In plain words

SAMA is the Saudi Central Bank. It was founded in 1952 as the Saudi Arabian Monetary Authority, and in 2020 it took its current name while keeping the short form everyone already used. 1

Picture a city that both issues driving licences and owns the roads. SAMA decides who may run a bank, a payment company or a wallet in Saudi Arabia, and it also owns the national payment systems those companies drive on: SARIE for bank transfers, mada for debit cards and SADAD for bills. 2

For a founder, that makes SAMA the first stop for almost any product that holds or moves money for people in Saudi Arabia. It is also a regulator that has actively tried to grow a local fintech sector, with a sandbox for testing new products and a payments law that created licences for non-bank payment and e-money firms.

How it works

How a fintech gets to market under SAMA

Most teams move through some version of these four stages.

  1. 1

    Define the activity

    Payments, e-money, lending, banking or something new. Each points to a different set of SAMA rules.

  2. 2

    Test or partner

    Either test the product in SAMA’s regulatory sandbox, or launch through an institution SAMA already licenses.

  3. 3

    Apply for a licence

    Usually through a locally incorporated company, with capital, governance, AML, cyber security and data controls ready for review.

  4. 4

    Connect and operate

    Plug into the national rails, directly or through a bank, and report to SAMA under ongoing supervision.

What SAMA licenses

SAMA’s remit covers most of the Saudi financial sector outside the capital markets. For fintech founders, these are the categories that come up most often.

CategoryWhat it allowsTypical fintech
Payment institutionMoving money, for example transfers, merchant acquiring or payment initiationPayment gateways, remittance apps, merchant tools
E-money institutionIssuing e-money and holding customer balances, as well as payment servicesWallets and prepaid card programmes
Finance companyConsumer and business credit, including buy now, pay laterLending and BNPL apps
Bank, including digital banksDeposits and lendingDigital-only banks

Payment and e-money licences rest on the Law of Payments and Payment Services and its implementing regulations. The rules set different tiers depending on the size of the business, so requirements scale as you grow. Check the current tiers, capital and conditions with SAMA or a local adviser before you plan around them. 1

Investment fintech, such as robo-advice or equity crowdfunding, sits with the Capital Market Authority, not SAMA. The two regulators also back Fintech Saudi, an initiative that helps early-stage fintechs understand the market and the rules.

Two practical points catch foreign founders out. First, a licence is usually granted to a company set up in Saudi Arabia, not to a foreign parent. Second, the licence comes with obligations from day one: capital that must be kept up, named people accountable for compliance and risk, and regular reporting to SAMA. Plan the team and the budget for both, not only for the application.

The sandbox and the rules that come with a licence

SAMA runs a regulatory sandbox where fintechs can test new products with real customers, under supervision and agreed limits, before seeking a full licence. It is useful when a product does not fit an existing category neatly, or when you want evidence before committing to a full application.

A licence also brings rules that shape how you build the product:

01

Cyber security

The SAMA Cyber Security Framework applies to the firms SAMA regulates.

02

Data protection

The Saudi PDPL governs personal data, with its own rules on transfers abroad.

03

AML and KYC

Customer checks, transaction monitoring and reporting, to SAMA’s standards.

04

Open banking

SAMA has published an open banking framework for sharing account data and initiating payments through licensed firms.

SAMA compared with the UK and the UAE

The biggest difference from the UK is that one body does both jobs. The biggest difference from the UAE is that there are no financial free zones with their own regulator for payments.

Saudi ArabiaUnited KingdomUAE (mainland)
Payments regulatorSAMAFCACBUAE
Is it the central bank?YesNo, the Bank of England is separateYes
Wallet licenceE-money institutionEMISVF
Instant paymentssarieFaster PaymentsAani
Domestic card schememadaNone; Visa and MastercardJaywan

Licences do not travel between these countries. For what needs to change per market, see the GCC expansion configuration matrix.

Example: an SME card startup enters Riyadh

Sara runs an expense card startup for small businesses in Dubai. Several of her clients have teams in Riyadh and ask for the same product there.

  1. The activities. Her product holds a company balance, issues cards to staff and pays suppliers. In Saudi terms, that is e-money plus payment services.
  2. The route. She sets up a Saudi company and launches with a SAMA-licensed partner that holds the regulated activities, while her team runs the app and the back office.
  3. The local details. Her cards need to work on mada terminals, supplier payments need to go through SARIE, and customer data needs to meet the Saudi PDPL. None of this was in her UAE build.
  4. The licence plan. Once the Saudi business proves itself, she prepares her own e-money licence application, using real transaction data and working controls as evidence.

Common misconceptions

“A UAE licence covers Saudi Arabia.”

It does not. There is no passporting between Gulf countries, and SAMA licenses its own market.

“Only banks can do payments in Saudi Arabia.”

The payments law created licences for non-bank payment and e-money institutions, and a number of fintech wallets now operate under them.

“The sandbox is a shortcut to a licence.”

It is a supervised test with limits. You still need to meet the full licence requirements when you leave it.

FAQ

What does SAMA stand for?

SAMA originally stood for the Saudi Arabian Monetary Authority. In 2020 it was renamed the Saudi Central Bank but kept the short name SAMA.

Does a fintech need a SAMA licence to operate in Saudi Arabia?

If it provides payment services or issues e-money to people in Saudi Arabia, yes, or it must work through a firm that SAMA already licenses. Lending, banking and insurance have their own licences, and investment-related fintech is regulated by the Capital Market Authority instead.

What is the SAMA regulatory sandbox?

It is a programme where fintechs can test new financial products with real customers, under SAMA's supervision and agreed limits, before applying for a full licence. It helps both the company and the regulator learn how the product behaves.

What is the difference between a payment institution and an e-money institution in Saudi Arabia?

Under the Law of Payments and Payment Services, a payment institution moves money, for example transfers or merchant acquiring. An e-money institution can also issue e-money, which lets customers hold a balance in a wallet and spend it later.

Who runs mada and SARIE?

Both are national payment systems owned by SAMA. They have been operated through Saudi Payments, a company owned by SAMA.

Is SAMA the same as the CBUAE?

No. SAMA is Saudi Arabia's central bank and regulator, and the CBUAE plays that role in the UAE. Each has its own licences, so a licence in one country does not let you operate in the other.

Related terms

SARIEmadaSaudi PaymentsSADADRegulatory sandboxSAMA CSFSaudi PDPLEMIPIOpen banking

Sources

  1. 1 SC

    Saudi Central Bank Saudi Central Bank (SAMA)

    https://www.sama.gov.sa/en-US/Pages/default.aspx
  2. 2 SC

    Saudi Central Bank National payment systems: sarie

    https://www.sama.gov.sa/en-US/payment/Pages/SARIE.aspx
  3. 3 SC

    Saudi Central Bank National payment systems: mada

    https://www.sama.gov.sa/en-US/payment/Pages/mada.aspx