Payment Gateway Saudi Arabia: A Complete Guide for Online Businesses
A payment gateway in Saudi Arabia is the technical layer carrying a card or wallet payment from your checkout to the issuing bank and back. What makes this market distinct is regulation rather than technology.
Since 13 June 2023, payment services here operate under SAMA’s Implementing Regulations of the Law of Payments and Payment Services, and only a SAMA-licensed institution or a bank may settle money into your merchant account. That single rule decides more about your shortlist than any feature comparison.
How much of Saudi retail payment is already electronic?
The Saudi Central Bank reported that electronic payments reached 85% of total retail payments in the Kingdom during full-year 2025, on 14.6 billion transactions across the national payment systems. The comparable share was 62% in 2022, 70% in 2023 and 79% in 2024. Cash is now the exception at a Saudi checkout.
Electronic share of total retail payments in Saudi Arabia
Source: Saudi Central Bank, on 14.6 billion transactions in 2025.
Which regulation governs payment services here today?
The operative rule is the Implementing Regulations of the Law of Payments and Payment Services, issued under SAMA Circular No. 000044093096 on 13 June 2023. It sits beneath the Law of Payments and Payment Services, Royal Decree No. M/26, and it repealed the Payment Services Provider Regulations in force since January 2020.
This is worth pressing, because much of the content ranking for Saudi payments questions is wrong about it. Blog posts, provider comparisons and even law-firm client alerts still describe the 2020 rules as current, quoting capital thresholds and a five-business-day complaint window that the 2023 text did not re-confirm. A page citing the 2020 PSPR as live law is three years stale.
The regulations sit in SAMA’s own rulebook, which is more reliable than the document links on the main SAMA site.
The four licence categories
SAMA issues four payment service provider licences, split on two axes: whether the institution issues electronic money, and whether it operates at micro or major scale. The category on a licence tells you what that provider may do.
| Licence category | What distinguishes it |
|---|---|
| Micro Payment Institution | Payment services, limited scale; no electronic money |
| Major Payment Institution | Payment services including acquiring, full scale; no electronic money |
| Micro Electronic Money Institution | Issues electronic money and operates wallets, limited scale |
| Major Electronic Money Institution | Issues electronic money and operates wallets, full scale |
Regulated services in scope include executing payment transactions, credit transfers, direct debits, issuing payment instruments, issuing electronic money, acquiring, money remittance, payment initiation and account information. Acquiring is the one most merchants care about, because it is what puts a settled balance in your bank account.
Does every payment gateway need a SAMA licence?
No, and merchants regularly get this wrong. Under SAMA Circular No. 46004436, dated 24 July 2024, a technical-only provider needs no licence. But merchant contracting, KYC and AML checks, and final settlement into merchant accounts must be performed by a SAMA-licensed PSP or a bank.
That division has a direct commercial consequence. A company can build an excellent checkout, an API, a fraud engine and a dashboard, market itself accurately as a payment gateway, and never hold a SAMA licence. What it cannot be is the entity that contracts with you and pays your money out.
So there are two structures. Either your provider holds the licence, or it sits on top of a licensed institution or bank that is the real settlement counterparty. Both are legitimate. Ask which one you are buying, and which named legal entity sits on the settlement side, in writing, so the answer lands in your contract rather than in a sales call.
How to check a provider’s licence in about a minute
SAMA publishes its register of licensed payment service providers on its own website, and any merchant can read it without an account. The register lists each entity by registered legal name, activity type, unified number and licence expiry date.
Open SAMA’s Licensed Entities portal at sama.gov.sa and give the table a moment, since it is script-rendered. Then search the registered legal entity name rather than the brand: these companies often trade under a short brand while the licence names a longer entity, so the brand alone gives false negatives.
Read the Activity Type column, which tells you which of the four categories the entity holds. Cross-check the unified number against the entity on the contract you are about to sign, because a foreign parent’s licence does not cover a separate Saudi subsidiary. And check the expiry date: a licence expiring inside your contract term is a question to raise before signature.
One honest caveat about reading an absence. Filtering by “E-commerce Payment Services” returned results identical to “All” when we checked, so the filter may not do what its label implies. A company you cannot find may also operate through a differently named entity. If you cannot find a provider, ask it directly rather than assuming it is unlicensed.
