Saudi Arabia Crypto Regulation: CMA Framework and Vision 2030 Digital Finance
Saudi Arabia is the Arab world's largest economy and the GCC's most influential capital market — and it is developing tokenization infrastructure at a pace matching Vision 2030's ambition. The CMA's regulatory framework for digital assets is live and expanding, with Tadawul actively pursuing tokenized securities infrastructure.
Overview
Saudi Arabia occupies a unique position in global tokenization development: it is simultaneously one of the most ambitious jurisdictions in terms of digital finance vision and one of the most careful in its regulatory implementation. The Capital Market Authority (CMA) and the Saudi Central Bank (SAMA) have built a regulatory framework that permits fintech and digital asset innovation under supervised conditions, while the national transformation agenda — Vision 2030 — has designated digital finance as a strategic pillar.
The kingdom’s approach to cryptocurrency has evolved. Public trading of crypto assets remains subject to significant restrictions for retail investors. However, institutional tokenization infrastructure — DLT-based securities settlement, tokenized government bonds, wholesale CBDC — is actively developed with regulatory support. Saudi Arabia’s tokenization story is fundamentally about financial market modernization rather than retail crypto adoption.
Primary Regulators: CMA and SAMA
CMA (Capital Market Authority): Regulates Saudi Arabia’s capital markets, including the Tadawul (Saudi Exchange) and Nomu (parallel market). The CMA has established a fintech regulatory sandbox under Regulatory Sandbox Framework 2019, through which digital asset and tokenization businesses can test services under supervised conditions with temporary regulatory relief.
SAMA (Saudi Central Bank): Regulates banking, insurance, payment systems, and fintech in the non-securities financial sector. SAMA operates its own fintech regulatory sandbox for payment, lending, and insurance innovations, and has led Saudi Arabia’s wholesale CBDC development through Project Aber (joint CBDC pilot with the UAE Central Bank).
CMA Sandbox and Digital Asset Framework
The CMA’s regulatory sandbox has admitted multiple fintech and digital asset businesses for testing, including: robo-advisory platforms, digital brokerage services, and — most recently — tokenized securities and digital asset custody platforms. Sandbox participants operate under time-limited exemptions from specific CMA regulations while testing their services with real clients under CMA oversight.
Tokenized Securities: The CMA’s framework treats tokenized securities as securities under the Capital Market Law and related regulations. Issuance of tokenized securities requires: CMA approval for public offers or exemption reliance for private placements, dealing through CMA-licensed financial intermediaries, and settlement through CMA-approved systems.
The Tadawul has been developing DLT-based post-trade infrastructure under a multi-year capital market development program. Phase 1 — clearing and settlement modernization — is expected to include DLT-based settlement capabilities for equities and debt securities, potentially enabling tokenized securities settlement on the Tadawul infrastructure.
SAMA and Payment Tokens
SAMA’s payment regulation has progressively accommodated digital payment innovation. The Payment Services Provider (PSP) regulations permit licensed PSPs to offer digital payment wallet services and process electronic payments. Stablecoin issuance and digital currency services require SAMA licensing as a PSP, with capital and reserve requirements set by SAMA based on transaction volumes.
Project Aber: Saudi Arabia and the UAE conducted Project Aber — a joint wholesale CBDC pilot — in 2019–2020. The project successfully demonstrated cross-border settlement using a shared DLT platform, with SAMA and UAE Central Bank both issuing digital currency units used for interbank settlements. Project Aber’s findings directly informed both Saudi Arabia’s and UAE’s wholesale CBDC strategies.
Capital Market Law Compliance
Foreign entities seeking to operate in Saudi Arabia’s capital markets must navigate the Capital Market Law and its implementing regulations, which require:
- CMA licensing: For dealing in securities (including tokenized securities), providing investment advice, managing client portfolios, and operating trading platforms
- Local presence: Significant operations in Saudi Arabia typically require a locally incorporated entity or a branch of a licensed financial institution
- Saudi shareholders: While 100% foreign ownership is permitted in some financial service categories since 2021 reforms, many capital market licenses require or strongly favor Saudi partner participation
AML/KYC Requirements
Saudi Arabia’s AML framework applies to all regulated financial institutions and fintech businesses:
- Anti-Money Laundering Law (Royal Decree M/31, 2017): Full CDD at onboarding; EDD for high-risk customers; ongoing monitoring; suspicious activity reporting to the Saudi Financial Intelligence Unit (SAFIU)
- Sanctions: Screening against UN, OFAC, EU, and Saudi-specific designations required; SAME coordinates international sanctions enforcement
- FATF Recommendations: Saudi Arabia is a FATF member and implements FATF standards including Travel Rule requirements for financial institutions
Compliance Checklist: Saudi Arabia Tokenization Operations
- Engage CMA fintech regulatory sandbox for tokenization services; prepare sandbox application with detailed business plan and compliance framework
- For tokenized securities: obtain CMA dealing license and/or SWAP (Securities, Wakala, and Alternative Products) licensing as applicable
- For payment or stablecoin services: obtain SAMA PSP license; implement reserve and capital requirements
- Establish locally incorporated entity or CMA-licensed branch; assess Saudi shareholder requirements for chosen license category
- Implement AML/CFT program per Saudi AML Law: CDD, EDD, SAFIU STR reporting
- Implement FATF Travel Rule for relevant financial transfers
- Monitor Tadawul DLT infrastructure development for tokenized securities settlement integration
- Engage Vision 2030 Financial Sector Development Program (FSDP) initiatives for alignment with national digital finance strategy
Authority References
For GCC regulatory comparison across Saudi Arabia, UAE, and Bahrain, see the Licensing Matrix. For Tadawul and Saudi capital market terminology, see the Regulatory Encyclopedia. For regional tokenization infrastructure analysis, see Platform Benchmarks.
Subscribe for full access to compliance intelligence across all 7 analytical lenses, including licensing guides, jurisdiction benchmarks, and enforcement trackers.
Subscribe from $29/month →