Is Crypto Legal in Saudi Arabia?
Cryptocurrency is legal but heavily restricted in Saudi Arabia. The jurisdiction has a restrictive regime with banking or trading constraints. Saudi Central Bank is among the 2 regulators with oversight. Primary legislation: Royal Decree No. M/1 dated 21/2/1416H. The FATF Travel Rule is adopted.
Derived from 95 sourced facts for Saudi Arabia · last updated · primary sources
Overview
Saudi Arabia regulates crypto under a partial framework anchored in the 2022 Law of Payments and Payment Providers and its 2023 SAMA Payment Service Provider Regulations, with no standalone VASP law; activities such as crypto trading, custody, wallet services, and payment processing trigger entry through SAMA's Regulatory Sandbox as the sole recognized licensing pathway, while business registration with the Ministry of Investment (MISA) is a prerequisite but insufficient on its own. Firms must incorporate a local legal entity, disclose ultimate beneficial owners, and maintain ongoing compliance verification encompassing AML/CFT obligations under Royal Decree M/20, with no asset segregation rules yet applicable to crypto custody. Foreign firms may apply pre-incorporation but must establish a Saudi entity upon sandbox approval, and unlicensed operations remain impermissible, making sandbox admission the critical gate for any retail exchange, custody, or brokerage activity. (sama.gov.sa, misa.gov.sa)
Regulatory Bodies
Saudi Central Bank - Implementing Regulation to the AML Law (PDF) - Note: PDF currently returns access error
2018 Standing Committee Declaration (via SAMA/CMA): Virtual assets illegal/unlicensed.
Operating Models
9/9 verdictsCan specific business models operate in Saudi Arabia? Each card answers the operational question for one kind of operator. Curated cells reflect counsel-grade review; AI-generated cells should be confirmed before relying on them.
Conditional · high burden.
AI · UnreviewedConditional · high burden.
AI · UnreviewedNot permitted.
AI · UnreviewedConditional · high burden.
AI · UnreviewedNot permitted.
AI · UnreviewedConditional · high burden.
AI · UnreviewedNot permitted.
AI · UnreviewedConditional · high burden.
AI · UnreviewedConditional · high burden.
AI · UnreviewedPrimary Legislation
| Law / Regulation | Year | Scope |
|---|---|---|
| Royal Decree M/20 (AML/CFT) | Royal Decree M/20 (AML/CFT): General transaction reporting. (https://zipmex.com/blog/is-crypto-mining-legal-in-saudi-arabia/) | |
| Royal Decree No. M/1 dated 21/2/1416H | The Commercial Register Law, issued by Royal Decree No. (M/83) dated 19/3/1446H, replaces the previous Commercial Register Law (Royal Decree No. | |
| Royal Decree No. M/83 | The five-year grace period for correcting subsidiary commercial registers under the Commercial Register Law (Royal Decree No. |
Licensing Requirements
No standardized licenses: There is no broadly public VASP (Virtual Asset Service Provider) or crypto-specific license for retail exchanges, custody, or payment processing; activities like crypto trading, wallet services, or brokerage fall outside approved perimeters without explicit regulatory approval.
Limited permitted activities: Under SAMA's 2023 Payment Service Provider Regulations (enabled by the 2022 Law of Payments and Payment Providers), related services such as digital banking, electronic payment processing, P2P lending/investment, asset/wealth investment, crypto/blockchain applications, and BNPL may qualify indirectly, but not pure crypto trading or custody.
Exchanges and custody: Require entry via SAMA's Regulatory Sandbox as the primary (and currently only recognized) route for testing and potential approval; full operations demand ongoing compliance verification.
Payment processors: Must align with payment regulations; foreign entities can apply pre-incorporation but must form a local entity upon issuance.
Primarily a licensing regime with sandbox entry: Business registration alone (e.g., via Ministry of Investment - MISA portal) is insufficient; it precedes a preliminary sandbox application to SAMA for crypto-related activities. No "one-click" registration substitutes for licensing, and unlicensed operations face administrative penalties, unannounced inspections, and potential legal action.
Entity setup first: Legally register a company (e.g., LLC), disclose UBOs/shareholding, define business objects, then seek sandbox admission; foreign firms may operate if activities align with SAMA approvals.
Register entity and obtain investment license via MISA portal (upload documents, select authorized activity).
Submit preliminary application to SAMA Regulatory Sandbox electronically (full documentation on solvency, audits, AML systems, business model).
Undergo review/testing (up to 1 year); meet ongoing reporting, security, and client protection standards.
Post-sandbox: Secure full operational approval; continuous audits required.
SAMA Payment Service Provider Regulations (2023): https://www.sama.gov.sa (search regulations).
