← Regulations / Saudi Arabia / licensing
Grade A AI-Researched

Saudi Arabia -- Licensing Requirements Regulatory Overview

Published: 2026-04-21 Updated: 2026-04-18 Author: Perplexity Sonar Version 1 Sources cited in: English (1), Arabic (2)
Note: This article cites primary sources in languages other than English. Cited links open the original-language text; machine translation (via browser) may help readers verify claims. See the badge next to each source for its language.

Methodology

AI-generated synthesis from web search results.

Limitations

  • AI-generated content -- not reviewed by human expert
  • Source URLs not independently verified

Saudi Arabia maintains a conservative and restrictive regulatory stance on cryptocurrencies and virtual assets, with no clear, publicly available general licensing regime for retail exchanges, custody providers, or payment processors as of 2026; public cryptocurrencies like Bitcoin remain effectively illegal for general use per longstanding warnings from the Saudi Central Bank (SAMA), Capital Markets Authority (CMA), and Ministry of Finance.[5][2][8]

Licensing Requirements for Exchanges, Custody Providers, and Payment Processors

  • No standardized licenses: There is no broadly public VASP (Virtual Asset Service Provider) or crypto-specific license for retail exchanges, custody, or payment processing; activities like crypto trading, wallet services, or brokerage fall outside approved perimeters without explicit regulatory approval.[2][5][8]
  • Limited permitted activities: Under SAMA's 2023 Payment Service Provider Regulations (enabled by the 2022 Law of Payments and Payment Providers), related services such as digital banking, electronic payment processing, P2P lending/investment, asset/wealth investment, crypto/blockchain applications, and BNPL may qualify indirectly, but not pure crypto trading or custody.[3]
  • Exchanges and custody: Require entry via SAMA's Regulatory Sandbox as the primary (and currently only recognized) route for testing and potential approval; full operations demand ongoing compliance verification.[1][9]
  • Payment processors: Must align with payment regulations; foreign entities can apply pre-incorporation but must form a local entity upon issuance.[3]

Registration vs. Licensing Regime

  • Primarily a licensing regime with sandbox entry: Business registration alone (e.g., via Ministry of Investment - MISA portal) is insufficient; it precedes a preliminary sandbox application to SAMA for crypto-related activities. No "one-click" registration substitutes for licensing, and unlicensed operations face administrative penalties, unannounced inspections, and potential legal action.[1][2][6]
  • Entity setup first: Legally register a company (e.g., LLC), disclose UBOs/shareholding, define business objects, then seek sandbox admission; foreign firms may operate if activities align with SAMA approvals.[1][3]

Key Requirements

Requirement Details
Capital Minimum SAR 10 million (~USD 2.6 million) for VASP-like entities; emphasis on financial solvency, sustainability, and transparent funding sources.[1][3]
AML/KYC FATF-grade standards mandatory: KYC/KYB with beneficial ownership verification, risk scoring, enhanced due diligence, sanctions screening (OFAC/UN/EU), blockchain/wallet monitoring, source-of-funds/wealth checks, MLRO-equivalent, board oversight, and segregated functions. Applies even pre-licensing for banking/partners.[2]
Local Presence Local entity incorporation required post-approval; management/compliance substance planning, including intercompany agreements and vendor mapping.[1][2][3]

Application Process

  1. Register entity and obtain investment license via MISA portal (upload documents, select authorized activity).[1][6]
  2. Submit preliminary application to SAMA Regulatory Sandbox electronically (full documentation on solvency, audits, AML systems, business model).[1][3]
  3. Undergo review/testing (up to 1 year); meet ongoing reporting, security, and client protection standards.[1][3]
  4. Post-sandbox: Secure full operational approval; continuous audits required.[1]

Regulatory References (official sources not directly linked in results; warnings stem from SAMA/CMA/MOF statements):

