal-in-saudi-arabia/)

licensing 20% confidence

Asset segregation rules: No rules apply, as crypto custody lacks regulation; institutional players are advised to use offshore custodians in jurisdictions like UAE or Bahrain.

licensing 20% confidence

Insurance requirements: None specified, given the lack of a custody framework. [1-7]

travel-rule 20% confidence

Whether Saudi Arabia has enacted specific legislation or regulatory guidance for the Travel Rule

travel-rule 20% confidence

An effective implementation date for Saudi Arabia

travel-rule 20% confidence

Applicable threshold amounts for transactions

travel-rule 20% confidence

Which types of VASPs are covered under Saudi Arabia's framework

travel-rule 20% confidence

URLs to relevant Saudi Arabian legislation or regulatory guidance

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — an on-shore VASP may operate in Saudi Arabia only by entering SAMA's Regulatory Sandbox (up to 1-year testing phase) and securing post-sandbox full operational approval, given the 2018 declaration that virtual assets are illegal/unlicensed and the absence of any standardized VASP license.

Questions this verdict aims to answer

  • What license(s) are required to operate locally?
  • What capital, governance, and reporting obligations apply?
  • What is the application process and timeline?