How to Buy a Licensed Fintech or Payment Services Company in Saudi Arabia (2026): SAMA Approvals, Change-of-control Steps and Timeline

FinTech acquisition Saudi Arabia has become one of the most procedurally demanding transaction types in the Kingdom, and the evolving Saudi Central Bank (SAMA) licensing framework, combined with the Companies Law issued under Royal Decree No. M/132 (which came into force in 2023), has reshaped how buyers must plan and execute these deals. Acquiring a licensed payment service provider, electronic money institution or other SAMA-regulated FinTech is not a conventional share purchase: it triggers a mandatory change-of-control approval process that runs in parallel with, and frequently gates, commercial completion.

This guide sets out the eligibility tests, the step-by-step filing process, an executable timeline, the required documents, costs, and the model contractual protections that experienced acquirers build into their share purchase agreements. It is written for acquirers, private equity investors, strategic buyers, and the M&A and regulatory counsel advising them.

Overview: why FinTech acquisition Saudi Arabia matters in 2026

The Kingdom’s payments and FinTech sector has expanded rapidly under Vision 2030, and SAMA, the Saudi Central Bank, is the primary prudential and conduct regulator for licensed payment service providers, electronic money institutions and other regulated financial technology businesses. Payment service providers are principally regulated under the Payment Services Provider Regulations issued by SAMA pursuant to its statutory mandate. Any transaction that transfers control of one of these licensed entities engages SAMA’s supervisory jurisdiction. The regulator’s core concern is continuity: it must be satisfied that a new controller is fit and proper, adequately funded, and capable of maintaining the operational, AML/CFT, cyber-resilience and customer-protection standards attached to the licence.

This guide applies to the acquisition of businesses that hold a SAMA licence or authorisation. It does not apply to the purchase of unlicensed technology vendors, software developers or service companies that merely supply regulated firms, those are ordinary commercial transactions and do not require SAMA change-of-control clearance. The distinction is the first thing every buyer must confirm, because it determines whether the entire regulatory workstream applies.

What counts as a “change of control” under SAMA

A change of control is not limited to a 100% share purchase. SAMA looks at both direct and indirect acquisition of the ability to influence a licensed entity. That typically captures the acquisition of a shareholding above a defined threshold, the power to appoint or remove directors, and the acquisition of managerial or operational control regardless of the precise equity percentage. Because control can be acquired incrementally, a buyer building a stake through successive tranches should assume that crossing a control threshold on any tranche will trigger the filing obligation. The precise thresholds and definitions are set out in the applicable SAMA regulations for the relevant licence category and should be confirmed for the specific target.

When this guide applies

Apply this guide whenever the target holds a SAMA licence and the transaction will change who controls it, whether through a share purchase, an asset transfer that moves the licensed activity, a group reorganisation, or a change in the ultimate beneficial owner. Where the target is a sandbox participant or early-stage licensee, additional pathways may be available, discussed later.

Eligibility: when SAMA approval is required

The practical eligibility question is whether the proposed transaction crosses a control test attached to a licensed activity. There are three questions to work through in sequence: does the target hold a live SAMA licence or authorisation; will the transaction transfer control as SAMA defines it; and does the buyer’s profile (including any foreign investor element) create additional approval requirements.

Thresholds that trigger a change-of-control filing SAMA expects

In assessing whether a filing is required, apply these practical tests:

• Shareholding percentage. Acquisition of a stake above the relevant control threshold, including the aggregation of connected parties’ holdings, will normally trigger the filing.
• Board and director control. The power to appoint or remove a decisive number of directors, or to control board decisions, is treated as control even where the equity stake alone would not be.
• Managerial control. Contractual or de facto arrangements that give the buyer control over the licensed entity’s management, strategy or key operational decisions can constitute a change of control.
• Indirect control. Acquiring control of an upstream holding company that owns the licensed entity is caught, because SAMA examines the ultimate controller.

Where any of these is met, the prudent working assumption is that prior SAMA notice, and in most cases prior SAMA approval, is required before completion. Buyers should verify the precise threshold and definition against the current SAMA instructions applicable to the specific licence category, because payment institutions and electronic money institutions may be subject to slightly different tests.

