Setting Up a Fintech Company in Saudi Arabia (2026)

By Rozy — Business Consultant, Noble Core · Updated June 2026

This guide explains the fintech boom driving the opportunity, who regulates what, how the SAMA Regulatory Sandbox and CMA FinTech Lab let you test before you scale, the main licence types, the MISA licence and capital you need, and the exact steps to launch. For the wider setup journey, see our company formation in Saudi Arabia guide.

Why Saudi Arabia is the Gulf’s fastest-growing fintech market

Saudi Arabia’s fintech sector is one of the standout success stories of Vision 2030. Under the Financial Sector Development Program and the dedicated FinTech Strategy, the Kingdom set out to build a thriving digital-finance ecosystem — and the numbers have moved faster than the targets.

By the middle of the decade the country was home to more than 200 active fintech companies, already ahead of the schedule set for that point, on the way to a goal of 525 fintech firms by 2030. The cashless shift has been even more dramatic: Saudi Arabia aimed for non-cash payments to reach 70% of all transactions by 2025 and hit that mark two years early, with electronic payments accounting for roughly 85% of retail payments. The 2030 ambition is for non-cash transactions to make up 80% of the total.

Fintech Saudi — the initiative launched by SAMA in partnership with the Capital Market Authority — acts as the catalyst connecting startups, investors, talent and regulators. It runs accelerator programmes, a directory of licensed players, a regulatory navigator and talent initiatives, and it has become the de facto front door for founders trying to understand where their model fits. For a founder, the message is simple: demand is real, the infrastructure (Open Banking, instant payments through the sarie and mada rails, a maturing regulatory framework) is in place, and the government actively wants more licensed players.

The market drivers are unusually strong. Saudi Arabia has the largest population in the Gulf, a median age under 30, and one of the highest smartphone-penetration rates in the world — a near-ideal profile for digital finance. A significant share of consumers and small businesses were historically under-served by traditional banking, which gives well-capitalised fintechs a genuine wedge in payments, lending and wealth. At the same time, the regulators have deliberately published clear frameworks rather than leaving fintech in a grey zone, which lowers the legal risk of building here compared with many emerging markets. The combination — large young market, supportive policy, clear rules and deep government backing — is what makes the Kingdom the Gulf’s fastest-growing fintech market rather than merely a promising one.

For a foreign founder, the practical implication is that you are not pioneering an untested regime. The pathways — sandbox, ExPermit, MISA licence, SAMA or CMA authorisation — are documented, and a growing cohort of licensed firms has already walked them. Your job is to map your specific model onto the right pathway, capitalise it properly, and build compliance in from the start.

Who regulates fintech in Saudi Arabia: SAMA vs CMA

Saudi Arabia uses a two-regulator model, and the very first strategic decision you make is identifying which one your business sits under. Getting this right shapes your licence, your capital and your timeline.

SAMA — the Saudi Central Bank

SAMA (Saudi Central Bank, sama.gov.sa) supervises banking, payments, insurance and most lending. Your fintech falls under SAMA if you handle money movement or credit, including:

• Payment services — e-wallets, payment gateways, money transfer, acquiring
• Buy Now Pay Later (BNPL)
• Consumer and SME financing (finance companies)
• Debt-based crowdfunding
• Insurance technology (insurtech)

CMA — the Capital Market Authority

The CMA (cma.gov.sa) supervises securities and investment activity. Your fintech falls under the CMA if it touches capital markets, including:

• Equity crowdfunding
• Robo-advisory and digital wealth management
• Investment platforms, social trading and digital asset arranging

A useful rule of thumb: if you move payments or lend money, think SAMA; if you help people invest, think CMA. A small number of models — such as crowdfunding — are split, with debt-based crowdfunding under SAMA and equity crowdfunding under the CMA.

Two other authorities sit alongside the financial regulators and matter to every fintech. The Communications, Space and Technology Commission and the national cybersecurity bodies set the data and security standards your platform must meet, and the Ministry of Investment (MISA) handles your right to be foreign-owned. For a few activities you may also touch the Ministry of Commerce and the Saudi Business Center for the underlying corporate registration. The key point is that fintech licensing in Saudi Arabia is layered: a single product can require an investment licence, a financial licence and ongoing compliance with cybersecurity and data rules — so scoping all of these at the outset prevents nasty surprises mid-build.

Where a model genuinely spans both regulators — for example a super-app combining payments and investment features — you will typically need separate authorisations and a clear internal separation of the regulated activities. Engaging early with both SAMA and the CMA, often via the sandbox or FinTech Lab, is the cleanest way to avoid building a product that no single licence can cover.