Caveats: Information from consultancy sites conflicts (e.g., some claim VASP paths exist[3], others affirm no clear framework[2][5][8]); official SAMA/CMA positions prioritize caution, with sandbox as the evidentiary route only. No comprehensive retail licensing confirmed; consult SAMA directly for 2026 updates.[2][5][7][8]

Source Data

60%

No standardized licenses: There is no broadly public VASP (Virtual Asset Service Provider) or crypto-specific license for retail exchanges, custody, or payment processing; activities like crypto trading, wallet services, or brokerage fall outside approved perimeters without explicit regulatory approval.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
60%

Limited permitted activities: Under SAMA's 2023 Payment Service Provider Regulations (enabled by the 2022 Law of Payments and Payment Providers), related services such as digital banking, electronic payment processing, P2P lending/investment, asset/wealth investment, crypto/blockchain applications, and BNPL may qualify indirectly, but not pure crypto trading or custody.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
60%

Exchanges and custody: Require entry via SAMA's Regulatory Sandbox as the primary (and currently only recognized) route for testing and potential approval; full operations demand ongoing compliance verification.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
60%

Payment processors: Must align with payment regulations; foreign entities can apply pre-incorporation but must form a local entity upon issuance.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
60%

Primarily a licensing regime with sandbox entry: Business registration alone (e.g., via Ministry of Investment - MISA portal) is insufficient; it precedes a preliminary sandbox application to SAMA for crypto-related activities. No "one-click" registration substitutes for licensing, and unlicensed operations face administrative penalties, unannounced inspections, and potential legal action.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
60%

Entity setup first: Legally register a company (e.g., LLC), disclose UBOs/shareholding, define business objects, then seek sandbox admission; foreign firms may operate if activities align with SAMA approvals.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
60%

Register entity and obtain investment license via MISA portal (upload documents, select authorized activity).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
60%

Submit preliminary application to SAMA Regulatory Sandbox electronically (full documentation on solvency, audits, AML systems, business model).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
60%

Undergo review/testing (up to 1 year); meet ongoing reporting, security, and client protection standards.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
60%

Post-sandbox: Secure full operational approval; continuous audits required.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
60%

SAMA Payment Service Provider Regulations (2023): https://www.sama.gov.sa (search regulations).

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1
60%

2018 Standing Committee Declaration (via SAMA/CMA): Virtual assets illegal/unlicensed.

[primary] sama.gov.sa [primary] sama.gov.sa — RegulatorySandbox [primary] https://misa.gov.sa[1

13 fact(s) collected but awaiting source verification. View in explorer →

References

This article was generated by Perplexity Sonar .

Primary Sources

sama.gov.sa. (n.d.). sama.gov.sa. Retrieved April 18, 2026, from https://www.sama.gov.sa ar

sama.gov.sa. (n.d.). RegulatorySandbox. Retrieved April 18, 2026, from https://www.sama.gov.sa/en-US/FinTech/Pages/RegulatorySandbox.aspx ar

misa.gov.sa. (n.d.). misa.gov.sa. Retrieved April 18, 2026, from https://misa.gov.sa

Edit History

2026-04-21 — auto-publish-pipeline: published — Auto-published: grade A

Related Content

Frameworks: vasp-casp-licensing, fatf-recommendations, aml-cft, custody
Fact IDs: sa.licensing.custodial-license-requirements-none-exist, sa.licensing.segregation-of-client-assets-rules, sa.licensing.insurancebonding-requirements-not-mandated-as, sa.licensing.cold-storage-mandates-no-mandates, sa.licensing.qualified-custodian-definitions-no-definitions, sa.licensing.no-standardized-licenses-there-is, sa.licensing.limited-permitted-activities-under-samas, sa.licensing.exchanges-and-custody-require-entry, sa.licensing.payment-processors-must-align-with, sa.licensing.primarily-a-licensing-regime-with

This article is maintained by AI research workers and reviewed by human editors. Learn about our methodology →