Saudi Arabia CMA Tokenization Regulation Guide 2026
Saudi Arabia is rapidly transforming its financial sector under the Vision 2030 mandate, creating new opportunities for digital asset infrastructure and blockchain technology. While neighboring jurisdictions have aggressively courted retail crypto exchanges, the Kingdom has taken a measured, institutional approach to market development. Understanding Saudi Arabia CMA tokenization regulation requires navigating a dual-regulator system where the Capital Market Authority handles securities and the Saudi Central Bank oversees banking operations. For founders and institutions looking to tap into the largest economy in the Middle East, this regulatory landscape offers massive capital potential paired with strict compliance requirements.
The Saudi government recognizes that modernizing capital markets is necessary to attract foreign investment and diversify the economy away from oil dependence. This push for modernization has created openings for tokenization platforms, digital asset custodians, and blockchain-based settlement providers. However, foreign entities entering the market face a complex web of licensing requirements, localization rules, and Sharia compliance considerations. This guide examines how existing securities laws apply to tokenized assets, the role of government fintech sandboxes, and the practical costs of establishing a compliant digital asset business in Riyadh.
Regulatory authority and digital asset classification
The Capital Market Authority and the Saudi Central Bank jointly oversee digital assets in Saudi Arabia. The CMA regulates tokenized securities under the Capital Market Law of 2003, while SAMA manages banking and payments. Currently, the Kingdom lacks a unified digital asset framework, relying instead on existing financial legislation to classify and govern tokenized instruments.
The Capital Market Authority serves as the primary regulator for any digital asset that functions as an investment instrument. Under the Capital Market Law (Royal Decree M/30, issued in 2003), the definition of a security is broad enough to capture most tokenized assets, including digital shares, tokenized debt instruments, and fractionalized real estate funds. If a token provides the holder with equity, debt obligations, or profit-sharing rights, the CMA treats it as a traditional security. Issuers of such tokens must comply with standard prospectus requirements, offering rules, and disclosure mandates. The CMA has not created a separate regulatory category for security tokens, meaning platforms must operate under existing licensing categories for dealing, managing, or arranging securities.
The Saudi Central Bank (SAMA, formerly the Saudi Arabian Monetary Authority) controls the other half of the regulatory equation, focusing on payments, banking, and currency issuance. In 2017, SAMA issued a strict cautionary statement warning that Bitcoin and similar virtual currencies are not recognized as legal tender in the Kingdom. The central bank highlighted the high risks associated with unregulated digital currencies and prohibited domestic banks from processing cryptocurrency transactions. However, this hardline stance has gradually softened as the national priorities of Vision 2030 demand financial innovation. Today, SAMA actively researches stablecoins and digital payments, distinguishing between speculative cryptocurrencies and utility-driven blockchain infrastructure.
Founders must carefully analyze their token architecture before entering the Saudi market to determine which regulator has jurisdiction. A tokenized real estate fund falls squarely under CMA oversight and requires a capital market institution license. A fiat-backed stablecoin intended for cross-border remittances triggers SAMA’s payment regulations. Projects that blend investment returns with payment utility face the complex task of satisfying both regulatory bodies simultaneously, often requiring extensive legal consultation to structure the offering compliantly.
Vision 2030 and digital transformation
Vision 2030 drives Saudi Arabia’s financial modernization through the Financial Sector Development Program. This initiative specifically targets fintech growth, capital market expansion, and digital economy infrastructure. Tokenization aligns directly with these goals by promising increased foreign investment and modernized settlement systems for the Saudi Tadawul exchange.
Launched by Crown Prince Mohammed bin Salman in April 2016, Vision 2030 represents a comprehensive blueprint to diversify the Saudi economy away from its historical reliance on oil revenues. The Financial Sector Development Program (FSDP) serves as one of the primary realization programs for this vision. The FSDP aims to build a diversified and effective financial sector to support the development of the national economy, stimulate savings, finance investments, and increase the efficiency of the financial sector. Developing the capital markets is a core pillar of this program, with specific targets for increasing foreign investor participation and expanding the range of available financial products. For those asking what is asset tokenization in the context of Saudi Arabia, it represents a technological mechanism to achieve these exact FSDP goals by making illiquid assets accessible to a broader global investor base.