Fintech licence types and which regulator issues them

The table below maps the most common Saudi fintech activities to their regulator and indicative capital. Capital and fee figures change — always confirm the current numbers on the official portal before you budget.

Fintech activity	Regulator	Indicative minimum capital
Micro Payment Institution	SAMA	SAR 1 million
Major Payment Institution	SAMA	SAR 3 million
Buy Now Pay Later (BNPL)	SAMA	Set by SAMA per activity
Finance company (consumer/SME lending)	SAMA	Set by SAMA (substantial)
Debt-based crowdfunding	SAMA	Set by SAMA per rules
Open Banking service provider	SAMA	Per Open Banking framework
Equity crowdfunding platform	CMA	Per CMA authorisation
Robo-advisory / investment platform	CMA	Per CMA authorisation

For the SAMA payment licences the thresholds are clear: a Micro Payment Institution requires a Saudi LLC with at least SAR 1 million in paid-up share capital and is capped at an average monthly payment transaction value of around SAR 10 million during its first year, while a Major Payment Institution requires SAR 3 million. Both must keep that capital available as working capital on an ongoing basis. BNPL, finance-company and crowdfunding licences carry their own thresholds set by the regulator.

The SAMA Regulatory Sandbox and CMA FinTech Lab

One of the smartest features of the Saudi system is that you may not need a full licence on day one. Both regulators run controlled “test-and-learn” environments where innovative models operate under supervision before graduating to full authorisation.

The SAMA Regulatory Sandbox lets selected fintechs trial payment, lending and Open Banking use cases with a limited customer base, under SAMA’s oversight, for a defined period. Open Banking itself is the model example: firms tested it inside the sandbox, the framework matured, and in 2026 SAMA moved Open Banking into a full licensing regime — with Lean Technologies becoming the first firm to secure an Open Banking licence after years in the sandbox.

On the capital-markets side, the CMA FinTech Lab issues an Experimental Permit (ExPermit) so robo-advisory, crowdfunding and investment platforms can test innovative business models within defined limits before applying for full CMA authorisation.

For many founders the sandbox or ExPermit is the right entry point: it lowers the initial bar, lets you prove the model with real users, and builds a track record that strengthens your eventual full-licence application.

It helps to understand the lifecycle. A sandbox journey usually moves through application and eligibility assessment, onboarding with agreed testing parameters (customer caps, transaction limits, a defined test window), a live testing phase under close supervision, and finally an exit decision — graduate to full authorisation, extend, or wind down. SAMA publishes the cohorts of permitted fintechs it admits, and being named in one is itself a credibility signal to investors and partners. The discipline the sandbox imposes — clear metrics, controlled risk, regular reporting — is exactly the discipline a regulator will expect once you hold a full licence, so the experience compounds.

That said, the sandbox is not a licence and not a marketing channel. It is a supervised test with strict limits, and operating outside those limits — or marketing as if you were fully licensed — is a serious breach. Treat it as a structured proving ground: define the hypothesis you are testing, instrument it properly, and use the results to make your full application stronger and faster. Founders who go in with a sharp, measurable test plan tend to graduate; those who treat it as a soft launch tend to stall.

The MISA licence: your gateway to foreign ownership

Before any financial licence, a foreign-owned fintech needs an investment licence from the Ministry of Investment of Saudi Arabia (MISA). The MISA licence is what authorises non-Saudi ownership of the company — in most activities with 100% foreign ownership and no local partner required.

In 2026, MISA’s licence issuance and renewal fees are suspended (they were previously SAR 12,000 for the first year and SAR 62,000 for renewal), and with complete, properly attested documents the MISA licence is typically issued in 3 to 10 business days. You will usually need the parent company’s commercial registration, articles of association, audited financial statements and a board resolution — all notarised, legalised by the Saudi embassy and translated into Arabic. To go deeper on this step, read our dedicated MISA licence guide.

The MISA licence does not replace the SAMA or CMA approval — it sits alongside it. A fintech needs both: MISA for the right to be foreign-owned, and the financial regulator for the right to carry out the regulated activity.

Sequencing matters. In most fintech setups the MISA licence comes first, because it is the legal basis for a non-Saudi to own the company that will then hold the financial licence. Once MISA is granted you complete the Commercial Registration, and the entity that emerges is the one that applies to SAMA or the CMA. Trying to run these wholly in parallel can create mismatches between the corporate entity on record and the applicant the regulator expects, so most advisers sequence MISA and CR before the financial application. Keeping your corporate details — shareholders, managers, capital — consistent across MISA, the Commercial Register and the financial regulator is essential, because inconsistencies are a common cause of requests for clarification that add weeks.

