Fintech Licence in Riyadh (2026): SAMA & Sandbox

By Fazal Hashmi — Sr. Business Consultant, Noble Core · Updated June 2026

What a fintech licence in Riyadh actually means

“Fintech licence” is an umbrella term. In Saudi Arabia there is no single fintech permit — your authorisation depends on what your product does. The two financial regulators are the Saudi Central Bank (SAMA), which oversees payments, e-money, lending, money transfer, and insurance-tech, and the Capital Market Authority (CMA), which oversees investment, crowdfunding, robo-advisory, and capital-market activities. On top of the financial permit, every company also needs the standard commercial setup: a Ministry of Investment (MISA) investment licence for foreign ownership, a Commercial Register from the Ministry of Commerce, and registration with the Saudi Business Center.

Think of it as two layers. The corporate layer makes your company legally exist and lets you hire and invoice. The regulatory layer (SAMA or CMA) gives you permission to handle regulated financial activity. A payment-app founder in Riyadh needs both; a pure software vendor selling tools to banks may only need the corporate layer. Getting this distinction right early saves months.

Riyadh is the natural home for a Saudi fintech. It hosts SAMA’s headquarters, the Capital Market Authority, the Ministry of Investment, and the country’s largest concentration of banks, payment processors, and venture capital. Vision 2030 explicitly targets a cashless, digitally-enabled economy, and the Financial Sector Development Program has set ambitious goals for the share of digital payments and the number of licensed fintechs in the Kingdom. For a founder, that translates into a regulator that is actively building pathways for innovation rather than gatekeeping it — the Sandbox being the clearest example.

Who needs a SAMA or CMA fintech licence

You need a regulatory financial licence if your business touches client money or regulated financial services. You do not need one if you only sell software or consulting to financial institutions without holding funds or providing the regulated service yourself.

• SAMA-regulated: digital wallets and e-money, payment gateways and acquiring, money transfer/remittance, consumer or SME lending, buy-now-pay-later (BNPL), open banking services, and insurance-technology (insurtech).
• CMA-regulated: equity and debt crowdfunding, robo-advisory and digital wealth management, investment platforms, and securities-related activities.
• Corporate layer only (no SAMA/CMA permit): SaaS for banks, white-label tech providers, data analytics, and back-office fintech tooling — though you must still confirm scope with the relevant authority.

If you are unsure which bucket you fall into, the safest first step is the SAMA Regulatory Sandbox application, which is designed precisely to test innovative models under supervision before a full licence is required. Our team at Noble Core can help you map your activity to the correct regulator before you spend on the wrong pathway.

A closer look at the main fintech activities

Each activity sits under a specific regulatory framework, and the requirements scale with the risk your product carries to consumers and the financial system.

• Payments and e-money: Digital wallets, prepaid accounts, and payment gateways fall under SAMA’s payment-services rules. These carry consumer-protection, settlement, and safeguarding-of-funds obligations because you may hold customer balances.
• Lending and BNPL: Consumer finance, SME lending, and buy-now-pay-later are among the fastest-growing Saudi fintech segments. SAMA has issued dedicated rules for BNPL providers, with affordability, disclosure, and reporting requirements.
• Open banking: SAMA’s Open Banking Framework lets licensed third parties access account data and initiate payments with customer consent. Account-information and payment-initiation services are a structured opportunity for new entrants in Riyadh.
• Insurtech: Insurance-technology activities are supervised within the insurance framework now consolidated under the Insurance Authority and SAMA’s wider remit; confirm the current supervisor for your specific model.
• Crowdfunding and wealth-tech: Equity and debt crowdfunding, robo-advisory, and digital investment platforms are CMA-regulated, with their own fintech permits and capital thresholds.

The SAMA Regulatory Sandbox explained

The SAMA Regulatory Sandbox is a controlled “test-and-learn” environment that lets fintech firms trial innovative products with real customers under defined limits before applying for a full licence. It is the most common entry point for payment, lending, and e-money startups in Riyadh, and it dramatically lowers the barrier for early-stage and foreign founders.

How the Sandbox works

Once accepted, you operate under a limited “permit to test” with caps on customer numbers, transaction volumes, and duration (commonly several months, extendable). SAMA monitors your product, reviews outcomes, and — if the test succeeds and you meet capital and governance standards — guides you toward a full licence. The Sandbox is published on SAMA’s official site at sama.gov.sa, where current cohorts and eligibility criteria are listed.

