COMPARE LICENCES
Twenty activities side by side — who regulates it, which licence it needs, the capital floor, how long it takes and whether the sandbox comes first.
SAMA · 54 ON THE MAP
Accepting, processing, or routing payment transactions on behalf of merchants or consumers. The licence sits with the provider, not the merchant.
SAMA · 21 ON THE MAP
Holding customer balances for spending, transfer, or top-up. SAMA’s PSP regulations set out e-money issuance as its own licensing category.
SAMA · 15 ON THE MAP
Deferred payment at the point of sale. BNPL sits inside SAMA’s finance company regime — the licensed finance company count passed 71 in April 2026.
SAMA · 18 ON THE MAP
Reading account data or initiating payments on a customer’s instruction. SAMA opened formal licensing in March 2026 after the sandbox phase closed; Lean Technologies took the first licence.
SAMA · 12 ON THE MAP
Cross-border transfer of funds for retail or corporate senders. The Kingdom is one of the largest outbound remittance corridors in the world, which is exactly why the capital floor is what it is.
SAMA · 20 ON THE MAP
Matching lenders with SME borrowers. The most crowded permitted category — most platforms entered through the SAMA sandbox first, pointed at an SME funding gap estimated near USD 80bn.
CMA · 10 ON THE MAP
Managing or advising on investment portfolios through an automated interface. CMA territory, not SAMA — and the CMA runs its own Fintech Lab, separate from the SAMA sandbox.
INSURANCE AUTHORITY · 5 ON THE MAP
Distributing, aggregating, or embedding insurance digitally. Moved to the Insurance Authority when it was established in 2023 — supervision changed hands mid-market.
SAMA · 6 ON THE MAP
Onboarding, verification, and liveness supplied to regulated entities. You inherit your client’s obligations rather than holding your own licence — which means their supervisor is effectively yours.
REGA · 3 ON THE MAP
Raising retail capital against property assets. Sits with REGA, usually alongside a CMA or SAMA permission depending on the instrument.
SAMA · 5 ON THE MAP
Deposit-taking and full banking business, digital-only. Three licences issued since the 2020 framework; capital has run SAR 1.5bn and above.
CMA · 7 ON THE MAP
Selling equity in private companies to investors through a platform. CMA-authorised, distinct from the SAMA debt permits — the two are routinely confused, at the cost of a quarter.
SAMA · 15 ON THE MAP
Financing receivables, purchase orders, or supplier invoices. Several entrants are still testing this inside the sandbox.
SAMA · 3 ON THE MAP
Digitised savings circles (jam’iyyah). A genuinely new category — permitted in the sandbox before any standing licence exists.
SAMA · 10 ON THE MAP
Small-ticket consumer credit, often embedded in a telco or wallet.
SAMA · 4 ON THE MAP
Collecting and reporting credit data. A closed category — bureaus are licensed individually, not on an open application route.
SAMA · 8 ON THE MAP
Cards, expense controls, and treasury tooling for companies. Most entrants launch on a licensed partner’s permission first and take their own later, if at all.
SDAIA · 1 ON THE MAP
Not a fintech licence — an obligation every fintech carries. PDPL sets consent, transfer, retention, and breach duties on top of whatever SAMA or the CMA already require.
ZATCA · 2 ON THE MAP
Phase 2 integration with the national e-invoicing platform. Payment and lending platforms that issue invoices on a merchant’s behalf inherit this through the merchant relationship.
NCA / SAMA · 4 ON THE MAP
NCA essential cybersecurity controls sit alongside SAMA’s own cyber framework. Two overlapping control sets, one audit season — plan the mapping once rather than twice.
THE LICENCE ROUTE
STAGE 01 · 1–3 MONTHS
STAGE 02 · 2–4 MONTHS
STAGE 03 · 6–12 MONTHS
STAGE 04 · 6–12 MONTHS
STAGE 05 · ONGOING
