Skip to content
Citizen Impact PortalCitizen Impact Portal

economy-investment

How Saudi finance got an app layer

In 2017, Saudi retail payments were roughly 70% cash. By 2024, cash had dropped to under 20%. mada became the backbone, STC Pay became the first Saudi fintech unicorn, Tabby and Tamara built BNPL into a category, and SAMA’s sandbox processed more than 100 firms through to licensing.

Editorial Team(Citizen Impact Portal)7 min read

Most Saudi citizens haven’t held physical cash for a routine purchase in months. The mada tap, the STC Pay QR scan, the BNPL checkout — these aren’t future features, they’re the default for a country that was overwhelmingly cash-based in 2017.

Financial-services transformations are usually slower than other kinds of modernization because the regulatory layer is the rate-limiting step. The Saudi experience between 2017 and 2025 is the exception. SAMA’s regulatory sandbox, launched 2018, has processed over 100 firms through to full licensing. The kingdom moved from cash-dominant retail payments to a majority-digital mix — and the institutional plumbing underneath is more interesting than the consumer-facing apps.

The pre-2017 baseline

Saudi retail finance in 2017 ran on three things: legacy bank branches, debit cards on the mada network, and a great deal of physical cash. The twelve commercial banks operated under SAMA supervision with a stable but conservative product set. E-commerce existed but was small; standalone payment apps were marginal; regulated buy-now-pay-later didn’t exist.

Cash dominated retail. The 2017 SAMA estimate put roughly 70% of person-to-merchant retail spend in physical cash. Cash on delivery was the default e-commerce payment method. This wasn’t a fringe pattern; it was the structure of a payments economy that hadn’t yet absorbed mobile-first design.

The regulatory pivot

Three SAMA policy moves did most of the structural work. First, the 2018 launch of the Regulatory Sandbox — a controlled environment for fintech firms to operate at limited scale while building toward full licensing; over 100 firms have passed through, with around 40+ achieving full operational licenses by 2025. Second, the 2021 licensing framework for digital banks, which enabled STC Pay, Vision Bank, and Saudi Digital Bank to operate as full banks without branch networks. Third, the 2024 Open Banking Framework, requiring banks to expose account and payment APIs to licensed third parties.

The Personal Data Protection Law provides the data-protection layer. It came into force in 2023 and is broadly aligned with GDPR principles. Open Banking implementation depends on its enforcement to make consumer-consent flows trustworthy; that enforcement is still maturing.

The four platforms citizens actually use

mada remains the universal backbone. Saudi Payments (a SAMA subsidiary) operates the national payment switch connecting every bank’s debit cards to every point-of-sale terminal and e-commerce gateway. The network extended to support Apple Pay (2019), Google Pay (2020), and contactless everywhere. The 99%+ Saudi debit-card penetration on mada means the network effects are essentially complete.

STC Pay is the largest digital wallet. Owned by Saudi Telecom Company, it crossed unicorn valuation in late 2020 — the first Saudi fintech to do so. Operating as a fully-licensed digital bank since 2021, it has over 14 million users by 2024 and is the dominant peer-to-peer transfer mechanism in the kingdom.

Tabby and Tamara built the BNPL category essentially from zero. Tabby reached a $3.3B valuation in 2024; Tamara crossed $1B in 2023. Both operate under SAMA’s BNPL licensing framework introduced in 2023 — one of the first formal BNPL regulatory frameworks in the region. Together they handle the substantial majority of installment-purchase retail e-commerce in the kingdom.

Vision Bank, Saudi Digital Bank, and the digital subsidiaries of legacy banks round out the picture — full banks operating without branch networks, building product-by-product against the legacy commercial banks. Their share is small but their effect on legacy-bank product pricing has been disproportionate.

The number that mattered wasn’t the fintech valuations or the digital-bank licenses. It was the SAMA sandbox processing over 100 firms in seven years. That institutional throughput is what restructured the sector underneath the apps.

What this means for citizens

Three things, concretely. First, payment friction. A citizen in 2017 routinely carried cash and waited 1–3 business days for inter-bank transfers. In 2025, the same citizen taps a phone at a coffee shop, sends instant payment to family across the country through STC Pay, and receives near-instant credits through the SARIE network.

Second, credit access. The BNPL category — structured to be Sharia-compatible — has opened consumer credit to demographic segments (young workers, women with independent accounts, lower-income households) who didn’t previously have it. The consumer-protection regime is still maturing, but the access shift is real.

Third, financial inclusion. Saudi women, who gained independent bank-account access at scale only between 2019 and 2022, now have full digital-banking access on the same terms as men. The compound effect with the labor-force-participation gain is one of the visible feedback loops: formal employment requires a bank account, and a bank account makes formal employment more useful.

The capital architecture flows through here: PIF-backed funds channel capital into fintech, which scales into the SAMA-regulated framework, which produces the citizen-facing apps.

Metrics referenced

Continue reading