Digital Banking, Fintech and the Payments Ecosystem in the Kingdom of Saudi Arabia

Introduction

The COVID-19 pandemic has led to a global wave of digitisation, directly impacting the banking and payment processing industries. The Saudi Vision 2030 has several programs under its umbrella, including the Financial Sector Development Program (“FSDP”), that aims to increase cashless transactions, stabilise and diversify the financial sector, while adhering to relevant international standards.  In furtherance of this goal, the Saudi Central Bank (“SAMA”) and the Capital Market Authority (“CMA”) have been working on a number of initiatives that will pave the way for the increasing digitisation of the banking, securities and payments processing sectors in the Kingdom of Saudi Arabia.

During the course of 2019 to 2021, SAMA issued a number of regulations and policies, in a concerted effort to promote the establishment of an innovation-based financial technology ecosystem as well as to address growing consumer needs. In this briefing, we provide an overview of the KSA banking and payments landscape, and also summarize the key features of these new regulations.

Fintech Saudi

With the aim of diversifying the financial sector and accelerating development in fintech, SAMA launched Fintech Saudi in April 2018. Major initiatives including the Fintech Saudi Tour 19, Fintech Access Guide, Fintech Saudi Podcast, Fintech Accelerator Programme, and Fintech Internship were launched under Fintech Saudi.

The initiative envisages KSA as a fintech hub in the coming years. It has also listed activities that do not require licenses, including business tools, personal management, regulation technology, gamification, back-office bank operations, reward-based crowdfunding, enhancing bank’s customer experience, and aggregation of publicly available financial information.

16 Fintech companies have received licenses to provide payment services, consumer micro-finance and digital insurance brokerage in the recent past. Halalah (now known as Hala) and Bayan Payments were amongst the first digital wallet companies that obtained SAMA’s license under the experimental permit initiative. SAMA has also signed an agreement with Ripple, in order to aid Saudi banks settle transactions using blockchain. Furthermore, the second edition of Fintech Saudi’s Annual Report stated that the number of fintech start-ups in the Kingdom had tripled, from 20 to 60 in the year 2019-2020, exhibiting the increasing rate of development in the sector.

Regulatory Sandbox Framework

In addition to Fintech Saudi, a Regulatory Sandbox was established, in order to aid innovators (international and local start-ups as well as established firms) to use a live and controlled environment to test their digital solutions, for a specified period of time. After testing, they will be allowed to take their products to the market, in accordance with the relevant guidelines. Alongside promoting financial inclusion, the Sandbox will benefit consumers by facilitating efficient new products. Further, SAMA will be able to collect evidence and use it while formulating regulations in the sector, and also mitigate risks.

In 2019, SAMA issued the Regulatory Sandbox Framework, which stated that the Sandbox is open to innovators proposing non-regulated technology, and innovators proposing new fintech solutions. However, solutions that are already existing in the Kingdom, or are not at sufficient stage of maturity, or are ill-conceived, among other factors, shall not be able to use the Sandbox as a suitable facility. 32 Fintech companies are operating under the Framework and companies such as Sahlah Company, which provides debt and crowdfunding services and Skyband, that gives digital payments services such as MADA (the Saudi Banks card-based payments method), have already used the framework till date. Additionally, Munafa Capital, which is an online marketplace where investors may invest in creative early-stage businesses, giving them access to direct investment options, due diligence tools, and industry data insights for a previously difficult-to-access assets class, has also been a part of the same.

Under the framework, applicants can either be SAMA licensed innovators wishing to test a solution covered by its existing permissions, or non-licensed local fintechs /start-ups, or non-licensed international fintech firms. Following the opening of the sandbox window, the application stage is open for 30 days. The criteria for consideration include genuine innovation, consumer benefit, readiness for testing, and exiting plan. It is essential that the innovators meet the principles of the Saudi Vision 2030 and the FSDP. This is followed by 60 days of evaluation in two phases, 30 days of the innovator and SAMA agreeing on Sandbox tools and deployment of customer safeguards, and the next 30 days for SAMA to decide on the cohorts’ composition and issue a Letter of Acceptance (“LoA”) /SAMA permission.

Testing in the Sandbox lasts for six months after the receipt of the LoA, with provisions for extension and reduction, based on the prevailing situation. The regulations mandate the innovator to present a final report to SAMA, which shall include the results of the test, the exiting strategy, and the request to extend the validity of the LoA. This is followed by the exit stage which decides whether the technology must enter the market.

Payment Services Provider Regulations (“PSPR”)

The PSPR, which were issued in January 2020 and updated in August 2020, provide a clear process for obtaining a license as a Payment Services Provider (“PSP”) in KSA. The PSPR adopt concepts contained in the European Union’s Payment Services Directive (PSD II), in line with international practices and enabling international PSPs to establish operations in KSA, without the need to substantially alter their business models.

