Saudi Arabia Tokenization: CMA Rules & Market Entry

Tokenization in Saudi Arabia is possible today, but only through regulated channels: there is no standalone digital-asset framework comparable to Dubai's VARA regime or Bahrain's CBB crypto-asset module. Tokens with security features fall under the Capital Market Authority (CMA) and the existing Capital Market Law, and novel tokenized offerings run through the CMA's FinTech Lab experimental permit (ExPermit) program rather than a dedicated licensing track. The state has moved fastest in real estate — in November 2025 the Real Estate General Authority (REGA) supervised the Kingdom's first tokenized title deed transaction on national registry infrastructure — while retail crypto trading remains restricted. For foreign sponsors, the realistic path is a sandbox permit, a partnership with a licensed Saudi capital market institution, or an offshore structure distributed into KSA through licensed persons.

Who Regulates What in KSA

Saudi Arabia splits financial regulation between two principal authorities, with a sector regulator now playing an outsized role in tokenization.

Regulator	Scope	Tokenization relevance
CMA (Capital Market Authority)	Securities, investment funds, capital market institutions, Tadawul oversight — under the Capital Market Law (Royal Decree M/30, 2003)	Any token with security features falls in the CMA perimeter; FinTech Lab ExPermits for tokenized offerings
SAMA (Saudi Central Bank)	Banking, payments, insurance, finance companies	Payment tokens and stablecoins; its own regulatory sandbox for payments and open banking; banks need SAMA approval for any virtual-asset exposure
REGA (Real Estate General Authority)	Real estate sector regulation, brokerage, and the Real Estate Registry (RER)	Supervises real estate tokenization pilots and licensed fractional-ownership platforms

Two practical consequences follow. First, there is no single "digital assets license" to apply for — the question is always which existing perimeter your token falls into. Second, substance beats labeling: a token that behaves like an investment product will be treated as a security under the Capital Market Law and the Rules on the Offer of Securities and Continuing Obligations (OSCOs).

On the crypto side, the picture is deliberately conservative. A joint government committee declared in 2018 that cryptocurrencies are not legal tender, and Saudi banks may not engage in virtual-asset transactions without explicit SAMA approval. The stance is softening at the policy level — in November 2025, the government announced work on regulated stablecoins under joint SAMA–CMA oversight, aligned with Vision 2030 — but as of mid-2026 that initiative remains at the design stage, with no published licensing or reserve rules. For the broader regional context, see our MENA tokenization regulations guide.

What Is Actually Possible Today — and What Is Not

Honesty matters here: Saudi Arabia's tokenization framework is less mature than the UAE's or Bahrain's, and any market-entry plan should start from that fact.

Possible now, through regulated channels:

• Sandbox-permitted tokenized securities offerings. The CMA FinTech Lab, operating under the Financial Technology Experimental Permit Instructions (first issued 2018 and amended since), admits tokenization models for supervised live testing. In an early cohort, the CMA granted Wethaq Capital Markets an ExPermit to use distributed ledger technology to arrange sukuk offerings with custody services (CMA announcement No. 2740).
• Debt and sukuk crowdfunding, now formalized. The CMA has moved the digital debt-offering model from ExPermit pilots into formal regulation, permitting capital market institutions holding an arranging license to offer sukuk and debt instruments through crowdfunding platforms (CMA framework, 2025).
• Real estate tokenization under REGA. The November 2025 pilot — a tokenized title deed traded between the National Housing Company and a group of investors under REGA supervision — ran on national infrastructure built by the Real Estate Registry with SettleMint. REGA published technical tokenization standards in January 2026 and licensed a first batch of nine fractional-ownership platforms, alongside a second regulatory sandbox featuring tokenization models.
• Private placements of conventionally documented instruments with tokenized registry rails on the back end, arranged through CMA-licensed institutions under the OSCOs' exempt and private-placement categories.

Not possible (or not yet):

• Public retail offerings of security tokens outside the sandbox or REGA-licensed real estate programs — there is no general STO regime.
• Operating a token exchange, digital-asset custody business, or broker-dealer for virtual assets under a dedicated license — those categories do not exist in KSA yet.
• Retail crypto trading through a domestically licensed venue; Saudi residents who trade do so via platforms licensed elsewhere (notably Bahrain).

The compliance logic for any KSA-facing tokenized instrument follows the same securities-law analysis we cover in our tokenized securities compliance guide: classification first, offering exemptions second, transfer controls third.

