Cross-Border Digital Asset Custody Guide: Navigating Multi-Jurisdictional Custody for Saudi Tokenized Securities

Step-by-step guide for institutional investors establishing cross-border custody arrangements for Saudi tokenized securities — covering CMA custody license requirements, data residency obligations, and bilateral regulatory cooperation agreements enabling international custody chains.

Introduction

International institutional investors seeking exposure to Saudi tokenized securities — tokenized sukuk, equity tokens, and digital bonds — require cross-border custody arrangements that satisfy both Saudi CMA requirements and their home jurisdiction obligations. This guide covers the step-by-step process for establishing compliant cross-border custody, based on the CMA’s Digital Asset Custody Standards and bilateral cooperation agreements.

As of Q1 2026, 4 international custodian banks have completed integration with Tadawul’s digital securities platform, providing the operational infrastructure for cross-border custody. 47 institutional participants — including sovereign wealth funds, pension funds, and asset managers from 12 countries — hold positions in Saudi tokenized securities.

Prerequisites

Before establishing cross-border custody:

1. Qualified Foreign Investor (QFI) status with the CMA — minimum SAR 3.75 million portfolio requirement
2. Home jurisdiction licensing — custody provider must be licensed in its home jurisdiction
3. Bilateral cooperation agreement — the CMA’s international cooperation agreements cover 11 jurisdictions
4. FATF compliance — custody provider’s home jurisdiction must be a FATF member or equivalent (Saudi Arabia has been a FATF member since 2019)
5. Legal counsel in both Saudi Arabia and the investor’s home jurisdiction

Step 1: Custody Model Selection

Three custody models are available for international investors in Saudi tokenized securities:

Model A — Saudi-Licensed Custodian Only: The investor appoints a CMA-licensed Saudi custodian (11 licensed as of Q1 2026) to hold tokenized securities. All custody operations occur within Saudi Arabia. Simplest model but requires the investor to manage a Saudi custodian relationship directly.

Model B — Sub-Custody Chain: The investor appoints their existing global custodian, which sub-delegates to a CMA-licensed Saudi custodian for Saudi tokenized securities. The global custodian maintains the client-facing relationship; the Saudi sub-custodian holds the tokens on Edaa’s DLT register. This is the most common model for large institutional investors.

Model C — Direct International Custodian: The investor uses one of the 4 international custodian banks with direct Tadawul platform integration. These custodians hold both CMA custody authorization (through Saudi operational presence) and home jurisdiction licenses, providing a single-custodian solution.

Step 2: Regulatory Compliance Assessment

Cross-border custody must comply with requirements from multiple regulatory authorities:

Saudi CMA Requirements (Digital Asset Custody Standards):

• 95% cold storage of client digital assets
• SAR 65M minimum professional indemnity insurance
• Quarterly proof-of-reserves attestation
• Edaa custodian-of-last-resort mechanism
• Saudi data residency for all custody-related data
• AML/CFT compliance including Travel Rule

Home Jurisdiction Requirements:

• Custody provider’s home regulator requirements (varies by jurisdiction)
• Cross-border transfer reporting obligations
• Tax reporting (withholding tax, CRS/FATCA)
• Sanctions screening against home jurisdiction lists

Bilateral Agreement Requirements: The CMA’s bilateral cooperation agreements with GCC and international regulators specify information sharing protocols, joint supervision arrangements, and mutual assistance provisions for cross-border custody. Agreements currently cover ADGM, VARA, DFSA, CBB, MAS, FCA, SEC, AMF, BaFin, JFSA, and HKMA.

Step 3: Data Residency and PDPL Compliance

Saudi Arabia’s Personal Data Protection Law (PDPL) and CMA requirements impose strict data residency obligations:

• All custody-related data (client identity, transaction records, key management logs) must be stored in Saudi-resident databases
• International custodians must execute Standard Contractual Clauses (SCCs) approved by SDAIA (Saudi Data and Artificial Intelligence Authority)
• Cross-border data transfers for operational purposes (settlement instructions, corporate actions) are permitted under SCC framework
• PDPL breach notification within 72 hours applies to custody data breaches

The 4 international custodians with Tadawul integration have completed SCC execution and established Saudi-resident data processing infrastructure.

