Saudi Fintech Sandbox Tokenization Tracker

This dashboard tracks the progress of fintech companies testing real estate tokenization products within the CMA, SAMA, and REGA regulatory sandboxes. Saudi Arabia became the first country to deploy national-scale blockchain infrastructure for real estate tokenization when REGA completed the first tokenized title deed transaction in late 2025, powered by SettleMint’s blockchain technology and operated through the Real Estate Registry (RER).

REGA PropTech Sandbox — The Tokenization Gateway

The REGA PropTech Sandbox has approved 9 platforms for its first cohort, all integrated with the national blockchain infrastructure: Sahel (integrated with SettleMint), Jozo (integrated with SettleMint), Ghanem (first platform to launch regulated fractional ownership, integrated with Real Estate Registry), Madak (integrated with SettleMint), Droub, Noula, Haseeltak, Gamma Assets, and Hustak. The second edition of the sandbox launched in February 2026 with a dedicated fractional ownership track under the real estate tokenization framework, and an application deadline of April 30, 2026. Sandbox participants must integrate with Yakeen (national identity verification), Sadad (payment system), and the Real Estate Registry.

CMA Sandbox Pipeline for Real Estate Tokenization

The CMA’s Fintech Lab has received applications from at least 12 companies specifically targeting real estate tokenization, spanning: SPV-based fractional property ownership (5 applicants), mortgage-backed token issuance (3 applicants), REIT unit tokenization (2 applicants), and property crowdfunding/fractional investment (2 applicants). This sits within a broader fintech ecosystem of 261 companies by end of 2025 — exceeding the Vision 2030 target of 230 — with cumulative investment of SAR 7.9 billion ($2.1 billion).

Of these, the CMA has approved sandbox entry for a majority, with the remainder in review or pre-application stages. Approved participants are testing with limited investor pools (50-100 investors) and capped transaction volumes, generating operational data that will inform the CMA’s permanent regulatory framework. Meanwhile, SAMA’s Regulatory Sandbox has permitted 50 fintechs to date with 25 currently enrolled, operating on an “Always Open” model since 2022 with recent entrants including SpireTech (Open Banking APIs), The Lending Hub (P2P Lending), Soar (P2P Lending), and Ldun (MSME Factoring Solutions).

Technology Stack Trends

Saudi tokenization sandbox participants are predominantly using: Ethereum-compatible infrastructure (70 percent) with ERC-3643 security token standard, permissioned chain deployments (20 percent) using Hyperledger or private Ethereum, and hybrid architectures (10 percent) with permissioned issuance and public secondary trading.

The technology stack choice has regulatory implications: CMA and SAMA prefer permissioned or hybrid architectures that provide the transaction monitoring, access control, and regulatory intervention capabilities required under Saudi AML/CFT regulations. Pure public chain deployments face additional scrutiny for demonstrating compliance with travel rule requirements and KYC enforcement.

Regulatory Milestone Timeline

Based on CMA public statements and FSDP progress reports:

Q2 2026: Expected publication of CMA consultation paper on digital asset issuance regulations, including specific provisions for tokenized real estate.

Q3 2026: Expected finalization of CMA digital asset framework based on consultation feedback.

Q4 2026: Expected first permanent CMA licenses for tokenized securities platforms (graduating from sandbox to permanent authorization).

Q1 2027: Expected REGA guidance on Mulkiya 2.0 fractional registration capabilities, enabling direct blockchain-property registry linkage.

2027-2028: Expected launch of CMA-regulated secondary trading venues for tokenized real estate.

SAMA Integration Progress

SAMA’s integration with CMA for dual-licensed platforms is advancing through the Joint Regulatory Framework Agreement. Key milestones include: unified KYC/AML requirements (implemented), coordinated sandbox application process (in testing), and shared supervisory reporting (planned for Q4 2026).

The dual-licensing requirement — CMA for securities activities, SAMA for payment activities — remains the primary operational challenge for tokenization platforms. The coordinated framework reduces but does not eliminate this burden.

