Welcome to the Saudi Arabia focus edition of Law Update.
One of the key markets in the Middle East and North Africa (MENA) that continues to lead from the front is the Kingdom of Saudi Arabia (KSA). As the largest country in the Middle East and the 18th largest economy in the world, the progress KSA continues to make is underpinned by its Vision 2030 that envisions developing the country as an investment powerhouse and hub that ultimately connects Asia, Europe, and Africa. Given Saudi Arabia’s significance to the regional economy, our team of experts have prepared a range of pertinent articles that provide insights into new laws, regulations, and the legal landscape in the Kingdom.
This edition will provide you with an up-to-date guide on matters such as; the framework issued by the Saudi Central Bank on IT governance, the anti-corruption landscape under Vision 2030; we also provide practical tips for dispute avoidance. This is only a snapshot; there are many more articles within the KSA focus section for you to read, which we hope you will find valuable and enjoyable.Read the edition
The COVID-19 pandemic has led to a global wave of digitisation, directly impacting the banking and payment processing industries. The Saudi Vision 2030 has several programs under its umbrella, including the Financial Sector Development Program (“FSDP”), that aims to increase cashless transactions, stabilise and diversify the financial sector, while adhering to relevant international standards. In furtherance of this goal, the Saudi Central Bank (“SAMA”) and the Capital Market Authority (“CMA”) have been working on a number of initiatives that will pave the way for the increasing digitisation of the banking, securities and payments processing sectors in the Kingdom of Saudi Arabia.
During the course of 2019 to 2021, SAMA issued a number of regulations and policies, in a concerted effort to promote the establishment of an innovation-based financial technology ecosystem as well as to address growing consumer needs. In this briefing, we provide an overview of the KSA banking and payments landscape, and also summarize the key features of these new regulations.
With the aim of diversifying the financial sector and accelerating development in fintech, SAMA launched Fintech Saudi in April 2018. Major initiatives including the Fintech Saudi Tour 19, Fintech Access Guide, Fintech Saudi Podcast, Fintech Accelerator Programme, and Fintech Internship were launched under Fintech Saudi.
The initiative envisages KSA as a fintech hub in the coming years. It has also listed activities that do not require licenses, including business tools, personal management, regulation technology, gamification, back-office bank operations, reward-based crowdfunding, enhancing bank’s customer experience, and aggregation of publicly available financial information.
16 Fintech companies have received licenses to provide payment services, consumer micro-finance and digital insurance brokerage in the recent past. Halalah (now known as Hala) and Bayan Payments were amongst the first digital wallet companies that obtained SAMA’s license under the experimental permit initiative. SAMA has also signed an agreement with Ripple, in order to aid Saudi banks settle transactions using blockchain. Furthermore, the second edition of Fintech Saudi’s Annual Report stated that the number of fintech start-ups in the Kingdom had tripled, from 20 to 60 in the year 2019-2020, exhibiting the increasing rate of development in the sector.
In addition to Fintech Saudi, a Regulatory Sandbox was established, in order to aid innovators (international and local start-ups as well as established firms) to use a live and controlled environment to test their digital solutions, for a specified period of time. After testing, they will be allowed to take their products to the market, in accordance with the relevant guidelines. Alongside promoting financial inclusion, the Sandbox will benefit consumers by facilitating efficient new products. Further, SAMA will be able to collect evidence and use it while formulating regulations in the sector, and also mitigate risks.
In 2019, SAMA issued the Regulatory Sandbox Framework, which stated that the Sandbox is open to innovators proposing non-regulated technology, and innovators proposing new fintech solutions. However, solutions that are already existing in the Kingdom, or are not at sufficient stage of maturity, or are ill-conceived, among other factors, shall not be able to use the Sandbox as a suitable facility. 32 Fintech companies are operating under the Framework and companies such as Sahlah Company, which provides debt and crowdfunding services and Skyband, that gives digital payments services such as MADA (the Saudi Banks card-based payments method), have already used the framework till date. Additionally, Munafa Capital, which is an online marketplace where investors may invest in creative early-stage businesses, giving them access to direct investment options, due diligence tools, and industry data insights for a previously difficult-to-access assets class, has also been a part of the same.
Under the framework, applicants can either be SAMA licensed innovators wishing to test a solution covered by its existing permissions, or non-licensed local fintechs /start-ups, or non-licensed international fintech firms. Following the opening of the sandbox window, the application stage is open for 30 days. The criteria for consideration include genuine innovation, consumer benefit, readiness for testing, and exiting plan. It is essential that the innovators meet the principles of the Saudi Vision 2030 and the FSDP. This is followed by 60 days of evaluation in two phases, 30 days of the innovator and SAMA agreeing on Sandbox tools and deployment of customer safeguards, and the next 30 days for SAMA to decide on the cohorts’ composition and issue a Letter of Acceptance (“LoA”) /SAMA permission.
