Part 11 · Launch and operations
Who you buy fromمن تشتري منه
Six things every financial product in the Kingdom needs, and none of them can build. This is who sells each one.
5 minute read
The expensive part of a financial product is not the code.
The list you find out about late
Picture yourself building a wallet. The interface is yours, the database is yours, and you wrote the balance logic in a week. Then you reach the first screen and ask: who is this user?
You have no answer. You do not hold the civil register, and nothing you own tells you the ID number they typed is theirs. So you buy the answer.
Then you reach the withdrawal screen. Does this IBAN exist, and is its owner the same person who holds the account with you? No answer there either. So you buy a second one.
This happens five or six times in any financial product in the Kingdom. Each time, what you are missing turns out not to be a library, but access to something that is not yours.
A financial product is not a program standing on its own. It is a program suspended from other people's systems, and you pay for the suspension.
Three kinds of seller
These markets are not alike. Some have one seller, some have ten, and some admit only whoever the regulator has admitted.
The first kind is a single national supplier. and are not companies you picked from a shortlist. They are the only route to the national digital identity and to the civil register. There is no haggling on price, no comparison, and no backup provider for the day one goes down. What you can own is a plan for the outage, not a replacement.
The second kind is an open market. Anyone may sell an AML screening product, and no licence is needed to sell you one. Here you compare, you negotiate, and you switch after a year if the service turns bad.
The third kind is sold only by a licensee. Issuing an account is a banking activity. Reading your customer's account at another bank is licensed, and so is taking customers' money at all. The list is short, and writes it rather than the market.
That split has a very practical consequence. Your negotiating power changes with the kind, and so does your plan for the day it breaks. Buying from an open market means you have an alternative. Buying from a national supplier means your alternative is to stop.
A licence is not a yes or a no
Ask a company "are you licensed?" and the answer is yes almost every time. The useful question is: licensed for what?
licenses payment services in four categories. Two of them are the Micro Payment Institution and the Major Payment Institution, with two matching sizes for electronic money institutions. The category sets the limits on what a company may process and on what it may hold.
In March 2026 granted the Kingdom's first open banking licence to Lean, as a Major Payment Institution. The category that describes a wallet also describes a company reading account data. The classification follows the activity, not the brand.
So do not stop at "licensed by SAMA" on a vendor page. Ask for the category, then ask yourself whether that category covers what you intend to do with it.
Two routes to the same answer
One piece of information can be reached through two entirely different doors. Bank account verification is the clearest example.
The first door is a bank opening an interface onto its own record. The second is an open banking licensee reading your customer's account at any bank, once that customer has consented.
The difference is not technical. The bank answers about accounts it holds; the licensee answers about accounts across the market but needs explicit consent every time. The first is broader in permission and narrower in coverage, and the second is the reverse.
One question settles the choice: are all your customers at a single bank?
The IBAN that is not an account
One of these services is hard to understand from its name. A virtual IBAN is not a bank account at all. It is an address pointing at the account you already have.
Picture a platform collecting money for a thousand merchants into one account. A transfer arrives for thirty-seven thousand riyals. Who sent it? The name on the transfer may be the owner's rather than the shop's, it may arrive misspelled, and two merchants may send the same amount in the same minute.
So the rest of the day goes on matching by hand. Every mistake in that means a merchant who did not get their money, or who got somebody else's.
A virtual IBAN solves it by giving each merchant an address of their own that points at your single account. The transfer arrives already labelled with who sent it, before you ever look at it.
Notice what you bought there. Not the movement of money, but the end of guessing.
The provider follows your regulator
Compliance products are built for one regulator in particular. A screening product built for payment companies assumes is yours, and shapes its reports and its cycles around that assumption.
If you are a capital market institution, yours is the , and your obligations differ in form and in timing. Buying a product built for the other regulator means you will build the difference yourself, which is the difference you paid to avoid.
So the first question for any compliance vendor is not about accuracy and not about artificial intelligence. It is: who was this built for?
How not to believe a stale fact
This page will age too. Licences are granted and withdrawn, companies are acquired, and products are discontinued. Treat every name here as a starting point rather than a conclusion.
Open the provider's site and read what it publishes about itself. Go to the regulator's register rather than a news story about it. And ask any vendor selling you sanctions lists when those lists were last updated.
The list below is built on that rule. Every name points at a page its own owner or a regulator publishes, and each one is dated with the day it was read.
What you buy instead of build
These are examples a beginner meets often, not recommendations. Every service here has other providers.
