The ownership rules will be different for foreigners, and this depends on the legal structure and license type. Most business activities allow 100% foreign ownership in the finance sector via MISA approval. This requires an application, business plan, and financials. Shareholding and governance structures mandate diversified ownership for JSCs (minimum 5 shareholders), a board with at least 3 members, including independents, fit and proper checks for executives.
EXTERNAL APPROVALS & REGULATORY LICENSES
Saudi Central Bank (SAMA)
The SAMA licensing process for banks and non-banking institutions includes pre-application consultation and formal submission with a business plan and capital proof. The review process requires between six and twelve months to complete, which results in conditional approval after an operational readiness evaluation.
The “fit and proper” criteria require shareholders, board members, and executives to have clean records, financial soundness, and relevant professional experience, with integrity assessments conducted by SAMA. The capital rules establish a minimum adequacy ratio of 20%, which requires independent board governance and strong risk management systems to control credit risk, market risk, and operational risk.
A financial institution company in KSA must fulfill their ongoing obligations by submitting quarterly financial reports together with risk disclosures and anti-money laundering compliance documentation.
Capital Market Authority (CMA)
CMA licensing is needed for all types of investment management firms, asset managers, and financial brokerages which have categorized activities such as dealing, custody, managing, arranging, and advising. The company application needs to have a detailed business plan and capital proof; the review process and approval can take around 3-6 months. Note this is a separate process from the MISA/Ministry of Commerce (MoC) applications.
The key business activity categories include asset management, which requires (SAR 20m capital), and dealing/custody, which requires (SAR 50m), along with inspections for operational readiness, such as IT systems and compliance. The minimum capital is a baseline, and depending on the specific business model or type, the authority may adjust it based on risk calculations. There will be a strong emphasis on robust compliance, AML, and risk management systems. Applicants must demonstrate “fit and proper” criteria for executives and officers, including current qualifications, experience, and no criminal records, via a police clearance certificate from their home country.
Ministry of Investment (MISA)
Foreign-owned companies will need MISA approval to get their license. A foreign company will need to complete the MISA application, business plan, financial documents, and proof of their one-year overseas operation, and other requirements the authority may request. The post-2025 reforms eliminate license fees, and the processing time for applications takes between three and six weeks. The restrictions apply to sensitive sectors, which need extra approval, and the documentation requirements include entity information, investment plans, and compliance declarations.
Other Regulatory Bodies
The MoC handles commercial registration post-MISA application, and this includes the company name reservation, articles of association, which are normally completed within a 1–2-week timeframe (subject to authority approvals). The AML/CTF regulations implemented by SAMA/CMA require organizations to perform KYC and transaction monitoring while reporting activities to the Financial Intelligence Unit (FIU).
The Saudi Data & AI Authority (SDAIA) Personal Data Protection Law in Saudi Arabia (PDPL) establishes data protection standards that require sensitive data to be stored locally while organizations conduct Data Protection Impact Assessment (DPIA). The organization implements cybersecurity measures that conform to SAMA’s Cybersecurity Framework through its threat control and incident reporting system. The Insurance Authority supervises Takaful operations through its licensing process, which parallels SAMA requirements that mandate SAR 100m capital.
OPERATIONAL & COMPLIANCE REQUIREMENTS
Governance & Risk Management
The board needs to have at least 3 members, who must include one-third independent members, while local members and diverse members must meet CMA/SAMA rules. The company requires both internal controls and audit committees to conduct quarterly assessments, which need independent verification. The organization uses risk management frameworks, which include credit provisioning, market VAR models, and operational business continuity management (BCM) management to meet Basel III standards. The organization provides annual governance reports to SAMA/CMA for compliance and reporting purposes.
Capital & Funding Requirements
Minimum capital for commercial banks is SAR 500m, investment firms (for dealing) – SAR 50m, asset managers – SAR 20m, insurance – SAR 100m, and fintech – SAR 5m. The capital adequacy ratios require a total of 20% according to the Saudi Arabian Monetary Agency’s (SAMA) implementation of Basel III standards. Shareholder contributions must be fully paid, with liquidity at 20% liquidity coverage ratio (LCR). The SAMA scheme provides banks with reserve and deposit insurance protection.