The Saudi Tadawul Group, which operates the largest stock exchange in the Middle East, plays a central role in this transformation. Tadawul has actively pursued technological modernization to align with global standards and attract institutional capital. While the exchange has not yet launched a public tokenized asset platform, the underlying infrastructure upgrades reflect a clear preparation for digital asset integration. The government has also established dedicated entities to support this technological leap, including the Saudi Data and AI Authority (SDAIA) and the Ministry of Communications and Information Technology. These bodies work alongside financial regulators to ensure the national infrastructure can support advanced blockchain networks and high-frequency digital trading systems.
Massive gigaprojects like NEOM further accelerate the national demand for blockchain and tokenization solutions. NEOM operates with a mandate to build futuristic technological infrastructure from the ground up, entirely unencumbered by legacy systems. The project’s leaders have publicly discussed the integration of blockchain for identity management, supply chain tracking, and digital payments. This localized demand for enterprise-grade blockchain solutions creates a fertile testing ground for tokenization platforms that can demonstrate clear utility in financing large-scale infrastructure and real estate developments.
SAMA fintech sandbox and experimental permits
SAMA launched its regulatory sandbox in 2018 to allow fintech companies to test innovative solutions for 12 to 18 months. Simultaneously, the CMA offers an Experimental Permit for capital market innovations. Both programs provide controlled environments for blockchain and tokenization projects to operate before obtaining full regulatory authorization.
The SAMA regulatory sandbox operates as a secure testing environment where domestic and international fintech companies can deploy new financial products without immediately facing the full burden of standard regulatory compliance. The program typically accepts participants in cohorts, focusing on specific themes such as open banking, digital payments, or alternative lending. Companies admitted to the sandbox receive a temporary license valid for 12 to 18 months, during which they can serve a limited number of actual customers under close SAMA supervision. To qualify, applicants must demonstrate that their product is genuinely innovative, provides clear benefits to Saudi consumers, and includes robust risk management protocols. While SAMA has historically been cautious about public blockchain networks, enterprise distributed ledger solutions for payments and settlements have found traction within the sandbox environment.
Parallel to the central bank’s efforts, the Capital Market Authority operates the FinTech ExPermit (Experimental Permit) program specifically for securities-related innovations. This sandbox is highly relevant for tokenization platforms, digital asset custodians, and blockchain-based crowdfunding portals. The CMA uses the ExPermit program to understand how new technologies interact with existing capital market laws and to determine whether new regulatory frameworks are necessary. Successful graduates from the ExPermit program can eventually apply for a full Capital Market Institution license. The dual-sandbox structure means that tokenization founders must carefully route their applications based on the underlying nature of their digital assets, ensuring they engage the correct regulatory body from day one.
Digital asset framework developments
Saudi Arabia digital assets regulation remains in a developmental phase, contrasting with the comprehensive frameworks established in neighboring jurisdictions. While the UAE utilizes the Virtual Assets Regulatory Authority, Saudi regulators maintain a conservative approach, prioritizing institutional safety and Sharia compliance over rapid retail crypto adoption.
The regulatory approach in Riyadh differs significantly from the strategies employed in Dubai and Abu Dhabi. While the UAE has aggressively positioned itself as a global crypto hub by creating bespoke regulatory bodies like VARA and implementing comprehensive virtual asset frameworks, Saudi Arabia has chosen a more deliberate path. The CMA and SAMA prefer to integrate digital assets into the existing financial architecture rather than creating parallel regulatory structures. This conservative stance limits the rapid proliferation of retail crypto exchanges but provides strong institutional certainty for enterprise tokenization projects. Founders evaluating the tokenization regulations by country will find that Saudi Arabia prioritizes projects that offer tangible economic benefits over speculative trading platforms.
Despite the conservative pacing, Saudi regulators are actively developing their digital asset policies. The CMA has issued various consultation papers regarding the use of distributed ledger technology in securities clearing and settlement. These documents indicate a clear regulatory interest in the efficiency gains provided by blockchain infrastructure. Furthermore, the competitive dynamics between Riyadh and the UAE for regional financial dominance act as a catalyst for regulatory evolution. As international institutions increasingly demand clarity on digital assets, Saudi regulators face pressure to formalize their tokenization frameworks to maintain their position as the leading capital market in the Middle East. For companies researching the best country to launch an STO, Saudi Arabia offers unparalleled access to regional wealth, provided the issuer can navigate the prolonged regulatory approval process.
