CMA Securities Tokenization Rules — Saudi Capital Market Authority Framework

CMA Securities Tokenization Framework

The Capital Market Authority’s approach to securities tokenization is built on the foundation of the Capital Market Law (Royal Decree M/30, 2003) and its subsequent amendments, most significantly the 2021 amendment expanding CMA jurisdiction to include digital assets that qualify as securities under Saudi law. The CMA operates within a financial ecosystem of 261 fintech companies as of end 2025, with cumulative investment of SAR 7.9 billion ($2.1 billion) according to Fintech Saudi — both figures exceeding Vision 2030 targets. Tadawul has joined MSCI, S&P Dow Jones, and FTSE Russell global indices, and the exchange launched its derivatives market on August 30, 2020. Direct access for all foreign investors opened in February 2026, with the QFI concept abolished entirely.

The regulatory architecture distinguishes between three categories of tokenized instruments: tokenized securities (digital representations of existing securities such as equities, sukuk, or fund units), security tokens (new digital assets issued natively on blockchain that carry rights equivalent to securities), and utility tokens with investment characteristics (hybrid instruments that may trigger securities classification). Real estate tokenization falls primarily into the first two categories, depending on whether existing property assets are being fractionalized or new investment structures are being created.

The Fintech Sandbox — Gateway to Tokenization Licensing

The CMA’s Fintech Lab — launched under the Financial Sector Development Program (FSDP), one of Vision 2030’s realization programs that has seen 57 percent of core KPIs on track or ahead of schedule — operates as the primary entry point for companies seeking to offer tokenized investment products. The FSDP has already exceeded its fintech company count target (261 actual versus 230 target for 2025) and cashless transaction target (79 percent actual versus 70 percent target). The sandbox provides a controlled regulatory environment where firms can test innovative financial products with real customers under CMA supervision, without requiring a full capital market license during the testing phase.

Sandbox entry requirements include: a detailed business plan demonstrating genuine innovation (not merely digitizing existing processes), minimum capital requirements (SAR 5 million for category 1 activities, SAR 2 million for category 2), Saudi-based operational presence, and compliance with CMA’s anti-money laundering and counter-terrorism financing requirements as specified in SAMA’s AML/CFT rules.

For real estate tokenization specifically, sandbox applicants must demonstrate: legal title verification mechanisms (integration with Ministry of Justice property registry), investor suitability assessment procedures, secondary market or buyback provisions, and custody arrangements for the underlying real estate assets. The CMA has signaled through public statements and industry consultations that real estate tokenization represents a priority innovation category aligned with the FSDP’s goals of diversifying capital market products and increasing non-oil sector investment.

Securities Classification for Tokenized Real Estate

The critical regulatory question is whether tokenized real estate interests constitute “securities” under Article 2 of the Capital Market Law. The CMA’s interpretive guidance — while not yet codified in formal regulations — applies a substance-over-form analysis. A real estate token is likely classified as a security if it:

Represents a fractional ownership interest in real property or a real estate holding entity
Carries an expectation of profit derived primarily from the efforts of others (the Howey test equivalent under Saudi law)
Is offered to the public or to more than 200 qualified investors
Is transferable on a secondary market or platform

This classification matters because securities-classified tokens trigger the full CMA regulatory framework: prospectus requirements (detailed disclosure document filed with CMA), authorized person requirements (issuance must be conducted through a CMA-licensed entity), suitability obligations (assessment of investor sophistication and risk tolerance), and continuous disclosure requirements (quarterly reporting on asset performance, rental income, and NAV calculations).

Tokens structured as direct co-ownership interests — where token holders are legally registered as fractional owners of specific property — may fall outside securities classification if holders actively participate in management decisions. However, this structure is impractical for most tokenized real estate offerings, which rely on passive income distribution.

Authorized Person Requirements

Any entity facilitating tokenized real estate issuance must hold CMA authorization for relevant activities. The current authorization categories most relevant to real estate tokenization are:

Dealing as Principal (Category 1): Required if the platform operator takes a position in the tokenized assets. Capital requirement: SAR 50 million minimum.

Dealing as Agent (Category 2): Required for platforms that match buyers and sellers of tokenized real estate interests without taking proprietary positions. Capital requirement: SAR 5 million minimum.