Location & Operational Setup
SAMA and CMA need to approve all branches that belong to the main office in Saudi Arabia. Foreign banks need to provide parent guarantees for their branch operations. MoC requires commercial registration after the MISA process, which includes name reservation and document submission to be completed within one to two weeks. The premises fit out includes secure facilities that meet SAMA cybersecurity standards for protected areas.
Saudization & Human Capital
Saudization (Nitaqat) quotas require at least 40% Saudi nationals in consulting/finance. The entire system uses different color codes to show how organizations comply with regulations, which also impact their visa applications. Saudi nationals must hold key positions, which include CEO and compliance officer, according to established quotas. The organization sources its talent through the Ministry of Human Resources and Social Development (MHRSD) portals and training programs. The organization must submit its regulatory reports, which include Nitaqat updates, to MHRSD on a quarterly basis.
Accounting, Reporting & Tax Compliance
Corporate tax at 20% is applied to non-Saudi shareholders, Zakat for Saudis is 2.5%, and VAT at 15% is charged on services. SAMA/CMA regulatory reporting includes quarterly financials and capital/risk reports. International Financial Reporting Standards (IFRS) adoption by listed companies and banks is compulsory. Annual internal or external audits are mandatory.
IT, Cybersecurity & Data Protection
Data storage follows SDAIA’s PDPL, which is the requirement of local hosting for sensitive data and DPIAs. Cybersecurity follows SAMA’s Framework with controls, incident response, and yearly assessments as standards. Digital banking requires secure APIs and compliance with SAMA’s fintech regulations.
LICENSING & APPROVAL PROCESS
Choose Your Legal Structure
The economic activities are categorized according to the Unified National Classification for Economic Activities (based on ISIC 4), managed by MISA. The investors must also choose a legal structure, typically a Limited Liability Company (LLC) or a Branch of a Foreign Company.
Each structure has different governance and tax implications under the Companies Law (Royal Decree No. M/132 of 2016, as amended in 2022). For example, a professional services firm generally needs a Service License with limited liability status, while a trading entity may need a Commercial License, with varying minimum capital requirements. Getting clarity at this stage will ensure that the MISA licensing and the MoC registration criteria are met.
Draft Articles of Association
The Articles of Association (AoA) outline the company’s internal management system, including shareholder ownership percentages, initial capital contributions, profit distribution, and management hierarchy.
The AoA must be drafted in Arabic and notarised either by a Saudi notary public or via the Unified Electronic Articles of Association System on the Meras platform. Companies Law requires the AoA to define a company’s objectives, its registered address, and shareholding structure. The AoA becomes a legally binding document of the company after its notarization.
Obtain MISA Investment License
The foreign investors must obtain an Investment License from the Ministry of Investment of Saudi Arabia (MISA), which permits foreign ownership.
The application process is conducted through the Invest Saudi portal and includes submission of the parent company’s incorporation documents, last year’s audited financial statements, and a notarised board resolution that sanctions the investment in Saudi Arabia. MISA verifies the financial standing of the foreign entity, its global operations, and compliance with the Foreign Investment Law (Royal Decree No. M/1 of 2000).
The license, once granted, provides the foreign investor with the legal status to continue with the company registration process and to request commercial registration from the MoC.
Register with the MoC
After MISA approval, submit the notarised AoA, MISA license, shareholder identification, and proof of a registered office to the MoC. This results in the issuance of the Commercial Registration (CR) certificate, Saudi Arabia’s equivalent of a company incorporation certificate. Once issued, the CR is publicly searchable on the MoC Business Register. The company is now legally incorporated and recognized under Saudi law.
Register for ZATCA Tax & VAT
The company must register with the Zakat, Tax, and Customs Authority (ZATCA) for income tax, VAT, and Zakat obligations. Non-Saudi-owned businesses pay corporate tax at 20%, while Saudi-owned entities pay 2.5% zakat on net worth. As soon as the annual taxable supplies rise over SAR 375,000, VAT registration becomes a requirement.