Capital requirements and indicative setup costs

Fintech is a capital-intensive sector by design, because regulators want licensed players to be financially sound enough to protect customers. Beyond the regulatory capital itself, budget for the standard company-setup and compliance costs:

Cost item	Indicative amount (2026)
MISA investment licence	Issuance/renewal fees suspended
Commercial Registration (CR)	SAR 1,200–2,000
Chamber of Commerce membership	SAR 2,000–3,000 / year
Regulatory capital (Micro PI)	SAR 1,000,000
Regulatory capital (Major PI)	SAR 3,000,000
Document attestation & translation	Varies by jurisdiction
Noble Core setup package	From SAR 36,999

Regulatory capital must usually be deposited and maintained as ongoing working capital, not just shown on paper at incorporation. Treat every figure above as indicative and confirm current amounts on the SAMA, CMA, MISA and Saudi Business Center portals, since fees and thresholds are periodically updated.

Beyond the headline capital and registration costs, realistic fintech budgeting should include several recurring and one-off items that founders often overlook. Compliance is the biggest of these: you will likely need a Money Laundering Reporting Officer and a compliance function, AML/KYC tooling, cybersecurity certification and ongoing audit. Technology is the second: secure, certified infrastructure, penetration testing, and — for payments — integration with the national payment rails. Then there is the cost of Saudization, since the Ministry of Human Resources and Social Development (MHRSD) sets quotas for Saudi nationals you must meet to keep your operations compliant through Qiwa. Office space and a registered national address are also required.

A sensible way to plan is to separate three buckets: regulatory capital (locked and maintained), one-off setup costs (MISA, CR, attestation, incorporation, licence application), and the ongoing operating and compliance run-rate. Under-budgeting the third bucket is the most common founder error, because a fintech licence is not a one-time purchase but an ongoing supervised relationship with the regulator that carries continuous cost. Engaging an experienced local adviser early usually pays for itself by avoiding rework and shortening the licensing timeline.

Step-by-step: how to set up a fintech company in Saudi Arabia

1. Define your activity and pick your regulator

Decide precisely what your fintech does — payments, BNPL, lending, crowdfunding, robo-advisory — and confirm whether it falls under SAMA or the CMA. This single decision drives your licence, capital and timeline.

2. Consider the sandbox or ExPermit

If your model is new or you want to validate it with real users first, apply to the SAMA Regulatory Sandbox or the CMA FinTech Lab before committing to a full licence.

3. Obtain your MISA investment licence

Apply to MISA with attested corporate documents to secure the right to foreign ownership. Issuance is typically 3–10 business days.

4. Complete Commercial Registration

Reserve your trade name and register the company with the Ministry of Commerce through the Saudi Business Center, obtaining your Commercial Registration under the unified national CR system.

5. Apply for the financial licence

Submit your full application to SAMA or the CMA, deposit the required regulatory capital, and demonstrate governance, security, AML/CFT and consumer-protection compliance.

6. Complete post-licence registrations

Register with ZATCA (tax/VAT), GOSI (social insurance) and Qiwa/Muqeem (labour and residency), and set up Saudization through the Ministry of Human Resources and Social Development (MHRSD) so you can hire and invoice. Open a corporate bank account, integrate the relevant payment infrastructure, and stand up your compliance and reporting processes so you are operational and supervisable from day one.

Across these six steps the single biggest determinant of timeline is preparation. Founders who arrive with attested documents in order, a precisely defined activity, properly structured capital and a credible compliance plan move through far faster than those who treat licensing as a form-filling exercise. The Saudi regulators are supportive but rigorous: they reward applicants who clearly understand the rules and have built their business to meet them.

Compliance obligations every Saudi fintech must meet

A fintech licence comes with ongoing duties, and regulators monitor them closely. Build these into your operating model from day one:

• AML/CFT — robust anti-money-laundering and counter-terrorist-financing controls, KYC and transaction monitoring
• Data protection and cybersecurity — compliance with Saudi data and cybersecurity standards, secure APIs and consent management for Open Banking
• Consumer protection — transparent pricing, fair terms and clear disclosures, especially for BNPL and lending
• Capital adequacy — maintaining the required paid-up and working capital on an ongoing basis
• Shari’ah alignment — financing activities must operate in line with Shari’ah principles under the Finance Companies Control Law
• Reporting — regular regulatory reporting to SAMA or the CMA, and annual confirmation of your CR

None of these are optional, and regulators view weak compliance as a serious matter. The good news is that building these controls properly also makes your business more investable: institutional partners, banks and acquirers all conduct their own due diligence, and a fintech with clean AML, strong cybersecurity and transparent consumer terms clears those checks far more easily.