2018 Standing Committee Declaration (via SAMA/CMA): Virtual assets illegal/unlicensed.
AML/KYC Requirements
Saudi Central Bank - Implementing Regulation to the AML Law (PDF) - Note: PDF currently returns access error
Saudi Central Bank - AML Laws Page
Saudi Central Bank - Insurance AML Regulations IIR_4600 (PDF)
Saudi Central Bank - Official Website (Arabic)
Saudi Central Bank - Historical Currency Information
FATF Mutual Evaluation Report - Saudi Arabia 2018 - Note: Not included in original source list; referenced for FATF compliance status
Travel Rule
No verified facts yet. 5 unverified fact(s) in explorer
Tax Reporting
Tax reporting data collection in progress.
Custody Requirements
Custody regulation data collection in progress.
Stablecoin Regulation
Stablecoin regulation data collection in progress.
Securities Classification
The Capital Market Authority (CMA) oversees the regulatory framework for cryptocurrencies and digital assets in Saudi Arabia, ensuring compliance with securities laws and anti-money laundering (AML) standards.
The CMA has issued regulations that categorize certain digital assets as securities, subjecting them to the same licensing and disclosure requirements as traditional securities.
Issuers of digital asset securities must obtain a license from the CMA, demonstrating compliance with capital adequacy, disclosure, and market conduct requirements.
Digital asset service providers are required to implement robust AML and Know Your Customer (KYC) procedures, in line with the directives from the Anti-Money Laundering Committee.
The CMA has the authority to enforce penalties, including fines and suspension of licenses, against entities that violate regulatory requirements related to digital assets.
Digital asset transactions are subject to Saudi Arabia's corporate income tax regime, with specific guidance provided for crypto-related income.
Current regulations may not fully address emerging technologies such as decentralized finance (DeFi) platforms, posing potential regulatory gaps and associated risks.
Capital Market Authority | Home
Capital Market Law - Capital Market Law - cma.org.sa
Implementing Regulations - Implementing Regulation - cma.org.sa
Anti-Money Laundering Committee - aml.gov.sa
The Capital Market Authority - The Capital Market Authority - cma.org.sa
Saudi Arabia - Corporate - Group taxation
PDF General Saudi Capital Market Rules and Regulations
Sanctions & Restrictions
Sanctions data collection in progress.
Research & Articles
Regulatory Forecast
high confidenceLikely enforcement action expected around 2026-04-22
Based on 53 historical regulatory events for Saudi Arabia, with increasing regulatory activity.
Recent Updates
Custodial License Requirements: None exist, as no licenses are issued for cryptocurrency practices; entities clai...
Custodial License Requirements: None exist, as no licenses are issued for cryptocurrency practices; entities claiming otherwise face legal action.
Cold Storage Mandates: No mandates, due to the overall ban on public cryptocurrencies.
Cold Storage Mandates: No mandates, due to the overall ban on public cryptocurrencies.
No standardized licenses: There is no broadly public VASP (Virtual Asset Service Provider) or crypto-specific lic...
No standardized licenses: There is no broadly public VASP (Virtual Asset Service Provider) or crypto-specific license for retail exchanges, custody, or payment processing; activities like crypto trading, wallet services, or brokerage fall outside approved perimeters without explicit regulatory approval.
Limited permitted activities: Under SAMA's 2023 Payment Service Provider Regulations (enabled by the 2022 Law of ...
Limited permitted activities: Under SAMA's 2023 Payment Service Provider Regulations (enabled by the 2022 Law of Payments and Payment Providers), related services such as digital banking, electronic payment processing, P2P lending/investment, asset/wealth investment, crypto/blockchain applications, and BNPL may qualify indirectly, but not pure crypto trading or custody.
Primarily a licensing regime with sandbox entry: Business registration alone (e.g., via Ministry of Investment - ...
Primarily a licensing regime with sandbox entry: Business registration alone (e.g., via Ministry of Investment - MISA portal) is insufficient; it precedes a preliminary sandbox application to SAMA for crypto-related activities. No "one-click" registration substitutes for licensing, and unlicensed operations face administrative penalties, unannounced inspections, and potential legal action.
Entity setup first: Legally register a company (e.g., LLC), disclose UBOs/shareholding, define business objects, ...
Entity setup first: Legally register a company (e.g., LLC), disclose UBOs/shareholding, define business objects, then seek sandbox admission; foreign firms may operate if activities align with SAMA approvals.
Planned but unconfirmed STO rules via CMA (announced 2022).
Planned but unconfirmed STO rules via CMA (announced 2022).
Whether Saudi Arabia has enacted specific legislation or regulatory guidance for the Travel Rule
Whether Saudi Arabia has enacted specific legislation or regulatory guidance for the Travel Rule
The Saudi Central Bank (SAMA) and Capital Market Authority (CMA) are the primary regulatory bodies issuing wa...
