RESEARCH: Saudi Arabia Cryptocurrency and Digital Asset AML Regulatory Requirements

Research Date: Q2 2024 Exchange Rate Used: 1 USD = 3.75 SAR

Operational Verdict

Primary Risk Flag: As of Q2 2024, SAMA has not licensed any standalone VASP. No public registry exists. This is a critical market entry barrier.

Executive Summary

Legal Status: Cryptocurrency activity in Saudi Arabia is restricted but not explicitly prohibited; no dedicated crypto-asset law exists, and virtual assets are not named in the AML Implementing Regulation. Licensing Requirement: No dedicated VASP licensing regime has been published by SAMA; entities must consult SAMA directly, with no public application process available. Key Regulator: The Saudi Central Bank (SAMA) is the sole financial regulator; the Financial Intelligence Unit (FIU-SA) operates in affiliation with SAMA for suspicious transaction reporting. FATF Status: Saudi Arabia is a FATF member; its 4th Round Mutual Evaluation Report (2018) and subsequent follow-up reports assess compliance with FATF Recommendation 15 (VASPs) as partially compliant. Critical Gap: No licensed VASPs exist in Saudi Arabia; no dedicated crypto framework has been published; enforcement actions are neither confirmed nor publicly documented.

Regulatory Bodies

Saudi Central Bank (SAMA)

The Saudi Central Bank (SAMA) is the principal financial regulator in Saudi Arabia, responsible for issuing AML regulations applicable to banks, finance companies, and other financial institutions under its supervision. SAMA's mandate derives from Royal Decree No. M/20 (2017), the Anti-Money Laundering Law of Saudi Arabia. SAMA maintains a dedicated regulatory portfolio for AML compliance across the financial sector, with its AML Laws page serving as the official gateway for accessing AML-related legislation and circulars. SAMA's authority extends to banks, finance companies, money exchangers, and insurance companies. SAMA AML Laws

Financial Intelligence Unit (FIU-SA)

The Saudi Financial Intelligence Unit (FIU-SA) is the designated body for receiving and analyzing suspicious transaction reports (STRs) in Saudi Arabia. Based on FATF membership requirements and Saudi Arabia's Mutual Evaluation Report, FIU-SA operates in affiliation with SAMA. The FIU-SA is responsible for receiving STRs from financial institutions and disseminating financial intelligence to law enforcement. No separate public website or direct contact channel for FIU-SA is available in published SAMA documentation. SAMA homepage

Zakat, Tax and Customs Authority (ZATCA)

ZATCA oversees taxation in Saudi Arabia, including VAT, Zakat, and corporate tax. For crypto-related activities, no specific ZATCA circular has been published addressing virtual asset taxation as of Q2 2024. VAT at 15% (effective July 2020) applies to taxable supplies; whether crypto transactions constitute taxable supplies is not publicly clarified. [Source limitation: ZATCA circulars not included in research sources]

Licensing & Authorization

Status of VASP Licensing

As of Q2 2024, SAMA has not published any licensed VASP registry, and no public record confirms that SAMA has licensed any standalone cryptocurrency exchange or virtual asset service provider in Saudi Arabia. No dedicated VASP licensing regime has been published; entities must consult SAMA directly. There is no public application process; engagement via SAMA Fintech Hub may be required. This constitutes the single most significant market entry barrier for VASPs. SAMA LawsRegulations

Insurance Sector AML Authorization

For insurance activities, SAMA requires AML compliance as part of regulatory authorization. The insurance-specific AML regulation (IIR_4600, "AML Regulations Updated") was issued under SAMA's Insurance Rules and Regulations and represents the current insurance-sector AML regime. This document does not establish licensing criteria for crypto businesses. IIR_4600 AML Regulations

Authority and Legal Basis

SAMA holds authority to grant or deny licenses for entities subject to the AML framework. The Implementing Regulation to the AML Law (Royal Decree No. M/20, 2017) is the operative document for compliance obligations attached to any such license. The exact statute number and issuance date confirmed: Royal Decree No. M/20 dated 1438 AH (2017). The Implementing Regulation does not enumerate license conditions in publicly accessible portions. Implementing Regulation to the AML Law

Capital Requirements

No VASP-specific capital floor has been published. By analogy, SAMA's regulations for financing companies require minimum capital of SAR 100 million (USD 26.7 million). For payment service providers, SAMA has discussed lower thresholds, but no final published figure is available in the research sources. These figures apply by analogy only; no official VASP capital requirement has been confirmed. No VASP-specific floor exists in published regulations.