The CMA FinTech Lab: The Practical Entry Door

For anything investment-shaped, the FinTech Lab is the regulator's preferred meeting point. The ExPermit allows a company to operate with real users and real money within defined limits — typically up to two years — while the CMA evaluates whether the model warrants full authorization or a new regulatory category. Per the CMA's September 2025 announcement, the Lab had issued 68 experimental permits with 50 fintech companies active, spanning securities crowdfunding, fund distribution, robo-advisory, and tokenized debt models.

Three features of the ExPermit path deserve attention from sponsors:

1. It is a genuine test, not a fast-track license. Permits are scoped, time-limited, and can end without permanent authorization — plans should include an exit scenario.
2. It has produced real rule-making. The sukuk crowdfunding framework graduated from Lab pilots to formal regulation — the CMA uses the sandbox as a pipeline, not a parking lot.
3. Local substance is expected. Applicants generally need a Saudi entity and credible Saudi-market rationale; foreign teams typically enter alongside a local partner or licensed capital market institution.

Why the Market Is Worth the Friction

The regulatory conservatism sits on top of one of the most tokenization-suited asset bases in the world:

• Vision 2030 giga-projects. NEOM, Red Sea Global, Diriyah, and Qiddiya represent hundreds of billions of dollars in real assets that will eventually need diversified funding structures — and REGA's registry-linked tokenization standards were built with fractional property investment in mind.
• The sukuk market. Sukuk and debt instruments listed on the Saudi capital market reached SAR 663.5 billion by end-2024, up 20% year-on-year (Saudi Press Agency, 2025). Sukuk are a natural tokenization candidate: standardized cash flows, existing Shariah governance, and a domestic investor base that already understands the instrument.
• An opening capital account. Effective February 1, 2026, the CMA's amended Rules for Foreign Investment in Securities abolished the Qualified Foreign Investor regime and opened Tadawul-listed securities to all foreign investors, following the July 2025 Saudi Depositary Receipts framework.
• Family offices and private wealth increasingly seek structured, Shariah-compatible private-market exposure — the segment where tokenized registry and transfer infrastructure adds control without requiring a public market.

For regional market sizing, capital-flow data, and how KSA demand compares across the Gulf, see the pillar GCC tokenization market overview.

Shariah Considerations at the Structuring Level

Shariah compatibility is not a legal requirement for every Saudi instrument, but it is a commercial requirement for most of the capital raised there. At the structuring level — leaving religious rulings to qualified Shariah boards — three patterns dominate:

• Sukuk-like participation structures, where token holders hold beneficial entitlements to identifiable assets and their income rather than an interest-bearing claim.
• Ijara (lease-based) income assets, where returns derive from rental streams on real assets — the workhorse for tokenized real estate and infrastructure.
• Murabaha and commodity-based financing structures for shorter-duration, fixed-return profiles.

The practical checklist: appoint a recognized Shariah board early, ensure the token's smart-contract mechanics (transfer, income distribution, default waterfall) match the approved structure, and document the fatwa scope so distributors can rely on it. Our Shariah-compliant water infrastructure case shows how a halal income-asset structure translates into token terms, registry logic, and investor documentation.

Market Entry Structures for Foreign Sponsors

Because KSA has no dedicated tokenization license, foreign sponsors typically choose among four routes:

1. Offshore issuer + KSA-facing distribution through licensed persons. The instrument is issued by an SPV in an established venue (ADGM, DIFC, Cayman), and Saudi investors are accessed via private placement arranged through a CMA-licensed capital market institution under the OSCOs. This is today's default for private-market deals.
2. ExPermit application (directly or with a local partner) for models that need onshore operation — slower and uncertain, but the only route to operating a KSA-domiciled tokenized-offering platform.
3. REGA-licensed platform partnership for real estate specifically, plugging into the RER-linked national infrastructure rather than building parallel rails.
4. Wait-and-watch with UAE/Bahrain base. Many sponsors serve Gulf investors from Dubai or Manama first; see our guides to VARA licensing in Dubai and Bahrain's tokenized securities framework for those routes.

A critical caveat on passporting: there is no EU-style passporting for securities activities in the GCC — a VARA, ADGM, or CBB license confers no right to solicit investors onshore in Saudi Arabia. A GCC fund-passporting framework was adopted in 2025 and the CMA has published implementation proposals, but under current rules foreign funds still require CMA registration and a locally licensed distributor. Treat any claim of "GCC-wide coverage" from a single license with skepticism.

Sequencing the entity map, offering exemptions, and distribution agreements across an offshore issuer and Saudi-facing intermediaries is legal-architecture work — our legal setup engagement coordinates that design with qualified counsel in each jurisdiction.