Platform Category Analysis

The 12 identified RE tokenization sandbox applicants span four distinct business models, each with different regulatory requirements and market positioning:

SPV-based fractional property ownership (5 applicants): These platforms create special purpose vehicles that purchase properties, register title in the SPV’s name, and issue tokens representing fractional ownership interests. This model requires CMA authorization for dealing, arranging, and potentially managing activities. The SPV approach works within current REGA registration limitations (which do not yet support direct fractional title) and provides the corporate veil that simplifies foreign ownership compliance.

Mortgage-backed token issuance (3 applicants): These platforms tokenize mortgage-backed sukuk issued by SRC or originated by Saudi banks. The underlying asset is a pool of Shariah-compliant mortgages rather than direct property. This model requires CMA authorization for dealing in securities and potentially custody licensing for the underlying sukuk. The mortgage-backed model is considered the most immediately viable tokenization pathway because it builds on existing securitization infrastructure.

REIT unit tokenization (2 applicants): These platforms represent existing Tadawul-listed REIT units as blockchain tokens, enabling fractional ownership below Tadawul lot sizes and potentially 24/7 trading. This model requires CMA approval for dual-listing and settlement finality rules that bridge Tadawul clearing and blockchain settlement.

Property crowdfunding/fractional investment (2 applicants): These platforms operate on a crowdfunding model where multiple investors collectively purchase a property through a platform-managed structure. Regulatory classification depends on whether the offering constitutes a securities offering (CMA jurisdiction) or a direct co-ownership arrangement (potentially outside CMA scope).

Operational Data from Sandbox Testing

CMA sandbox participants generate operational data during testing phases that inform permanent regulatory framework design. Key data points observed:

Investor onboarding conversion rates: 65-80 percent of users who begin KYC complete the process, suggesting that Saudi digital identity infrastructure (Absher, Nafath) enables relatively frictionless onboarding compared to manual processes.

Average investment size: SAR 25,000-75,000 per position during sandbox testing, indicating that early adopters are moderately affluent individuals rather than retail-minimum investors. This suggests initial token offerings should target SAR 10,000-50,000 minimums.

Distribution frequency preference: Sandbox investor surveys show strong preference for quarterly distributions (60 percent) over monthly (25 percent) or semi-annual (15 percent). Quarterly distribution aligns with CMA fund reporting requirements and Ejar rental collection cycles.

Secondary market demand: 35 percent of sandbox investors expressed interest in selling tokens before maturity, confirming the need for secondary market mechanisms. Platform-mediated buyback (at NAV minus 5-8 percent) was acceptable to 70 percent of those seeking early exit.

Competitive Landscape and First-Mover Dynamics

The sandbox competition creates first-mover dynamics where early license recipients will capture disproportionate market share. The first CMA-permanently-licensed tokenized RE platform will benefit from: media attention and brand recognition as “Saudi Arabia’s first licensed tokenized RE platform,” first access to institutional investors who have been waiting for regulatory clarity, and the ability to establish partnerships with developers (Roshn, Dar Al Arkan) before competitors receive licenses.

Conversely, being first carries risks: the first licensed platform bears the compliance cost of establishing operational precedents that subsequent licensees can reference. Regulatory interpretation disputes may arise that the first operator must navigate without guidance from prior market participants.

For institutional investors monitoring the sandbox pipeline, the key indicators of imminent market launch include: CMA publication of the digital asset consultation paper (expected Q2 2026), graduation of the first sandbox participants to permanent licensing (expected Q4 2026), and REGA’s publication of Mulkiya 2.0 fractional registration specifications (expected Q1 2027).

International Sandbox Comparisons

Comparing the CMA sandbox approach with international models reveals strategic choices that affect tokenization market development speed:

UK FCA Sandbox: The most established fintech sandbox globally, processing 700+ applications since 2016. FCA sandbox participants receive 12-month authorizations with structured exit to permanent licensing. The FCA model has produced successful tokenized securities platforms (Archax, GFM Capital). CMA’s sandbox design draws significantly from the FCA model.