Foreign investor considerations and the MISA interplay

Foreign investment in Saudi FinTech is possible, but a non-Saudi acquirer of a regulated entity faces a second regulatory layer. The Ministry of Investment (MISA) governs foreign investment licensing, and a foreign buyer acquiring a Saudi-licensed payment services company will generally need the appropriate MISA foreign-investment authorisation in addition to SAMA change-of-control approval. The two processes are distinct but interdependent: SAMA will want to see that the buyer has, or will obtain, the necessary foreign-investment permission, while MISA’s assessment may itself reference the target’s regulated status. Foreign ownership can attract enhanced scrutiny of source of funds, ultimate beneficial ownership and the fit-and-proper standing of the controlling group.

Buyers should sequence the MISA and SAMA workstreams together from day one rather than treating foreign-investment clearance as an afterthought.

Step-by-step: the buy-side process and SAMA filings for a fintech acquisition Saudi Arabia

The following twelve steps set out the executable buy-side process for a fintech acquisition Saudi Arabia, from pre-deal screening through to final licence endorsement. Each step identifies who is responsible and what should be prepared. The Step/Who/Duration timeline table follows the narrative.

1. Pre-deal regulatory screening. Before committing resources, the buyer’s legal and compliance team, supported by local counsel, confirms the target’s licence type and scope, any shareholding or activity restrictions, and whether there are outstanding enforcement actions or supervisory conditions. This screening determines the entire regulatory pathway and should flag any red-line issues before term sheets are signed.
2. Seller consents and vendor due diligence. Obtain preliminary seller board approvals and any consents required under the target’s constitutional documents. Run vendor due diligence tailored specifically to SAMA’s areas of interest, AML/CFT controls, systems resilience, consumer-funds segregation and complaints handling, rather than a generic corporate review.
3. Draft the SPA with conditional completion. The share purchase agreement should make completion conditional on SAMA approval. It must specify each party’s SAMA filing deliverables and timing obligations, define break fees and reimbursement, and set out the escrow triggers. Consider a model condition precedent such as: “Completion is conditional upon the Buyer having received unconditional written approval from SAMA to the change of control contemplated by this Agreement, or approval subject only to conditions reasonably acceptable to the Buyer.”
4. Prepare the SAMA change-of-control filing package. Assemble the full documentary package (see the Required documents table below), including Arabic translations and attestations. Buyer and seller cooperate, with local counsel coordinating certification.
5. Lodge the formal application with SAMA. Identify the named filer, usually the buyer or its nominated representative, and lodge the application with a designated contact person for correspondence. Clarity on who files avoids duplication and gaps.
6. Respond to SAMA requests for information. SAMA will typically issue one or more requests for information (RFIs). Expect detailed follow-up on AML/CFT, systems resilience and customer protection. Prompt, complete responses are the single biggest factor in keeping the timeline on track.
7. Obtain preliminary or conditional approval. SAMA may grant approval subject to undertakings, for example, capital maintenance, retention of key control functions, or specific remediation commitments. Once the shape of any conditions is known, finalise the closing mechanics.
8. Close the transaction. Complete only after the SAMA conditions are satisfied, or, where a commercial imperative requires earlier closing and SAMA permits it, close using a regulatory escrow structure subject to the approved undertakings, so that economic and control transfer aligns with regulatory clearance.
9. Post-closing notifications. Update the commercial register with the Ministry of Commerce, file the new board composition, and complete any MISA post-completion requirements where a foreign investor is involved.
10. Integration and compliance remediation. Update compliance manuals, suspicious activity reporting lines, and customer grievance procedures to reflect the new ownership and any SAMA undertakings.
11. Update public registers and notify customers. Where SAMA requires it, notify customers of the change of control and update any public-facing regulatory disclosures.
12. Final licence update or endorsement. File any formal changes to the licence, or add licence holders where the transaction requires it, and obtain SAMA’s final endorsement.