The “in-scope” services identified by the PSPR, include the execution of payment transactions, including the execution of credit transfers and direct debits; issuing payment instruments; issuing electronic money (by opening e-wallets or otherwise); acquiring payment transactions; money remittance; services enabling cash to be placed on or withdrawn from a payment account and the operation of a payment account; payment initiation services; account information services; and any other activity designated by SAMA as a payment service.

Under the PSPR, Payment Institutions (“PI”) and Electronic Money Institutions (“EMI”) are provided with licenses. While the latter are only licensed to issue electronic money, the former can carry out all payment services except issuing electronic money. There are four types of licenses that may be applied for: Major PI, Micro PI, Major EMI and Micro EMI.

Major PI

This license requires setting up a joint stock company (JSC) in KSA having a minimum paid-up share capital of SAR 3 million. The Major PI must also maintain, as working capital (on an ongoing basis), the minimum paid-up share capital amount or an amount equal to 1% of the Average Monthly Payment Transaction Value,[1] whichever is higher.

Micro PI

This license requires forming a joint stock company (JSC) or a limited liability company (LLC) in KSA and a minimum paid-up share capital of SAR 1 million, which must be maintained as working capital on an ongoing basis. A Micro PI must abide by certain restrictions, not provide services to persons outside the KSA, and not exceed the Average Monthly Payment Transaction Value of SAR 10 million for its first 12-month period of operations.

Major EMI

This license requires forming a joint stock company (JSC) in KSA and a minimum paid-up share capital of SAR 10 million. The Major EMI must also maintain, as working capital (on an ongoing basis), the minimum paid-up share capital amount or an amount equal to 2% of the Total Average Outstanding Electronic Money,[2] whichever is higher.

The Major EMI license must not permit customer balances to exceed SAR 100,000 of electronic money in aggregate for each customer, and customer transactions to exceed SAR 100,000 per calendar month in aggregate for each customer, unless in relation to the closure of an electronic money account.

Micro EMI

This license requires forming a joint stock company (JSC) in KSA and a minimum paid-up share capital of SAR 2 million. The Micro EMI must also maintain the minimum paid-up share capital amount as working capital on an ongoing basis. The Micro EMI must not exceed the Total Average Outstanding Electronic Money to SAR 10 million for its first 12-month period of issuing electronic money, and Average Monthly Payment Transaction Value of SAR 10 million for its first 12-month period of operations, unless otherwise approved by SAMA. It must also not permit customer balances to exceed SAR 20,000 of electronic money in aggregate for each customer, and not permit any payment transactions exceeding SAR 20,000 per calendar month in aggregate for each customer, unless (i) in relation to the closure of an electronic money account, or (ii) as otherwise approved by SAMA.

In the present scenario, SAMA has actively been issuing licenses as both international and local PSPs have expressed their interest in entering the sector. It has already granted PI licenses to Skyband and Foodics through the point of sales services, and NoonPay through the e-commerce payment gateway services.

Additional Licensing Guidelines and Criteria for Digital-Only Banks in Saudi Arabia

In February 2020 SAMA issued the additional licensing guidelines and criteria for digital-only banks in KSA. These guidelines apply to digital-banks only and are to be read together with SAMA’s Banking Licensing Guidelines and Minimum Criteria published on SAMA’s website.

Digital-only banks are defined as banks that conduct business mainly through digital channels such as the internet and mobile applications. Under SAMA’s guidelines, digital-only banks must be set up in KSA as joint stock companies. Its promoters must have technology and financial industry related experience and knowledge, and the financial capacity to support setting up the digital-only bank.

Furthermore, each applicant must possess a team with adequate expertise to discuss relevant aspects of the application. As part of the application, the applicant will be required to present, among other things, a business plan, an exit plan (in case of difficulties in achieving the targeted business objectives). Moreover, the Guidelines have not mentioned any minimum capital requirement, but the applicant has to submit an internal capital adequacy assessment plan (ICAAP), an internal liquidity adequacy assessment plan (ILAAP). Therefore, SAMA will be assessing the financial adequacy based on those requirements.

Applicants must maintain a physical presence in KSA as their principal place of business, but are not expected to establish physical branches. However, on exceptional basis, SAMA may require a digital-only bank to establish customer service centres in order to facilitate customer interaction, enquiries or complaints.

In June 2021, the Cabinet approved the licensing of two digital banks- STC Bank, a local digital bank established after the conversion of STC Pay, and Saudi Digital Bank, led by Abdul Rahman Bin Saad Al-Rashed and Sons Company.

Rules for Engaging in Debt-Based Crowdfunding

In January 2021, SAMA published the Rules for Engaging in Debt-Based Crowdfunding (“Crowdfunding Rules”) which set out licensing procedures and requirements for the activity of Debt-Based Crowdfunding and the minimum standards and procedures applicable to Debt-Based Crowdfunding Companies (“DBC Companies”).

