SAMA Fintech Licensing Framework for Real Estate Tokenization

SAMA Fintech Licensing and Payment Infrastructure

The Saudi Central Bank (SAMA) controls the payment rails on which tokenized real estate settlement will operate. While the CMA regulates the securities aspects and REGA governs the property aspects, SAMA’s fintech licensing framework, open banking mandates, and digital currency experiments determine whether tokenized property transactions can settle efficiently, compliantly, and at scale within the Saudi financial system.

SAMA’s fintech regulatory framework has produced 261 fintech companies by end of 2025 — exceeding the Vision 2030 target of 230 by 13 percent, with 21 percent growth from 216 companies in 2024, according to Fintech Saudi. Cumulative fintech investment has reached SAR 7.9 billion ($2.1 billion), exceeding the 2025 target by 204 percent. The SAMA Regulatory Sandbox, launched in 2018 and operating on an “Always Open” model since 2022, has permitted 50 fintechs to date with 25 currently enrolled. SAMA has also licensed 27 payment service providers and 12 finance companies under its permanent framework.

Payment Services Licensing

Tokenized real estate transactions require three payment functions: initial investment (fiat-to-token conversion), ongoing distributions (rental income to token holders), and secondary market settlement (token-to-token or token-to-fiat exchange). Each function triggers different SAMA licensing requirements:

Electronic Money Institution (EMI) License: Required for platforms that hold customer funds in electronic form for the purpose of payment transactions. Tokenization platforms that maintain investor wallets containing SAR balances need EMI licensing. Capital requirement: SAR 15 million minimum, with additional operational capital based on transaction volume.

Payment Service Provider (PSP) License: Required for entities facilitating payment transactions between parties. Platforms enabling secondary market trading of real estate tokens — where SAR transfers between buyer and seller accounts — need PSP licensing. Capital requirement: SAR 5 million minimum, as specified in the Implementing Regulations of the Payments and Payment Services Law, though SAMA retains discretion to adjust this threshold.

Payment Aggregator License: A lighter category for entities that aggregate payments from multiple sources — potentially applicable to rental distribution mechanisms where a property manager collects rent and distributes to many token holders via a tokenization platform.

The practical challenge for tokenization platforms is that SAMA licensing requirements are additive to CMA authorization. A platform must hold both CMA authorization (for securities dealing and arranging) and SAMA licensing (for payment services), creating dual regulatory compliance obligations that increase operational costs and time to market.

Open Banking Framework

SAMA’s Open Banking Framework — launched in 2022 with the Open Banking Lab going live in November 2022 and Payment Initiation Services (PIS) operational since September 2024 — requires licensed banks to provide API access to customer account data and payment initiation services. Open banking sandbox participants include SpireTech (Open Banking APIs), XSquare, and NeotTek. For tokenized real estate, open banking enables:

Streamlined investor onboarding: Tokenization platforms can verify investor identity and bank account details through bank APIs, reducing KYC friction and enabling automated suitability checks.

Direct payment initiation: Investors can fund token purchases directly from their bank accounts through the platform, without requiring separate wire transfers or card payments. This reduces settlement time from days to seconds.

Automated distribution: Rental income can be distributed directly to token holders’ bank accounts through payment initiation APIs, eliminating the need for manual bank transfers or check payments.

The open banking framework creates a significant infrastructure advantage for Saudi tokenized real estate compared to markets without mandatory open banking. In Dubai, for example, tokenization platforms must negotiate individual API connections with banks — a fragmented and costly process. Saudi Arabia’s mandatory framework provides standardized connectivity.

CBDC and Digital Currency Experiments

SAMA’s digital currency program centers on the Saudi Digital Riyal, currently in pilot phase for wholesale use cases. SAMA joined the mBridge multi-CBDC wholesale project in June 2024, now at Minimum Viable Product (MVP) stage alongside the central banks of China, Hong Kong, Thailand, and the UAE. The mBridge Ledger blockchain — EVM-compatible — has processed $22 million in trial transactions and offers instantaneous cross-border settlement, programmable finance via smart contracts, and automated escrow and compliance triggers. The BIS stepped back from the project in October 2024, with participating central banks now managing development directly.

For tokenized real estate, the mBridge infrastructure could enable atomic settlement of tokenized property transactions — simultaneous delivery of property tokens and payment in digital SAR, eliminating settlement risk. The programmability features are particularly relevant: smart contract-triggered rental distributions, automated tax withholding (for foreign investors subject to Saudi withholding tax), and conditional payments linked to property performance milestones. Legal clarity is still needed for privacy, AML/KYC, and digital asset governance frameworks surrounding the Digital Riyal, and no retail launch date has been announced.

Stablecoin Regulation

SAMA has not issued specific stablecoin regulations, but its existing electronic money framework implicitly covers SAR-denominated stablecoins. An entity issuing tokens redeemable for SAR at a fixed rate would require EMI licensing and must maintain 100 percent reserve backing in SAMA-regulated bank accounts. Dollar-denominated stablecoins (USDT, USDC) can be used on Saudi platforms but face practical limitations: they are not recognized as legal tender, and SAMA’s AML framework requires enhanced due diligence for cryptocurrency-related transactions.