Building SAMA approval change of control into completion mechanics

The critical drafting decision is how to align economic closing with the SAMA approval change of control. Best practice is to make completion a condition precedent to SAMA final or conditional approval. Where the parties need to signal commitment before approval, a regulatory escrow can hold consideration and, where structured carefully, defer the transfer of voting control until SAMA clears the deal. The SPA should also allocate the risk of refusal, through reverse break fees, cost reimbursement and clear walkaway rights, so that neither party is left exposed if SAMA declines.

Step / Who / Duration timeline

The durations above are practical planning estimates only. SAMA’s review timing is discretionary and depends on the completeness of the file and the speed of the parties’ responses; there is no fixed statutory clock, and the ranges should not be relied on as guarantees.

Required documents: the SAMA change-of-control checklist

A complete, well-organised filing is the fastest route through SAMA review. Incomplete KYC, unsigned board minutes and missing Arabic translations are the three most common causes of delay. The table below sets out a typical documentary package for a payment service provider acquisition Saudi buyers should prepare; the exact requirements should be confirmed against the current SAMA instructions for the relevant licence category.

Certification, notarisation and attestation requirements

SAMA frequently requires that corporate documents, board resolutions and investor KYC be provided in Arabic or with certified Arabic translations, and that documents executed abroad be notarised and attested through the appropriate legalisation chain. Foreign corporate buyers should begin the attestation process early, because legalisation of overseas documents can add days or weeks that buyers routinely underestimate. Where the transfer of licence FinTech Saudi buyers are pursuing involves an offshore ultimate parent, allow additional time for beneficial-ownership documentation to be attested in each relevant jurisdiction.

How to prepare financial projections for SAMA

SAMA’s review is forward-looking. The business and continuity plan should include realistic multi-year financial projections, a capital adequacy narrative demonstrating that the acquired entity will remain adequately funded, and an operational integration plan showing continuity of key control functions. Projections that are internally consistent with the audited historical financials, and that explain any post-acquisition changes to strategy or funding, tend to draw fewer follow-up questions.

Timeline and deadlines: realistic SAMA review times

For a complete and well-prepared file, buyers should plan for a practical SAMA review window of roughly four to ten weeks, recognising that requests for information can extend this materially. The timeline is driven far more by the quality of the initial submission and the speed of the parties’ RFI responses than by any fixed statutory clock. Because SAMA’s timing is discretionary and file-dependent, treat any indicative range as a planning assumption rather than a guarantee, and build float into the SPA long-stop date.

Typical responses to information requests

Most transactions attract at least one RFI. Common areas of follow-up are the buyer’s source of funds and beneficial ownership, the adequacy of AML/CFT and cyber-resilience controls, and the continuity of customer-fund segregation. Assign a single owner on the buy-side to coordinate RFI responses so that answers are complete, consistent and returned promptly, each delayed response effectively pauses the regulator’s assessment.

Remedies for missed deadlines

Where an SPA long-stop date approaches before SAMA has ruled, the parties’ options are governed by the agreement: an agreed extension of the long-stop date, a walkaway right with defined cost allocation, or continued closing through a regulatory escrow if permitted. Drafting these mechanics clearly at the outset prevents the parties from being forced to renegotiate under time pressure.

Costs and fees for a fintech acquisition Saudi Arabia deal

Budgeting should cover regulatory, advisory and transactional costs, plus a contingency for remediation. The table below gives indicative ranges only; SAMA’s administrative fees and all professional fees are subject to change and should be verified at the time of filing.

Who normally bears which costs

Regulatory filing fees, buy-side due diligence, and fit-and-proper checks conventionally fall to the buyer, while each side typically bears its own M&A legal fees unless the deal dynamics dictate otherwise. Translation and attestation costs are frequently split, and escrow fees are usually a buyer cost but negotiable. Because post-closing remediation can be the largest single line item, buyers should scope it during due diligence rather than discovering it after completion.

Recent developments: practical impact on deals

The maturing of SAMA’s payments and FinTech licensing framework, read alongside the Companies Law that came into force in 2023, has clarified change-of-control procedures and tightened documentary standards. For deal teams, the practical effects are threefold. First, SAMA now expects a standardised, complete filing package, which rewards buyers who prepare thoroughly and penalises incomplete submissions. Second, the Companies Law refined the corporate-approval and shareholder-resolution mechanics that underpin the transaction, so board and shareholder documentation must be aligned with the current statutory thresholds. Third, lighter-touch pathways may be available for regulatory sandbox participants and early-stage licensees, where the regulatory footprint is smaller and the continuity risk lower.