The Saudi Central Bank (SAMA) and Capital Market Authority (CMA) are the primary regulatory bodies issuing warnings on cryptocurrency speculation, but no dedicated crypto regulator existsSaudi Arabia section, insights4vc.substack.com/p/global-crypto-asset-regulation-outlook.
SAMA and CMA have issued public warnings about the risks of crypto speculation, indicating informal enforcement throu...
SAMA and CMA have issued public warnings about the risks of crypto speculation, indicating informal enforcement through advisoriesSaudi Arabia section, insights4vc.substack.com/p/global-crypto-asset-regulation-outlook.
SAMA and CMA have issued warnings against crypto speculation, indicating informal enforcement through public notices....
SAMA and CMA have issued warnings against crypto speculation, indicating informal enforcement through public notices.Saudi Arabia
UNVERIFIED: Travel Rule not implemented as no VASP registration or crypto-specific regulations exist.
UNVERIFIED: Travel Rule not implemented as no VASP registration or crypto-specific regulations exist.
SAMA and CMA have issued public warnings against crypto speculation to deter participation.https://insights4vc.substa...
SAMA and CMA have issued public warnings against crypto speculation to deter participation.https://insights4vc.substack.com/p/global-crypto-asset-regulation-outlook
UNVERIFIED: No dedicated licensing requirements for crypto activities exist, as there is no comprehensive regulatory ...
UNVERIFIED: No dedicated licensing requirements for crypto activities exist, as there is no comprehensive regulatory framework.
UNVERIFIED: No specific AML/CFT rules tailored to crypto have been implemented.
UNVERIFIED: No specific AML/CFT rules tailored to crypto have been implemented.
UNVERIFIED: No specific tax reporting obligations for crypto assets are defined.
UNVERIFIED: No specific tax reporting obligations for crypto assets are defined.
UNVERIFIED: Travel Rule not implemented, due to absence of comprehensive crypto regulation.
UNVERIFIED: Travel Rule not implemented, due to absence of comprehensive crypto regulation.
UNVERIFIED: No specific AML/CFT requirements for crypto, given the lack of a regulatory framework.
UNVERIFIED: No specific AML/CFT requirements for crypto, given the lack of a regulatory framework.
UNVERIFIED: Travel Rule compliance is not mandated, as there is no regulatory framework requiring it for VASPs.8
UNVERIFIED: Travel Rule compliance is not mandated, as there is no regulatory framework requiring it for VASPs.8
SAMA and CMA issue public warnings against crypto speculation but have not pursued dedicated enforcement actions spec...
SAMA and CMA issue public warnings against crypto speculation but have not pursued dedicated enforcement actions specific to crypto firms.8
Regulators like SAMA and CMA have issued public warnings against crypto speculation without formal enforcement mechan...
Regulators like SAMA and CMA have issued public warnings against crypto speculation without formal enforcement mechanisms for crypto-specific activities.8
Regulatory bodies such as SAMA and CMA have issued warnings about crypto speculation, indicating informal enforcement...
Regulatory bodies such as SAMA and CMA have issued warnings about crypto speculation, indicating informal enforcement through public advisories.8
UNVERIFIED: Travel Rule not implemented for crypto transactions.
UNVERIFIED: Travel Rule not implemented for crypto transactions.
Regulators such as SAMA and CMA have issued warnings against crypto speculation without formal enforcement mechanisms...
Regulators such as SAMA and CMA have issued warnings against crypto speculation without formal enforcement mechanisms for crypto activities.8
Regulatory bodies such as SAMA and CMA issue public warnings against crypto speculation without formal enforcement me...
Regulatory bodies such as SAMA and CMA issue public warnings against crypto speculation without formal enforcement mechanisms for crypto activities[https://insights4vc.substack.com/p/global-crypto-asset-regulation-outlook].
UNVERIFIED: No specific AML/CFT regulations tailored to cryptocurrencies have been enacted.
UNVERIFIED: No specific AML/CFT regulations tailored to cryptocurrencies have been enacted.
UNVERIFIED: No specific tax treatment or reporting obligations for crypto gains or transactions defined in law.
UNVERIFIED: No specific tax treatment or reporting obligations for crypto gains or transactions defined in law.
The Saudi Central Bank (SAMA) and the Capital Market Authority (CMA) are the primary regulatory bodies issuin...
The Saudi Central Bank (SAMA) and the Capital Market Authority (CMA) are the primary regulatory bodies issuing warnings about cryptocurrency speculation, but they do not oversee a dedicated crypto framework.Saudi Arabia
Regulators like SAMA and CMA issue public warnings against crypto speculation without formal enforcement mechanisms f...
Regulators like SAMA and CMA issue public warnings against crypto speculation without formal enforcement mechanisms for crypto firms.Saudi Arabia
This profile is maintained by AI research workers and updated regularly. Connect via MCP for programmatic access.