SAMA’s fintech sandbox, launched in 2018 as part of the Kingdom’s Financial Sector Development Program under Vision 2030, has permitted 50 fintechs to date with 25 currently enrolled as of early 2026. The sandbox adopted an “Always Open” model in 2022, moving away from cohort-based applications to accept year-round submissions — a structural change that has accelerated the pace of fintech entry into the Saudi market. Recent entrants include SpireTech (Open Banking APIs), The Lending Hub and Soar (P2P Lending), and Ldun (MSME Factoring Solutions). An Open Banking Lab, launched in November 2022, provides a dedicated sandbox for open banking businesses, with XSquare, NeotTek, and MoneyMoon among its approved participants, and the sandbox has expanded from its initial focus on payment services to cover digital banking, open banking, insurtech, and — since 2024 — digital currency and payment token activities. The sandbox represents the primary regulatory entry point for fintech innovation in the Saudi financial system, complementing the CMA’s digital asset sandbox for securities-specific activities.
Sandbox Structure and Governance
Regulatory Scope
SAMA’s sandbox covers financial activities under SAMA’s regulatory jurisdiction:
- Payment services: Digital wallets, payment processing, money transfer, point-of-sale innovation
- Digital banking: Neobanking, digital-only banking services, banking-as-a-service
- Open banking: API-based financial data sharing, account aggregation, payment initiation
- Insurtech: Digital insurance distribution, parametric insurance, claims automation
- Digital currency: Payment tokens, stablecoins, and CBDC-related services (added in 2024)
- Lending technology: Peer-to-peer lending platforms, automated credit assessment, micro-lending
Activities that fall under CMA jurisdiction — such as securities issuance, trading, or custody — must apply through the CMA sandbox, though entities may participate in both sandboxes simultaneously for products that span both regulatory perimeters.
Governance Framework
The sandbox is governed by SAMA’s Fintech Department, reporting to the Deputy Governor for Supervision. Key governance elements:
- Sandbox Committee: A five-member committee chaired by the Deputy Governor, meeting monthly to review applications, assess participant progress, and approve graduations
- Technical Assessment Team: Eight-member team conducting technology reviews, penetration testing, and infrastructure assessments
- Compliance Monitoring Team: Six-member team providing real-time compliance oversight of sandbox participants
- Industry Advisory Panel: External panel of fintech entrepreneurs, banking executives, and technology experts providing input on sandbox policy
Application Process
Eligibility Criteria
SAMA sandbox applicants must demonstrate:
- Innovation: The proposed service must represent a genuine innovation in the Saudi financial market — either a new service category or a meaningful improvement over existing licensed services
- Consumer benefit: Clear articulation of how Saudi consumers or businesses will benefit
- Technology readiness: A working prototype or MVP, not just a business plan
- Financial resources: Minimum SAR 500,000 in available capital (lower than CMA’s SAR 1M sandbox minimum)
- Saudi nexus: Either a Saudi-domiciled entity or a commitment to establish Saudi operations within 6 months of sandbox admission
- Regulatory clarity: Understanding of which SAMA regulations apply and how the proposed service addresses regulatory requirements
Application Documentation
Required submissions:
- Business plan with 3-year financial projections
- Technology architecture document including security assessment
- Risk management framework covering operational, financial, and technology risks
- Compliance framework addressing AML/CFT, data protection, and consumer protection
- Key personnel details including qualifications and background checks
- Corporate governance structure
- Capital adequacy evidence
Timeline
Applications are processed within 45 business days of complete submission. SAMA provides feedback at 3 stages:
- Initial screening (10 days): Eligibility assessment and completeness check
- Substantive review (25 days): Detailed evaluation of the business model, technology, and regulatory approach
- Decision (10 days): Approval, conditional approval, or rejection with detailed feedback
Approval rates have averaged 55% over the sandbox’s lifetime, with rejection primarily driven by insufficient innovation (35% of rejections), inadequate technology readiness (30%), and unclear consumer benefit (20%).