For tokenized real estate platforms, the stablecoin question is significant. Platforms using SAR settlement benefit from SAMA’s regulatory clarity and banking system integration. Platforms using USD stablecoins gain access to international capital but face higher regulatory scrutiny and potential SAMA objections to circumventing the domestic payment system.

AML/CFT Requirements

SAMA’s AML/CFT framework — implementing FATF recommendations — applies to all licensed fintech entities and, through CMA coordination, to all tokenized asset platforms. Key requirements include:

Customer Due Diligence (CDD): Full KYC for all token purchasers, with enhanced due diligence for transactions exceeding SAR 200,000 (approximately $53,000) — a threshold that most real estate token purchases will exceed.

Transaction monitoring: Automated systems to detect suspicious patterns including unusual trading volumes, rapid buy-sell sequences, and transfers to high-risk jurisdictions.

Travel Rule compliance: For token transfers between platforms, SAMA requires originator and beneficiary information to be transmitted — a technical challenge for blockchain-based transfers that several Saudi fintech companies are developing solutions for.

Sanctions screening: Real-time screening of all counterparties against Saudi and international sanctions lists, including OFAC, EU, and UN sanctions.

These requirements create operational complexity but also build institutional confidence. Institutional investors considering Saudi tokenized real estate can rely on SAMA-grade AML/CFT compliance — a differentiator against tokenization platforms operating in less regulated jurisdictions.

Cross-Regulatory Coordination

The most significant development in Saudi fintech regulation is the 2024 Joint Regulatory Framework Agreement between SAMA, CMA, and the Communications, Space and Technology Commission (CST), establishing a unified approach to fintech oversight. Under this agreement, tokenized real estate platforms can apply for coordinated licensing across all three regulators through a single application process — reducing the regulatory burden from three separate sandbox applications to one integrated review.

This “one-stop-shop” approach — if fully implemented — would give Saudi Arabia a structural regulatory advantage over the UAE, where tokenization platforms must navigate separate licensing with the SCA, DFSA, ADGM FSRA, and Central Bank through independent processes.

Saudi Payments Infrastructure (mada, SARIE, SADAD)

SAMA’s payment infrastructure — the digital rails on which tokenized real estate settlement operates — comprises three interconnected systems that tokenization platforms must integrate:

mada (national payment network): Saudi Arabia’s debit card and point-of-sale network processes over 4 billion transactions annually. mada integration enables tokenization platforms to accept investor deposits through debit card payments — the most accessible funding mechanism for Saudi retail investors. mada’s transaction limits (SAR 20,000 per transaction for online payments) may require multiple transactions for larger token purchases, creating user experience friction that platforms must address through alternative funding options.

SARIE (Saudi Arabian Riyal Interbank Express): SAMA’s real-time gross settlement system for large-value interbank transfers. SARIE processes institutional-sized transactions (SAR 500,000+) within seconds during banking hours. Tokenization platforms handling institutional investor deposits use SARIE for same-day fund settlement — critical for time-sensitive token purchase opportunities.

SADAD: Saudi Arabia’s centralized bill payment system, processing utility payments, government fees, and recurring charges for over 25 million accounts. SADAD integration enables automated recurring distributions to token holders — rental income can be distributed through SADAD’s existing infrastructure, leveraging a payment channel that 85 percent of Saudi adults already use.

For tokenized RE platforms, the optimal payment architecture integrates all three systems: mada for retail investor onboarding and small transactions, SARIE for institutional deposits and large token purchases, and SADAD for automated quarterly or monthly distribution payments to token holders. This multi-channel approach ensures that investor funding and distribution reach every segment of the Saudi banking population.

Digital Banking and Neobanks

Saudi Arabia now has three operational digital banks and one newly approved. STC Bank (formerly STC Pay, the Kingdom’s first fintech unicorn valued at $1.3 billion) commenced operations as a fully licensed digital bank in January 2025 with SAR 2.5 billion capitalization and serves 12 million customers. Vision Bank launched operations in September 2025, D360 Bank is an established digital banking operator, and EZ Bank received its digital banking license approval most recently. Digital banks serve a younger, more technology-adoptive demographic in a market where smartphone penetration reaches 97 percent and 14.4 million people actively use digital wallets — a 52 percent year-on-year increase in 2024.

Digital bank integration with tokenization platforms enables: instant KYC verification (leveraging the digital bank’s existing eKYC on file), seamless fund transfer (in-app connectivity between digital bank accounts and tokenization platform wallets), and embedded investment features (tokenized RE products offered within the digital bank’s investment marketplace). The infrastructure is built for scale — Saudi Arabia processed 11.5 billion card transactions in 2024, with 96 percent of POS transactions now contactless and 2 million POS terminals deployed across the Kingdom.

