Crypto Regulation in Saudi Arabia: 2026 Update

Crypto regulation in Saudi Arabia has undergone a significant transformation over the past few years, shifting from an environment of informal prohibition toward a structured, multi-authority licensing regime. The Kingdom now operates one of the most actively developing digital asset frameworks in the Gulf Cooperation Council, driven by its Vision 2030 agenda and the ambition to become a regional financial technology hub. For international founders, exchanges, and institutional investors, understanding the current rules is essential before entering the Saudi market. This guide covers the regulatory authorities, licensing pathways, compliance obligations, recent legislative developments, and the practical realities of operating a crypto or virtual asset business in Saudi Arabia.

Saudi Arabia does not have a single unified crypto regulator. Oversight is distributed across three principal authorities, each with a distinct mandate.

The Saudi Central Bank, known as SAMA, supervises payment services, stablecoins with monetary characteristics, and any digital asset activity that intersects with the banking and payments infrastructure. SAMA has issued guidance restricting licensed banks and payment institutions from dealing in certain crypto assets without prior approval, and it continues to monitor systemic risk from digital asset exposure.

The Capital Market Authority, or CMA, is responsible for securities regulation. Where a digital asset qualifies as a security - based on its economic characteristics and the rights it confers - the CMA asserts jurisdiction. The CMA has been the more active of the two bodies in recent years, publishing frameworks for the issuance and trading of tokenised securities and digital investment products.

The Saudi Data and Artificial Intelligence Authority, SDAIA, plays an indirect but growing role, particularly where crypto platforms involve data processing, AI-driven trading, or identity verification systems subject to the Personal Data Protection Law.

In practice, founders should consider which regulator has primary jurisdiction over their specific product before approaching any authority. A stablecoin issuer will engage SAMA; a tokenised equity platform will engage the CMA; a platform combining both functions may need to engage both simultaneously.

Saudi Arabia does not have a single omnibus crypto law comparable to the European Union';s Markets in Crypto-Assets Regulation. Instead, the framework is assembled from several instruments issued by SAMA and the CMA, supplemented by general financial services legislation.

The CMA';s framework for digital securities, developed under the Capital Market Law and its implementing regulations, allows for the issuance, trading, and custody of tokenised financial instruments by licensed entities. This framework is technology-neutral in principle but requires that any token representing a security be issued through a CMA-licensed platform and comply with disclosure, investor protection, and anti-money laundering requirements.

SAMA has published a regulatory sandbox framework that permits fintech companies, including those working with digital assets, to test products under a controlled licence with relaxed requirements. Sandbox participants operate under time-limited approvals and must demonstrate a credible path to full compliance before graduating to a standard licence.

The Anti-Money Laundering Law and its implementing regulations, enforced by the Financial Intelligence Unit under the Presidency of State Security, apply fully to virtual asset service providers. Saudi Arabia is a member of the Financial Action Task Force, and its VASP rules closely follow the FATF Recommendations, including the Travel Rule, which requires the transmission of originator and beneficiary information for transfers above specified thresholds.

A common mistake among foreign operators is assuming that the absence of a dedicated crypto statute means the sector is unregulated. In practice, existing financial services, AML, data protection, and securities laws create a dense compliance environment that applies to most commercially meaningful crypto activities.

Obtaining a VASP licence in Saudi Arabia is a structured process that varies depending on the nature of the activity. The CMA and SAMA each operate distinct authorisation tracks, and the choice of track depends on the asset class and service type.

For exchange and brokerage services involving non-security crypto assets, the pathway currently runs through SAMA';s fintech regulatory sandbox or, for more established businesses, through a payment institution licence with a digital asset endorsement. SAMA has signalled that a dedicated virtual asset exchange framework is under active development, and several applicants are understood to be in advanced dialogue with the authority.

For platforms dealing in tokenised securities, investment tokens, or digital funds, the CMA';s authorisation framework applies. Applicants must meet capital adequacy requirements, demonstrate fit-and-proper standards for key personnel, submit a detailed business plan and risk management framework, and appoint a compliance officer with relevant experience. The CMA also requires a local legal presence - a branch or a Saudi-incorporated entity - for most licence categories.

