Existing CMA Licensee Digital Asset Pathway: Accelerated Authorization for Licensed Institutions

Twelve of the 34 entities currently authorized for digital asset activities in Saudi Arabia entered through the CMA’s Existing Licensee Digital Asset Pathway (ELDAP), which launched alongside the broader Digital Assets Regulatory Framework in Q3 2024. ELDAP reduces the average time to digital asset authorization from 14 months to 8 months by leveraging existing compliance infrastructure and regulatory relationships. The pathway has proven particularly attractive to Saudi banks, brokerage firms, and investment companies seeking to add tokenized securities capabilities to their existing operations.

Pathway Eligibility

ELDAP is available to entities that meet the following criteria. Notably, CMA licenses cover five core activity types — Dealing, Arranging, Managing, Advising, and Custody — with 10-year automatically renewable terms, providing the stable regulatory foundation that makes ELDAP acceleration possible:

1. Hold a current, unrestricted CMA license in any category (dealing, custody, advisory, fund management, or exchange operation)
2. Have maintained the license for a minimum of 24 consecutive months without material regulatory sanctions
3. Have a compliance track record with no CMA enforcement actions in the preceding 36 months
4. Can demonstrate board-level commitment to digital asset activities through a formal board resolution

Eligible entities represent approximately 40% of the CMA’s 127 licensed entities. The remaining 60% either do not meet the compliance track record requirements, have not been licensed long enough, or have active enforcement matters that disqualify them.

Entity Types Using ELDAP

Among the 12 entities that have completed the ELDAP process:

• Saudi banks (4): Adding digital asset custody and trading capabilities to existing banking operations, coordinating with SAMA on overlapping regulatory requirements
• Brokerage firms (3): Extending dealing licenses to cover digital asset securities, leveraging existing Tadawul connectivity
• Investment companies (3): Adding tokenized fund management to existing fund operations
• Custody providers (2): Extending conventional securities custody to digital asset custody

Accelerated Process

ELDAP condenses the standard licensing process from five stages to three:

Stage 1: Gap Assessment (2-3 months)

The CMA conducts a gap assessment comparing the entity’s existing regulatory infrastructure against digital asset requirements. Areas typically requiring enhancement:

• Technology infrastructure (blockchain integration, smart contract capabilities)
• Staff competency (digital asset expertise, cybersecurity qualifications)
• Risk management (blockchain-specific risk categories, smart contract risk assessment)
• Compliance monitoring (on-chain transaction monitoring, digital asset AML/CFT)
• Client-facing processes (digital asset suitability assessments, disclosure delivery)

The gap assessment produces a remediation plan with specific milestones and deadlines. CMA assigns a dedicated case officer for the duration of the ELDAP process.

Stage 2: Remediation and Testing (4-6 months)

The entity implements the remediation plan, with CMA conducting periodic reviews:

• Technology readiness assessment — Verification that blockchain infrastructure meets CMA technical standards including approved protocol deployment, smart contract audit completion, and integration with existing systems
• Staff competency verification — CMA-approved digital asset training completion for all client-facing and compliance staff
• Pilot operations — Limited-scale testing equivalent to sandbox Phase 1 but with compressed timelines (3-4 months versus 6-12 months)
• Investor protection readiness — Updated client documentation, suitability questionnaires, and complaint handling processes

Stage 3: Authorization (1-2 months)

CMA technical and compliance review of the remediated entity against full digital asset licensing standards. If satisfactory, the existing CMA license is amended to include digital asset activities within the authorized scope.

The authorization does not require a new license — the entity’s existing license is extended with a digital asset endorsement, preserving the entity’s regulatory history and existing client relationships.

Reduced Capital and Insurance Requirements

ELDAP entities benefit from modified capital requirements:

• Capital requirement: The entity must meet only the incremental capital requirement for digital asset activities, not the full standalone minimum. For example, a brokerage firm with SAR 30M in capital adding digital asset dealing capabilities needs only SAR 5M in additional capital (versus SAR 50M for a standalone digital asset trading platform license).
• Insurance: Existing professional indemnity policies can be extended to cover digital asset activities, provided the total coverage meets CMA minimums. This typically reduces insurance costs by 30-40% compared to standalone digital asset entity insurance.
• Investor protection contributions: Based on digital asset activity volume only, not total entity activity volume.

