LogoRegulatory Alerts

Saudi Arabia: lending & credit regulation

Regulated

Lending regulated by SAMA under Finance Companies Control System; strict consumer protection

Lead regulator
Saudi Central Bank (SAMA)
Also involved
CMA (crowdfunding) · SIMAH (credit data) · MCI (telecom)
Core law
Finance Companies Control System (2007)
Entry capital
SAR 100m (Finance Company)
Approval timeline
6-12 months
Customer assets
Segregated accounts required
Data protection
PDPL 2023 · SDAIA
Sandbox
Yes - SAMA Regulatory Sandbox

Lending is strictly regulated by SAMA under the Finance Companies Control System. Entities must be licensed as Finance Companies or Banks. The regime emphasizes consumer protection, income verification, and data sharing with SIMAH. Debt-based crowdfunding is permitted under specific rules.

Which licence do you need?

Your activityRequirementCapitalTimelineAuthority
Consumer lendingLicenceFinance Company License[1][2]

Requires income verification and APR standardization

SAR 100m6-12 monthsSAMA
SME / commercial lendingLicenceFinance Company License[3]

Must use Qawaem for commercial entity data

SAR 100m6-12 monthsSAMA
MicrofinanceLicenceFinance Company License[4]

Cash-flow based financing via Mada POS allowed

SAR 100m6-12 monthsSAMA
Buy-now-pay-laterLicenceFinance Company License[1]

Treated as consumer finance; APR rules apply

SAR 100m6-12 monthsSAMA
P2P lending platformLicenceDebt-Based Crowdfunding License[5][6]

Requires dedicated collection accounts

SAR 10m3-6 monthsSAMA
Credit bureau / scoringLicenceCredit Information Provider License[7]

SIMAH is the primary bureau; data sharing mandatory

SAR 50m6-12 monthsSAMA
Debt collectionLicenceFinance Company License[8][9]

Debt purchase regulated; consent required

SAR 100m6-12 monthsSAMA

New — what changed recently

  • 2025-12-22Circular No. 472038007 — Prohibits requesting promissory notes from individuals for credit card financing.[10]
  • 2025-10-15SIMAH Data Sharing Mandate — Mandates sharing of residential mortgage data with SIMAH.[7]
  • 2024-10-17Debt-Based Crowdfunding Amendment — Amends rules for debt-based crowdfunding, requiring alignment within 90 days.[6]

Market-entry checklist

  1. 1Secure SAMA Finance Company LicenseMeet SAR 100m minimum capital and governance standards.
  2. 2Implement SIMAH Data ReportingConnect to SIMAH for mandatory credit data sharing.
  3. 3Adopt Standardized ContractsUse SAMA-approved model contracts for financing.
  4. 4Establish Income VerificationImplement due diligence for customer income authentication.
  5. 5Comply with APR RulesUse SAMA-approved calculator for APR disclosure.

Sources

  1. Circular Re. Rules Governing Calculation of Annual Percentage Rate (APR) · 2023-10-31
  2. Emphasis on Exercising Due Diligence when Verifying Customer Income Prior to Granting Finance · 2025-06-04
  3. The Mandatory Requirement of Using Qawaem Program Before Providing Credit Facilities to Commercial Entities · 2019-06-12
  4. The Finance of MSMEs Based on Cash Flows Through Mada POS Terminals · 2018-02-21
  5. Introduction of a Rule Entitled, “Collection Accounts for Managing the Finance Value of Debt-Based Crowdfunding Companies” · 2021-06-10
  6. Approval of the Amendment to the Rules for Engaging in Debt-Based Crowdfunding · 2024-10-17
  7. Sharing Residential Real Estate Finance Data with the Saudi Credit Bureau (SIMAH) · 2025-10-15
  8. Instructions for the Purchase of Consumer Finance Debt Between Finance Companies · 2021-11-18
  9. Circular Re. Instructions for the Purchase of Consumer Finance Debt for Individuals Between Finance Companies · 2021-11-18
  10. Not Requesting Promissory Notes from Individual Consumers when Offering Credit Card Financing Products · 2025-12-22
This guide is compiled automatically from 10 primary-source documents published by Saudi Arabia's regulators, reviewed by RegAlert, and refreshed monthly (last updated 2026-07-12). It is not legal advice — always confirm requirements with the regulator or local counsel before acting.