The Saudi market in numbers
The Saudi retail payments market covers transactions paid by card, by instant transfer, through the national bill payment system, and in cash. Saudi Arabia is the largest payments market in the Gulf. Electronic payments' share of consumer retail transactions rose from 62% in 2022 to 70% in 2023, then 79% in 2024. It reached 85% in 2025 (SAMA). Vision 2030's Financial Sector Development Program had targeted 70% for 2025, a goal the Kingdom beat ahead of schedule. Volumes followed the same curve: the Kingdom recorded 14.6 billion electronic transactions in 2025, up from 12.6 billion in 2024 (SAMA).
The scope of these data series needs careful reading. The e-commerce statistics published under the mada brand cover online purchases, in-app purchases, and wallets. They exclude Visa and Mastercard credit cards (SAMA, as reported by Arab News, 2025). Actual online card volume is therefore higher than the published figure, and a capacity plan built on the mada series alone underestimates the load.
- mada, the domestic debit scheme, mandatory for processing transactions of online stores based in the Kingdom (SAMA Circular No. 391000075005 of March 18, 2018).
- sarie, the retail instant payment service: 24/7, addressable by alias, capped at SAR 20,000 per transaction (SAMA).
- SADAD, the national bill payment system run by SAMA since 2004, the rail for government bills and recurring payments.
- SARIE, the Kingdom's RTGS system, in service since 1997, for high-value payments in central bank money. It shares a name with the instant payment service, but not a purpose.
- Fatoora, ZATCA's e-invoicing platform, which every B2B collection depends on for accounting integration.
mada: the domestic scheme and mandatory local processing
The Kingdom's domestic debit scheme is called mada. The Saudi national payment network behind it has operated since 1990 under the name Saudi Payments Network (SPAN). It connects the ATMs and point-of-sale terminals of every bank in the Kingdom (SAMA). SAMA Circular No. 361000013257 of November 17, 2014 gave it its current brand name, and the public rollout followed in 2015. The network is now operated by Saudi Payments, a subsidiary of the central bank.
Nearly every Saudi debit card carries mada, co-badged with Visa or Mastercard for international use. The co-badge gives the merchant no routing choice: domestic transactions must go over mada, which sets the cost of acceptance. SAMA Circular No. 391000075005 of March 18, 2018 sets the rule for splitting traffic between the two networks. Transactions at online stores located in the Kingdom go through the national system, while purchases from merchants based outside the Kingdom go over the international networks.
| Case | Reference | Rate |
|---|---|---|
| Point of sale, domestic mada card | mada / acquiring bank schedule | Merchant fee capped at 0.80% of the amount, up to a maximum of SAR 40 per transaction |
| E-commerce, domestic mada card | SAMA Circular No. 391000075005 (March 18, 2018) | Interchange of 0.70% paid by the acquirer to the issuer; merchant fee capped at 1.75% |
| Point of sale, gas stations | SAMA Circular No. 351000152594 | No interchange, no network fees, merchant fee capped at 7 halalas (SAR 0.07) per transaction |
| Point of sale, card issued by a GCC bank and acquired in the Kingdom | SAMA Circular No. 371000100598 | 1.5% of the amount, capped at SAR 80; GCC network fees of 1%, capped at SAR 37.5 |
| mada card used in another GCC country (mada as issuer) | SAMA Circular No. 371000100598 | 0.9% of the transaction amount |
Contactless is the norm in stores. In 2020, SAMA raised the no-PIN limit for mada Atheer contactless payments from SAR 100 to SAR 300 per transaction. The cumulative limit remains SAR 300, after which a PIN is required again. Mobile wallets rely on the same acceptance network. Apple Pay has been available in the Kingdom with mada cards since February 2019, and a second wave of banks followed in May 2019. SAMA lists Samsung Pay, Google Pay, and its own mada Pay app among the tokenized wallets accepted on its network.
Accepting payments online: 3-D Secure, gateways, and the new interface
Accepting a mada card online means a store based in the Kingdom accepting a remote payment. Three conditions must be met. The merchant has a merchant ID with an acquirer licensed in the Kingdom, and its gateway is certified by the mada authorization center. The cardholder authenticates through 3-D Secure, which SAMA describes as the protocol for the mada e-commerce channel. Banks enabled mada cards for online purchases on April 1, 2018, after testing and approval by the authorization center (SAMA Circular No. 391000075005).
The payment success rate is the ratio of completed payments to attempts over a given period. On the mada channel, it depends far more on the quality of the authentication chain than on risk scoring. The one-time passcode goes to the number the bank has on file, not the one the customer entered on the site. A roaming cardholder, an outdated number at the issuer, or a late SMS all cause drop-offs that the merchant mistakes for declines. Logs must separate failed authentications from authorization declines. Otherwise, the merchant is flying blind.
On July 7, 2025, SAMA announced the launch of a new e-commerce payment interface. It unifies the technical integration specifications and makes card tokenization standard. The interface also offers centralized merchant registration and brings mada together with the international networks behind a single entry point. Certification is done gateway by gateway. Mastercard Gateway received SAMA certification in December 2025. The announcement did not include a migration deadline for providers.