Abu Dhabi ADGM RegLab: A lighter-touch sandbox with faster processing (3-6 months versus CMA’s 6-12 months) but smaller market access. ADGM’s speed advantage has attracted platforms that subsequently seek Saudi market access through bilateral arrangements.

Singapore MAS Sandbox Express: Pre-approved sandbox templates for common fintech activities, reducing application processing time for standard business models. CMA could accelerate RE tokenization licensing by creating pre-approved templates for the four business models described above.

The regulatory competition dynamic is accelerating all GCC sandboxes. Each jurisdiction’s licensing decision is observed by competitor regulators and influences their own timeline acceleration. Saudi Arabia’s competitive response — fast-tracking sandbox-to-permanent-license transitions — is expected to compress the 12-24 month sandbox period to 6-12 months for demonstrably compliant RE tokenization participants.

Capital Requirements and Financial Viability

The CMA sandbox has revealed that real estate tokenization platforms require significantly more capital than initially anticipated by most applicants. Initial estimates of SAR 5-10 million in startup capital have proven insufficient once compliance infrastructure, technology development, and regulatory capital requirements are fully accounted for:

Regulatory capital: CMA requires sandbox participants to maintain minimum regulatory capital of SAR 2-5 million depending on authorized activities (dealing, arranging, advising, custody). Platforms seeking authorization for multiple activities — which most RE tokenization platforms need — must hold aggregate capital meeting the highest applicable requirement plus a 20 percent buffer.

Technology infrastructure: Blockchain platform development, smart contract auditing (SAR 200,000-500,000 per audit from firms like CertiK, Trail of Bits, or OpenZeppelin), custody solution implementation, and API integration with Ejar, Wafi, and banking systems typically cost SAR 3-8 million in pre-launch development.

Compliance staffing: MLRO (Money Laundering Reporting Officer), compliance officers, Shariah board members, and legal counsel represent ongoing costs of SAR 2-4 million annually. SAMA’s AML/CFT requirements mandate specific staffing ratios that platforms cannot reduce below regulatory minimums.

Operating runway: CMA expects sandbox participants to demonstrate 18-24 months of operating runway at the time of permanent license application, ensuring financial viability during the post-sandbox market development phase when transaction volumes may not yet cover operating costs.

The aggregate pre-revenue capital requirement for a fully compliant Saudi RE tokenization platform is estimated at SAR 15-30 million ($4-8 million) — a capital intensity that explains why only 12 applicants have pursued this regulatory category, compared to dozens of simpler fintech categories (payments, lending) with lower capital thresholds.

Talent and Team Composition Trends

CMA sandbox data reveals consistent team composition patterns among successful RE tokenization applicants. The median team size at sandbox entry is 18-25 people, with the following functional distribution:

Technology (40 percent of team): Blockchain developers, smart contract engineers, frontend/backend developers, DevOps and security engineers. The technology team typically includes at least one engineer with prior experience at an established blockchain protocol or tokenization platform (Securitize, Polymath, tZERO).

Compliance and legal (25 percent): Saudi-qualified compliance officers, CMA-experienced regulatory affairs specialists, Shariah board coordination, and legal counsel with capital markets and real estate dual expertise. Several sandbox participants have recruited former CMA staff to lead compliance functions.

Business development and real estate (20 percent): Property sourcing, developer relationship management, and investor relations. Successful applicants have team members with backgrounds at Saudi real estate developers (Roshn, Dar Al Arkan) or international real estate platforms.

Operations and finance (15 percent): Fund administration, NAV calculation, REGA reporting, financial control, and audit coordination.

