Digital asset regulation and tokenization in Saudi Arabia

A business considering a tokenized offering in Saudi Arabia should begin with the market to which its product belongs. Securities and related services may fit the capital-market authority’s laboratory, while other financial innovations fall within the central bank’s remit. These testing routes have specific purposes and do not amount to general access for cryptocurrency services.

For example, arranging a sukuk offering through a distributed ledger raises different questions from holding cryptocurrencies or developing internal traceability software. This guide separates the instrument, experimental permission and technology functions, and identifies the checks needed before moving from development to live customers.

How digital securities differ from cryptocurrencies

Saudi Arabia's framework requires separating cryptocurrencies, securities and technology applications. The August 2018 official warning stated that virtual currencies were not recognised as official currency and no parties were licensed for those practices. It is a restrictive historical statement; its wording alone does not establish that all private holdings or blockchain applications are criminal offences.

CMA contemplates distributed ledger technology, DLT, models for arranging securities offerings and custody, initially associated with sukuk. This sector-specific route does not establish a general virtual asset provider licence. Assessment starts with the instrument and actual activity, without attributing an identical regime to issuance, intermediation and software development.

When SAMA, CMA and property registration are relevant

Saudi Central Bank, SAMA, operates its sandbox for financial innovation within its remit. The Capital Market Authority, CMA, administers the FinTech Lab for securities-related activities. These are distinct supervisory processes. Admission to one does not establish permission from the other or extend approval to services outside its scope.

The Real Estate General Authority, REGA, supervises property registration. Its registry explanation distinguishes title, descriptions, rights, restrictions and legally valid changes. Property projects must coordinate financial permissions with rules governing the asset and its owners; a technology platform does not replace that assessment.

What testing permits and how market access works

The FinTech Lab receives domestic and international applications throughout the year. The model must be ready for testing and connected to capital markets, subject to assessment and supervisory conditions. The experimental-permission list identifies activity categories; it should not be presented as a list of licensed cryptocurrency exchanges or approval of every product offered.

SAMA's frequently asked questions distinguish a no-objection letter for preparing integrations with dummy data from permission to operate with live customers. The sandbox lifecycle includes readiness, testing and exit. Graduation may require a licence application and satisfaction of licensing requirements; successful testing does not automatically confer final commercial authorisation.

How to document the right represented by a token

Using DLT for an offering must preserve identification of the issuer, securities documentation, economic rights and intermediary and custody functions. CMA's description of admitted models is not legislation making every token ownership of its underlying asset. Documentation must establish whether the holder receives a security, an interest or a contractual claim.

For property, transfer effects must connect with the competent register and purchaser eligibility. An interest in a vehicle or fund does not necessarily constitute direct ownership of a building. Commercial tokenization announcements likewise do not establish a registry reform or replace assessment of foreign-investor restrictions.

What controls accompany experimental permission

The Anti-Money Laundering Law requires entities within scope to assess risks, identify customers and beneficial owners and maintain controls. Article 5 includes risks from new products, practices and technologies before their use. Compliance does not authorise an activity requiring financial permission; identifying users alone cannot establish that a business model is licensed.

Experimental permissions define testing limits and conditions, including required user protections. SAMA's announced CBDC experimentation serves monetary and wholesale purposes. That 2023 announcement distinguished research from an issuance decision; it does not establish private stablecoin authorisation or unrestricted commercial access to its infrastructure.

What to define before applying to test in Saudi Arabia

Describe the instrument, issuer, intended investors and platform functions. For a sukuk offering, detail distribution, custody and registration; for another financial service, explain why it falls within SAMA’s remit. The application should make clear what will be tested, with which users and how testing will end or move into another arrangement.

Check the current permission and applicable instructions before involving live customers. The April 2026 CMA consultation establishes proposals whose final adoption must be checked against the relevant text. Where property is involved, include title history and registry requirements. Experimental admission and central-bank monetary tests do not settle commercial authorisation for a different product.

To understand how this framework applies to your project, discuss your case with our team.