Payment Token Regulatory Framework: SAMA Rules for Digital Payment Instruments in Saudi Arabia

SAMA published its Payment Token Regulatory Framework in June 2024, establishing the first dedicated regulatory structure for digital payment instruments in Saudi Arabia. The framework operates within a digital payments ecosystem where electronic transactions have reached 79% of all retail activity, with 11.5 billion card transactions processed in 2024, 96% contactless POS penetration, and 2 million POS terminals deployed nationwide. The framework covers stablecoins, e-money tokens, and prepaid digital value instruments, requiring SAR 5M minimum capital, full reserve backing with Saudi-domiciled custodianship, and quarterly attestation by SAMA-approved auditors. Seven entities have received payment token authorization as of March 2026, with combined outstanding tokens valued at approximately SAR 1.8 billion.

Scope and Definitions

SAMA defines a “payment token” as any digital representation of value that is:

• Accepted as a means of payment by persons other than the issuer
• Issued against receipt of funds or assets
• Stored electronically or magnetically
• Redeemable at par value on demand

This definition captures several product categories:

Fiat-Referenced Stablecoins: Tokens pegged to the Saudi riyal (SAR) or other fiat currencies, maintained at stable value through reserve asset backing. These represent the largest category under the framework, with 4 authorized issuers.

E-Money Tokens: Digital representations of fiat currency issued against receipt of funds for the purpose of making payment transactions. Functionally similar to conventional e-money but deployed on blockchain infrastructure.

Prepaid Digital Value: Stored-value instruments that represent prepaid access to goods or services, deployed as blockchain-based tokens. These are subject to lighter regulation than stablecoins but must still meet basic consumer protection requirements.

Algorithmic Stablecoins: Tokens that maintain price stability through algorithmic supply management rather than full reserve backing. SAMA has effectively prohibited algorithmic stablecoins by requiring all payment tokens to maintain full (1:1) reserve backing — a direct response to the TerraUSD collapse that influenced regulatory thinking globally.

Exclusions

The framework explicitly excludes:

• Digital Asset Securities (governed by CMA)
• Central Bank Digital Currency (digital riyal, which is SAMA-issued rather than privately issued)
• Closed-loop tokens usable only within a single merchant or platform
• Virtual currencies without a stable value mechanism (e.g., Bitcoin, which SAMA treats as a virtual commodity)

Authorization Requirements

Capital Requirements

The higher capital requirements for foreign currency stablecoins reflect SAMA’s concern about exchange rate risk and the potential for capital outflow through stablecoin channels.

Reserve Asset Requirements

All payment tokens must maintain 100% reserve backing. Eligible reserve assets:

1. Saudi government securities (treasury bills, government sukuk) — up to 100% of reserves
2. Cash deposits at Saudi-licensed banks — up to 100% of reserves
3. Central bank deposits at SAMA — up to 100% of reserves
4. G7 government securities — up to 30% of reserves (for foreign currency tokens only)

Prohibited reserve assets: corporate bonds, equities, crypto assets, derivatives, or any asset with credit risk exceeding AA- rating. This conservative reserve composition mirrors the approach taken by Singapore’s MAS and exceeds the reserve requirements under EU MiCA regulation.

Reserve Custodianship

All reserve assets must be held by a Saudi-licensed bank or SAMA-approved custodian. The custodian must:

• Segregate reserve assets from its own assets and from other clients’ assets
• Provide daily valuation reports to the payment token issuer
• Provide quarterly attestation to SAMA confirming reserve composition and adequacy
• Not use reserve assets for lending, pledging, or any other purpose

Consumer Protection

SAMA’s payment token consumer protection provisions include:

Redemption Rights: Token holders have the right to redeem tokens at par value (1:1) on demand. Maximum redemption processing time is 24 hours for SAR-denominated tokens and 72 hours for foreign currency tokens. No redemption fees are permitted for amounts below SAR 10,000.

Disclosure: Issuers must clearly disclose the token’s reserve composition, redemption process, fee schedule, and risk factors. The disclosure must be in Arabic and English, presented before the user acquires tokens.

Complaints: Issuers must maintain a complaint resolution function meeting SAMA’s customer protection standards, with maximum 15 business day resolution timeline.

Insurance: Payment token issuers must maintain professional indemnity insurance of minimum SAR 10M, covering operational failures, cybersecurity breaches, and unauthorized transactions.

AML/CFT Requirements

Payment token activities are subject to SAMA’s full AML/CFT framework:

• Travel rule compliance for all transfers above SAR 3,750
• Customer due diligence for all token holders
• Transaction monitoring using SAMA-approved blockchain analytics tools
• Suspicious transaction reporting to SAFIU within 24 hours
• Annual AML/CFT independent audit

Payment tokens present unique AML/CFT challenges due to their potential for rapid cross-border transfer. SAMA requires enhanced monitoring for:

• Transfers to or from unhosted wallets
• Large-value redemptions (above SAR 200,000)
• Pattern-based structuring detection
• Cross-border transfer monitoring, particularly to jurisdictions with weak AML frameworks

Market Landscape

Seven authorized payment token entities as of March 2026:

• 4 SAR-referenced stablecoin issuers — Including 2 Saudi bank-affiliated entities and 2 fintech firms
• 2 e-money token issuers — Both fintech firms graduated from the SAMA sandbox
• 1 multi-currency stablecoin issuer — Authorized for SAR and USD-denominated tokens

Combined outstanding payment tokens reached approximately SAR 1.8 billion in Q1 2026, with the majority (SAR 1.2 billion) in SAR-referenced stablecoins used for domestic digital payments and remittance optimization.

Interoperability with CMA Framework

Payment tokens that also function as investment instruments (for example, tokens that pay yield on reserves to holders) fall under dual regulation by SAMA and the CMA. The SAMA-CMA Joint Digital Assets Committee provides guidance on classification in borderline cases.