The Crowdfunding Rules define Debt-Based Crowdfunding as the activity of raising funds from natural or legal persons (the “Participants”) through a digital platform (such as, websites or mobile applications) run by DBC Companies, which platform allows micro, small or medium-sized enterprises registered in KSA (referred to as “Institution Beneficiaries”) to seek and obtain financing from Participants in KSA pursuant to the terms of a loan agreement.

Entities wishing to engaging in Debt-Based Crowdfunding must be established as joint stock companies and obtain a license from SAMA in accordance with the requirements of the Crowdfunding Rules and the Finance Companies Control Law, as well as any additional instructions specified by SAMA from time to time.

The minimum share capital for a DBC Company is currently set at SAR 5 million. Taking into consideration the associated risks and their nature, SAMA may increase or decrease the minimum capital based on the prevailing market conditions or if it deems that the DBC Company’s proposed business model or the nature of its activity requires so. Licenses are granted for an initial term of five years which may be renewed at the request of the DBC Company.

The Crowdfunding Rules set our internal organization and operational requirements for DBC Companies, including, among other things, the requirement to carry out proper due diligence of the Participants and the Institutional Beneficiaries who are seeking to engage in Debt-Based Crowdfunding. In addition, the details to be covered under the loan and service agreements. The Crowdfunding Rules also impose credit limits, which include the following:

• the Debt-Based Crowdfunding shall not grant financing for consumer purposes. The targeted beneficiaries shall be legal persons that are micro, small and medium-sized enterprises only;
• the total amount of credit granted to each Institutional Beneficiary must not exceed SAR 7,500,000;
• each Participant’s contribution shall not exceed 25% of the finance amount requested, with the total amount of contribution capped at SAR 50,000 for each Institutional Beneficiary and SAR 200,000 annually for all finance options offered through the Debt-Based Crowdfunding Platform. Eligible Participants are however excluded from this limitation.

For Debt-Based Crowdfunding activities, SAMA has permitted Fintech companies such as Sahlah Company for Electronic Marketing, Raqamyah Platform, Munafa Capital, Maalem Financing Company, etc. in line with the Regulatory Sandbox Framework.

SAMA’s Open Banking Policy

SAMA announced the issuance of its Open Banking Policy in January 2021. Although brief, the Open Banking Policy provides a succinct overview of the benefits SAMA envisages from ‘Open Banking’, how such benefits are in line with the strategic objectives of Vision 2030 and FSDP, and how SAMA plans to implement the policy in the Kingdom.

The policy explains that ‘Open Banking’ is a technological innovation that enables customers to share their existing customer data securely with third parties, such as fintech companies which focus on providing customers new and innovative financial services. Through Open Banking, customers will benefit from better financial products and services, ranging from bringing all accounts into a single dashboard to creating smoother journeys into daily banking activities.

Other envisaged benefits of Open Banking include increased competition as a result of reducing barriers to entry for new participants, providing them with a better understanding of customer needs through financial products and services that offer more competitive pricing and also help increase financial inclusion by expanding the reach of such financial products and services for larger customer segments in the Kingdom.

SAMA’s Open Banking Policy sets out three distinct phases:

• the Design Phase (P1);
• the Implementation Phase (P2); and
• the Go-live Phase (P3).

P1 will occur in the first half of 2021 during which SAMA will design the Open Banking ecosystem (processes and technologies) and governance systems involving market participants (such as, banks, fintech companies and other financial institutions).

P2 will occur in the second half of 2021 during which SAMA will develop and define frameworks, technology building blocks, and rollout activities, including enhancement of customer awareness.

The final phase, P3, is scheduled for the first half of 2022, when the Open Banking ecosystem will be formally launched. It will involve a staged approach to building and supporting customer awareness, and it will seek to guarantee continuous improvements to the Open Banking digital architecture and infrastructure.

SAMA anticipates that this approach will result in the optimal Open Banking framework that is specifically geared towards addressing the specific needs of the stakeholders in the Kingdom.

Conclusion

The regulations and policies set out above are here to stay and will be a necessity even in the post COVID-19 landscape, given the wave of digitalisation around the globe. They aim to achieve some of the strategic objectives of Saudi Vision 2030 and will undoubtedly transform the banking and payments industries in KSA. We expect that additional regulations and guidelines will be issued by SAMA in support of the above.

[1] Average Monthly Payment Transaction Value means:

• in relation to a PSP that has been licensed by SAMA for at least 12 calendar months, the monthly average over the period of 12 calendar months preceding the date of calculation of the total amount of payment transactions executed by the PSP, including payment transactions executed by its agents; and
• in relation to an applicant or a PSP that has been licensed for fewer than 12 calendar months, as set out in Articles 6.2(b) and 6.4(b) of the PSPR,

which, in each case, shall exclude the issuance or redemption of electronic money by the PSP.

[2] the arithmetic mean of the total amount of financial liabilities related to electronic money issued by the EMI at the end of each calendar day over the last 12 calendar months.

Al Tamimi & Company’s Banking & Finance team regularly advises on digital banking, fintech and licensing. For further information, please contact Rafiq Jaffer or Agathi Trakkidi.