Financial Services Licensing in Saudi Arabia 2026: Regulators and Requirements for Foreign Firms

Few sectors illustrate the scale of Saudi Arabia’s economic transformation as clearly as financial services.

Backed by the Financial Sector Development Program (FSDP), a flagship initiative under Vision 2030, the Kingdom is building a diversified, inclusive financial ecosystem, and the results are already visible.

This article examines the forces driving the sector’s growth, the regulators that shape it, and what the path to market entry looks like for international firms.

Who Regulates Financial Services in Saudi Arabia?

Understanding the regulatory landscape is the first strategic decision for any foreign financial firm, as the regulator determines the licensing route, documentation, and ongoing obligations. The sector is overseen by three primary bodies.

The Saudi Central Bank (SAMA) regulates banks, insurance firms, finance companies, payment services, and fintech. The Capital Market Authority (CMA) governs capital market institutions, including asset managers, investment banks, brokerages, and custodians. The Insurance Authority regulates insurance and reinsurance companies.

What Does the CMA Licensing Process Involve?

For firms entering the capital markets space, CMA licensing is among the most demanding parts of market entry.

The process begins with selecting the appropriate license type based on the company’s intended capital market activities, as this choice shapes every subsequent requirement.

CMA License Application Process

To apply for a CMA license, companies need to:

Select the appropriate license category based on the capital market activities they intend to conduct.

Prepare a comprehensive set of supporting documents, including:

Completed CMA application form and detailed business plan

Corporate governance framework and organizational charts

Compliance and anti-money laundering and counter-terrorist financing (AML-CFT) manuals

Audited financial statements and financial projections

Fit-and-proper documentation for key personnel

Technical specifications and systems architecture

Companies must also demonstrate adequate capital, providing evidence that paid-up capital meets the minimum requirement. These amounts vary by activity type, which is another reason the initial license selection matters.

The application then goes through the CMA’s multi-stage regulatory review, which assesses the business plan, systems, and fit-and-proper checks. Approval alone does not permit a firm to begin trading, however.

Before commencing activities, companies must achieve operational readiness by establishing the required local roles, completing CMA professional exams where needed, implementing technical systems, meeting Saudization requirements, and satisfying any conditional approvals.

How Does Business Setup Work for a Financial Services Company?

Beyond sector licensing, foreign financial firms must complete the standard process of business setup in Saudi Arabia, which typically unfolds in three phases.

Establishing the Legal Entity

The first phase, which is projected to take around one month, lays the legal foundation for the business. It begins with obtaining a MISA Investor License, valid for one year, followed by reserving the company name. The company then drafts and notarizes its Articles of Association (AoA), secures a Commercial Registration (CR) from the Ministry of Commerce, and completes its Chamber of Commerce (CoC) registration. Together, these steps constitute company formation in Saudi Arabia and give the entity its legal standing in the Kingdom.

Authorizing Operations and Hiring

The second phase, projected at two to three months, focuses on authorizing operations and building a local presence. The company obtains an official company seal, registers with the Ministry of Labor, and enrolls with the General Organization for Social Insurance (GOSI) to provide employee coverage. It must also register a National Address, issue a visa for its General Manager (GM), and register with the Zakat, Tax and Customs Authority (ZATCA) for VAT compliance.

Completing Residency and Banking

The final phase, projected at three to six months, completes the residency procedures and banking relationships that are especially critical for financial services operations. The company activates its CoC account, while the GM obtains health insurance, completes a medical check-up, and receives an Iqama (residency permit). The company then registers on the Muqeem, Absher, Qiwa, and Mudad portals before opening a corporate bank account with a Saudi bank.

For financial institutions, the banking relationship carries additional weight, as it underpins not only day-to-day operations but also payroll, tax payments, and capital deposits.

What Compliance Obligations Continue After Setup?

Securing a license and completing incorporation mark the beginning of a firm’s regulatory obligations rather than the end. Saudi Arabia’s framework for financial services is designed to ensure financial stability, consumer protection, and market integrity, and it places several ongoing requirements on foreign entrants.

Saudization, governed by the Nitaqat program, requires every company to meet a quota of Saudi nationals based on its size and sector. Firms that fall short risk being placed in the Red Zone, which can lead to operational disruptions and legal penalties. For financial services firms, where specialized talent is often in demand, workforce planning around Saudization should begin early.

Companies must also keep their accounts on government platforms such as Muqeem, Qiwa, and Mudad accurate and up to date. These platforms are interconnected, so outdated records in one can create compliance issues across others. Alongside this, firms employing local staff must adhere to regulations on salary payments and record-keeping.

Every entity operating in the Kingdom is required to submit accurate annual tax returns to ZATCA within the authority’s deadlines. Finally, firms must track and renew the licenses and documents that allow them to operate, including the GM’s Iqama, the Commercial Registration, and the MISA license, each of which expires periodically.