Custody of digital assets is treated as a regulated activity. Any entity holding crypto assets on behalf of Saudi clients must either obtain a custody licence or partner with a licensed custodian. This requirement applies to both domestic and foreign-based custodians serving Saudi residents.

In practice, founders should consider the sandbox route as the most accessible entry point for early-stage businesses. Sandbox approval typically takes several months and requires a detailed application, but it provides a legal basis to operate while the full licensing framework is finalised.

If you are assessing which licensing pathway applies to your business model, our team can assist with a regulatory mapping exercise before you commit to a formal application. Contact us at info@vlolawfirm.com.

Anti-money laundering and counter-terrorism financing compliance is among the most demanding aspects of operating a crypto business in Saudi Arabia. The obligations derive from the AML Law, the Combating Terrorism Financing Law, and FATF-aligned guidelines issued by SAMA and the CMA.

All licensed VASPs must implement a risk-based AML programme. This includes customer due diligence at onboarding, enhanced due diligence for high-risk customers and politically exposed persons, ongoing transaction monitoring, and suspicious activity reporting to the Financial Intelligence Unit. The programme must be documented, tested regularly, and overseen by a designated compliance officer.

The Travel Rule, which Saudi Arabia has adopted in line with FATF Recommendation 16, requires VASPs to collect and transmit originator and beneficiary information for virtual asset transfers above a defined threshold. In practice, this means that platforms must either build or integrate technical solutions capable of exchanging Travel Rule data with counterpart VASPs, including foreign platforms. Many smaller operators underestimate the technical and operational cost of Travel Rule compliance, which can require significant investment in third-party solutions.

Know-your-customer requirements align with those applicable to traditional financial institutions. Customers must be identified using government-issued documents, and identity verification must be completed before any transaction is processed. Remote onboarding is permitted but must meet standards set by SAMA for electronic identity verification, which in Saudi Arabia is closely linked to the national digital identity infrastructure.

A non-obvious requirement is that VASPs must also screen customers and transactions against Saudi-specific sanctions lists maintained by the Presidency of State Security, in addition to international lists. Foreign operators often focus exclusively on UN and OFAC lists and overlook this domestic obligation.

Saudi Arabia does not impose personal income tax on individuals, which means that individual crypto investors are generally not subject to capital gains tax on their holdings. This is a significant structural advantage for retail participants compared with many other jurisdictions.

However, the position for corporate entities is more complex. Saudi-incorporated companies and foreign companies with a permanent establishment in Saudi Arabia are subject to corporate income tax or zakat, depending on the ownership structure. Profits derived from crypto trading, mining, or staking activities conducted through a Saudi entity are treated as taxable income for corporate tax purposes. The Zakat, Tax and Customs Authority, ZATCA, is the competent body for tax assessment and collection.

Value added tax applies to certain crypto-related services. The supply of financial services is generally exempt from VAT, but the classification of specific crypto activities - such as exchange fees, advisory services, or software licensing - requires careful analysis. ZATCA has not yet published comprehensive VAT guidance specific to digital assets, and the treatment of some activities remains uncertain.

For foreign companies providing crypto services to Saudi residents without a local presence, the withholding tax rules may apply to payments made from Saudi entities to foreign service providers. The standard withholding rate applies to service fees, and treaty relief may be available depending on the counterparty';s jurisdiction.

Many foreign founders underestimate the complexity of the zakat regime, which applies to Saudi and GCC national shareholders and is calculated on a different basis from conventional corporate income tax. Businesses with mixed ownership structures must account for both zakat and income tax obligations simultaneously.

Saudi Arabia has accelerated its digital asset regulatory agenda in recent periods, driven by both domestic financial sector ambitions and regional competition with the UAE, Bahrain, and Qatar.

