Saudi Arabia splits financial supervision along a line that is easy to state and easy to get wrong in practice. The Capital Market Authority regulates the securities market and the firms conducting securities business in the Kingdom. The Saudi Central Bank, SAMA, supervises banks, finance companies, insurance and payment services. A firm's activity decides which door it goes through, and some fintech models touch both.
Authorised persons and what authorisation covers
The CMA authorises firms to carry on securities business, with permissions written by activity: dealing, arranging, managing, advising and custody. The permission set is the licence. A firm authorised to advise is not authorised to deal, and the distinction is not cosmetic, because dealing as principal against clients brings capital, conduct and conflict of interest obligations that advising does not.
The Kingdom has also built out a fintech track, with SAMA and the CMA operating permissions and testing routes for new models in their respective areas. That has widened what is possible, but it has widened it through supervision rather than around it. Firms hoping the fintech framing removes the need for a permission have read the direction of travel backwards.
Presence expectations follow from that. A firm authorised in the Kingdom is expected to have an office, staff and senior people who can be held responsible locally, and the regulator assesses the individuals proposed for key functions as well as the entity. This is the part of the cost that founders leave out of the model, and it is the part that cannot be compressed. The office and the payroll are the licence as much as the certificate is.
The cross-border problem is the whole story
Most firms reading this will never apply for a Saudi permission. They will instead run advertising, affiliate traffic or a Telegram funnel aimed at Saudi residents from an entity licensed somewhere else, and that is where the exposure sits. Offering or promoting securities business into a jurisdiction generally requires authorisation in that jurisdiction or reliance on a narrow exemption, and regulators across the Gulf publish warnings about unlicensed entities soliciting their residents. Those warning lists have practical consequences well beyond enforcement: banks and payment providers read them during onboarding and periodic review.
The defensive argument founders reach for is that the client approached them. That doctrine exists in some regimes and is drawn far more narrowly than marketing teams assume, and it collapses the moment there is a campaign, an affiliate link or a local-language landing page. We set out how thin that ground is in reverse solicitation, and the same reasoning applies to offshore marketing into regulated markets generally.
General information, not legal advice. Requirements, exemptions and enforcement practice in Saudi Arabia are matters for qualified local counsel, and any firm targeting clients in the Kingdom should take that advice before it spends on acquisition.
How the payment layer reacts
Founders usually discover the jurisdiction problem through payments rather than through a regulator. Acquirers ask which countries the customer base sits in, and cross-border card transactions into markets where the merchant has no local licence attract more scrutiny, higher declines and occasionally a rolling reserve. Issuers in the region decline transactions they read as high-risk cross-border. Correspondent banks review the geography of the flows. None of this involves a regulator writing a letter; it is risk scoring, and it happens automatically.
Local payment rails complicate the picture further. Domestic instant payment and card schemes are built for licensed domestic businesses, and access to them typically runs through a locally regulated acquirer or payment institution. A firm without local standing ends up on international rails at international pricing and international approval rates, which is covered in our guide to local payment methods and in payment approval rates.
Product design details that matter in the Kingdom
Two product features come up in every Gulf conversation. The first is swap-free account handling, since overnight financing is unacceptable to a large part of the client base for religious reasons, and the mechanics of how a firm replaces swaps without recreating them under another name are a genuine design question rather than a checkbox. We cover it in Islamic account rules. The second is marketing conduct: risk warnings, bonus and incentive restrictions, and claims about performance. Restrictions of this kind exist across many regimes and advertising platforms enforce their own financial services policies on top, which is discussed in CFD marketing restrictions.
The honest conclusion
For a firm that wants Saudi retail clients as a core market, there is no substitute for local authorisation and local presence, and the cost of that route is the point rather than an obstacle to be engineered around. For a firm that does not intend to apply, the disciplined answer is to exclude the Kingdom properly: geo-blocking that actually works, no local-language acquisition, affiliate contracts that prohibit it, and onboarding checks that catch residency rather than only nationality. Half-measures produce the worst outcome, which is exposure without the client volume that would have justified it.
SINGUARD's role in this is narrow and worth stating plainly. We build software: the trading platform, the CRM and the client portal, with the controls a compliance team needs to enforce country restrictions and keep records. SINGUARD holds no financial services licence in any jurisdiction and is not a broker, bank, payment institution or adviser. Firms operating in or into Saudi Arabia are responsible for their own licensing and must take their own legal advice. Our Riyadh overview covers how regional firms tend to organise the work.
"Every quarter someone shows me a funnel pointed at Riyadh and a licence from a country nobody in Riyadh has heard of. That is not a structure, that is a countdown."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- The CMA regulates securities business in Saudi Arabia while SAMA supervises banks, finance companies, insurance and payments.
- Authorisation is written by activity, so dealing, arranging, advising and custody are separate permissions rather than one licence.
- The real exposure for most firms is cross-border solicitation of Saudi residents, and reverse solicitation arguments are far narrower than marketing teams assume.
- Country restrictions have to be enforced technically through geo-blocking, residency checks and affiliate contracts, not stated in a footer.
Frequently Asked Questions
Can a foreign broker accept Saudi residents without a CMA permission?
Offering or promoting securities business into the Kingdom generally requires authorisation there, and regulators in the region publish warnings about unlicensed entities soliciting residents. Any firm considering this must take qualified local legal advice rather than relying on general guidance.
What is the difference between the CMA and SAMA?
The Capital Market Authority regulates the securities market and securities business. The Saudi Central Bank, SAMA, supervises banks, finance companies, insurance and payment services. Which regulator applies depends on the activity, and some fintech models involve both.
Why do card payments from Saudi clients get declined so often?
Cross-border transactions into a market where the merchant has no local standing attract higher risk scoring from issuers and acquirers, and leveraged trading already sits in a high-risk category. Local rails generally require access through a locally regulated acquirer or payment institution.
About the Author
Roman Onta is an Executive Director at SINGUARD. He builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals side by side with his brother Alex Onta, and he helped on the design of eTrader, the division Alex built and leads. His ground is worldwide payment processing, AML compliance and the corporate structures brokers are built on, work the two of them carry together, shaped by executive roles in the UAE and international corporates. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.