Sandbox eligibility in brief

• A genuinely innovative product or business model with a clear consumer benefit.
• Readiness to test in a live (but limited) environment with real users.
• A defined testing plan, risk controls, and an exit/transition strategy.
• A registered Saudi entity (or a clear plan to form one) — this is where the MISA licence and Commercial Register come in.

From Sandbox to full licence

The Sandbox is a bridge, not a destination. While you test, you are gathering exactly the evidence the regulator wants for a permanent permit: real transaction data, proof your controls work, customer-complaint handling, and a track record of safe operation. A well-run test shortens the full-licensing conversation because you have already demonstrated the things a cold application can only promise. Plan the transition from the start — know which full licence you are aiming for, build your capital toward its threshold during the test period, and keep your governance and reporting at full-licence standard from day one so the step up is administrative rather than transformational.

Step-by-step: how to get your fintech licence in Riyadh

Here is the practical sequence most foreign-owned fintechs follow. The corporate steps and the regulatory steps run partly in parallel, but the order below reflects a clean, low-risk path.

1. Define and classify your activity. Confirm whether you are SAMA-regulated, CMA-regulated, or corporate-only. This determines every later step.
2. Apply to the SAMA Regulatory Sandbox (for most payment/lending/e-money models) via the SAMA portal at sama.gov.sa. Submit your product description, testing plan, and risk controls.
3. Obtain your MISA investment licence. Apply through the Ministry of Investment (MISA) so your foreign-owned company can legally form and own 100% in most activities. MISA licensing typically takes 3–10 business days.
4. Issue your Commercial Register (CR). Register the company through the Ministry of Commerce and the Saudi Business Center at business.sa. Under the new Commercial Register Law effective 3 April 2026, you receive a unified national CR with an ID starting with “7” and no expiry date.
5. Join the Chamber of Commerce and complete municipal and administrative registrations.
6. Register for tax with ZATCA. Set up your VAT and e-invoicing (Fatoora) account at zatca.gov.sa. VAT is 15% and e-invoicing integration rolls out in waves.
7. Register staff with GOSI and set up labour files on Qiwa. Use qiwa.sa for the labour file and gosi.gov.sa for social insurance; arrange Iqamas for foreign staff through Muqeem and Absher.
8. Complete the Sandbox test, then apply for the full SAMA or CMA licence, meeting the capital, governance, AML/CFT, and cybersecurity requirements set by the regulator.

Required documents and IDs

Prepare these before you start so applications are not bounced back. Exact requirements vary by activity and regulator, so always confirm the current checklist on the official portal.

• Certified copies of shareholder passports and, for corporate shareholders, the parent company’s commercial registration and audited financials.
• A detailed business plan and a fintech-specific product description (data flows, customer journey, fund-handling model).
• A Sandbox testing plan with risk controls, AML/CFT framework, and a cybersecurity overview for SAMA.
• Proposed Articles of Association and the company’s proposed Arabic and English trade names (English trade names are now permitted under the 2026 CR law).
• National Address registration, a Riyadh office lease/Ejar contract, and details of key management (fit-and-proper for senior roles).
• Source-of-funds evidence and proof of paid-up or committed capital appropriate to the activity.

Indicative fees and timelines

The table below gives indicative 2026 figures in Saudi Riyals to help you budget. Government fees can change and many depend on activity and headcount, so treat these as planning numbers and confirm current figures on the official portal before you commit.

Item	Indicative cost (SAR)	Typical timeline
SAMA Regulatory Sandbox application	No standard published fee (confirm with SAMA)	Assessed per cohort
MISA investment licence (issue/renew)	Fees suspended in 2026 (were SAR 12,000 issue / 62,000 renew)	3–10 business days
Commercial Register (CR)	~1,200–2,000 (indicative)	1–3 business days
Chamber of Commerce membership	~2,000–3,000 / year (indicative)	Same day–2 days
Iqama (issuance/renewal govt fee)	~650 / year + applicable levies (indicative)	Per application
GOSI social insurance (Saudi staff)	~21.5% total contribution (employer + employee)	Monthly
VAT registration (ZATCA)	No fee; VAT rate 15%	Online, same day
Noble Core foreign-company setup package	From 36,999	Managed end-to-end

The full SAMA or CMA licence stage carries additional, activity-specific capital and compliance requirements that vary widely — a payment institution and a crowdfunding platform sit at very different thresholds. Build the regulatory capital into your model from day one rather than treating it as an afterthought.

Capital, governance, and compliance requirements

The Sandbox lowers the barrier to test, but a full SAMA or CMA licence raises the bar on substance. Financial regulators worldwide — and Saudi Arabia is no exception — assess four pillars: minimum capital, governance, risk management, and security. Knowing what they look for lets you prepare credibly rather than scrambling at the licensing stage.