Performance Metrics

ELDAP performance data as of March 2026:

The higher success rate reflects the self-selecting nature of ELDAP — only established, well-resourced entities with strong compliance records apply.

Supervisory Treatment

ELDAP-authorized entities are subject to the same ongoing supervisory requirements as standalone digital asset licensees, with one exception: their digital asset activities are supervised as part of the entity’s consolidated CMA supervision, rather than through a separate supervisory team. This integrated approach provides efficiency for both the CMA and the entity but requires the CMA’s existing supervisory staff to develop digital asset competency.

The CMA has conducted cross-training programs for 40 supervisory staff members covering blockchain technology, smart contract analysis, and digital asset risk assessment. The training program, developed in partnership with the Saudi Blockchain Lab, is now mandatory for all CMA supervisory personnel.

Future Developments

The CMA has indicated plans to expand ELDAP in two directions:

1. Cross-border ELDAP: Entities licensed by Gulf regulatory bodies with CMA mutual recognition agreements (UAE SCA, Central Bank of Bahrain) will be eligible for an international version of ELDAP, expected to launch in Q4 2026
2. Digital-First ELDAP: A reverse pathway allowing digital asset-native firms with proven track records to obtain conventional CMA licenses through an accelerated process, supporting the integration of digital and traditional securities

Case Studies: ELDAP in Practice

The 12 completed ELDAP processes provide instructive case studies:

Case A — Major Saudi Bank: One of Saudi Arabia’s largest banks completed ELDAP in 7 months, the fastest authorization to date. The bank’s existing custody infrastructure, compliance systems, and client relationships provided a strong foundation. Key gaps addressed: blockchain node operation capability, smart contract risk assessment methodology, and digital asset-specific AML/CFT procedures. The bank now offers digital asset custody alongside conventional securities custody, providing clients with a unified service.

Case B — Tadawul-Affiliated Brokerage: A brokerage with existing Tadawul connectivity completed ELDAP in 9 months. The primary challenge was adapting the firm’s order management system to handle T+0 atomic settlement alongside conventional T+2 orders. The firm invested SAR 8 million in technology upgrades, funded through a combination of retained earnings and venture capital from a digital asset-focused fund.

Case C — International Custody Specialist: A global custody bank with a Saudi subsidiary completed ELDAP in 12 months — longer than average due to the complexity of integrating the Saudi digital asset custody operations with the bank’s global custody platform. The entity now provides cross-border digital asset custody services connecting Saudi tokenized securities with international investor bases.

Strategic Implications

ELDAP has strategic implications for the Saudi digital asset market’s development trajectory:

Institutional Foundation: By channeling established financial institutions into the digital asset market, ELDAP ensures that the Saudi tokenized securities ecosystem is built on institutional-grade infrastructure. This contrasts with markets where digital asset regulation has attracted primarily crypto-native startups, resulting in periodic institutional failures.

Competitive Moat: The combination of existing regulatory relationships, client bases, and operational infrastructure gives ELDAP entrants significant competitive advantages over sandbox-entry firms. This institutional bias is deliberate — the CMA has indicated that market stability during the formative period is more important than maximizing the number of participants.

Convergence Acceleration: ELDAP accelerates the convergence of digital and traditional securities by ensuring that the same institutions serve both markets. When a broker-dealer can route both conventional and tokenized orders through unified systems, the operational friction of the parallel market structure is minimized for investors.

International Model: Several partner jurisdictions have expressed interest in replicating Saudi Arabia’s ELDAP model. The CMA has shared the ELDAP framework design with the UAE SCA and Central Bank of Bahrain through bilateral cooperation agreements.

