Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Financial services › Capital Market Institutions Regulations

Capital Market Institutions Regulations

Licensing and conduct rules for CMIs (formerly the Authorised Persons Regulations)

Type	Regulation
Issuing authority	Capital Market Authority (CMA)
Framework	Financial services
Tier	Implementing & executive regulation
Legal status	In force
Instrument number	Capital Market Authority
In force from	2020-11-01
Dates	Formerly the Authorised Persons Regulations; in force 1 November 2020; Art 59 outsourcing from 1 January 2022
Last verified	2026-10-20

The Capital Market Institutions Regulations, formerly the Authorised Persons Regulations, set the CMA's licensing and conduct rules for Capital Market Institutions (CMIs).

• In force in their current form since 1 November 2020.
• Art 59 (outsourcing): applies from 1 January 2022.
• Read with the CMA Cybersecurity Guidelines for CMIs.
• 215 licensed CMIs at end-2025 (CMA annual report).

Documents

• Official source (cma.gov.sa)

In this framework

• The Capital Market Law
• Saudi Central Bank Law
• Law of Payments and Payment Services and its Implementing Regulation
• Credit Information Law
• Banking Control Law
• Implementing Regulations of the Credit Information Law
• Payment Services Provider Regulations (2020)
• SAMA Rules on Outsourcing (No. 41027017)
• Financial Consumer Protection Principles and Rules
• Cyber Resilience Fundamental Requirements (CRFR)
• Adherence to the PDPL and Data Governance Policies, Regulations and Rules (SAMA No. 43045328)
• SAMA Cyber Security Framework (CSF)
• Business Continuity Management Framework
• Counter-Fraud Framework (banks)
• Counter-Fraud Fundamental Requirements (finance and payment companies)
• Enhancement of Operational Resilience to Address Quantum Computing Risks
• Oversight Framework for Payment Systems and Their Operators
• Open Banking Framework
• IT Governance Framework
• Cyber Threat Intelligence Principles
• Ethical Red Teaming Framework
• CMA Cybersecurity Guidelines for Capital Market Institutions
• Payment Services Provider Regulatory Guidelines

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21