← Regulations / Saudi Arabia / Operating Models / Remote VASP

Remote VASP serving residents in Saudi Arabia

Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.

Conditional AI-Generated · Unreviewed

Remote VASP is conditionally permitted in Saudi Arabia with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • General AML/CFT reporting obligations under Royal Decree M/20 apply to any authorized financial activity.
  • Operators in the SAMA sandbox must submit documentation on AML systems as part of the sandbox application (solvency, audits, AML systems, business model).
  • Ongoing reporting and client protection standards are required during and after sandbox testing.

Key Restrictions

  • Virtual assets were declared illegal/unlicensed by the 2018 Standing Committee declaration (SAMA/CMA/MOF).
  • No standardized VASP or crypto-specific license exists — retail exchanges, custody, wallet services, and brokerage are outside approved perimeters without explicit regulatory approval.
  • The only recognized path for crypto-related activities is entry via SAMA's Regulatory Sandbox.
  • Foreign entities may apply pre-incorporation but must form a local entity (e.g., LLC) upon licensing issuance.
  • Unlicensed operation is illegal — entities claiming to have licenses for crypto practices face legal action.
  • SAMA and MOF have issued ongoing warnings that crypto activities are outside the legal framework.

Key Risks

  • High enforcement risk: unlicensed remote VASPs serving Saudi residents face legal action per the 2018 Standing Committee declaration and subsequent SAMA/MOF warnings.
  • Regulatory ambiguity: no clear VASP licensing framework exists, and the only path (SAMA sandbox) is experimental and time-limited.
  • Binance-style enforcement precedent: international exchanges serving Saudi residents without authorization are at risk of being blocked or prosecuted.
  • No recognized crypto custody framework means any custodial service is effectively illegal unless authorized via sandbox.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 20% confidence

Custodial License Requirements: None exist, as no licenses are issued for cryptocurrency practices; entities claiming otherwise face legal action.

licensing 60% confidence

No standardized licenses: There is no broadly public VASP (Virtual Asset Service Provider) or crypto-specific license for retail exchanges, custody, or payment processing; activities like crypto trading, wallet services, or brokerage fall outside approved perimeters without explicit regulatory approval.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Exchanges and custody: Require entry via SAMA's Regulatory Sandbox as the primary (and currently only recognized) route for testing and potential approval; full operations demand ongoing compliance verification.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Primarily a licensing regime with sandbox entry: Business registration alone (e.g., via Ministry of Investment - MISA portal) is insufficient; it precedes a preliminary sandbox application to SAMA for crypto-related activities. No "one-click" registration substitutes for licensing, and unlicensed operations face administrative penalties, unannounced inspections, and potential legal action.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Entity setup first: Legally register a company (e.g., LLC), disclose UBOs/shareholding, define business objects, then seek sandbox admission; foreign firms may operate if activities align with SAMA approvals.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Submit preliminary application to SAMA Regulatory Sandbox electronically (full documentation on solvency, audits, AML systems, business model).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Undergo review/testing (up to 1 year); meet ongoing reporting, security, and client protection standards.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Post-sandbox: Secure full operational approval; continuous audits required.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

2018 Standing Committee Declaration (via SAMA/CMA): Virtual assets illegal/unlicensed.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 20% confidence

2018 Standing Committee declaration (SAMA/CMA/MOF): Virtual currencies illegal. (https://www.lightspark.com/knowledge/is-crypto-legal-in-saudi-arabia)

licensing 20% confidence

SAMA warnings against Bitcoin (ongoing): No oversight or support. (https://zipmex.com/blog/is-crypto-mining-legal-in-saudi-arabia/) ; (https://freemanlaw.com/cryptocurrency/saudi-arabia/)

licensing 20% confidence

MOF 2019 warning: Outside legal framework. (https://timesofindia.indiatimes.com/world/middle-east/saudis-bitcoin-trading-laws-2025-what-traders-and-businesses-need-to-know/articleshow/124017628.cms)

licensing 20% confidence

Royal Decree M/20 (AML/CFT): General transaction reporting. (https://zipmex.com/blog/is-crypto-mining-legal-in-saudi-arabia/)

licensing 60% confidence

Payment processors: Must align with payment regulations; foreign entities can apply pre-incorporation but must form a local entity upon issuance.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
licensing 60% confidence

Register entity and obtain investment license via MISA portal (upload documents, select authorized activity).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
high

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — a remote VASP cannot serve Saudi residents from abroad without authorization; the only legal pathway requires local entity incorporation and entry into SAMA's Regulatory Sandbox, and operating without such authorization is illegal under the 2018 Standing Committee declaration, with high enforcement risk.

Questions this verdict aims to answer

  • May a non-resident provider serve residents from abroad?
  • Does cross-border service trigger licensing, registration, or AML obligations?
  • What enforcement risk exists for unlicensed remote operators?