High-opportunity fintech segments in 2026

Not every fintech vertical is equally open. Some are crowded, some are still emerging, and a few are being actively encouraged by policy. Understanding where the runway is helps you position your application and your business model.

• Open Banking — now a fully licensed activity after moving out of the SAMA sandbox in 2026, creating room for account-aggregation, lending-decisioning and payment-initiation players built on standardised APIs.
• Payments and embedded finance — with non-cash payments already around 85% of retail, the next wave is embedding payments and financial services inside non-financial apps and platforms.
• SME and consumer lending, including BNPL — strong demand from under-served small businesses and consumers, licensed and supervised by SAMA with a clear consumer-protection emphasis.
• Wealthtech and robo-advisory — a growing, young, investing population creates demand for digital wealth and investment platforms under the CMA.
• Insurtech and regtech — digitising insurance distribution and helping financial firms automate compliance are both rising as the regulated market matures.

Whichever segment you target, the winning approach is the same: pick a clearly defined, properly capitalised, well-regulated lane, validate it through the sandbox or ExPermit where appropriate, and build compliance and security in from the first line of code rather than retrofitting it later.

Common mistakes to avoid

• Misidentifying your regulator — applying to SAMA when your model is a CMA activity (or vice versa) wastes months
• Underestimating regulatory capital — it must be deposited and maintained, not just declared
• Skipping the sandbox when a test-and-learn entry would have lowered cost and risk
• Treating the MISA licence as optional — a foreign-owned fintech needs both MISA and the financial licence
• Starting document attestation too late — embassy legalisation and Arabic translation are the main causes of delay
• Leaving AML/CFT, cybersecurity and consumer-protection compliance until after launch instead of building it in from the start

Frequently Asked Questions

How do I set up a fintech company in Saudi Arabia in 2026?

You need two approvals: a MISA investment licence allowing foreign ownership, and a financial licence from SAMA (for payments, BNPL or lending) or the CMA (for crowdfunding or robo-advisory). After defining your activity and regulator, you obtain the MISA licence, complete Commercial Registration, then apply for the financial licence and deposit the required capital.

Who regulates fintech in Saudi Arabia, SAMA or CMA?

Both. SAMA (the Saudi Central Bank) regulates payments, BNPL, lending, finance companies, insurtech and debt crowdfunding. The CMA (Capital Market Authority) regulates investment-related fintech such as equity crowdfunding, robo-advisory and investment platforms. A simple rule: if you move money or lend, think SAMA; if you help people invest, think CMA.

What is the minimum capital for a payment fintech in Saudi Arabia?

Under SAMA’s payment services rules, a Micro Payment Institution requires a Saudi LLC with at least SAR 1 million in paid-up capital, while a Major Payment Institution requires SAR 3 million. The capital must be maintained as ongoing working capital. Always confirm current thresholds on the SAMA portal, as figures can be updated.

What is the SAMA Regulatory Sandbox?

The SAMA Regulatory Sandbox is a controlled, test-and-learn environment where selected fintechs trial innovative payment, lending and Open Banking models with a limited customer base under SAMA’s supervision, before applying for a full licence. Open Banking moved from the sandbox into full licensing in 2026, with Lean Technologies becoming the first licensed Open Banking firm.

Do I need a MISA licence to launch a fintech in Saudi Arabia?

Yes, if your fintech is foreign-owned. The MISA investment licence from the Ministry of Investment authorises non-Saudi ownership, in most activities with 100% foreign ownership. It does not replace the SAMA or CMA financial licence — you need both: MISA for ownership and the financial regulator for the regulated activity.

How long does it take to get a fintech licence in Saudi Arabia?

The MISA licence is typically issued within 3 to 10 business days with complete, attested documents. The financial licence from SAMA or the CMA takes longer and depends on the activity, your readiness, and whether you enter through the sandbox or ExPermit first. Plan for a multi-stage timeline of several months for full authorisation.

Can a foreigner own 100% of a fintech company in Saudi Arabia?

Yes. In most activities the MISA licence permits 100% foreign ownership of a Saudi company with no local partner required. A limited number of restricted activities sit on the MISA negative list, so confirm your specific activity is open to full foreign ownership before applying.

Can Noble Core help me set up a fintech company in Saudi Arabia?

Yes. Noble Core handles the full journey end to end — activity and regulator selection, MISA investment licence, document attestation and translation, Commercial Registration, the SAMA or CMA application, capital structuring, and post-licence registrations with ZATCA, GOSI and Qiwa. Our setup package starts from SAR 36,999.