Minimum capital

Each licensed activity has its own minimum paid-up capital, set by the regulator to match the risk the activity poses. A money-transfer or payment institution sits at a different threshold from an e-money issuer or a crowdfunding platform. Because these figures are activity-specific and periodically updated, confirm the current requirement directly with SAMA or the CMA for your exact licence — do not budget from a competitor’s old number.

Governance and fit-and-proper

Regulators expect a clear board and senior-management structure, with key individuals passing fit-and-proper checks covering experience, integrity, and financial soundness. A Riyadh-based, qualified compliance function and a money-laundering reporting officer are typically expected. Foreign-owned fintechs should plan for genuine local substance, not a paper presence.

AML/CFT, consumer protection, and cybersecurity

You will need a documented anti-money-laundering and counter-terrorist-financing framework, KYC and transaction-monitoring controls, a consumer-protection and complaints process, and a cybersecurity program aligned with SAMA’s expectations. Data-residency and customer-data-protection requirements also apply. These frameworks are not optional add-ons — they are core to whether your application succeeds.

The corporate setup behind the licence

Even the best Sandbox application stalls if the company underneath it is not correctly formed. The corporate layer is where most timeline surprises hide, so it pays to get it right with experienced support. For foreign founders, the headline is positive: 100% foreign ownership is available in most activities, MISA licensing is fast, and the 2026 Commercial Register reform has simplified the paperwork.

If you want the full picture of forming a Saudi entity — from MISA approval to CR, Chamber, ZATCA, GOSI, and Qiwa — see our detailed guide to company formation in Saudi Arabia. Because the investment licence is the gateway to foreign ownership, also read our dedicated walkthrough of the MISA licence in Saudi Arabia, which covers eligibility, documents, and the suspended-fee position for 2026.

The 2026 Commercial Register reform in one paragraph

The new Commercial Register Law took effect on 3 April 2026. It introduces a unified national CR (so you no longer juggle separate registers per city), CR identifiers that begin with “7”, no expiry date (you submit an annual confirmation instead of renewing), a five-year grace period for the transition, and the long-awaited option to register English trade names. For a fintech planning to operate across Riyadh, Jeddah, and the Eastern Province, this is a meaningful simplification.

Tax, e-invoicing, and ongoing compliance

Once licensed, fintechs in Riyadh carry the same core obligations as other Saudi companies, plus their regulator’s reporting. Build these into your operating calendar from launch.

• VAT and ZATCA: Register for VAT (15%) and integrate with the Fatoora e-invoicing system, which rolls out in waves; ZATCA notifies you of your integration window. Manage everything via zatca.gov.sa.
• GOSI: Register all staff and pay social-insurance contributions (~21.5% total for Saudi employees) through gosi.gov.sa.
• Qiwa and Muqeem: Maintain your labour file on qiwa.sa and manage residency records on muqeem.sa; issue and renew Iqamas via Absher at absher.sa.
• SAMA/CMA reporting: Once licensed, you submit periodic regulatory reports covering capital adequacy, AML/CFT, consumer protection, and cybersecurity. Treat these as core operations, not paperwork.

Common errors that delay fintech approvals

Most delays are avoidable. The patterns below come up repeatedly with Riyadh fintech applicants.

Common mistakes to avoid

• Choosing the wrong regulator. Applying to SAMA for a CMA activity (or vice versa) wastes weeks. Classify your activity first.
• Skipping the Sandbox. Many early-stage models are better off testing in the SAMA Sandbox than chasing a full licence prematurely.
• Forming the company before confirming the activity. Set up the CR around the licensed activity, not the other way round.
• Underestimating regulatory capital. Full SAMA/CMA permits carry activity-specific capital and governance thresholds — model them from day one.
• Weak AML/CFT and cybersecurity documentation. These are make-or-break for financial regulators; thin paperwork gets bounced.
• Ignoring ZATCA e-invoicing timing. Missing your Fatoora integration wave creates compliance gaps from launch.
• Assuming old fee figures. MISA issue/renew fees are suspended in 2026 and CR rules changed on 3 April 2026 — always confirm current figures on the official portal.
• Leaving GOSI and Qiwa registration to the end. You cannot properly onboard staff or sponsor Iqamas without them.

