CMA Saudi Arabia

The Capital Market Authority (CMA) of Saudi Arabia is the Kingdom’s independent securities regulator, established in 2003 under Royal Decree No. M/30. The CMA’s FinTech Lab, launched in 2017, has issued 68 experimental permits as of Q2 2025, with 36 companies operational, 5 graduated to full licensing, and 50 currently registered — spanning innovation areas including robo-advisory, crowdfunding, digital trading, investment fund distribution, and real estate investment platforms. As of March 2026, the CMA oversees 127 licensed entities and has emerged as the primary regulatory architect of Saudi Arabia’s tokenization ecosystem through the Digital Assets Regulatory Framework published in Q3 2024.

Role in Saudi Tokenization Ecosystem

This entity plays a critical role in Saudi Arabia’s tokenization infrastructure. The institutional framework created by the CMA and SAMA depends on organizations like this to provide the operational, technological, and market infrastructure that transforms regulatory frameworks into functioning markets.

Key Metrics

Digital Assets Division

The CMA’s Digital Assets Division, established in Q3 2024, serves as the dedicated regulatory unit overseeing all tokenized securities activities in the Kingdom. The division is staffed by approximately 45 professionals with specialized expertise in blockchain technology, smart contract governance, Islamic finance, and digital asset compliance. Key responsibilities include:

• Processing sandbox applications and managing the three-phase testing structure
• Evaluating ELDAP applications from existing CMA licensees seeking digital asset authorization
• Maintaining the Approved Protocol Registry (5 blockchain protocols currently approved)
• Supervising proof-of-reserves attestations from 11 licensed custodians
• Conducting market surveillance of Tadawul’s digital securities platform
• Coordinating with SAMA on joint AML/CFT oversight through the Joint Digital Assets Committee

Regulatory Framework Architecture

The CMA’s Digital Assets Regulatory Framework establishes 7 specific license categories for digital asset activities:

1. Digital asset dealing (12 licensees) — SAR 15-50M capital
2. Digital asset custody (11 licensees) — SAR 25-100M capital with 95% cold storage mandate
3. Digital asset issuance (8 licensees) — SAR 10-25M capital
4. Digital asset advisory (5 licensees) — SAR 2-5M capital
5. Digital asset fund management (4 licensees) — SAR 10-25M capital
6. Digital asset exchange operation (2 licensees) — SAR 50-100M capital
7. Digital asset clearing (1 licensee) — SAR 100M capital

Strategic Initiatives

The CMA’s strategic initiatives align with Saudi Arabia’s Vision 2030 financial sector development objectives:

1. Digital-traditional convergence — A three-phase roadmap targeting unified securities infrastructure by 2028, eliminating the regulatory distinction between tokenized and conventional securities
2. Sovereign digital sukuk — Joint program with the Ministry of Finance targeting 2027 launch, potentially making Saudi Arabia the first sovereign to issue blockchain-native government debt
3. Investor protection expansion — Graduated retail investor access to tokenized securities, with mandatory education programs and three-tier classification
4. International regulatory cooperation — 11 bilateral agreements enabling cross-border enforcement and information sharing, leveraging Saudi Arabia’s FATF membership (since 2019) and G20 participation
5. Sharia compliance integration — The world’s most detailed regulatory framework for Islamic digital asset securities, with 6 approved Sharia boards and 85% certification rate

FATF Standing

The CMA’s regulatory framework benefits from Saudi Arabia’s FATF membership, secured in 2019. The FATF’s 2024 mutual evaluation rated the Kingdom’s digital asset framework as “largely compliant” with FATF Recommendations 15 and 16, positioning Saudi Arabia among the top-rated jurisdictions globally for virtual asset regulation. This rating strengthens the CMA’s credibility in bilateral negotiations and provides international institutional investors with independent assurance of regulatory quality.

Market Impact

Under the CMA’s oversight, Saudi Arabia’s tokenized securities market has grown from zero in Q2 2024 to SAR 2.1 billion in outstanding tokenized securities by Q1 2026. The CMA’s SAR 50 billion target for tokenized securities by 2030 represents approximately 1.7% of Tadawul’s current $2.7 trillion market capitalization.

Ecosystem Connections

The CMA connects to the broader Saudi tokenization ecosystem through:

• Co-regulatory relationship with SAMA through the Joint Digital Assets Committee
• Market infrastructure oversight of Tadawul and Edaa
• Technology standards through coordination with the Saudi Blockchain Lab
• Ecosystem development through partnership with Fintech Saudi
• Enforcement across all 34 digital asset-authorized entities

Network Intelligence

For comprehensive coverage of Saudi Arabia’s tokenization ecosystem across all verticals:

• CMA Framework — Digital asset regulations and licensing
• SAMA Fintech — Fintech sandbox and payment tokens
• Capital Markets — Tadawul digital securities platform
• Ecosystem — Enterprise adoption and venture capital

Related network sites: Saudi Tokenized Real Estate | Dubai Tokenisation | UAE Tokenization Regulations | Capital Tokenization

CMA FinTech Lab and Digital Assets Division

The CMA FinTech Lab serves as the operational unit responsible for sandbox administration, innovation monitoring, and regulatory technology development. The Lab employs 12 dedicated staff processing sandbox applications and monitoring active participants — scaled from 4 staff at the sandbox’s January 2024 launch. The Lab maintains a DeFi monitoring desk tracking international decentralized finance developments across 11 jurisdictions covered by bilateral cooperation agreements, with intelligence informing both enforcement priorities and the regulatory development roadmap.

