Launching a Fintech in Saudi Arabia: Sandbox, Licence and Open Banking Steps

The path for a foreign fintech entering Saudi Arabia, from choosing the regulator and sandbox to licensing, open banking integration and launch.

Fintech in Saudi Arabia is regulated by the Saudi Central Bank (SAMA) for payments, lending, insurance technology and banking activities, and by the Capital Market Authority (CMA) for investment-related activities such as crowdfunding for securities, robo-advice and wealth platforms. Both run testing environments, and SAMA has issued an open banking framework. The Financial Sector Development Program and the Fintech Saudi initiative promote the sector. The stages below describe the typical path from idea to licensed operation.

Before stage one

Identify precisely which activity you will perform, because the regulator, licence category and capital expectations depend on it. A payments app, a consumer lending platform and a robo-adviser follow different paths. Prepare governance, compliance, cybersecurity and data protection plans before engaging the regulator, since the first meeting goes better with a clear product and a credible control framework.

• A defined regulated activity, target customers and revenue model.
• A plan for local presence, board composition and Saudi staff.
• Compliance, anti-money laundering and cybersecurity frameworks in draft.
• A capital and funding plan covering the licensing period, which can be long.
• A legal opinion on whether the product needs a licence at all.

Stage 1: Identify the regulator and pathway

Determine whether SAMA or CMA covers your activity, and whether a sandbox, a test permit or a full licence is the right starting point.

• Deliverable: A regulatory map for the product with the licence category identified.
• Owner: Founders with regulatory counsel.
• Approval gate: Pathway confirmed through early engagement with the regulator rather than assumed.

Stage 2: Set up the entity

Register with MISA and the Ministry of Commerce as required, open a bank account and recruit the core local team.

• Deliverable: Registered company with the activities needed and key roles filled.
• Owner: Legal and people teams.
• Approval gate: Regulator requirements for ownership, fit and proper management and governance met.

Stage 3: Enter the sandbox or testing phase

Apply to test the product with a limited number of customers under regulatory supervision, agreeing limits and reporting.

• Deliverable: Sandbox or test permit approval with an agreed test plan.
• Owner: Product and compliance leads.
• Approval gate: Testing objectives, customer limits and success criteria defined and agreed.

Stage 4: Build compliance and security

Implement anti-money laundering, customer protection, complaints handling, cybersecurity and data protection controls aligned with regulator requirements and the Personal Data Protection Law.

• Deliverable: Documented and tested controls with named owners.
• Owner: Compliance officer and security lead.
• Approval gate: Controls tested independently before wider launch.

Stage 5: Integrate open banking where relevant

Connect to bank interfaces under SAMA's open banking framework for account information or payment initiation, following its technical and security standards.

• Deliverable: Working integrations with participating banks.
• Owner: Technology team.
• Approval gate: Integration and security testing accepted under the framework.

Stage 6: Apply for the full licence

Submit the licence application with evidence from testing, audited controls, a business plan and full documentation.

• Deliverable: Licence or conditional approval with its conditions listed.
• Owner: Founders and counsel.
• Approval gate: All pre-licence conditions satisfied and capital in place.

Stage 7: Launch and scale

Launch to the public, monitor compliance and expand products within the licence scope, applying for variations when adding activities.

• Deliverable: An operating fintech with regulatory reporting running on schedule.
• Owner: Management team.
• Approval gate: Ongoing reporting and audit obligations met each period.

Handovers between stages

The critical transition is from sandbox to full licence. Products often need changes after testing, compliance controls must scale from a handful of customers to many, and investors expect growth at the same time. Plan the licensing application during the sandbox rather than after it, and keep the regulator informed about product changes as they happen.

How you know it is finished

The fintech is established when it holds the appropriate licence, operates with tested controls, integrates with banks and payment partners as needed, meets ongoing reporting obligations and can add products without renegotiating its whole regulatory position.

If a Vision 2030 programme or market trend is shaping your investment case, Domira can test it against real land, construction costs and local demand in the city you are considering before you commit capital.