FATF Compliance and International Standards

ELDAP benefits from Saudi Arabia’s FATF membership (since 2019), which ensures that existing CMA licensees already operate under internationally benchmarked AML/CFT standards. The FATF’s 2024 mutual evaluation rated Saudi Arabia’s financial sector compliance as “largely compliant,” meaning ELDAP entrants inherit a compliance foundation that meets global standards. The gap analysis for ELDAP applicants focuses on digital asset-specific AML/CFT requirements — blockchain analytics, travel rule compliance, unhosted wallet due diligence — rather than rebuilding fundamental compliance infrastructure.

This compliance advantage is particularly relevant for ELDAP entities serving international clients. The CMA’s bilateral cooperation agreements with 11 jurisdictions enable ELDAP entities to offer cross-border digital asset services with regulatory recognition that pure-play digital asset firms cannot match. International institutional investors evaluating Saudi tokenized securities custody options consistently favor ELDAP entities due to their established regulatory relationships and proven compliance track records.

Technology Investment Patterns

The 12 completed ELDAP processes reveal consistent technology investment patterns:

Core Infrastructure: Average technology investment of SAR 5-12 million per entity, covering blockchain node deployment, smart contract integration, digital wallet infrastructure, and enhanced cybersecurity for key management operations. ELDAP entities with existing Tadawul connectivity require approximately 30% less investment than entities building connectivity from scratch.

Staff Augmentation: Each ELDAP entity hired an average of 8 digital asset specialists — including blockchain developers, Sharia compliance technology advisors, and digital asset compliance officers. Fintech Saudi’s talent development programs have been instrumental in sourcing qualified candidates, though demand still exceeds supply.

Timeline Optimization: The fastest ELDAP completion (7 months) was achieved by a major Saudi bank with pre-existing blockchain research capabilities. The slowest (12 months) involved an international custody specialist navigating complex integration between Saudi digital asset operations and a global custody platform. The median completion time of 8.5 months represents a significant advantage over the sandbox pathway’s 14-month average.

ELDAP continues to be the preferred pathway for established Saudi financial institutions seeking to participate in the Kingdom’s tokenized securities market. The combination of accelerated timelines, leveraged compliance infrastructure, and existing client relationships positions ELDAP entities as the institutional backbone of Saudi Arabia’s digital asset ecosystem — supporting the CMA’s vision of an institutional-grade tokenized capital market integrated with Vision 2030 financial sector objectives.

Elm Company and Digital Infrastructure Integration

ELDAP entities benefit from Saudi Arabia’s comprehensive digital infrastructure ecosystem. Elm Company — PIF’s digital solutions subsidiary — provides the Absher and Nafath identity verification platforms used by all ELDAP entities for investor onboarding, ensuring consistent KYC standards between conventional and digital asset client bases. The Saudi Digital Academy’s “Digital Capital Markets” certification program has trained 35 compliance professionals specifically from ELDAP entities, ensuring that the staff competency requirements of Stage 2 remediation can be met through a structured domestic training pipeline rather than expensive international recruitment.

The CMA FinTech Lab has published an ELDAP Implementation Guide based on lessons from the 12 completed processes, providing prospective applicants with detailed gap assessment checklists, technology vendor evaluations, and compliance remediation templates. The guide — developed in consultation with the Saudi Blockchain Lab and Fintech Saudi — reduces the preparation time for ELDAP applications by an estimated 2-3 months, addressing the CMA’s objective of scaling ELDAP throughput to support the Kingdom’s target of 75 licensed digital asset entities by 2028. Saudi Arabia’s FATF membership since 2019 provides a critical accelerator for ELDAP entities: because existing CMA licensees already operate under FATF-compliant AML/CFT frameworks, the incremental digital asset compliance burden focuses narrowly on blockchain-specific requirements rather than fundamental compliance infrastructure. The Elm Company’s Nafath digital identity platform integrates with ELDAP entities’ existing KYC systems, ensuring consistent investor onboarding standards across both conventional and digital asset activities. The ELDAP pathway’s success — 12 completions in 18 months — validates the CMA’s approach of leveraging existing regulatory relationships and compliance infrastructure to accelerate digital asset market development, with an additional 8 applications currently in various stages of the four-stage process.

For ELDAP application inquiries: info@sauditokenisation.com