Options for sandbox participants and early-stage licensees

Where the target is a SAMA regulatory sandbox participant or an early-stage licensee with limited scale, the change-of-control process may be capable of a lighter-touch review. Even so, the core fit-and-proper and source-of-funds evidence will still be required, any acceleration is in review time, not in documentary rigour. Buyers should confirm eligibility for any lighter-touch pathway with SAMA early, because it materially affects the deal timetable.

Sample clause drafting considerations

SPAs should be updated so that condition-precedent language references the current SAMA approval process and any available expedited route, and so that shareholder and board resolutions track the current Companies Law thresholds. A well-drafted SPA will also expressly contemplate SAMA imposing undertakings, giving the buyer a defined mechanism to accept, negotiate or reject conditions before it is bound to complete.

Common pitfalls and how to avoid them

• Late SAMA notice. Treating the filing as a post-signing formality; it should be planned from the term-sheet stage.
• Incomplete KYC. Missing beneficial-ownership or source-of-funds evidence is the leading cause of RFIs and delay.
• SPA silent on licence transfer conditions. Failing to condition completion on SAMA approval, leaving the buyer exposed to a refusal.
• Missing Arabic translations. Filing English-only documents where certified Arabic versions are required.
• Unsigned or uncertified board minutes. Submitting draft or unattested corporate approvals.
• Ignoring the MISA workstream. Foreign buyers who sequence MISA approval after SAMA rather than in parallel.
• No refusal mechanics. Omitting reverse break fees, cost allocation or walkaway rights if SAMA declines.
• Underscoping remediation. Failing to budget for post-closing compliance implementation.
• Aggregating stakes without checking control. Building a stake incrementally and inadvertently crossing a control threshold.
• Optimistic long-stop dates. Setting SPA deadlines that do not accommodate realistic SAMA review and RFI cycles.

Remediation checklist

Before completion, confirm that all SAMA conditions are documented and capable of being satisfied, that compliance manuals and reporting lines are ready for update, that customer notifications are drafted where required, and that registry and MISA filings are prepared for immediate submission on approval.

Comparison: asset purchase versus share purchase for licensed FinTechs

For most licensed FinTech targets, a share purchase is the cleaner route because the licence stays with the entity, avoiding the complexity of transferring or re-applying for authorisation. An asset purchase can be attractive where the buyer wants to carve out historical liabilities, but the regulatory friction of moving the licensed activity often outweighs that benefit. Counsel experienced in FinTech M&A in the Kingdom, see our Commercial Lawyers Saudi Arabia practice, can advise on the optimal structure for a specific target.

Practical next steps for your fintech acquisition Saudi Arabia

A successful fintech acquisition Saudi Arabia deal turns on early regulatory screening, a complete and well-attested SAMA filing, an SPA that conditions completion on approval, and a realistic timetable that absorbs the RFI cycle. Buyers who prepare the documentary package thoroughly, run the MISA and SAMA workstreams in parallel where a foreign investor is involved, and build clear refusal and escrow mechanics into the SPA will move through the process considerably faster than those who treat the regulatory workstream as an afterthought. Before signing, obtain a regulatory pre-screening of the target, confirm any available expedited eligibility, and align your corporate approvals with the current Companies Law.

For tailored guidance on structuring and executing a fintech acquisition Saudi Arabia transaction, connect with the Global Law Experts network, which can coordinate SAMA change-of-control filings, foreign-investment approvals and conditional-completion drafting for licensed FinTech and payment services deals.

Sources

1. Saudi Central Bank (SAMA), official site
2. SAMA Rules & Instructions
3. Ministry of Investment, Kingdom of Saudi Arabia (MISA)
4. Bureau of Experts at the Council of Ministers, Laws Portal
5. Ministry of Commerce
6. Saudi Official Gazette (Umm Al-Qura)