Testing in the Sandbox lasts for six months after the receipt of the LoA, with provisions for extension and reduction, based on the prevailing situation. The regulations mandate the innovator to present a final report to SAMA, which shall include the results of the test, the exiting strategy, and the request to extend the validity of the LoA. This is followed by the exit stage which decides whether the technology must enter the market.
The PSPR, which were issued in January 2020 and updated in August 2020, provide a clear process for obtaining a license as a Payment Services Provider (“PSP”) in KSA. The PSPR adopt concepts contained in the European Union’s Payment Services Directive (PSD II), in line with international practices and enabling international PSPs to establish operations in KSA, without the need to substantially alter their business models.
The “in-scope” services identified by the PSPR, include the execution of payment transactions, including the execution of credit transfers and direct debits; issuing payment instruments; issuing electronic money (by opening e-wallets or otherwise); acquiring payment transactions; money remittance; services enabling cash to be placed on or withdrawn from a payment account and the operation of a payment account; payment initiation services; account information services; and any other activity designated by SAMA as a payment service.
Under the PSPR, Payment Institutions (“PI”) and Electronic Money Institutions (“EMI”) are provided with licenses. While the latter are only licensed to issue electronic money, the former can carry out all payment services except issuing electronic money. There are four types of licenses that may be applied for: Major PI, Micro PI, Major EMI and Micro EMI.
This license requires setting up a joint stock company (JSC) in KSA having a minimum paid-up share capital of SAR 3 million. The Major PI must also maintain, as working capital (on an ongoing basis), the minimum paid-up share capital amount or an amount equal to 1% of the Average Monthly Payment Transaction Value, whichever is higher.
This license requires forming a joint stock company (JSC) or a limited liability company (LLC) in KSA and a minimum paid-up share capital of SAR 1 million, which must be maintained as working capital on an ongoing basis. A Micro PI must abide by certain restrictions, not provide services to persons outside the KSA, and not exceed the Average Monthly Payment Transaction Value of SAR 10 million for its first 12-month period of operations.
This license requires forming a joint stock company (JSC) in KSA and a minimum paid-up share capital of SAR 10 million. The Major EMI must also maintain, as working capital (on an ongoing basis), the minimum paid-up share capital amount or an amount equal to 2% of the Total Average Outstanding Electronic Money, whichever is higher.
The Major EMI license must not permit customer balances to exceed SAR 100,000 of electronic money in aggregate for each customer, and customer transactions to exceed SAR 100,000 per calendar month in aggregate for each customer, unless in relation to the closure of an electronic money account.
This license requires forming a joint stock company (JSC) in KSA and a minimum paid-up share capital of SAR 2 million. The Micro EMI must also maintain the minimum paid-up share capital amount as working capital on an ongoing basis. The Micro EMI must not exceed the Total Average Outstanding Electronic Money to SAR 10 million for its first 12-month period of issuing electronic money, and Average Monthly Payment Transaction Value of SAR 10 million for its first 12-month period of operations, unless otherwise approved by SAMA. It must also not permit customer balances to exceed SAR 20,000 of electronic money in aggregate for each customer, and not permit any payment transactions exceeding SAR 20,000 per calendar month in aggregate for each customer, unless (i) in relation to the closure of an electronic money account, or (ii) as otherwise approved by SAMA.
In the present scenario, SAMA has actively been issuing licenses as both international and local PSPs have expressed their interest in entering the sector. It has already granted PI licenses to Skyband and Foodics through the point of sales services, and NoonPay through the e-commerce payment gateway services.
In February 2020 SAMA issued the additional licensing guidelines and criteria for digital-only banks in KSA. These guidelines apply to digital-banks only and are to be read together with SAMA’s Banking Licensing Guidelines and Minimum Criteria published on SAMA’s website.
Digital-only banks are defined as banks that conduct business mainly through digital channels such as the internet and mobile applications. Under SAMA’s guidelines, digital-only banks must be set up in KSA as joint stock companies. Its promoters must have technology and financial industry related experience and knowledge, and the financial capacity to support setting up the digital-only bank.
Furthermore, each applicant must possess a team with adequate expertise to discuss relevant aspects of the application. As part of the application, the applicant will be required to present, among other things, a business plan, an exit plan (in case of difficulties in achieving the targeted business objectives). Moreover, the Guidelines have not mentioned any minimum capital requirement, but the applicant has to submit an internal capital adequacy assessment plan (ICAAP), an internal liquidity adequacy assessment plan (ILAAP). Therefore, SAMA will be assessing the financial adequacy based on those requirements.