The distinction is critical: a SAR-referenced stablecoin that simply maintains par value and facilitates payments is SAMA-regulated. If that same stablecoin distributes interest income from reserve assets to holders, it acquires securities-like characteristics and requires CMA authorization.

Comparison with International Frameworks

Saudi Arabia’s framework is among the most restrictive globally, reflecting SAMA’s priority of monetary stability and its concern about the potential for payment tokens to disrupt the domestic banking system’s deposit base.

Payment Tokens and Tokenized Securities Settlement

Payment tokens serve as the primary digital settlement medium for tokenized securities on Tadawul’s digital platform. The interaction operates as follows:

Delivery-versus-Payment (DvP): When an investor purchases a tokenized sukuk or equity token on Tadawul, the payment leg can be settled using SAR-referenced stablecoins. The atomic settlement mechanism on R3 Corda executes the token transfer and payment simultaneously — the sukuk token moves to the buyer’s wallet and the SAR stablecoin moves to the seller’s wallet in a single atomic transaction (3-7 seconds).

Profit Distribution: Smart contracts can distribute sukuk profit payments and equity dividends using payment tokens, enabling instant, automated distribution to all holders without manual bank transfer processing.

Redemption: At maturity, tokenized sukuk smart contracts can execute redemption payments in payment tokens, burning the sukuk tokens and distributing SAR stablecoins to all registered holders in a single transaction.

Cross-Border Settlement: International investors accessing Saudi tokenized securities through cross-border custody arrangements can use USD-denominated payment tokens for settlement, with FX conversion occurring at the point of settlement.

Technology and Infrastructure

Payment token issuers must deploy technology infrastructure meeting SAMA’s requirements:

Blockchain Protocol: Payment tokens must be deployed on CMA-approved protocols if they will be used for tokenized securities settlement. For general payment use, issuers may deploy on any protocol meeting SAMA’s security standards, though R3 Corda (for Tadawul integration) and Ethereum ERC-20 (for international interoperability) are the most common choices.

Smart Contract Audit: Payment token smart contracts must undergo security audit by a SAMA-approved auditor — the same 6 firms approved by the CMA for tokenized securities smart contract audits. Annual re-audit is required.

Data Residency: All payment token transaction data, customer data, and reserve management data must be stored on Saudi-hosted infrastructure, consistent with PDPL data residency requirements. Issuers using public blockchains must ensure that validator/node infrastructure includes Saudi-hosted nodes.

Cybersecurity: Minimum requirements include annual penetration testing, real-time intrusion detection, multi-signature key management for minting/burning operations, and incident response plans filed with SAMA.

Payment Token and Digital Riyal Interaction

The relationship between private payment tokens and the planned digital riyal CBDC is a key policy question:

• Coexistence model: SAMA has confirmed that private payment tokens will coexist with the digital riyal. Payment tokens serve specific commercial use cases (tokenized securities settlement, cross-border payments, programmable payments), while the digital riyal serves as the risk-free public digital currency
• Reserve denomination: Upon digital riyal launch, SAMA may require payment token issuers to hold a portion of reserves in digital riyal rather than bank deposits, strengthening the link between private tokens and central bank money
• Interoperability: Payment token issuers will be required to support digital riyal redemption, enabling token holders to convert between private and central bank digital currency seamlessly

Enforcement and Compliance History

SAMA has taken 3 enforcement actions against payment token entities through March 2026:

The relatively low enforcement count reflects the sector’s early stage. SAMA has indicated that enforcement intensity will increase as the payment token market grows and supervisory expectations mature.

Vision 2030 and Payment Token Growth

Payment tokens contribute to Vision 2030 Financial Sector Development Program objectives:

• 70% digital payment adoption by 2030: Payment tokens represent a new digital payment channel, complementing card-based and open banking-initiated payments
• Financial inclusion: Payment tokens with simplified KYC (for balances below SAR 5,000) extend digital payment access to underbanked populations
• Capital markets development: Payment tokens as settlement media support the SAR 50 billion tokenized securities target by 2028
• International competitiveness: A regulated SAR stablecoin ecosystem positions Saudi Arabia alongside Singapore, the EU, and the UAE as jurisdictions with comprehensive digital payment regulation

Operational Risks and Mitigation

SAMA identifies specific operational risks for payment token activities:

Smart Contract Risk: Coding errors in payment token smart contracts could result in unauthorized minting, burning failures, or frozen tokens. The mandatory annual smart contract audit requirement mitigates this risk, but SAMA also requires issuers to maintain emergency procedures for contract pausing and manual intervention.

Custodian Concentration: All payment token reserves must be held at Saudi-licensed banks, creating concentration risk. SAMA recommends reserve diversification across multiple custodian banks for issuers with outstanding supply exceeding SAR 500 million. The two largest issuers currently use 2-3 custodian banks each.

Redemption Risk: Mass redemption events could strain issuer liquidity even with 100% reserves, particularly if reserves include government securities requiring liquidation. The 40% minimum cash requirement for SAR stablecoins provides a first-loss buffer, but extreme scenarios could still create temporary processing delays within the 24-hour redemption window.

Resources

• Stablecoin Regulation — SAR stablecoin specifics
• Digital Riyal CBDC — Central bank digital currency
• AML/CFT Compliance — Payment token compliance
• Self-Custody Position — Unhosted wallet controls
• Cross-Border Payments — International settlement
• Blockchain Settlement Infrastructure — DvP settlement
• CMA Digital Assets Framework — Securities regulation

Related network sites: Saudi Tokenized Real Estate | Dubai Tokenisation | UAE Tokenization Regulations | Capital Tokenization

For payment token licensing inquiries: info@sauditokenisation.com