Identity data verificationالتحقق من بيانات الهوية
You send a national ID or iqama number and get back the official record for it: name, date of birth, nationality.
Why you cannot build it: The record lives at the National Information Center. There is no copy of it you could hold, and no algorithm that derives it.
YakeenOne national supplier
Operated by Elm against National Information Center records, and named in the SAMA rulebook as a source for electronic ID verification.
Ask before you sign: Which fields does your licence category actually let you request, and what do you do with the ones you do not need?
Login with the national identityتسجيل الدخول بالهوية الوطنية
The user proves who they are in a government app, and your app is told the answer. You never see a password.
Why you cannot build it: It authenticates against the national digital identity. Nothing you could build reaches that.
NafathOne national supplier
The unified national single sign-on, run by the National Information Center under SDAIA.
Ask before you sign: What happens to a user who cannot complete it, and is that path as safe as the one you just replaced?
Bank account verificationالتحقق من الحساب البنكي
Confirming that an IBAN exists and that its owner is the person in front of you, before money leaves.
Why you cannot build it: The account is the bank's record, not yours. Two routes reach it: a bank exposes its own, or an open banking licensee reads it with the customer's consent.
Lean TechnologiesLicensed for this activity
Holds the first open banking licence issued by SAMA, granted in March 2026 as a Major Payment Institution.
anbLicensed bank
Publishes an account verification API that checks an account by national ID, IBAN and BIC.
Ask before you sign: What comes back when the name nearly matches, and who in your company decides what nearly means?
Virtual IBANالآيبان الافتراضي
Each of your customers gets an IBAN of their own. Anything transferred to it lands in your one real account, already labelled with who sent it.
Why you cannot build it: Issuing an account is a licensed banking activity. What you are really buying is an end to guessing which transfer belongs to which customer.
anbLicensed bank
Publishes a virtual IBAN management API: create one, suspend it, and read the statement behind it.
Ask before you sign: Whose name is on the underlying account, and what does the customer see when they look at where their money sits?
Sanctions and AML screeningفحص العقوبات ومراقبة غسل الأموال
Every new customer is checked against sanctions and politically exposed person lists, and their later behaviour is watched for what has to be reported.
Why you cannot build it: The lists change daily, and matching Arabic names against Latin ones is a hard problem of its own that you would be solving instead of your product.
FOCAL by MoznCommercial vendor
Riyadh-based, screening against global and local sanctions and PEP lists with name matching built for Arabic and Latin text.
DalCommercial vendor
Built for capital market institutions and their CMA obligations rather than for payment companies.
Ask before you sign: Which regulator does this product assume you answer to, and how many false alerts a day will your team be reading?
Accepting paymentsقبول المدفوعات
The gateway that takes a card or a wallet at your checkout and eventually settles the money to you.
Why you cannot build it: Holding other people's money on its way to somebody else is a licensed activity. SAMA licenses it in four sizes, and the size decides what a company may do.
MoyasarCheck its licence
A Saudi gateway covering mada, cards and wallets. Ask for its licence category rather than assuming it.
HyperPayCheck its licence
Operates across the region with local acquiring in the Kingdom. The register, not the website, settles what it is licensed for.
Ask before you sign: Which licence category does it hold, and does that category cover holding your money as well as moving it?
Every link above was opened and read on 2026-08-16.
New words here
- Virtual IBANالآيبان الافتراضي
- An address of its own for each customer that points at your one real account, so an incoming transfer arrives already labelled with who sent it.
- Major Payment Institutionمؤسسة مدفوعات كبيرة
- One of the categories SAMA licenses payment services under. The category, not the company, sets what may be processed and held.
- Politically exposed personشخص معرّض سياسياً
- Someone holding a prominent public position, whose accounts carry extra scrutiny. Screening products check every new customer against these lists.
The short version
- A financial product is suspended from systems you do not own, and you pay for the suspension
- Three kinds of market: one national supplier, an open market, or licensees only
- The kind decides your negotiating power and your plan for the day it breaks
- "Are you licensed?" is answered yes by everybody. Ask which category
- A compliance product is built for one regulator. Buying the wrong one means building the difference yourself
Check your understanding
Answer before reading the explanation. Getting one wrong here is worth more to you than a lucky guess.
Official sources
For checking the rules stated above yourself. The article is complete without them.
This is a learning guide built from field experience. It is not legal, regulatory or investment advice, and it does not replace qualified professional counsel. FinTech rules change quickly and vary by country, so check the primary source before you make a decision that matters.