Saudi Arabia: technology regulation at a glance

Framework: Patchwork of in-force restrictions plus emerging sectoral rules: 2018 Standing Committee declaration (led by SAMA) that virtual currencies are 'illegal' and unlicensed, reinforced by the 2019 Ministry of Finance warning; banks prohibited from crypto dealings without SAMA approval; Capital Market Authority (CMA) FinTech Lab / sandbox and evolving tokenization rules for security tokens; a joint SAMA–CMA stablecoin framework announced in late 2025 but not yet in force. No comprehensive dedicated crypto law has been enacted.

Saudi Arabia has no dedicated comprehensive crypto/digital-asset law in force. Since a 2018 Standing Committee statement (SAMA) and the 2019 Ministry of Finance warning, virtual currencies remain officially unrecognized and unlicensed, with banks prohibited from facilitating them; personal ownership is not criminalized in practice but there are no licensed exchanges. Regulatory activity is now expanding through the CMA's digital-assets/tokenization sandbox (with real-estate and security-token pilots) and a joint SAMA–CMA stablecoin framework announced in late 2025, alongside continuing SAMA CBDC work — making the overall posture 'developing' rather than a settled regime.

Framework: Saudi Data & Artificial Intelligence Authority (SDAIA), non-binding AI Ethics Principles and Generative AI Guidelines, underpinned by the Personal Data Protection Law (PDPL); no comprehensive AI-specific statute in force.

Saudi Arabia has no dedicated, binding AI law. AI is governed primarily through SDAIA's voluntary instruments, the AI Ethics Principles and the Generative AI Guidelines, supplemented by the legally binding Personal Data Protection Law (PDPL), which regulates automated decision-making and data use. SDAIA leads national AI policy under a risk-based, principles-driven approach aligned with Vision 2030 and the National Strategy for Data & AI.

Framework: Personal Data Protection Law (PDPL), issued by Royal Decree No. M/19 (2021), amended by Royal Decree No. M/148 (2023); enforced by the Saudi Data and Artificial Intelligence Authority (SDAIA). Supplemented by the Implementing Regulations and the Regulation on Personal Data Transfer Outside the Kingdom.

Saudi Arabia has a comprehensive, GDPR-aligned data protection regime under the Personal Data Protection Law (PDPL), which entered into force on 14 September 2023 with full compliance required from 14 September 2024 after a one-year grace period. The national data protection authority is SDAIA, which issued the Implementing Regulations and a dedicated cross-border data transfer regulation, and operates enforcement committees that have begun imposing penalties.

Framework: Law of Payments and Payment Services (Royal Decree No. M/26, 1443H) and its Implementing Regulations (in force 13 June 2023), administered by the Saudi Central Bank (SAMA), which is the sole licensing and supervisory authority for payment systems and payment service providers.

Saudi Arabia operates a clear, comprehensive licensing regime for digital payments and fintech under SAMA. A person may not operate a payment system or provide payment services in the Kingdom without a SAMA licence, with defined categories for payment institutions and e-money institutions, dedicated BNPL rules, a formal open banking licensing framework (live since March 2026), and national rails (sarie, mada, SADAD, SARIE). The regime is anchored in the 2021 Law of Payments and Payment Services and its 2023 Implementing Regulations.

Framework: Tourist eVisa under the Saudi Tourism Authority (visitsaudi.com); Premium Residency Law (Royal Decree of 15 May 2019), administered by the Premium Residency Center

Saudi Arabia has no dedicated digital-nomad or remote-work visa as of May 2026; claims of one circulate only on promotional sites and are not confirmed by any official Saudi source. Remote workers earning foreign income typically stay on the one-year, multiple-entry tourist eVisa (up to 90 days per visit), while longer-term relocators and investors can pursue the Premium Residency ('golden visa') program, which includes Entrepreneur, Special Talent, Real Estate Owner and fixed/unlimited-duration tracks.

Framework: Communications, Space & Technology Commission (CST, ex-CITC) operates extensive state filtering; Anti-Cyber Crime Law (Royal Decree M/17, 2007); CST Regulations for Providing Digital Content Platform Services (2024); GAMR media/content-creator licensing under the Audiovisual Media Law (Royal Decree M/33, 2017)

Saudi Arabia heavily restricts the internet through one of the world's most extensive state filtering systems run by the CST, blocking content across 90+ categories, while vaguely worded cybercrime and counterterrorism laws are used to prosecute online speech (Freedom House rated it 'Not Free', 25/100, in Freedom on the Net 2025). On top of censorship, the kingdom layers comprehensive licensing/registration controls: digital content platforms must register with the CST and content creators/influencers must hold GAMR 'Mawthooq' permits. The overall posture is one of heavy government control rather than a rights-protective online-safety regime.

Framework: National Cybersecurity Authority (NCA), the supreme national cyber authority (established by Royal Order in 2017) issuing binding controls including the Essential Cybersecurity Controls (ECC); complemented by the Anti-Cyber Crime Law (Royal Decree M/17, 2007) and sectoral/data-protection regimes (SAMA, SDAIA/PDPL).

Saudi Arabia operates a comprehensive, centralized cybersecurity regime led by the National Cybersecurity Authority (NCA), which sets and enforces mandatory frameworks across government, critical national infrastructure (CNI), and the private sector. This is layered with the Anti-Cyber Crime Law (criminal offences), sector-specific rules from the Saudi Central Bank (SAMA) for financial institutions, and personal-data breach-notification duties under the PDPL administered by SDAIA. The regime has been progressively expanded, with updated controls (ECC-2:2024) and new private-sector controls (NCNICC-1:2025) issued recently.

Framework: Investment Law (Royal Decree, 1446H/2024, in force 2025) administered by the Ministry of Investment of Saudi Arabia (MISA); company incorporation and Commercial Registration via the Ministry of Commerce / Saudi Business Center (business.sa).

Saudi Arabia has substantially liberalized market entry: 100% foreign ownership is permitted across most sectors and the new Investment Law replaces the old foreign-investment licensing regime with a simplified MISA registration and pledges equal treatment of foreign and domestic investors. A foreigner must still obtain MISA registration before incorporating, observe a 'negative list' of excluded/restricted activities, and meet sector-specific minimum-capital and document-legalization requirements, so the process is open but multi-step rather than frictionless.