Step 4: Establish Custody Agreement

The cross-border custody agreement must include Saudi-specific provisions:

• CMA licensing status of the Saudi custodian entity
• Cold storage and key management arrangements (95% minimum)
• Edaa custodian-of-last-resort acknowledgment
• Insurance coverage confirmation (SAR 65M minimum)
• Proof-of-reserves attestation schedule
• Saudi data residency compliance
• AML/CFT cooperation protocols
• Sharia compliance provisions (if holding Sharia-certified instruments)
• Governing law and dispute resolution (Saudi arbitration or SIRC)
• Termination and asset transfer procedures

Step 5: Technical Integration

Cross-border custody requires technical integration across:

Tadawul Digital Platform Connectivity:

• R3 Corda node deployment for trade settlement
• API integration for order routing through CMA-licensed broker-dealers
• Real-time position reconciliation with Edaa register

Payment Settlement Infrastructure:

• SAR settlement account at a Saudi bank for atomic DvP
• Payment token or digital riyal wallet for digital settlement
• Cross-border payment channels for SAR funding/withdrawal (SARIE, SWIFT)

Compliance Infrastructure:

• AML/CFT transaction monitoring for all custody transactions
• Travel Rule messaging for cross-border transfers above SAR 3,750
• Sanctions screening integration with home jurisdiction lists
• Tax reporting data capture (withholding tax, CRS/FATCA)

Step 6: Onboarding and Account Setup

Once agreements and technical integration are complete:

1. QFI registration with CMA (if not already registered)
2. Account opening at Saudi custodian and/or sub-custodian
3. Digital wallet creation on Edaa’s DLT register
4. SAR settlement account activation
5. Test transaction to verify end-to-end settlement flow
6. Compliance system testing (AML/CFT, Travel Rule)
7. Operational go-live

Step 7: Ongoing Operations

Post-establishment ongoing obligations:

CMA Reporting:

• Quarterly custody position reports
• Proof-of-reserves attestation (quarterly)
• Material event disclosure (custody infrastructure changes, security incidents) within 24 hours

AML/CFT Compliance:

• Ongoing transaction monitoring using blockchain analytics
• Suspicious transaction reporting to SAFIU within 24 hours
• Annual AML/CFT program review and update

Corporate Actions:

• Processing tokenized sukuk profit distributions
• Equity token dividend processing
• Redemption and maturity settlement
• Smart contract upgrade coordination

Cost Structure

GCC Cross-Border Custody

GCC cooperation agreements are developing harmonized custody standards that will simplify cross-border custody within the Gulf region. The Saudi CMA’s custody standards (95% cold storage) exceed current GCC peer requirements, positioning Saudi custody infrastructure as the highest-standard in the region.

Resources

• CMA Digital Asset Custody Standards — Regulatory requirements
• Edaa Securities Depository — Central depository and custodian of last resort
• CMA International Regulatory Cooperation — Bilateral agreements
• Data Privacy and Tokenized Securities — PDPL compliance
• Saudi vs. UAE Custody Comparison — Regional benchmarking
• How to Invest FAQ — Investor questions

Related network sites: Saudi Tokenized Real Estate | Dubai Tokenisation | UAE Tokenization Regulations | Capital Tokenization

Institutional Infrastructure and Sovereign Backing

Cross-border custody for Saudi tokenized securities benefits from the Kingdom’s institutional infrastructure depth — a distinguishing factor relative to other GCC custody jurisdictions.

PIF’s exploration of tokenization for portfolio company equity creates institutional demand for cross-border custody infrastructure capable of handling sovereign-scale digital securities. PIF’s approximately $1 trillion portfolio includes companies whose equity, sukuk, and financing instruments would flow through Tadawul’s digital platform and require custody arrangements meeting both CMA standards and international institutional requirements. The 4 international custodians currently integrated with Tadawul are positioning for this anticipated institutional volume.

Elm Company’s Nafath digital identity platform provides the identity verification layer that cross-border custody operations rely on for AML/CFT compliance. International investors onboarding through CMA-licensed custodians use Nafath-verified identity data that integrates with Saudi Arabia’s Absher government ID system, meeting the CMA’s investor protection standards for foreign investor onboarding.