Arranging (Category 3): Required for entities that structure tokenized offerings and bring together issuers and investors. Capital requirement: SAR 2 million minimum.

Managing (Category 5): Required for entities managing pooled tokenized real estate funds. Capital requirement: SAR 10 million minimum.

Custody (Category 6): Required for entities holding tokenized assets on behalf of investors. The CMA has not yet published specific custody rules for blockchain-based assets, creating regulatory uncertainty that the sandbox is designed to address.

The CMA’s sandbox allows testing of these activities with reduced capital requirements and limited customer numbers (typically capped at 50-100 investors during sandbox phase). Successful sandbox participants receive a pathway to full authorization.

Disclosure and Investor Protection

The CMA’s disclosure framework for tokenized offerings requires comprehensive documentation including: property valuation by a CMA-approved appraiser, rental income projections with methodology disclosure, fee structure (platform fees, management fees, exit fees), smart contract audit reports from recognized auditors, tax implications (both Saudi and international for foreign investors), and risk factors specific to tokenized real estate (liquidity risk, smart contract risk, regulatory change risk, platform counterparty risk).

Investor protection mechanisms must include: segregation of investor assets from platform operating funds, regular NAV reporting (at least quarterly), independent verification of property ownership records, dispute resolution mechanisms (CMA’s Committee for the Resolution of Securities Disputes has jurisdiction), and cooling-off periods for retail investors (typically 10 business days for real estate securities).

Cross-Border Implications

The CMA’s framework requires Saudi-domiciled entities for platform operation, but permits foreign investors to participate in tokenized offerings subject to foreign investment rules under the Ministry of Investment’s licensing requirements. The 2021 amendments to the Foreign Investment Law removed most sector restrictions for foreign property ownership, though certain geographic areas near borders and military installations remain restricted.

For Saudi real estate tokens to be offered internationally, the CMA requires either: bilateral regulatory recognition agreements (currently limited), or compliance with both Saudi CMA rules and the destination market’s securities regulations. This creates a practical barrier for global distribution that the CMA is actively working to address through its participation in IOSCO’s fintech network and bilateral MOUs with the DFSA, ADGM FSRA, and other regional regulators.

Timeline and Outlook

The CMA’s regulatory development timeline for tokenized assets — based on public statements by CMA Chairman Mohammed Al-Kuwaiz and FSDP progress reports — suggests formal regulations (not sandbox rules but permanent frameworks) for digital asset issuance by Q3 2026, with specific real estate tokenization guidance following by Q1 2027. This timeline may accelerate given the competitive pressure from Dubai’s advanced tokenization framework and Abu Dhabi’s ADGM regulations that already permit tokenized real estate offerings.

The competitive regulatory dynamic is significant: Saudi Arabia cannot afford to lag Dubai in tokenization regulation if it expects to attract institutional capital for Vision 2030 mega-project tokenization. The CMA’s response to this competitive pressure will likely shape the speed and scope of regulatory clarity for real estate tokenization.

Enforcement and Penalties Framework

The CMA’s enforcement apparatus provides the deterrence framework that supports institutional confidence in Saudi tokenized RE offerings. The CMA’s enforcement powers include: fines up to SAR 5 million per violation, suspension or revocation of authorized person licenses, public reprimand and market notification of violations, referral to the Public Prosecution for criminal fraud cases, and disgorgement of profits from illegal activity.

For tokenized real estate, enforcement focuses on three priority areas: unauthorized token issuance (offering tokens without CMA sandbox or permanent authorization), misleading disclosure (misrepresenting property values, rental projections, or risk factors in token offering documents), and market manipulation (artificial inflation of token prices through wash trading, coordinated buying, or misleading social media promotion).

The Committee for the Resolution of Securities Disputes (CRSD) — CMA’s quasi-judicial body — has jurisdiction over disputes between token investors and platform operators, including: claims of misrepresentation in offering documents, disputes over NAV calculation methodology, complaints about fee charging practices, and allegations of failure to distribute rental income. The CRSD provides a specialized dispute resolution mechanism that is faster and more specialized than general Saudi courts, typically resolving cases within 6-12 months.