SAMA’s regulatory framework treats digital banks identically to traditional banks for purposes of tokenization platform integration — ensuring that digital bank customers have the same access to tokenized RE products as customers of Al Rajhi, SNB, or other conventional banks. Google launched digital payments in Saudi Arabia in September 2025, and Alipay+ is expected to enter the cross-border payments market in 2026, intensifying the digital payments ecosystem that underpins tokenized settlement.

Insurance Regulatory Framework

SAMA’s insurance supervision — governing both conventional and cooperative (Islamic) insurance companies — intersects with tokenized RE in several areas:

Property insurance for tokenized assets: SPVs holding tokenized real estate must maintain adequate property insurance from SAMA-licensed insurers. Insurance requirements include: comprehensive property coverage (fire, natural disaster, structural failure), third-party liability, loss of rent insurance (covering income disruption from insured events), and professional indemnity for platform operators.

Cyber insurance: Tokenization platforms face cybersecurity risks (private key theft, smart contract exploitation, platform hacking) that require specialized cyber insurance. SAMA’s regulatory expectations for fintech companies include mandatory cyber risk management plans, and many institutional investors require evidence of cyber insurance before committing capital to tokenized offerings.

Title insurance: While not yet common in Saudi Arabia, title insurance — protecting against defects in property ownership records — is increasingly discussed as a requirement for tokenized property investments where the integrity of the underlying title is critical to token value. SAMA is evaluating regulatory frameworks for title insurance products that would specifically support tokenization.

Directors and officers (D&O) insurance: Platform executives and SPV directors face personal liability exposure from CMA securities enforcement actions, investor lawsuits, and regulatory penalties. D&O coverage from SAMA-licensed insurers protects key personnel and supports governance structures that institutional investors expect from regulated financial services platforms. The due diligence checklist should verify that tokenized RE platform operators maintain adequate insurance coverage across all categories before recommending capital deployment.

SAMA Regulatory Outlook and Tokenization Timeline

Saudi Arabia’s cashless economy transition — reaching 79 percent of retail transactions in 2024, up from 36 percent in 2019 and exceeding the 2025 target of 70 percent two years early — demonstrates the payment infrastructure maturity that tokenized settlement requires. The fintech ecosystem now generates 6,726 jobs, and the fintech market is valued at $2.7 billion in 2025 with a projected 14.0 percent CAGR to $6.7 billion by 2032. The key milestones for tokenization platforms to monitor:

2026 Q3-Q4: Expected publication of SAMA’s Virtual Asset Service Provider (VASP) regulations, establishing permanent (non-sandbox) licensing for blockchain-based financial services. These regulations will define capital requirements, custody standards, and operational resilience obligations that directly affect tokenization platform feasibility.

2027: Wholesale CBDC pilot for institutional settlement, potentially enabling atomic delivery-versus-payment for large tokenized RE transactions. This milestone would eliminate settlement counterparty risk — a significant improvement over current T+2 bank transfer settlement for property transactions.

2028-2029: Potential retail CBDC launch enabling direct-to-consumer tokenized RE investment settlement. A retail digital riyal would provide the payment infrastructure for the broadest possible Saudi retail investor participation in tokenized real estate.

For portfolio construction and institutional entry strategies, SAMA’s regulatory timeline suggests a phased approach: early-stage allocation through CMA sandbox offerings (2025-2026), scaling through permanent-framework offerings (2027+), and full institutional deployment when CBDC settlement infrastructure is operational (2028+). The risk framework should incorporate regulatory milestone dependencies into its assessment of platform operational risk for tokenized RE offerings.

SAMA’s Role in Investor Protection for Tokenized Real Estate

Beyond payment infrastructure, SAMA’s supervisory framework provides multiple layers of investor protection that strengthen the institutional credibility of Saudi tokenized RE offerings:

Bank deposit protection: Investor funds held in SAMA-regulated bank accounts (including Wafi escrow accounts and platform settlement accounts) benefit from Saudi Arabia’s deposit protection framework. SAMA requires banks to maintain capital adequacy ratios exceeding Basel III minimums, providing systemic protection for investor funds during the settlement and distribution process.

Anti-fraud supervision: SAMA’s Financial Fraud Committee coordinates anti-fraud efforts across the Saudi financial system. Tokenization platforms operating under SAMA licensing are subject to fraud monitoring, suspicious activity reporting requirements, and coordinated investigation protocols that provide institutional-grade protection against platform-level fraud — a risk category that has caused significant investor losses on unregulated tokenization platforms globally.

For portfolio construction and institutional entry purposes, SAMA’s supervisory infrastructure provides a trust layer that distinguishes Saudi tokenized RE from offerings in less regulated jurisdictions. The combination of CMA securities oversight, SAMA payment supervision, and REGA property regulation creates a three-regulator protection framework unmatched in the GCC tokenized RE landscape.

Updated March 19, 2026

samafintechlicensingpaymentscbdc