Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Financial services › Law of Payments and Payment Services and its Implementing Regulation

Law of Payments and Payment Services and its Implementing Regulation

Statutory basis of the payments sector

Type	Law
Issuing authority	Saudi Central Bank (SAMA)
Framework	Financial services
Tier	Primary law: niẓām (Royal Decree M/…)
Legal status	In force
Instrument number	M/26 · Royal Decree; Saudi Central Bank (SAMA)
Issued	(22/3/1443H)
In force from	2023-07-06
Dates	Royal Decree M/26 (22/3/1443H); Implementing Regulation 18/12/1444H (6 July 2023)
Last verified	2026-10-20

The Law of Payments and Payment Services (Royal Decree M/26, 22/3/1443H) gives the payments sector its own statutory basis. Its Implementing Regulation was issued on 18/12/1444H (6 July 2023) and took effect on issue.

• SAMA licenses and supervises payment service providers under the Law.
• The Implementing Regulation appears to replace the 2020 Payment Services Provider Regulations; the rulebook status is being confirmed.
• Payment data is personal data under the PDPL where it relates to individuals.

In this framework

• The Capital Market Law
• Saudi Central Bank Law
• Credit Information Law
• Banking Control Law
• Implementing Regulations of the Credit Information Law
• Payment Services Provider Regulations (2020)
• Capital Market Institutions Regulations
• SAMA Rules on Outsourcing (No. 41027017)
• Financial Consumer Protection Principles and Rules
• Cyber Resilience Fundamental Requirements (CRFR)
• Adherence to the PDPL and Data Governance Policies, Regulations and Rules (SAMA No. 43045328)
• SAMA Cyber Security Framework (CSF)
• Business Continuity Management Framework
• Counter-Fraud Framework (banks)
• Counter-Fraud Fundamental Requirements (finance and payment companies)
• Enhancement of Operational Resilience to Address Quantum Computing Risks
• Oversight Framework for Payment Systems and Their Operators
• Open Banking Framework
• IT Governance Framework
• Cyber Threat Intelligence Principles
• Ethical Red Teaming Framework
• CMA Cybersecurity Guidelines for Capital Market Institutions
• Payment Services Provider Regulatory Guidelines

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21