The process of registration, done through ZATCA’s Electronic Real Estate Asset Database (ERAD) system online, calls for submission of the CR, MISA license, and bank details. Tax Identification Number (TIN) is issued by ZATCA, and it is required to be on all invoices and official correspondence.
Registration noncompliance or hold-up in VAT filings can lead to administrative penalties as stipulated under the Tax Procedures Law (Royal Decree No. M/113 of 2017).
Open Corporate Bank Account
When the tax registration procedure is finished, the business is required to open a corporate banking account with one of the approved financial institutions in Saudi Arabia. According to the Saudi Arabian Monetary Authority (SAMA) rules, banks must do extensive Know Your Customer (KYC) and anti-money laundering (AML) checks. The company cannot deposit the paid-up capital (if any) and conduct financial operations until the account is ready. The top banks that facilitate such accounts include the Saudi National Bank (SNB), Al Rajhi Bank, and Riyadh Bank, all having special divisions catering to foreign-owned corporate accounts.
Set Up E-Invoicing & Digital Compliance
The company must comply with ZATCA e-invoicing regulations after opening the corporate bank account, which mandates all taxable entities to issue, store, and report invoices electronically. The company needs to have its invoice software integrated with ZATCA’s FATOORA platform for instant clearance and reporting. Compliance requires secure archiving of all invoices for a minimum of six years, following the data retention policy. To set up compliant systems, security standards, and staff training, companies generally hire our team to assist and implement a ZATCA-approved solution. Non-compliance may result in penalties, VAT suspension, or business limitations.
Secure Office Lease & Municipality License
Every company that operates in Saudi Arabia must have a physical address in the country. Investors must lease office premises compliant with municipal zoning regulations and register the lease contract on the Ejar electronic system operated by the Ministry of Municipal and Rural Affairs and Housing (MoMRAH). The benefit of using Creation Business Consultants is that we can provide a cost-efficient office solution via our business center in Riyadh. We have the option of business national address, virtual office, flexi-desk, and ready-to-operate serviced offices. These solutions will save time and money rather than paying for a large professional space to comply with this law. Once this step is complete, the company must then apply for a Municipality License (Baladiyah License), which authorizes commercial use of the premises. This license is needed for the renewal of the Chamber of Commerce certificate and the visa quota issuance by the MHRSD.
Issue Company Establishment Card & Visas
The last step is to get the Company Establishment Card from the General Directorate of Passports (Jawazat), which gives the company the right to hire foreign employees and their dependents under the Iqama system. The card carries the company’s immigration file number and must be renewed annually. Through the Qiwa and Muqeem platforms, the company can apply for work visas, sign employment contracts, and check Saudization compliance. This step gives the company the right to operate, recruit, and make contracts, which is the last stage of a Saudi mainland company’s establishment process.
GROWTH OPPORTUNITIES
Fintech and digital banking, among other services, are expected to create a market of USD 6.7bn by 2032 and host 525 fintech companies by 2030 under Vision 2030. The trend of foreign investments reached SAR 12.2bn in venture capital (VC), and cross-border fund passporting is facilitating access further. Vision 2030 supports the development of new technology by making the economy and the region a global hub for innovation.
COMMON MISTAKES & COMPLIANCE RISKS
Common issues include:
- Longer licensing periods caused by incomplete documents, requiring full doc submission.
- Not abiding by Saudization or AML/KYC leads to implications such as fines and visa blocks.
- Poor governance/risk policies cause delisting.
- Concerns over cybersecurity/data protection result in SAMA/SDAIA penalties.
- Failing to report to SAMA/CMA/MISA incurs sanctions.
CONCLUSION
Saudi’s financial sector offers many opportunities for foreign investors. With clear regulations, rapid growth prospects, and Vision 2030’s backing. Now is the time to set up your Saudi company and establish your presence, but only with careful planning and compliance.
Do you need help setting up your financial company in Saudi Arabia?
Reach out to our team at Creation Business Consultants, and we can guide you through licensing, regulatory approvals, governance setup, and operational compliance, ensuring a smooth market entry into the Kingdom. Contact us today at [email protected] to get your finance company started.