Testing Phases
Phase 1: Limited Testing (3-6 months)
- Maximum 500 end users
- Maximum SAR 2M in transaction volume
- Monthly reporting to SAMA
- SAMA observer access to all platform data and analytics
- Mandatory user feedback collection and analysis
Phase 2: Expanded Testing (6-12 months)
- Maximum 5,000 end users
- Maximum SAR 20M in transaction volume
- Quarterly reporting (replacing monthly)
- Independent technology audit required
- Demonstration of AML/CFT compliance at scale
Phase 3: Pre-License Assessment (3-6 months)
- No user or volume restrictions
- Full compliance with applicable SAMA regulations
- Comprehensive SAMA assessment covering technology, governance, financial soundness, and consumer protection
- Preparation of full license application
Graduation and Licensing
Twenty-eight entities have graduated from the sandbox to full SAMA licenses:
| License Category | Graduated Entities | Notable Examples |
|---|---|---|
| Payment Service Provider | 12 | stc pay, HalalaPay, Mada Pay |
| Fintech Company | 8 | Rasan, Geidea, Lean Technologies |
| Digital Banking | 3 | D360, STC Bank |
| Open Banking | 3 | Tarabut Gateway, Lean |
| Insurtech | 2 | Tameeni, Walaa Digital |
The median time from sandbox entry to full license is 16 months, slightly longer than the CMA sandbox average of 14 months. The longer SAMA timeline reflects the broader scope of testing required for financial services that directly handle consumer funds.
Digital Currency Sandbox Track
Since 2024, SAMA has operated a dedicated digital currency track within the sandbox, specifically for:
- Payment token issuance and operation
- Stablecoin technology testing
- CBDC integration services
- Cross-border digital payment solutions
The digital currency track has stricter requirements:
- Minimum capital of SAR 5M (versus SAR 500,000 for the general sandbox)
- Mandatory coordination with CMA if the payment token has securities-like characteristics
- Enhanced AML/CFT requirements including travel rule compliance from day one
- SAMA’s direct involvement in technology architecture review, including blockchain protocol assessment
Five entities are currently in the digital currency track, including 2 international stablecoin issuers seeking Saudi market authorization and 3 domestic fintech firms developing payment token solutions.
Sandbox Impact on Saudi Fintech Ecosystem
The SAMA sandbox has catalyzed measurable growth in Saudi fintech:
- Pre-sandbox (2017): Approximately 10 fintech firms operating in Saudi Arabia
- Post-sandbox (March 2026): Over 200 fintech firms, with 82 holding SAMA licenses
- Employment: Sandbox graduates employ approximately 4,500 staff in Saudi Arabia
- Investment: Sandbox participation has facilitated over SAR 4.5 billion in venture capital funding for Saudi fintech firms
- Financial inclusion: Digital payment adoption in Saudi Arabia reached 79% in 2025, up from 36% in 2019 and exceeding the Vision 2030 target of 70%, driven significantly by sandbox-graduated payment services
Fintech Saudi, the ecosystem development arm, works closely with the SAMA sandbox to identify and prepare potential applicants, running pre-sandbox bootcamp programs and providing mentorship during the testing phases.
International Recognition
SAMA’s sandbox has received recognition from several international bodies:
- World Bank: Featured as a case study in regulatory sandbox best practices in 2024
- BIS Innovation Hub: SAMA sandbox model referenced in the BIS’s global sandbox survey
- FATF: Saudi sandbox’s integration of AML/CFT requirements from the application stage cited as a model approach in FATF’s 2024 virtual assets guidance
The sandbox’s evolution from a payment-focused testing environment to a comprehensive fintech regulatory laboratory reflects SAMA’s adaptive approach to financial innovation — maintaining rigorous standards while expanding the scope of testable activities in response to market development and the Kingdom’s Vision 2030 digital economy objectives.
Cost Structure for Sandbox Participants
Sandbox participation involves both regulatory costs and operational investments:
| Cost Category | Range (SAR) | Notes |
|---|---|---|
| Application fee | 25,000 | Non-refundable |
| Minimum capital deposit | 500,000 - 5,000,000 | Varies by activity type |
| Technology development | 500,000 - 3,000,000 | MVP to production readiness |
| Legal counsel | 100,000 - 300,000 | Saudi regulatory expertise |
| Compliance infrastructure | 200,000 - 800,000 | AML/CFT tools, monitoring systems |
| Independent audit | 100,000 - 250,000 | Required during Phase 2 |
| Sharia advisory | 100,000 - 300,000 | If offering Sharia-compliant products |
| Staff (during sandbox) | 500,000 - 2,000,000 | Compliance, technology, operations |
| Total estimated | 2,000,000 - 12,000,000 | Depending on complexity |
Fintech Saudi provides SAR 100,000-500,000 in non-dilutive grants through the Digital Asset Accelerator to offset some of these costs. Saudi venture capital funding (SAR 4.5 billion invested in fintech since 2018) provides additional capital for sandbox participants.