The Saudi Digital Academy’s “Digital Asset Custody Operations” certification program has trained 40 professionals in cross-border custody compliance, key management, and Edaa DLT register operations. This specialized workforce supports the 11 CMA-licensed custodians in managing the technical and regulatory complexity of multi-jurisdictional custody chains.

The Saudi Blockchain Lab’s research into hardware security module (HSM) architectures and cold storage key management directly informs the CMA’s custody technical standards — the 95% cold storage requirement and multi-signature key management specifications that international custodians must implement for Saudi-held tokenized securities. The Lab’s 4 patent applications include a cryptographic protocol for cross-chain custody key management that could streamline multi-protocol custody operations.

Saudi Arabia’s FATF membership (since 2019) and the FATF’s 2024 “largely compliant” mutual evaluation provide international institutional investors with confidence in the AML/CFT standards governing Saudi custody operations. The CMA’s 11 bilateral cooperation agreements — covering regulators including the SEC, FCA, MAS, and JFSA — establish the supervisory cooperation framework that enables cross-border custody chains to operate under coordinated regulatory oversight.

SAMA’s digital riyal CBDC program will impact cross-border custody by introducing risk-free digital settlement media for the payment leg of atomic DvP settlement. International custodians currently settling through SAR bank accounts would gain the option of digital riyal settlement, potentially reducing settlement times and eliminating payment-side counterparty risk for cross-border trades in Saudi tokenized securities.

The Fintech Saudi ecosystem supports cross-border custody development by coordinating between CMA-licensed custodians, international financial institutions, and technology providers building the infrastructure for multi-jurisdictional custody operations. The Saudi FinTech Strategy 2025’s target of attracting international financial institutions to the Kingdom’s fintech ecosystem directly supports the expansion of cross-border custody connectivity beyond the current 4 integrated international custodians.

The GCC cross-border custody landscape is evolving toward harmonized standards, with the Saudi CMA’s 95% cold storage requirement and SAR 65M insurance mandate representing the highest custody standard in the region. GCC cooperation on custody harmonization — involving the CMA, ADGM, VARA, DFSA, and CBB — aims to establish mutual recognition of custody standards that would simplify cross-border custody chains within the Gulf. The sovereign digital sukuk program (SAR 5 billion target, 2027 launch) is expected to drive significant international institutional demand for cross-border custody, as foreign investors seeking Saudi sovereign credit exposure through tokenized instruments will require compliant custody arrangements.

The planned digital-traditional securities convergence on Tadawul by 2028 — where DLT settlement becomes the default for all exchange-traded securities — would transform cross-border custody from a specialized digital asset function into a standard component of all international institutional Saudi equity and fixed-income exposure. International custodians preparing for this convergence are investing in R3 Corda infrastructure and Edaa API integration capabilities ahead of the transition timeline.

The IOSCO principles for financial market infrastructures — which inform the CMA’s custody framework — require that custody arrangements provide robust legal certainty, operational reliability, and transparent governance regardless of the jurisdictions involved. The CMA’s implementation of these principles through the Digital Asset Custody Standards provides international institutional investors with confidence that Saudi custody infrastructure meets the highest global standards for post-trade services. The CMA’s enforcement capability extends to cross-border custody arrangements, with bilateral cooperation agreements enabling joint supervision and information sharing between Saudi and home jurisdiction regulators for custodians operating across multiple markets. The SEC and ESMA cooperation agreements are particularly significant for cross-border custody, as they cover the two largest institutional investor pools with material interest in Saudi tokenized securities exposure through regulated custody channels. The CMA’s adherence to IOSCO custody principles positions Saudi Arabia as a jurisdiction where international custodians can establish operations with confidence that regulatory standards align with the global institutional framework they operate within. International custodians currently evaluating Saudi market entry should note that the CMA’s ELDAP pathway reduces authorization timelines to approximately 8 months for entities already licensed in jurisdictions covered by bilateral cooperation agreements, providing an accelerated route to cross-border custody service provision.

Saudi Arabia’s participation in the mBridge cross-border CBDC project positions the Kingdom to offer digital riyal settlement for international custody transactions, further reducing counterparty risk for cross-border tokenized securities trades.

For guide-related inquiries: info@sauditokenisation.com