Applicants must maintain a physical presence in KSA as their principal place of business, but are not expected to establish physical branches. However, on exceptional basis, SAMA may require a digital-only bank to establish customer service centres in order to facilitate customer interaction, enquiries or complaints.
In June 2021, the Cabinet approved the licensing of two digital banks- STC Bank, a local digital bank established after the conversion of STC Pay, and Saudi Digital Bank, led by Abdul Rahman Bin Saad Al-Rashed and Sons Company.
In January 2021, SAMA published the Rules for Engaging in Debt-Based Crowdfunding (“Crowdfunding Rules”) which set out licensing procedures and requirements for the activity of Debt-Based Crowdfunding and the minimum standards and procedures applicable to Debt-Based Crowdfunding Companies (“DBC Companies”).
The Crowdfunding Rules define Debt-Based Crowdfunding as the activity of raising funds from natural or legal persons (the “Participants”) through a digital platform (such as, websites or mobile applications) run by DBC Companies, which platform allows micro, small or medium-sized enterprises registered in KSA (referred to as “Institution Beneficiaries”) to seek and obtain financing from Participants in KSA pursuant to the terms of a loan agreement.
Entities wishing to engaging in Debt-Based Crowdfunding must be established as joint stock companies and obtain a license from SAMA in accordance with the requirements of the Crowdfunding Rules and the Finance Companies Control Law, as well as any additional instructions specified by SAMA from time to time.
The minimum share capital for a DBC Company is currently set at SAR 5 million. Taking into consideration the associated risks and their nature, SAMA may increase or decrease the minimum capital based on the prevailing market conditions or if it deems that the DBC Company’s proposed business model or the nature of its activity requires so. Licenses are granted for an initial term of five years which may be renewed at the request of the DBC Company.
The Crowdfunding Rules set our internal organization and operational requirements for DBC Companies, including, among other things, the requirement to carry out proper due diligence of the Participants and the Institutional Beneficiaries who are seeking to engage in Debt-Based Crowdfunding. In addition, the details to be covered under the loan and service agreements. The Crowdfunding Rules also impose credit limits, which include the following:
For Debt-Based Crowdfunding activities, SAMA has permitted Fintech companies such as Sahlah Company for Electronic Marketing, Raqamyah Platform, Munafa Capital, Maalem Financing Company, etc. in line with the Regulatory Sandbox Framework.
SAMA announced the issuance of its Open Banking Policy in January 2021. Although brief, the Open Banking Policy provides a succinct overview of the benefits SAMA envisages from ‘Open Banking’, how such benefits are in line with the strategic objectives of Vision 2030 and FSDP, and how SAMA plans to implement the policy in the Kingdom.
The policy explains that ‘Open Banking’ is a technological innovation that enables customers to share their existing customer data securely with third parties, such as fintech companies which focus on providing customers new and innovative financial services. Through Open Banking, customers will benefit from better financial products and services, ranging from bringing all accounts into a single dashboard to creating smoother journeys into daily banking activities.
Other envisaged benefits of Open Banking include increased competition as a result of reducing barriers to entry for new participants, providing them with a better understanding of customer needs through financial products and services that offer more competitive pricing and also help increase financial inclusion by expanding the reach of such financial products and services for larger customer segments in the Kingdom.
SAMA’s Open Banking Policy sets out three distinct phases:
P1 will occur in the first half of 2021 during which SAMA will design the Open Banking ecosystem (processes and technologies) and governance systems involving market participants (such as, banks, fintech companies and other financial institutions).
P2 will occur in the second half of 2021 during which SAMA will develop and define frameworks, technology building blocks, and rollout activities, including enhancement of customer awareness.
The final phase, P3, is scheduled for the first half of 2022, when the Open Banking ecosystem will be formally launched. It will involve a staged approach to building and supporting customer awareness, and it will seek to guarantee continuous improvements to the Open Banking digital architecture and infrastructure.
SAMA anticipates that this approach will result in the optimal Open Banking framework that is specifically geared towards addressing the specific needs of the stakeholders in the Kingdom.
The regulations and policies set out above are here to stay and will be a necessity even in the post COVID-19 landscape, given the wave of digitalisation around the globe. They aim to achieve some of the strategic objectives of Saudi Vision 2030 and will undoubtedly transform the banking and payments industries in KSA. We expect that additional regulations and guidelines will be issued by SAMA in support of the above.
 Average Monthly Payment Transaction Value means:
which, in each case, shall exclude the issuance or redemption of electronic money by the PSP.
 the arithmetic mean of the total amount of financial liabilities related to electronic money issued by the EMI at the end of each calendar day over the last 12 calendar months.