In Saudi Arabia, non-bank entities, particularly fintechs, can provide payment services within the regulatory framework set forth by SAMA and CMA.
SAMA issues licenses for different financial services, and compliance depends on the nature of the fintech’s service offerings. SAMA’s catalogue of regulated services includes enabling funds to be deposited on a payment account, enabling cash withdrawals from payment accounts, execution of payment transactions, issuing of payment instruments, acquiring payee transactions, issuing e-money (opening e-wallets or otherwise), payment initiation services, payment account information services and the recently added aggregated payment services and payment account services as well as any other service that SAMA may decide to consider as a payment service.
In instances where a fintech’s activities do not align with any existing licenses, reporting to SAMA is required, especially considering the open-ended list of regulated services. Furthermore, regulatory constraints may impose that different business verticals are carried out with distinct vehicles, especially where provisions on capital adequacy and protection of customers’ funds apply.
For activities related to securities, CMA oversees matters, including the usage of distributed ledger technologies for arranging and offering securities, custody services, or managing investment and real estate funds distribution platforms.
In cases involving overlapping activities, both SAMA and CMA may exercise regulatory powers.
Specific conditions and provisions govern fintechs’ payment services, covering aspects such as consumer protection, lending, additional paid features, deferral of payment, fee restrictions, card services, QR code payments, and incentives policies. Notably, SAMA requires fintechs to disclose to consumers details of fees, charges, and commissions, and to notify them in advance of any changes in fees or charges, including those imposed by a third party. Thresholds for credit limits and late payment fees are also in place to protect cardholders.
Under the CMA’s instructions, fintechs should not persuade any customer to complete any transactions by offering gifts or incentives. Considering the importance of prize-giving operations in the digital economy, fintechs planning such actions should cautiously assess their marketing operations to ensure compliance.
Also, third-party services supporting fintechs may need to comply with relevant terms, typically through contractual arrangements rather than direct regulatory intervention.