Readiness Snapshot: KSA vs UAE vs Bahrain

Factor	Saudi Arabia	UAE (VARA/ADGM/DIFC)	Bahrain (CBB)
Dedicated tokenization/VA framework	No — sandbox + sector pilots	Yes — multiple mature regimes	Yes — crypto-asset module since 2019
Security token offerings	Sandbox or private placement only	Licensed pathways available	Licensed pathway available
Real estate tokenization	National registry infrastructure live (REGA/RER, 2025–26)	Licensed pilots and platforms	Possible under CBB framework
Retail participation	Restricted	Permitted with licensing	Permitted with licensing
Domestic market depth	Largest in GCC	Large, internationally connected	Small, gateway role
Realistic sponsor posture	Partner-led entry, sandbox for platforms	Direct licensing	Cost-effective licensed base

The pattern: the UAE and Bahrain sell regulatory certainty; Saudi Arabia sells market size with a maturing rulebook. Most institutional strategies combine a licensed base elsewhere in the Gulf with a compliant, intermediated route into Saudi demand.

A Realistic Assessment Before You Commit

Before allocating budget to a KSA tokenization strategy, verify with qualified Saudi counsel:

• Classification: whether your token is a security under the Capital Market Law and where the offering fits within the OSCOs' exempt, private-placement, or public categories.
• Perimeter: whether any element (payment leg, stablecoin settlement, custody) touches SAMA's remit.
• Distribution legality: which activities your Saudi-licensed intermediary may perform, and what reverse-solicitation does and does not cover in practice.
• Sandbox exposure: ExPermit scope limits, duration, reporting burden, and what happens at expiry — permanent authorization is never guaranteed.
• Real estate specifics: REGA licensing status of any platform partner and conformity with the January 2026 tokenization standards.
• Shariah governance: board appointment, fatwa scope, and ongoing monitoring obligations if marketed as compliant.

Asset Haus builds the infrastructure layer for exactly this kind of entry — registry, transfer controls, and compliance architecture deployed across 9+ jurisdictions, with legal setup coordinated through qualified local counsel. We do not act as issuer, broker-dealer, exchange, custodian, or legal adviser in any market, including KSA.

Sources

• CMA FinTech Lab and Financial Technology Experimental Permit Instructions
• CMA announcement: Wethaq Capital Markets ExPermit (DLT sukuk arrangement)
• Rules on the Offer of Securities and Continuing Obligations (CMA)
• CMA: Rules for Foreign Investment in Securities (2026 amendments)
• SAMA Regulatory Sandbox
• Real Estate General Authority (REGA) and Ledger Insights: first Saudi title-deed tokenization
• Saudi Press Agency: sukuk and debt instruments reach SAR 663.5B

FAQ

Is tokenization legal in Saudi Arabia?

Yes, within regulated channels: CMA FinTech Lab experimental permits, private placements arranged by licensed capital market institutions, or REGA-licensed real estate platforms. There is no general-purpose tokenization or virtual-asset license, and public retail security token offerings are not available outside these programs.

Who regulates security tokens in KSA?

The Capital Market Authority (CMA). Any token with the features of a security falls under the Capital Market Law (2003) and the CMA's offering rules, regardless of technology. SAMA covers payment-related tokens and banks' virtual-asset exposure; REGA supervises real estate tokenization on the national Real Estate Registry infrastructure.

Can foreign issuers tokenize Saudi assets?

Typically only in partnership with locally licensed entities: an offshore issuing SPV with Saudi-facing distribution through a CMA-licensed capital market institution under private-placement rules, or a REGA-licensed platform partnership for real estate. Direct onshore operation requires a CMA ExPermit or full authorization, neither of which is guaranteed.

Do UAE or Bahrain licenses work in Saudi Arabia?

No. There is no EU-style passporting for securities activities in the GCC — a VARA, ADGM, DIFC, or CBB license does not authorize soliciting investors onshore in KSA. A GCC fund-passporting framework adopted in 2025 may ease fund distribution over time, but current rules still require CMA registration and a licensed local distributor.

Do tokenized instruments in Saudi Arabia need to be Shariah-compliant?

Not by law for every instrument, but in practice most Saudi-facing capital expects it. Common structures include sukuk-like participation, ijara (lease-based) income assets, and murabaha-based financing — each requiring certification by a qualified Shariah board and token mechanics that match the approved structure.

Planning a Saudi or GCC tokenization strategy? Request a structured readiness assessment to map your regulatory path before committing capital.