Saudi Arabia

At a glance

Choose the route your business actually needs.

SAMA and the Saudi CMA have separate remits. Crypto business models require a specific feasibility and perimeter assessment; do not assume an available general crypto licence.

• Classify the actual activities and product mechanics before choosing the entity and licence category.
• Map customer countries and marketing channels: a home licence is not universal cross-border permission.
• Compare capital, local substance, key appointments and operational readiness for the viable route.
• Identify client money, custody, investment, payment and virtual-asset overlaps; permissions may be cumulative.

Permissions & perimeter

Distinct activities. Distinct requirements.

Application evidence

Prepare a coherent submission—not just forms.

The exact checklist depends on the authority, permission and applicant. These workstreams establish a practical preparation baseline; authority-specific forms and evidence take precedence.

1. 01Business plan and activity map: products, customer types, revenue, execution flow and target countries.
2. 02Ownership and control chart, source of funds, beneficial-owner evidence and fit-and-proper files for management.
3. 03Financial projections, capital and liquidity plan, staffing, local presence and outsourcing arrangements.
4. 04AML/CFT risk assessment, customer due diligence, sanctions screening, monitoring and reporting procedures.
5. 05Governance, compliance monitoring, complaints, cybersecurity, business continuity and incident-response policies.

Assessment to launch

A structured path through the application.

1. 01Define the products, customers, funds flow and requested activities.
2. 02Confirm the regulatory perimeter, eligible licence category and establishment requirements.
3. 03Prepare the application evidence, policies and key-person submissions.
4. 04Address regulator questions and complete any pre-launch conditions.
5. 05Implement reporting, compliance monitoring and business-change notifications.

Capital, fees and timing vary by permission and applicant. Incorporation, initial approval or a pending application does not by itself permit regulated operations. Approval remains the regulator's decision.

Beyond the licence

Compliance and risk must work in practice.

Build a permissions register, regulatory calendar and control-testing programme. Assign owners for financial-crime controls, client assets, outsourcing, cyber incidents, complaints and board reporting. Reassess permissions before adding products, jurisdictions or distribution channels.

General advisory guidance, not a legal opinion or a guarantee of eligibility. Confirm current rules and local legal requirements for the proposed business before taking action.