Sharia compliance represents a unique and critical component of the Saudi regulatory framework for digital assets. Any tokenized financial product offered in the Kingdom must generally align with Islamic finance principles, which prohibit the charging of interest (Riba), excessive uncertainty (Gharar), and investments in restricted industries. Tokenization platforms must structure their smart contracts and underlying assets to ensure compliance with these religious mandates. This often requires engaging specialized Sharia advisory boards to certify the tokenized instruments before they can be marketed to Saudi investors. While this adds a layer of complexity, it also opens access to the massive global Islamic finance market, which actively seeks compliant digital investment products.
Project Aber and CBDC initiatives
Project Aber was a joint central bank digital currency pilot conducted by SAMA and the Central Bank of the UAE. Completed in 2020, the project successfully demonstrated the technical viability of a dual-issued wholesale CBDC for cross-border settlements using distributed ledger technology.
The collaboration between SAMA and the Central Bank of the UAE on Project Aber represents one of the most significant institutional blockchain initiatives in the Middle East. According to the final project report published in 2020, the pilot aimed to explore whether distributed ledger technology could enable a single regional digital currency to facilitate cross-border settlements between commercial banks in both countries. The project tested three distinct use cases: cross-border settlement between the two central banks, domestic settlement between commercial banks, and cross-border transactions between commercial banks. The technical findings confirmed that a DLT-based wholesale CBDC could significantly reduce settlement times, lower transaction costs, and eliminate the need for intermediary correspondent banks.
The success of Project Aber has heavily influenced SAMA’s current position on central bank digital currencies and tokenized settlement infrastructure. While SAMA has not announced an immediate timeline for a production-grade retail CBDC, the central bank continues to advance its wholesale CBDC research. A wholesale CBDC is particularly relevant for the tokenization industry, as it provides the essential fiat-backed settlement layer required for institutional security tokens. Without a digital fiat currency, tokenized securities must rely on traditional banking rails for final settlement, which negates many of the speed and efficiency benefits of blockchain technology. SAMA’s ongoing commitment to DLT research signals to the market that Saudi Arabia is preparing the necessary foundational infrastructure for a fully tokenized financial ecosystem.
Tax treatment for tokenized assets
Saudi Arabia does not levy personal income tax or capital gains tax on securities for individuals. Businesses face a 2.5% Zakat for Saudi or GCC owners, or a 20% corporate income tax for foreign owners. The Zakat, Tax and Customs Authority has not issued specific tax guidance for tokenized assets.
The tax landscape in Saudi Arabia offers distinct advantages for both investors and operators, though the lack of specific digital asset guidance requires careful navigation. The Kingdom does not impose personal income tax on individuals, whether they are Saudi nationals or expatriates. Furthermore, there is no capital gains tax on the sale of securities traded on the Saudi stock exchange or on private securities held by individuals. This creates a highly favorable environment for retail and high-net-worth investors participating in tokenized asset offerings. However, all goods and services are subject to a standard Value Added Tax (VAT) of 15%. Founders must consult the tokenization tax guide and local advisors to determine whether the issuance or trading of their specific tokenized instrument triggers VAT obligations, as the treatment often depends on whether the token is classified as a financial service or a digital good.
Corporate taxation depends entirely on the ownership structure of the business. Companies owned by Saudi or Gulf Cooperation Council (GCC) nationals are subject to Zakat, an Islamic wealth tax assessed at 2.5% on the company’s net assets and specific income sources. Conversely, companies owned by foreign entities are subject to a flat 20% corporate income tax on their net profits. If a company has mixed ownership, the tax burden is apportioned accordingly. The Zakat, Tax and Customs Authority (ZATCA) has not yet published explicit regulations detailing how tokenized assets, cryptocurrencies, or digital security inventories should be valued or taxed. In the absence of specific guidance, tax professionals generally apply existing accounting treatments based on the underlying nature of the token. A tokenized real estate share is taxed according to real estate regulations, while a tokenized debt instrument follows standard corporate debt tax rules.