SAMA Sandbox vs. CMA Sandbox
Entities must understand the distinction between the SAMA and CMA sandboxes:
| Feature | SAMA Sandbox | CMA Sandbox |
|---|---|---|
| Regulatory scope | Payments, banking, insurance | Securities, trading, custody |
| Minimum capital | SAR 500,000 | SAR 1,000,000 |
| Processing time | 45 business days | 60 business days |
| Testing duration | 12-24 months | 12-24 months |
| Graduation rate | 65% | 37% |
| Total graduates | 28 | 16 |
| Digital asset track | Since 2024 | Since inception |
| License categories | 6 | 7 |
Entities whose activities span both regulatory perimeters — for example, a platform offering payment token-settled tokenized securities trading — must participate in both sandboxes. The SAMA-CMA Joint Digital Assets Committee coordinates dual-sandbox participation to avoid duplicative testing and conflicting requirements.
Common Pitfalls
Based on SAMA’s published guidance and industry experience:
- Premature application: Applying without a working prototype results in rejection. SAMA requires demonstrated technology readiness, not conceptual business plans
- Underestimating compliance costs: AML/CFT infrastructure, blockchain analytics, and Travel Rule compliance represent significant investment that applicants frequently underbudget
- Ignoring data residency: All infrastructure must be hosted within Saudi Arabia. International firms using global cloud infrastructure must establish Saudi-resident data processing before sandbox entry
- Insufficient Saudi staffing: SAMA expects key compliance and operations roles to be filled by Saudi nationals or Saudi-resident staff. Remote management from international offices does not satisfy SAMA’s supervisory requirements
- Scope creep during testing: Expanding the tested product beyond the approved sandbox scope triggers regulatory review and potential suspension. Changes must be approved through formal sandbox modification requests
- Neglecting Sharia compliance: Products marketed to Saudi consumers as Sharia-compliant must engage qualified Sharia boards during the sandbox phase, not after graduation
Post-Graduation Support
SAMA provides structured post-graduation support for newly licensed entities:
- Dedicated relationship manager for the first 12 months post-license
- Enhanced reporting: Monthly reporting continues for 6 months post-graduation before transitioning to quarterly
- Peer network: SAMA facilitates a licensed fintech peer network for knowledge sharing and collaboration
- Regulatory updates: Priority notification of regulatory changes affecting licensed fintech entities
- International representation: SAMA includes graduated fintech entities in international delegation visits and regulatory dialogue forums
Future Sandbox Development
SAMA’s sandbox roadmap for 2026-2028 includes:
- AI track: Dedicated sandbox track for AI-powered financial services, including robo-advisory, automated credit assessment, and AI-driven fraud detection
- Green fintech track: Testing environment for climate-related financial technology, including carbon credit tokenization and ESG-linked financial products
- International sandbox: Partnerships with international regulatory sandboxes (FCA, MAS, ADGM) for cross-border fintech testing, enabling international firms to test simultaneously in multiple jurisdictions
- Accelerated track: A 6-month fast-track sandbox for low-risk innovations with established technology, reducing the barrier for incremental product enhancements by existing licensed entities
Resources
- CMA Sandbox Application Guide — Securities sandbox
- Saudi Fintech Licensing Landscape — License categories
- Digital Banking License Framework — Neobank licensing
- Payment Token Framework — Digital currency sandbox track
- Fintech Saudi-CMA Partnership — Accelerator program
- Saudi Fintech Venture Capital — Funding landscape
- Vision 2030 Financial Sector — Strategic context
Related network sites: Saudi Tokenized Real Estate | Dubai Tokenisation | UAE Tokenization Regulations | Capital Tokenization
The SAMA sandbox operates as a complementary regulatory mechanism to the CMA sandbox, with the Joint Digital Assets Committee coordinating applications that span both securities and payment regulation. The Saudi FinTech Strategy 2025 set a target of 150 licensed fintech entities by 2030, requiring the sandbox to maintain its current throughput of 8-10 graduates per year while expanding its scope to accommodate emerging categories including payment token services, digital riyal wallet provision, and stablecoin issuance. Fintech Saudi’s accelerator program — which has supported 14 digital asset startups through two cohorts — serves as the primary pipeline feeding both the SAMA and CMA sandboxes, with graduates benefiting from regulatory preparation that reduces sandbox application processing time by approximately 30 days compared to standalone applicants.
For SAMA sandbox inquiries: info@sauditokenisation.com