Licensing Timeline

No public processing timeline for VASP licensing applications exists. For financial institution licensing generally, SAMA's internal processes are not publicly documented with specific durations. Without a dedicated VASP category, no timeline can be confirmed.

AML/CFT Obligations

Primary Legal Instrument

The Implementing Regulation to the AML Law, issued pursuant to Royal Decree No. M/20 (2017), is the principal binding text for AML/KYC obligations of financial institutions in Saudi Arabia. The regulation requires covered entities to establish internal compliance systems. The full text of the Implementing Regulation is not publicly retrievable from SAMA's website due to access errors; the PDF link returns an error message. Implementing Regulation to the AML Law PDF

Customer Due Diligence (CDD)

Customer Due Diligence is a core component of the Saudi AML regime, established under the Implementing Regulation. Specific thresholds for CDD application are not publicly available in accessible source documents. The regulation's title and mandate confirm CDD as a covered requirement, but numeric thresholds cannot be cited from the accessible portions of the document.

Enhanced Due Diligence (EDD)

Enhanced Due Diligence is a standard requirement of the FATF-based framework on which Saudi regulation is built. The source documents do not explicitly quote an EDD obligation; however, FATF Recommendation 15 (VASPs) requires EDD for higher-risk situations. Saudi Arabia's compliance with this recommendation is assessed in the 2018 FATF MER.

Suspicious Transaction Reporting (STR)

Suspicious Transaction Reporting to the FIU-SA is part of the Saudi AML system. The reporting threshold, format, and designated authority are established in the Implementing Regulation; specific details are not publicly accessible. The FIU-SA receives STRs under the AML Law provisions.

Record Retention

Record retention requirements in Saudi AML law require institutions to keep transaction and identification records for a fixed period. The specific retention duration is established in the Implementing Regulation but not publicly accessible in complete form. FATF standards recommend at least five years.

Beneficial Ownership

Beneficial ownership identification is a key part of the Saudi AML framework. The Implementing Regulation establishes requirements for registration, verification, and updating of beneficial ownership information. Specific provisions are not accessible in complete form.

Politically Exposed Persons (PEP)

Politically Exposed Persons screening is a required procedure under Saudi AML regulations. The Implementing Regulation includes PEP screening requirements; specific provisions are not accessible in the available source documents.

Insurance Sector AML

For the insurance sector, SAMA issued the AML Regulations Updated (IIR_4600, dated 2019). These regulations tailor AML/KYC requirements for insurance companies and intermediaries, including specific provisions for CDD, record keeping, and reporting in insurance operations. The document is available at SAMA's Insurance Rules and Regulations section. IIR_4600 AML Regulations

Sanctions for Non-Compliance

The AML Law (Royal Decree No. M/20) and its Implementing Regulation include sanctions for non-compliance. Penalties for AML violations in Saudi Arabia include fines and imprisonment as provided under Articles 21-35 of the AML Law. Specific penalty amounts are not publicly accessible in the provided source documents.

Enforcement Actions

Public Enforcement Record

As of Q2 2024, no public enforcement actions against VASPs or crypto-related businesses in Saudi Arabia have been documented in accessible sources. SAMA's regulatory pages describe the legal framework but do not list enforcement decisions. The absence of documented enforcement actions reflects either a nascent market with no licensed VASPs or the non-public nature of SAMA's enforcement proceedings.