The CMA has published consultation papers on a comprehensive virtual asset framework that would consolidate the current patchwork of guidance into a single rulebook. The proposed framework is expected to introduce formal licence categories for exchanges, brokers, custodians, and issuers of utility tokens, with differentiated capital and conduct requirements for each category. Market participants have broadly welcomed the direction, though concerns remain about the pace of implementation and the treatment of decentralised finance activities.

SAMA has continued to develop its central bank digital currency project, known as Project Aber, in collaboration with the UAE central bank. While Project Aber is a wholesale CBDC initiative focused on interbank settlement rather than retail payments, its development signals the Kingdom';s long-term commitment to digital monetary infrastructure and is likely to influence the regulatory treatment of private stablecoins over time.

The Financial Sector Development Program, one of the Vision 2030 delivery vehicles, has set explicit targets for increasing the contribution of fintech and digital finance to the Saudi economy. This creates a policy environment that is broadly supportive of regulated crypto activity, even as the authorities maintain strict controls on unlicensed operations.

A practical scenario worth noting: a foreign exchange seeking to serve Saudi retail customers remotely, without a local licence, faces significant legal risk. SAMA and the CMA have both indicated that cross-border provision of regulated services to Saudi residents without authorisation is treated as a violation of the financial services licensing regime, regardless of where the platform is incorporated.

A second scenario: a tokenised real estate platform seeking to offer fractional ownership of Saudi property to international investors must navigate both CMA securities rules and the Foreign Investment Law administered by the Ministry of Investment. The intersection of these two regimes adds complexity that is often underestimated at the planning stage.

For businesses navigating the licensing and compliance requirements described above, structured legal advice at the outset can prevent costly restructuring later. Reach out to our team at info@vlolawfirm.com to discuss your specific situation.

Is it legal to buy and hold crypto as an individual in Saudi Arabia?

The legal position for individual retail holders has evolved. While earlier SAMA guidance discouraged retail participation in crypto assets, there is no current statutory prohibition on individuals holding or transacting in crypto assets for personal purposes. However, individuals using unlicensed platforms or engaging in activities that constitute regulated financial services without authorisation may face legal exposure. The absence of a formal prohibition is not the same as a positive legal entitlement, and the regulatory environment continues to develop. Individuals with significant holdings or active trading strategies should seek specific legal advice on their circumstances.

How long does it take to obtain a VASP licence or sandbox approval in Saudi Arabia?

Timelines vary considerably depending on the type of authorisation sought and the completeness of the application. Sandbox applications to SAMA typically take between three and six months from submission to approval, assuming the application is well-prepared and the regulator does not request significant additional information. Full licence applications to the CMA for securities-related digital asset activities tend to take longer, often six to twelve months or more, particularly where the business model is novel or the applicant lacks a prior track record in Saudi Arabia. Applicants who engage with the regulator informally before submitting a formal application - through pre-application meetings or regulatory dialogue - generally experience shorter review periods.

Does Saudi Arabia recognise foreign crypto licences, or must businesses obtain a local licence?

Saudi Arabia does not operate a mutual recognition or passporting regime for foreign crypto licences. A licence issued by another jurisdiction - including the UAE, EU member states, or the United Kingdom - does not confer any right to provide regulated services to Saudi residents. Foreign-licensed entities wishing to operate in Saudi Arabia must either establish a local presence and obtain the relevant Saudi authorisation, or structure their activities so that they fall outside the scope of regulated services in the Kingdom. The latter approach carries significant risk and requires careful legal analysis. In practice, most serious market entrants pursue a local licence or a sandbox approval as the primary route to market.

Saudi Arabia';s approach to crypto regulation is evolving rapidly, moving from informal restriction toward a structured, multi-authority framework aligned with international standards. The regulatory environment rewards preparation: businesses that understand the licensing landscape, AML obligations, and tax treatment before entering the market are far better positioned than those that attempt to navigate compliance retrospectively.

VLO Law Firms advises international clients on crypto regulation in Saudi Arabia. We can assist with regulatory mapping, VASP licence applications, AML programme design, and cross-border structuring for digital asset businesses. To request a consultation, contact: info@vlolawfirm.com