Practical guidance and costs for founders
Establishing a tokenization business in Saudi Arabia requires Ministry of Investment registration and CMA authorization. Founders should expect MISA and formation costs between SAR 50,000 and SAR 200,000, plus legal structuring fees up to SAR 400,000. CMA dealing licenses require a SAR 50 million capital minimum.
Foreign companies looking to operate in Saudi Arabia must first obtain a foreign investment license from the Ministry of Investment (MISA). This process involves proving the company’s financial viability, track record, and potential contribution to the Saudi economy. Once the MISA license is secured, founders can proceed with company formation, typically opting for a Limited Liability Company (LLC), a branch office, or a Joint Stock Company. The initial MISA registration and company formation costs generally range from SAR 50,000 to SAR 200,000. Because the regulatory framework for digital assets is still evolving, tokenization platforms require extensive legal structuring to ensure compliance with both CMA and SAMA mandates. Founders should budget between SAR 100,000 and SAR 400,000 for specialized legal counsel to navigate the licensing applications and draft Sharia-compliant user agreements. Understanding these foundational steps is essential for anyone reviewing the tokenization glossary and preparing for Middle Eastern expansion.
Securing authorization from the Capital Market Authority represents the most significant financial and operational hurdle. The CMA imposes strict capital adequacy requirements on Licensed Persons to ensure market stability and protect investors. According to CMA regulations, a company seeking a license for dealing activities must maintain a minimum paid-up capital of SAR 50 million. Managing and custody licenses also carry substantial capital requirements, typically ranging from SAR 20 million to SAR 50 million depending on the specific scope of operations. These thresholds are considerably higher than those found in many offshore jurisdictions, reflecting Saudi Arabia’s preference for well-capitalized, institutional-grade market participants. Founders familiar with US SEC tokenization regulation will find the Saudi capital requirements similarly rigorous, though the application process involves different localization and governance mandates.
The Saudi market offers a compelling mix of distinct advantages and notable challenges for tokenization founders. On the positive side, the Kingdom boasts massive domestic wealth, a young population of roughly 36 million with exceptionally high smartphone penetration, and a government actively injecting capital into technology initiatives through Vision 2030. The absence of personal income tax further incentivizes user adoption of investment platforms. However, the business environment can be challenging for foreign entities operating without strong local partners. The regulatory framework remains conservative, the approval processes are lengthy, and Sharia compliance adds ongoing operational overhead. Success in Saudi Arabia requires significant upfront capital, deep respect for local business customs, and a long-term commitment to aligning with the government’s economic modernization goals.
Frequently Asked Questions
What regulators oversee digital assets in Saudi Arabia?
The Capital Market Authority (CMA) regulates tokenized securities and digital investment instruments under the Capital Market Law. The Saudi Central Bank (SAMA) oversees digital payments, stablecoins, and banking infrastructure. Projects often need to navigate both regulatory bodies depending on their token structure.
Is cryptocurrency legal in Saudi Arabia?
Cryptocurrencies like Bitcoin are not recognized as legal tender, and SAMA issued a warning against them in 2017. However, holding or trading digital assets is not explicitly criminalized for individuals, and the government is actively researching institutional blockchain applications through Vision 2030.
Does Saudi Arabia have a regulatory sandbox for tokenization?
Yes, there are two primary sandboxes. SAMA operates a regulatory sandbox for fintech and payment innovations, while the CMA offers a FinTech Experimental Permit (ExPermit) specifically for capital market and securities-related technologies, including digital asset platforms.
What are the capital requirements for a CMA dealing license?
Companies applying for a CMA license to conduct dealing activities in securities must maintain a minimum paid-up capital of SAR 50 million. This high threshold ensures that only well-capitalized, institutional-grade entities operate within the Saudi capital markets.
Are tokenized assets subject to tax in Saudi Arabia?
Saudi Arabia does not impose personal income tax or capital gains tax on individuals. Businesses are subject to either a 2.5% Zakat (for Saudi/GCC ownership) or a 20% corporate income tax (for foreign ownership), plus a standard 15% VAT on applicable services.
