Digital Banking License Framework: SAMA Requirements for Neo-Banks and Digital-Only Banking Services

Four digital banks now operate under SAMA’s digital banking license framework: STC Bank (converted from STC Pay in January 2025 with SAR 2.5 billion capitalization and 12 million customers), D360 Bank, Vision Bank (commenced operations September 2025), and EZ Bank (latest licensee). The digital banking expansion is accelerating within a market where electronic payments already account for 79% of all retail transactions — surpassing the 2025 target of 70% two years early — with 14.4 million active digital wallet users and 97% smartphone penetration. The digital banking license, introduced in 2021 as part of the SAMA fintech sandbox graduation pathway, requires SAR 200M minimum capital — significantly less than the SAR 1 billion minimum for full commercial banking licenses — while permitting the full range of retail banking services delivered through digital channels.

License Structure

SAMA’s digital banking license differs from a conventional banking license in three respects:

Channel Restriction: Digital banks cannot operate physical branches. All customer interactions must occur through digital channels (mobile app, web, API). ATM access is permitted through partnership agreements with existing ATM networks (primarily Saudi Payments mada network).

Reduced Capital: SAR 200M minimum capital (versus SAR 1 billion for commercial banks), reflecting the lower fixed-cost structure of digital-only operations. However, risk-weighted capital adequacy ratios are identical to conventional banks (minimum 8% CET1, 10.5% total capital).

Scope Limitation: Digital banking licenses initially restrict activities to retail and micro-SME banking. Corporate banking, investment banking, and treasury operations require separate authorizations or a full banking license upgrade.

Digital Banking and Tokenization Infrastructure

Digital banks create critical infrastructure for Saudi Arabia’s tokenization ecosystem:

Customer Base: The 4.2 million digital banking customers represent a tech-savvy population predisposed to digital asset adoption. CMA-regulated tokenized securities platforms can leverage digital banking partnerships for customer acquisition and onboarding.

Open Banking APIs: Digital banks offer the most advanced API infrastructures among Saudi financial institutions, enabling seamless integration with tokenized securities platforms for payment processing, account verification, and automated settlement.

Payment Token Distribution: Digital banks are positioned as natural distribution channels for SAR stablecoins and potentially the digital riyal, providing the customer interface for digital currency adoption.

Data Infrastructure: Digital banks’ cloud-native architectures and real-time data processing capabilities support the analytics requirements of tokenized securities compliance and AML/CFT monitoring.

Licensed Digital Banks

D360 Bank

• Launch: Q2 2023
• Ownership: Saudi-backed consortium including Derayah Financial and Saudi venture capital
• Customers: 1.8 million
• Deposits: SAR 5.2 billion
• Digital asset integration: Active in CMA sandbox for tokenized investment product distribution
• Key differentiator: Investment-focused neobank with integrated brokerage services

STC Bank

• Launch: Q4 2023
• Ownership: Saudi Telecom Company (stc) — converted from stc pay payment license to full digital banking license
• Customers: 1.6 million (transitioned from stc pay user base)
• Deposits: SAR 4.1 billion
• Digital asset integration: Partnership with stc pay for payment token services
• Key differentiator: Leverages stc telecommunications infrastructure for distribution and customer acquisition

Saudi Digital Bank

• Launch: Q1 2024
• Ownership: Saudi government-linked investors
• Customers: 0.8 million
• Deposits: SAR 2.7 billion
• Digital asset integration: Exploring custody services for retail digital asset holders
• Key differentiator: Government-backed institution focused on financial inclusion objectives aligned with Vision 2030

Regulatory Supervision

Digital banks are subject to the same SAMA supervisory framework as conventional banks, including:

• Quarterly financial reporting to SAMA
• Annual independent audit by SAMA-approved auditors
• AML/CFT compliance requirements (identical to conventional banks)
• Consumer protection standards including the SAMA complaint resolution framework
• Technology risk management requirements (enhanced for digital-only operations, covering cybersecurity, cloud infrastructure, and business continuity)
• Basel III capital and liquidity requirements

The digital banking license includes a 5-year review clause, at which point SAMA may convert the digital banking license to a full commercial banking license if the entity meets enhanced capital requirements and demonstrates operational maturity.

Digital Banking and Investor Onboarding

Digital banks streamline the onboarding process for tokenized securities investors. The conventional investor onboarding process — requiring branch visits, physical document submission, and multi-day verification — is replaced by fully digital workflows:

Identity Verification: Digital banks integrate with Absher (Saudi Arabia’s national identity platform) and the National Information Center for instant identity verification. This same infrastructure supports CMA investor classification — Qualified Investor (QI), Semi-Qualified Investor (SQI), and retail — by verifying income, net worth, and investment experience through bank data.

KYC and AML/CFT: Digital banks maintain comprehensive AML/CFT programs aligned with FATF standards (Saudi Arabia has been a FATF member since 2019). Customer due diligence data collected during bank account opening — including source of funds, beneficial ownership, and politically exposed person screening — can be shared (with customer consent under open banking frameworks) with CMA-licensed tokenized securities platforms, eliminating duplicate KYC processes.

Payment Integration: Digital bank accounts serve as the funding source for tokenized securities purchases. Atomic settlement on Tadawul’s digital platform requires real-time payment capability — digital banks’ instant payment infrastructure (via the SARIE system and mada network) supports the T+0 settlement model. Profit distributions from tokenized sukuk and dividend payments from equity tokens flow directly to digital bank accounts.

Technology Architecture

Digital banks operate on cloud-native technology stacks that differ fundamentally from conventional banks’ legacy core banking systems:

All three digital banks host their infrastructure within Saudi Arabia, satisfying PDPL data residency requirements. Cloud providers operating Saudi regions (AWS, Microsoft Azure, Oracle Cloud, Google Cloud) provide the underlying infrastructure, with SAMA requiring that all customer data remains within Saudi-hosted data centers.