- Check that your gateway is certified by the mada authorization center, not just “mada compatible” on its product page.
- Require raw response codes for each transaction from your acquirer, plus a separate field for the 3-D Secure result.
- Settle your tokenization approach at integration: the new e-commerce interface makes tokenization a cornerstone, and a non-portable token vault locks the merchant in with its provider.
- Support partial refunds from day one: each one triggers an electronic credit note with ZATCA.
- Test the flow with a real mada card issued by a Saudi bank, not just in a test environment.
sarie, SARIE, and SADAD: the non-card rails
Non-card rails are the funds transfer systems that use neither the domestic card scheme nor a payment terminal. The Kingdom has three, and two of them share a name. They carry most of the money that moves outside card networks: cards dominate acceptance, not overall flows. Telling these three systems apart comes before writing any integration spec.
| System | Launched | Topic | What a merchant uses it for |
|---|---|---|---|
| SARIE (RTGS) | 1997 | Real-time gross settlement, high value, in central bank money | Nothing directly: it is the interbank settlement layer, reached through your bank |
| sarie (instant) | 2021 | 24/7 retail transfers, addressable by alias, capped at SAR 20,000 | Payouts to sellers and service providers, refunds, A2A collections |
| SADAD | 2004 | National bill payment system: presentment and payment of government and private-sector bills | Recurring collections and billing, available across all banking channels |
The instant payment service runs 24 hours a day, every day of the year, between local banks (SAMA). Two separate limits govern its use cases. A standard transfer is capped at SAR 20,000. A quick transfer sent by alias, without registering the payee first, is capped at SAR 2,500. Accepted aliases are a mobile number, a national ID number, an iqama (residence permit) number, an email address, and the unified number assigned to commercial establishments.
The SAR 20,000 limit rules out sarie for settling large B2B orders, which stay on standard bank transfers. The same limit makes the service a good fit for high volumes of small payouts: marketplaces, delivery, gig work, and refunds. Alias addressing removes the need to collect IBANs, often the first point of friction in a payout setup. The system offers payee verification before sending, including for business accounts (SAMA).
ZATCA e-invoicing, in two phases
Saudi e-invoicing is the requirement to issue and store every invoice in a structured format the tax authority can process. Saudi VAT has been 15% since July 2020, after it was first introduced at 5% in 2018. Since 2021, the tax authority, ZATCA, has required e-invoicing from every resident taxpayer and from third parties invoicing on their behalf. Non-resident taxpayers registered for VAT are exempt. The program runs in two phases, and the second is itself rolled out in waves of taxpayers.
| Standard invoice (B2B, B2G) | Simplified invoice (B2C) | |
|---|---|---|
| Processing | Clearance: Fatoora validates the invoice before it goes to the buyer | Reporting: issued to the buyer immediately, then reported to Fatoora |
| Settlement time | Real time, before the invoice is sent | Within 24 hours of issuance |
| Format submitted | UBL 2.1 XML, or PDF/A-3 with embedded XML | UBL 2.1 XML |
| Proof of compliance | Cryptographic stamp applied by ZATCA after validation | Stamp from the taxpayer's device, QR code on the copy given to the buyer |
| Typical payments use case | Invoicing a merchant contract, a subscription, or a service | In-store sales and online sales to consumers |
Phase 2 shifts the burden from the accounting team to engineering. Each invoice carries a unique identifier, a sequential counter, a hash of the previous invoice, and a cryptographic stamp. This chaining links every invoice to the one before it, so any break in the sequence carries over to all subsequent invoices. Resubmitting an invoice, resetting a counter after restoring a backup, or running two POS instances on the same device breaks the chain. ZATCA can see the break, and recovery then has to be worked out invoice by invoice.
These obligations intersect with the payment flow at several points. A partial refund on an order generates an electronic credit note, subject to the same rules as the invoice it corrects. A card chargeback leaves the original invoice untouched and does not automatically produce a credit note. How to treat it is an accounting decision, which must be made before go-live. Invoices must include Arabic text, even when the e-commerce catalog is published in English.
Tabby, Tamara, and BNPL under a central bank license
Buy now, pay later (BNPL) lets a shopper pay for a purchase in several installments, while the provider pays the merchant up front. Offering it in the Kingdom requires a central bank license. On December 17, 2023, SAMA published rules governing BNPL companies that make licensing mandatory. Senior managers must meet fit-and-proper requirements and be permanent residents of the Kingdom. The company must maintain internal policies, information security, and a financial crime compliance program. The central bank issues initial approval or a reasoned rejection within 60 business days of receiving a complete application.
- BNPL license issuance fee: SAR 5,000; renewal or amendment: SAR 2,000 (SAMA, BNPL rules, 2023).
- BNPL is credit, not a payment service: a licensed payment provider cannot offer it under its payments license.
- A merchant that displays an installment offer must check that its partner is on SAMA's list of licensed entities.
In Saudi Arabia, installment options appear before wallets in an online store's checkout. The reverse order, imported from Western markets where BNPL sits at the bottom of the payment method list, costs conversions. The provider's fee is negotiated like a referral commission and does not compare neatly with a card fee, because the BNPL provider pays the merchant up front and carries the credit risk.