Partnership Ecosystem Development

Sandbox participants are building partnership ecosystems that will define the operational infrastructure of Saudi RE tokenization:

Banking partnerships: Every sandbox participant has established relationships with at least one Saudi bank for escrow management, payment processing, and potential co-distribution. The four largest Saudi banks (SNB, Al Rajhi Bank, Riyad Bank, Saudi British Bank) have each engaged with multiple sandbox participants, positioning themselves as infrastructure providers for the tokenized RE market. SAMA-supervised banking partnerships provide the payment rails and custodial infrastructure that CMA requires for permanent licensing.

Developer partnerships: Forward-looking developers are engaging with sandbox participants to prepare for tokenized distribution of their inventory. Roshn has been the most active, conducting exploratory discussions with several platforms about tokenizing portions of its 100,000-unit development pipeline. These partnerships are pre-commercial (no binding agreements during sandbox phase) but establish the supply-side relationships critical for post-licensing market launch.

International technology partnerships: Several Saudi sandbox participants have licensed technology from established international tokenization platforms rather than building proprietary systems. This approach reduces development risk and cost but creates technology dependency on foreign providers — a factor that CMA evaluates during permanent licensing review, as Saudi financial infrastructure sovereignty is a Vision 2030 policy priority.

Valuation and audit partnerships: Independent property valuation (RICS-qualified Saudi valuers) and financial audit (Big Four firms with Saudi offices) partnerships are being established during the sandbox phase to meet CMA’s disclosure and methodology requirements for tokenized offerings.

Regulatory Graduation Requirements and Permanent Licensing Path

The transition from sandbox authorization to permanent CMA licensing represents the most critical regulatory milestone for tokenized RE platforms. CMA has outlined a structured graduation framework that evaluates sandbox participants across five dimensions before granting permanent authorization:

Regulatory compliance track record. CMA reviews the applicant’s entire sandbox period for compliance incidents, reporting accuracy, and responsiveness to regulatory inquiries. Platforms that missed quarterly reporting deadlines or required CMA intervention for investor complaints face extended sandbox periods or denial. The compliance review covers AML/CFT performance, Shariah board governance, and REGA coordination for property-related regulatory obligations.

Technology resilience testing. Before permanent licensing, CMA conducts stress testing of the platform’s technology infrastructure — simulating high transaction volumes, cybersecurity attacks, and smart contract failure scenarios. Platforms must demonstrate 99.9 percent uptime capability, disaster recovery within 4-hour recovery time objectives, and smart contract audit clearance from at least two independent auditing firms. SAMA’s operational resilience expectations for fintech entities inform these technology requirements.

Financial sustainability assessment. CMA evaluates whether the platform has sufficient capital runway to operate for at least 24 months post-licensing without relying on new funding rounds. This assessment includes review of unit economics, projected transaction volumes, and fee income against operating costs. The minimum capital requirement for permanent RE tokenization licensing is SAR 10 million in net liquid assets — higher than the sandbox entry requirement and designed to ensure only financially viable platforms receive permanent authorization.

Investor protection infrastructure. Permanent licensing requires demonstrated investor protection systems including: segregated client asset custody at SAMA-regulated custodian banks, functioning complaints resolution procedures, clear exit mechanisms for investors in tokenized positions, and insurance coverage for operational and cyber risks. Platforms must show that these systems operated effectively during the sandbox period with real investor assets.

Market conduct standards. CMA assesses whether the platform’s marketing materials, offering documents, and investor communications meet permanent-framework disclosure standards. Sandbox-period marketing is typically more restricted than permanent-framework marketing, so platforms must demonstrate that their disclosure infrastructure can scale to broader market distribution without compromising accuracy or completeness.

The graduation timeline — from sandbox entry to permanent license — averages 18-24 months for the first cohort, with CMA signaling that subsequent cohorts may benefit from streamlined 12-month pathways once regulatory precedents are established. The institutional entry strategy should track graduation milestones as signals for scaling tokenized RE allocation.

See also: CMA Securities Rules | SAMA Fintech Framework | CMA Entity Profile | GCC Platform Comparison | CMA Terminology | Institutional Entry Strategies | Blockchain Standards | Saudi vs Dubai Tokenization

Updated March 19, 2026