Competitive Landscape and Differentiation

The three digital banks compete with 23 conventional Saudi banks and with each other across distinct market segments:

D360 Bank has positioned itself as the investment-focused digital bank, with integrated brokerage services and a product roadmap that includes tokenized securities distribution. Its participation in the CMA sandbox for tokenized investment product distribution makes it the most advanced digital bank in digital asset integration. D360’s customer base skews toward higher-income, investment-oriented users — a natural demographic for tokenized sukuk and equity token adoption.

STC Bank leverages the telecommunications distribution network of Saudi Telecom Company (stc), which reaches 99% of the Saudi population. Its transition from stc pay — the Kingdom’s largest digital wallet with 12 million customers — gives it the largest potential distribution base for payment token services and future digital riyal integration.

Saudi Digital Bank serves a financial inclusion mandate aligned with Vision 2030 objectives. Its government backing positions it for potential participation in sovereign digital sukuk distribution and public sector tokenization initiatives.

International Comparison

Saudi Arabia’s digital banking framework is among the most structured in the Middle East:

The SAR 200M capital requirement balances accessibility with prudential soundness. Unlike the UK model with very low entry barriers and high competition, or Singapore’s very high capital requirements, Saudi Arabia’s framework creates a curated digital banking sector with sufficient scale for meaningful market impact.

Growth Projections

SAMA projects the Saudi digital banking sector to reach:

• 2027: 8 million customers, SAR 25 billion in deposits
• 2030: 15 million customers, SAR 60 billion in deposits (representing 20-25% of retail banking market)

These projections are contingent on the continued expansion of digital banking services and the integration of new product categories — including tokenized securities distribution, digital currency services, and open banking-powered financial aggregation.

The potential for additional digital banking licenses remains open. SAMA has not announced a cap on digital banking licenses, and market participants anticipate 1-2 additional licenses by 2028, potentially including a digital bank focused specifically on SME banking or a joint venture with an international digital banking operator.

AML/CFT and Compliance Infrastructure

Digital banks are subject to the same AML/CFT requirements as conventional banks, with additional expectations for digital-native compliance:

Digital KYC: All three digital banks use video-based KYC integrated with Absher national identity verification. Biometric facial recognition is mandatory for account opening, with liveness detection to prevent spoofing. This digital KYC infrastructure is reusable for tokenized securities investor onboarding — under open banking consent frameworks, digital bank KYC data can be shared with CMA-licensed platforms, eliminating duplicate identity verification.

Transaction Monitoring: Digital banks deploy real-time transaction monitoring using machine learning models trained on Saudi-specific payment patterns. SAMA requires automated monitoring for all digital banking customers — manual review processes are not acceptable given the volume and velocity of digital transactions. The three digital banks collectively process over 50 million transactions monthly.

Travel Rule Compliance: For digital currency-related transactions (including payment token transfers), digital banks implement full FATF Travel Rule compliance at the SAR 3,750 threshold. Saudi Arabia’s FATF membership since 2019 ensures these standards are internationally recognized.

Sanctions Screening: Real-time screening against UN, US (OFAC), EU, and Saudi domestic sanctions lists is mandatory for all customer onboarding and transaction processing. Digital banks screen both fiat currency transactions and any digital asset-related activities.

Financial Inclusion and Vision 2030

Digital banks directly support Vision 2030 financial inclusion objectives:

• Youth banking: Approximately 35% of digital bank customers are aged 18-25, a demographic underserved by conventional banks. Digital banks’ mobile-first approach and low-minimum account requirements attract younger customers who are also more likely to adopt tokenized securities
• Women’s financial participation: Digital banking eliminates barriers to female financial participation by providing fully remote account opening and management. Women represent approximately 40% of digital bank customers, higher than the 30% share at conventional banks
• Micro-SME banking: Digital banks serve micro-enterprises with annual revenue below SAR 500,000 — a segment that conventional banks often find uneconomical to serve. Digital banks’ automated underwriting and lower cost structures make micro-SME banking viable
• Geographic reach: Digital banks serve customers across all 13 Saudi regions, including areas with limited conventional bank branch presence. The Eastern Province, Northern Borders, and Al-Baha regions have seen the highest relative growth in digital banking adoption

Consumer Protection and Deposit Insurance

Digital bank deposits are covered by the same depositor protection framework as conventional banks:

• SAMA depositor protection: Deposits at digital banks are covered under SAMA’s depositor protection arrangements, providing the same level of protection as conventional bank deposits
• Complaint resolution: Digital banks must maintain SAMA-compliant complaint resolution processes with maximum 15 business day resolution timelines. Digital banks receive approximately 2,800 complaints monthly combined — a lower rate per customer than conventional banks, reflecting the younger, more digitally comfortable customer base
• Service availability: SAMA mandates 99.5% availability for digital banking platforms, with SLA penalties for outages exceeding 4 hours. All three digital banks exceeded the 99.5% threshold in 2025, averaging 99.8% uptime
• Fee transparency: All digital bank fees must be disclosed prominently before transactions, with no hidden fees. SAMA conducts quarterly mystery-shopper assessments of fee disclosure compliance

Resources

• SAMA Fintech Sandbox — Licensing pathway
• Open Banking Framework — API infrastructure
• Payment Token Framework — Digital currency distribution
• Digital Riyal CBDC — Central bank digital currency
• CMA Digital Assets Framework — Securities regulation
• Vision 2030 Financial Sector — Strategic context

Related network sites: Saudi Tokenized Real Estate | Dubai Tokenisation | UAE Tokenization Regulations | Capital Tokenization

For digital banking inquiries: info@sauditokenisation.com