Eleven entries from the SAMA register
The register held 34 entities. These eleven are the names an online merchant is most likely to meet.
| Company, as listed on the register | Activity type | Unified no. | Licence expires |
|---|---|---|---|
| Hyperpay Inc Saudi Information Systems Technology Company | Electronic Money Institution | 7016872546 | 29/12/2029 |
| Geidea for Technology | Payment Institution | 7001715221 | 04/11/2030 |
| Tap Financial | Payment Institution | 7002845464 | 04/09/2029 |
| Moyasar Financial | Payment Institution | 7010466964 | 13/01/2030 |
| Alwans for Information Technology (Foodics) | Payment Institution | 7012409806 | 19/11/2028 |
| Network International Arabia | Payment Institution | 7005137505 | 16/01/2029 |
| Hala Company | Electronic Money Institution | 7009863320 | 03/12/2030 |
| Digital Payment Company (Loop) | Electronic Money Institution | 7002793649 | 01/12/2030 |
| Etihad Fintech (Mobily Pay) | Electronic Money Institution | 7015861680 | 13/01/2030 |
| Smart digital payment company (Tiqmo) | Electronic Money Institution | 7016422227 | 26/07/2030 |
| Enjaz Payments Services Company | Electronic Money Institution | 7030223460 | 04/05/2030 |
Our own entry is the first row, put there deliberately rather than in a footnote. HyperPay is listed as an Electronic Money Institution under unified number 7016872546, licence expiring 29 December 2029. Check that row before taking our word for anything else here.
Several well-known names do not appear under those names. Rather than infer, read what each company discloses. Telr’s Saudi pages state it is licensed and regulated by the Central Bank of the UAE. Checkout.com’s licences page lists ten jurisdictions, not including Saudi Arabia. Stripe’s Global Availability page does not list Saudi Arabia as a supported merchant country.
SAMA licence and Saudi Payments certification are not the same thing
They are two separate approvals from two separate bodies, and conflating them is a factual error you will see repeatedly in Saudi payments content. SAMA is the regulator: it licenses institutions to provide payment services. Saudi Payments operates the national infrastructure: it certifies technical providers to connect to and process on mada.
A provider can hold one without the other. A SAMA licence does not by itself let a provider accept mada cards, and Saudi Payments certification is no substitute for a licence.
HyperPay holds both: the SAMA Electronic Money Institution licence in the table above, and from Saudi Payments a permit as a Payment Technology Service Provider and a permit as an eMSP Payment Gateway. Ask any provider for both, and for the entity each one names.
How mada works for online payments
mada is the Saudi national payment system, owned by the Saudi Central Bank since its launch in 1990. It connects POS terminals, ATMs, and e-commerce sites to a central switch that routes each transaction to the issuing bank, completing payment in under three seconds via SAMA’s own account. SAMA states that mada e-commerce operates over the 3-D Secure protocol.
Two mechanical facts shape how mada behaves at your checkout. First, mada issues debit and prepaid cards only, co-badged with Visa or Mastercard plus GCCNET so they work abroad. Processor documentation from Checkout.com and Cybersource describes the routing consistently: domestic transactions in Saudi riyals route over mada, while international or foreign-currency transactions route over the co-badged rails. That is documented processing behaviour, and we found no public SAMA clause saying it in those words, so be sceptical of pages claiming SAMA mandates least-cost routing.
Second, mada cards are provisioned into Apple Pay, Samsung Wallet, and Google Wallet, and SAMA’s mada page lists Apple Pay provisioning among the network’s services. Apple Pay launched in Saudi Arabia on 19 February 2019. The merchant-side requirements are Apple’s, covered in our guide to Apple Pay gateway integration.
Which payment methods does a Saudi checkout actually need?
Mada is the one method a Saudi checkout cannot leave out. Beyond it, the methods that recur across licensed providers are Visa, Mastercard, American Express, Apple Pay, STC Pay, UnionPay, the buy-now-pay-later services Tabby and Tamara, SADAD for bill payments, and PayPal for cross-border buyers. HyperPay supports all of those behind one integration.
In the 2025 Global Digital Shopping Index, Saudi Arabia Edition, published by Visa Acceptance Solutions and PYMNTS Intelligence from a survey of 2,191 consumers and 240 merchants, 72% of Saudi consumers said payment-method availability influences which merchant they buy from, against a 55% global average. Seventeen points of difference, which means a missing method costs more here than it does in the average market.