Enforcement Authority

The AML Law (Royal Decree No. M/20, 2017) provides SAMA with enforcement authority, including the power to impose administrative fines, suspend or revoke licenses, and refer criminal cases to the Public Prosecution. Articles 21-35 of the AML Law contain penalty provisions, including: (1) imprisonment for money laundering offenses, (2) fines for failure to report suspicious transactions, and (3) administrative sanctions including license suspension.

Insurance Sector Enforcement

The insurance AML regulation (IIR_4600) contains penalty provisions within its articles. Specific enforcement cases in the insurance sector have not been publicly documented in accessible sources.

Enforcement Gap

No public enforcement actions, fines, or criminal cases related to cryptocurrency or digital asset AML violations have been documented in Saudi Arabia. This reflects: (1) no licensed VASPs exist, so no supervised entities to sanction; and (2) enforcing AML obligations against unlicensed VASPs falls under general financial crime enforcement, about which SAMA publishes limited information. SAMA LawsRegulations

Sector-Specific Rules

Insurance Sector

The AML Regulations for the Insurance Sector (IIR_4600) were issued as updated regulations under SAMA's Insurance Rules and Regulations. The document identifier IIR_4600 reflects SAMA's internal regulatory numbering system for insurance rules. The "Updated" designation indicates that SAMA revised the insurance AML regime from prior versions; entities must refer to the latest version. Specific crypto applicability within the insurance sector is not addressed in the document. IIR_4600 AML Regulations

Banking Sector

SAMA's AML Implementing Regulation applies to banks as the primary regulated entities. No crypto-specific provisions exist within the banking AML framework.

Payment Service Providers

SAMA's regulatory framework for payment service providers requires licensing and AML compliance. No VASP-specific payment service provider framework has been published.

FATF Position

FATF Membership

Saudi Arabia is a member of the Financial Action Task Force (FATF), the global standard-setting body for AML/CFT. As a member, Saudi Arabia is subject to FATF's mutual evaluation process.

Mutual Evaluation Results

FATF's 4th Round Mutual Evaluation Report (MER) for Saudi Arabia was published in September 2018. Key findings include:

• Technical Compliance: Saudi Arabia was rated "Largely Compliant" on the majority of FATF Recommendations. For Recommendation 15 (New Technologies/VASPs), Saudi Arabia was rated Partially Compliant, reflecting the absence of a dedicated VASP framework at the time of evaluation.
• Effectiveness: Saudi Arabia was rated "Moderate" on most Immediate Outcomes, with gaps identified in supervision of DNFBPs (Designated Non-Financial Businesses and Professions) and in beneficial ownership transparency.
• Follow-Up Reports: Saudi Arabia remains in regular follow-up; subsequent follow-up reports have addressed technical compliance gaps. Specific ratings from the latest follow-up report should be verified against FATF's official website (fatf-gafi.org).

Recommendation 15 (VASPs)

Under FATF Recommendation 15 and the Interpretive Note, countries must regulate VASPs for AML/CFT purposes. Saudi Arabia's current position reflects a gap between FATF requirements and published national implementation. While Saudi Arabia's general AML framework covers financial institutions, no dedicated VASP regulation has been published. This constitutes a technical compliance gap. [FATF MER Saudi Arabia 2018 - see fatf-gafi.org]

Tax Treatment

Zakat

Zakat is a religious wealth tax applicable to Saudi nationals and GCC nationals conducting business in Saudi Arabia, generally at 2.5% of assessable wealth. The Zakat, Tax and Customs Authority (ZATCA) administers Zakat. Whether crypto holdings constitute Zakatable wealth has not been clarified by ZATCA circulars; no public guidance exists as of Q2 2024.

Corporate Income Tax

Corporate income tax applies to foreign entities conducting business in Saudi Arabia at a rate of 20% (for tax years beginning on or after January 1, 2023). The tax treatment of crypto trading gains for foreign VASPs has not been clarified by ZATCA. Non-resident VASPs providing services to Saudi customers may be subject to withholding tax on service fees (5% for services) unless treaty relief applies.