The Digital Assets Division — established in Q3 2024 with 45 professionals — represents the CMA’s most significant organizational expansion since the authority’s 2003 founding. Division staff span blockchain technology specialists, smart contract auditors, Islamic finance compliance experts, and international regulatory cooperation officers. The division’s composition reflects the CMA’s recognition that digital asset regulation requires technical expertise alongside traditional securities regulatory knowledge.

Saudi FinTech Strategy 2025 and Institutional Coordination

The CMA co-authored the Saudi FinTech Strategy 2025 with SAMA, establishing a multi-year policy framework that connects digital asset regulation to Vision 2030 economic diversification objectives. The strategy sets explicit targets: 75 CMA-licensed digital asset entities by 2028, SAR 50 billion in tokenized securities by 2030, and Saudi Arabia positioned as the GCC’s institutional-grade digital securities market.

The CMA’s institutional coordination extends to the Elm Company — PIF’s digital solutions subsidiary — whose Nafath digital identity platform provides the biometric verification layer used by all 34 licensed digital asset entities for investor onboarding. The Saudi Digital Academy delivers CMA-designed training programs for digital asset regulatory professionals, with 120 certified through March 2026. The Saudi Blockchain Lab provides technical advisory informing the CMA’s Approved Protocol Registry and custody standards.

PIF’s exploration of tokenization for portfolio company equity engages the CMA at the sovereign level, requiring the regulatory framework to accommodate potential institutional-scale tokenization of Tadawul-listed securities. The Ministry of Finance’s planned sovereign digital sukuk program (SAR 5 billion) further tests the CMA’s regulatory infrastructure at government issuance scale.

The CMA’s G20 membership — exercised through IOSCO Fintech Task Force participation, including co-chairing the Crypto-Assets Working Group — positions Saudi Arabia as an active contributor to international digital asset regulatory standards. The SEC and ESMA engagement through IOSCO working groups ensures that the CMA’s framework development is informed by and contributes to global regulatory evolution, while the FATF membership (since 2019) provides the AML/CFT credibility that international institutional investors require before committing capital to Saudi digital asset markets.

Comparative Regulatory Position

The CMA’s Digital Assets Regulatory Framework is the most comprehensive securities-specific digital asset regulation in the GCC. Compared to UAE VARA (4 license categories), the CMA’s 7-category framework provides more granular authorization scoping. Compared to international frameworks including the SEC and ESMA, the CMA’s approach is distinguished by its integrated Sharia compliance requirements and three-tier investor classification system. The CMA’s custody standards — requiring 95% cold storage and SAR 65M insurance — exceed GCC peer requirements and align with emerging IOSCO guidance on digital asset safeguarding. The disclosure framework mandates 14 digital-asset-specific disclosure categories, the most detailed in the region. The CMA’s enforcement capability — 7 actions totaling SAR 20.5M through Q1 2026 — demonstrates regulatory willingness to sanction non-compliance, providing market participants with confidence in regulatory credibility. Enforcement categories cover unlicensed promotion (3 cases), AML/CFT failures (2 cases), capital requirement breaches (1 case), and smart contract non-compliance (1 case). The CMA’s sandbox has processed 43 participants with a 37% graduation rate, establishing a rigorous but achievable pathway to full licensing. The Fintech Saudi accelerator pipeline feeds directly into the sandbox, with 71% of recent applicants having participated in Fintech Saudi programs. The Saudi Blockchain Lab’s 42-criteria protocol evaluation framework and the Edaa DLT settlement infrastructure provide the technical foundations that the CMA’s regulatory framework operates on. The CMA’s Digital Assets Division maintains a DeFi monitoring desk tracking decentralized finance developments across 11 jurisdictions, informing enforcement priorities and the regulatory development roadmap for emerging digital asset categories. The CMA’s disclosure requirements mandate 14 digital-asset-specific disclosure categories — the most detailed in the GCC — ensuring transparent information for investors in tokenized sukuk, equity tokens, and digital bonds. The CMA’s proactive regulatory posture — publishing comprehensive digital asset rules before market activity scaled — contrasts with the reactive approaches adopted by several international peers, providing Saudi market participants with regulatory certainty that accelerates institutional adoption and reduces compliance risk for licensed entities.

For entity-specific inquiries: info@sauditokenisation.com