Wallets, digital accounts, and the move away from cash
A payment wallet is an app that stores a user's payment credentials and initiates payments on their behalf. In the Kingdom, wallets come from telecom operators and banking groups, and they operate under central bank oversight: Saudi Arabia's shift did not happen at the banks' expense, but alongside them. Wallets have replaced cash for everyday spending. Two paths illustrate this shift, and both can be seen elsewhere in the Gulf.
Cash on delivery means paying for an order in cash when it is delivered. Its use is declining but has not disappeared, especially outside the major cities. Its cost to the merchant is often accepted without being measured. It includes tied-up cash, the delivery company's cash collection fees, the rate of refused deliveries, and the simplified invoice that must be issued regardless. The fix is pricing, not removing the option from checkout: a visible surcharge at the moment of choice is often enough to shift demand to cards or installments.
SAMA, licensing, and market access
The Law of Payments and Payment Services is the sector's legal foundation in the Kingdom. It was enacted by Royal Decree No. M/26 of October 28, 2021 and took effect 180 days after publication. It applies to payment systems and their operators, and to payment services and their providers. It gives SAMA responsibility for regulating, supervising, and overseeing all of them. Articles 9 and 10 set a special regime for systems designated as systemically important, with rules on settlement finality, protection of netting arrangements, and default management.
The implementing regulations, published on June 13, 2023, set out the licensing regime. Article 6 lists 12 services that require a license. They include cash deposits and withdrawals on a payment account, merchant acquiring, payment aggregation, e-money issuance, and account information services. Applicants must provide SAMA with an irrevocable bank guarantee equal to the minimum capital required for their category.
| Category | Scope | Issuance fee |
|---|---|---|
| Major PI | Payment institution, higher activity thresholds | SAR 50,000 |
| Micro PI | Payment institution, limited activity | SAR 20,000 |
| Major EMI | E-money issuance, wallets, higher thresholds | SAR 50,000 |
| Micro EMI | E-money issuance, wallets, limited activity | SAR 20,000 |
| Payment Initiation Services Provider | Initiates payments on the customer's behalf | SAR 20,000 |
| Payment Account Information Services Provider | Aggregates payment account information | SAR 20,000 |
Open banking gives licensed third-party providers access to account data and payment initiation, with the customer's consent. SAMA published its framework in November 2022, and account information services went live in 2023. A September 2024 addition covers payment initiation, and third-party providers need a dedicated license. For a merchant, the immediate benefit is less about payment initiation than about account verification before payouts, which reduces payee errors on outgoing payments.
The acceptance market has well-established local players, including HyperPay, PayTabs, Geidea, and Moyasar, which run gateways and technical acquiring. Saudi National Bank, Al Rajhi Bank, Riyad Bank, and Alinma Bank are among the acquiring banks. Any market entry requires a contract with an acquirer licensed in the Kingdom, and these firms make up most of the market. How long it takes to open a merchant ID depends on the commercial registration and standard checks, and rarely on technology.
What breaks in production
The same problems come up at go-live in Saudi payment projects, one after another. They are rarely technical. They stem from assumptions carried over from other markets and never checked. The seven below are among the most costly.
- Assuming co-badged cards can be freely routed. Domestic transactions go over mada. An architecture designed to arbitrate between networks will not work in the Kingdom.
- Confusing SARIE with sarie. A cost estimate based on the wrong system gets the participants, limits, and timelines wrong. The mistake comes due at integration.
- Treating a 3-D Secure failure as an issuer decline. The two causes need opposite fixes, and lumping them together skews all management of the payment success rate.
- Discovering ZATCA after go-live. Invoice chaining must be ready before launch, not after the first broken counter.
- Ignoring the BNPL provider's holdback. Reconciliation must be built on two separate settlement sources from the very first month.
- Using a pricing model with a fixed fee. With the SAR 40 cap on mada, a fixed per-transaction fee makes no sense to a local merchant.
- Forgetting Arabic on tax documents. Invoices must include Arabic text, whatever market the site targets.
| Decision | When | Consequence of putting it off |
|---|---|---|
| Local acquirer and merchant ID | Before any technical integration | No mada acceptance possible; the project is limited to international cards |
| Tokenization strategy | At design stage, before the first token is created | Token vault locked in with the provider, costly migration |
| ZATCA Phase 2 compliance | Before the first invoice is issued | Hash chain has to be repaired invoice by invoice |
| Where installments sit in checkout | When designing the checkout flow | Lost conversions on a payment method now mainstream in the Kingdom |
| Payout rail: sarie or standard bank transfer | Before onboarding the first third-party seller | Unnecessary IBAN collection and avoidable delays on payouts that could have been instant |
SAMA's monthly statistics mostly circulate through the local business press, and the scope varies from one article to the next. An e-commerce figure quoted without saying how international cards were treated cannot be compared year over year. Paypedia's systems registry, each system's page on the SAMA website, and the online rulebook remain the reference points. Any figure taken from a press report should be cross-checked against one of these three sources.