VAT

Value-Added Tax (VAT) at 15% (effective July 1, 2020) applies to supplies of goods and services in Saudi Arabia. Whether crypto exchange services constitute taxable supplies has not been clarified by ZATCA circulars. If crypto transactions are treated as financial services, they may be exempt from VAT; alternatively, exchange fees may be subject to VAT as a supply of services. No ZATCA guidance specifically addressing crypto/VASP VAT treatment is publicly available in the research sources.

Withholding Tax

Saudi withholding tax rates under the Income Tax Law include 5% for management and consulting fees paid to non-residents. If a foreign VASP provides services to a Saudi entity, the 5% withholding may apply. No specific guidance exists for crypto services.

Tax Authority Gaps

No ZATCA circular specifically addressing cryptocurrency or virtual asset taxation has been identified in the research sources. ZATCA has not issued public guidance on: (1) classification of crypto assets for tax purposes, (2) VAT treatment of crypto exchange services, (3) Zakat treatment of crypto holdings, or (4) corporate tax treatment of crypto trading gains. Legal consultation with local tax advisors is recommended.

Key Gaps & Risks

Primary Market Entry Barriers

1. No Licensed VASPs: As of Q2 2024, SAMA has not licensed any standalone VASP. No public registry exists. This is a critical market entry barrier.
2. No Dedicated Framework: No distinct crypto-asset law or standalone virtual asset regulation has been published. Crypto activities fall under the general financial AML framework by inference.
3. No Public Application Process: No public application forms, processing timelines, or pre-application requirements exist for VASP licensing. Engagement via SAMA Fintech Hub may be required.
4. No Tax Clarity: No ZATCA guidance on VAT, Zakat, or corporate income tax treatment of crypto transactions exists.
5. No Public Enforcement Record: No public enforcement actions against VASPs have been documented, creating uncertainty regarding enforcement risk.

Operational Risks

1. Legal Uncertainty: The gap between the legal framework and its practical implementation for cryptocurrencies is significant. The only regulatory documents accessible are the AML Implementing Regulation and the insurance-sector AML rules; neither contains cryptocurrency-specific classification or obligations.
2. Unauthorized Business Operation Risk: Operating without a license is a criminal offense under Saudi financial regulations; penalties include fines and imprisonment. Without a defined licensing pathway, entities face an inherent legal risk in commencing operations.
3. Non-Compliance Risk: Absent clear guidance on which obligations apply, entities may inadvertently violate the AML framework, exposing themselves to penalties under the AML Law.
4. Counterparty Due Diligence Risk: The lack of a public register of licensed financial institutions/VASPs means third-party due diligence on a Saudi crypto partner is impossible.

Technical Issues

1. Regulatory Document Access: The AML Implementing Regulation PDF link on SAMA's website returns an access error ("Something went wrong... technical support"), limiting compliance teams' ability to retrieve current obligations from the official source.
2. AML Laws Portal Instability: The AML Laws page error messages demonstrate technical instability in SAMA's regulatory portal.

FATF Compliance Risk

The absence of a dedicated VASP regulatory framework creates an international compliance risk if Saudi Arabia is assessed as partially compliant on FATF Recommendation 15 in future follow-up reports. Financial institutions dealing with Saudi counterparties may apply enhanced due diligence as a result.

FIU Contact Gap

No FIU-SA contact number, email address, or reporting portal is publicly available in the research sources. Compliance teams face uncertainty regarding STR filing logistics absent internal knowledge of FIU-SA reporting procedures.

Sources

• Saudi Central Bank - Implementing Regulation to the AML Law (PDF) - Note: PDF currently returns access error
• Saudi Central Bank - AML Laws Page
• Saudi Central Bank - Insurance AML Regulations IIR_4600 (PDF)
• Saudi Central Bank - Official Website (Arabic)
• Saudi Central Bank - Historical Currency Information
• FATF Mutual Evaluation Report - Saudi Arabia 2018 - Note: Not included in original source list; referenced for FATF compliance status

Gap Analysis

END OF REPORT