The CMA’s enforcement track record — 47 enforcement actions in 2024, totaling SAR 38 million in fines — demonstrates active supervision that distinguishes Saudi regulatory oversight from jurisdictions where tokenization operates with minimal regulatory scrutiny. For institutional investors, CMA enforcement provides the regulatory backstop that due diligence frameworks require.

International Regulatory Coordination

The CMA actively participates in international regulatory coordination that shapes the cross-border dimension of Saudi tokenized RE:

IOSCO Fintech Network: CMA membership in the International Organization of Securities Commissions’ fintech task force provides access to global regulatory best practices and facilitates bilateral regulatory recognition discussions. IOSCO’s 2024 policy recommendations for tokenized assets directly inform CMA’s framework development.

GCC Securities Regulators Committee: Coordination with UAE SCA, DFSA, ADGM FSRA, and other GCC securities regulators on cross-border tokenized asset trading, mutual recognition of licensing, and harmonized investor protection standards. This coordination could eventually enable Saudi-issued tokens to be offered in Dubai and vice versa without duplicate licensing.

FATF Virtual Asset Working Group: CMA and SAMA joint participation in FATF’s work on virtual asset regulation ensures Saudi AML/CFT requirements align with global standards, facilitating international acceptance of Saudi-issued tokens.

Bilateral MOUs: Active MOUs with DFSA, ADGM FSRA, UK FCA, Swiss FINMA, and Singapore MAS enable regulatory information sharing, coordinated supervision, and potential mutual recognition that would simplify cross-border distribution of Saudi tokenized RE.

Custody and Settlement Framework

The CMA’s custody framework for tokenized assets — an area of active regulatory development — addresses one of the most critical operational questions for institutional allocators: who holds the digital keys controlling tokenized property interests, and what legal protections exist if the custodian fails?

Current sandbox guidance permits three custody models: platform custody (the tokenization platform holds private keys in secure hardware security modules on behalf of investors), third-party custody (a CMA-licensed custodian, such as Edaa — Saudi Arabia’s securities depository — holds tokens separately from the platform), and self-custody (qualified investors maintain their own private keys, with the platform providing only the trading interface). For institutional allocators, third-party custody through Edaa or a CMA-licensed custodian is the expected standard — providing the segregation of assets and independent safekeeping that fiduciary obligations require.

Edaa — the CMA’s central securities depository processing all Tadawul-listed securities — has publicly discussed blockchain-compatible custody capabilities that would extend its existing infrastructure to tokenized assets. If Edaa assumes the custodial role for tokenized real estate, investors would benefit from the same institutional safekeeping infrastructure that protects listed equities and sukuk — a significant confidence factor for institutional capital deployment.

Tokenized REIT Pathway

The CMA’s existing REIT framework — governing 18 listed Saudi REITs on Tadawul with combined market capitalization exceeding SAR 50 billion — provides a regulatory precedent that accelerates tokenized real estate adoption. The CMA’s REIT regulations (issued under the Real Estate Investment Traded Funds Instructions, 2016, updated 2023) establish disclosure standards, fund governance requirements, and distribution mandates that directly inform the tokenized RE framework under development.

The convergence pathway between REITs and tokenized RE is increasingly clear: Saudi REITs may eventually issue tokenized units alongside traditional exchange-listed units, providing investors with the choice between Tadawul-traded REIT units and blockchain-settled tokenized units representing identical underlying property portfolios. This convergence — already being explored in Singapore (by Mapletree and CapitaLand) and in the UAE (by Emirates REIT) — would leverage Saudi Arabia’s strong REIT regulatory foundation to accelerate tokenization adoption with minimal additional regulatory development.

For portfolio construction, the CMA’s regulatory timeline creates a phased investment opportunity: sandbox-stage token offerings (2025-2026) for early adopters willing to accept regulatory uncertainty, permanent-framework offerings (2027+) for institutional allocators requiring full regulatory clarity, and REIT-tokenized convergence products (2028+) combining the liquidity of exchange listing with the settlement efficiency of blockchain. Investors should monitor CMA announcements through the Fintech Sandbox Tracker for regulatory milestone updates that affect the timing and structure of tokenized RE offerings.

Updated March 19, 2026

cmasecurities-tokenizationdigital-assetsregulation