One caveat on wallets: Samsung Pay and Google Pay are technically ready on our platform but not currently available in Saudi Arabia.
Do you need a commercial registration to accept online payments?
The honest answer separates two requirements that most content collapses into one. No primary source we reviewed makes a Commercial Registration the exclusive legal route to sell online here. The Ministry of Commerce’s e-store documentation route accepts either a CR or a valid Freelance Work Document. But PSPs and acquiring banks commonly require a CR before opening a merchant account.
The distinction is between being legally permitted to trade and being eligible to open a merchant account with a particular provider. The first is set by the E-Commerce Law, Royal Decree No. M/126. The second is each provider’s own onboarding policy, and it varies.
Note where the documentation now lives. E-store verification moved from Maroof to the Business Platform at business.sa, under the Saudi Business Center, in March 2023. Guidance still telling merchants to register on Maroof is three years out of date. Applicants also need a commercial bank account, an active Absher account, and to be at least 18. If a provider is vague about onboarding on a Freelance Work Document, treat that as the answer.
Talk to our team about onboarding for a direct answer on your documentation before you commit engineering time.
What else belongs on a Saudi merchant’s compliance list?
Three items sit outside the payments licence but land on the same desk: ZATCA e-invoicing, personal data protection, and the card-data security standard your provider is assessed against. None is optional, and each has a current version that much published guidance gets wrong.
ZATCA is on Wave 25, covering taxpayers whose VAT-taxable revenues exceeded SAR 187,500 during 2022, 2023, 2024 or 2025, with Fatoora integration required no later than 1 February 2027. That threshold is half of Wave 24’s SAR 375,000. The Personal Data Protection Law, Royal Decree M/19, governs personal data connected to e-commerce payments, and SAMA cross-references it in its mada guidance.
PCI DSS v4.0.1 is the only active version: v4.0 retired on 31 December 2024, and v3.2.1 on 31 March 2024. HyperPay is certified to v4.0.1 at Level 1, with ISO/IEC 27001:2022 and ISO 22301.
Most Asked Questions about Payment Gateway Saudi Arabia
Is a SAMA licence required to operate a payment gateway in Saudi Arabia?
Not for a purely technical gateway. Under SAMA Circular 46004436 of 24 July 2024, providers offering only technical linkage and support do not need a licence. But merchant contracting, KYC and AML checks, and final settlement of funds into merchant accounts must be carried out by a SAMA-licensed PSP or a bank.
How can I verify that a payment provider is licensed by SAMA?
Open SAMA’s Licensed Entities portal and search the register by the provider’s registered legal name rather than its brand name. The listing shows activity type, unified number and licence expiry date. Match the unified number against the entity named in your contract, since a parent company’s licence does not automatically cover a subsidiary.
What licence does HyperPay hold?
HyperPay appears on SAMA’s register as Hyperpay Inc Saudi Information Systems Technology Company, licensed as an Electronic Money Institution under unified number 7016872546, with the licence expiring on 29 December 2029. It separately holds Saudi Payments permits as a PTSP and as an eMSP Payment Gateway.
Which regulations govern payment services in Saudi Arabia now?
The Implementing Regulations of the Law of Payments and Payment Services, SAMA Circular No. 000044093096, in force since 13 June 2023, under Royal Decree No. M/26. They repealed the 2020 Payment Services Provider Regulations. Any guidance still quoting the 2020 text, including its capital thresholds, is describing law that no longer applies.
Do I need a commercial registration to sell online in Saudi Arabia?
No primary source makes a Commercial Registration the exclusive legal route. The Ministry of Commerce’s e-store documentation route on business.sa accepts either a Commercial Registration or a valid Freelance Work Document. However, most payment providers and acquiring banks require a CR commercially before opening a merchant account, so check your provider’s policy specifically.
How do co-badged mada cards decide which network to use?
Processor documentation from Checkout.com and Cybersource describes it consistently: domestic transactions in Saudi riyals route over the mada network, while international or foreign-currency transactions route over the co-badged Visa or Mastercard network. This is documented processing behaviour, not a published SAMA routing mandate.
Is 3-D Secure required for mada online payments?
SAMA’s own mada page states that the mada e-commerce service operates through the 3-D Secure protocol, and Checkout.com’s merchant documentation advises that mada cards work only with 3D Secure enabled. The detailed technical specification is distributed to banks and PSPs rather than published, so no public SAMA rule names a specific 3DS version.