How Noble Core helps you launch a Riyadh fintech

Fintech is one of the more demanding setups in Saudi Arabia because it stacks a regulatory layer on top of standard company formation. Noble Core manages both ends so you can focus on the product. We help you classify your activity to the correct regulator, prepare and submit your SAMA Regulatory Sandbox application, and run the full corporate setup — MISA investment licence, Commercial Register, Chamber, ZATCA, GOSI, Qiwa, and Iqamas — under one project plan.

Our foreign-company setup packages start from SAR 36,999, with MISA licensing typically completed in 3–10 business days and the rest sequenced to keep your launch on schedule. We coordinate the National Address, Riyadh office lease, fit-and-proper documentation, and AML/CFT framework, and we keep your figures current against the suspended MISA fees and the 2026 Commercial Register reform. Whether you are building a payment app, a BNPL product, an insurtech tool, or a CMA-regulated investment platform, we map the cleanest path from idea to a fully licensed, compliant Riyadh entity.

The practical value of expert support shows up in the details that quietly derail self-managed setups: an activity classified to the wrong regulator, a trade-name clash, a National Address mismatch, an AML framework that reads as boilerplate, or fee assumptions based on figures that changed in 2026. We carry these for you and keep a single project timeline across SAMA or CMA, MISA, the Ministry of Commerce, ZATCA, GOSI, and Qiwa, so the moving parts stay in sync. The result is a faster route to launch and a compliance foundation that holds up as you scale across the Kingdom — book a consultation with Noble Core to get a clear, costed plan for your specific fintech model in Riyadh.

Frequently Asked Questions

Do I need a SAMA licence to start a fintech in Riyadh?

You need a SAMA licence if your fintech handles payments, e-money, lending, money transfer, BNPL, or insurance-tech. Investment, crowdfunding, and robo-advisory fall under the Capital Market Authority (CMA) instead. Pure software vendors to banks may need only the corporate setup. Most payment and lending startups begin in the SAMA Regulatory Sandbox before a full licence.

What is the SAMA Regulatory Sandbox and how does it work?

The SAMA Regulatory Sandbox is a controlled test-and-learn environment that lets fintechs trial innovative products with real customers under defined caps on volume, users, and duration. It is the most common entry route for payment and e-money startups in Riyadh. Successful tests, with strong governance and capital, transition toward a full SAMA licence. Details are published at sama.gov.sa.

How long does it take to get a fintech license in Riyadh?

The corporate layer is fast: a MISA investment licence typically issues in 3–10 business days and the Commercial Register in 1–3 days. The regulatory layer takes longer because the SAMA Sandbox runs for several months before a full licence. Overall, plan for several months from application to a fully licensed, operational fintech depending on your activity.

How much does a fintech license in Riyadh cost in 2026?

Indicative 2026 figures: MISA issue and renewal fees are suspended (previously SAR 12,000 and 62,000), Commercial Register is around SAR 1,200–2,000, and Chamber membership around SAR 2,000–3,000 per year. Full SAMA or CMA permits carry activity-specific capital requirements. Noble Core foreign-company setup packages start from SAR 36,999. Always confirm current figures on the official portal.

Can foreigners own 100% of a fintech company in Saudi Arabia?

Yes. Saudi Arabia allows 100% foreign ownership in most activities through a Ministry of Investment (MISA) investment licence, and fintech is broadly open to foreign founders. You still need the regulatory permit from SAMA or the CMA for the regulated activity itself. Noble Core helps foreign founders secure the MISA licence and the financial authorisation together.

What is the difference between a SAMA and a CMA fintech licence?

SAMA (the Saudi Central Bank) regulates payments, e-money, lending, money transfer, BNPL, open banking, and insurance-tech. The Capital Market Authority (CMA) regulates investment platforms, equity and debt crowdfunding, robo-advisory, and securities activities. Your product determines which regulator you report to. Choosing the wrong one wastes weeks, so classify your activity carefully before applying in Riyadh.

What documents do I need for a fintech licence in Riyadh?

Prepare shareholder passports, a detailed business plan and product description, a Sandbox testing plan with AML/CFT and cybersecurity frameworks, proposed Articles of Association, Arabic and English trade names, National Address and a Riyadh office lease, fit-and-proper details for senior management, and source-of-funds evidence. Exact requirements vary by activity, so confirm the current checklist on the official SAMA or CMA portal.

How does the 2026 Commercial Register reform affect my fintech setup?

The new Commercial Register Law, effective 3 April 2026, introduces a unified national CR with an ID starting with 7, no expiry date (an annual confirmation replaces renewal), a five-year transition grace period, and English trade names. For a fintech operating across Riyadh and other cities, this removes the old per-city register burden and simplifies ongoing compliance significantly.