Payment Gateways in Saudi Arabia and the Gulf: What the Rules Decide Before You Pick a Provider

Comparing payment gateways in Saudi Arabia does not start with a price list. It starts with two constraints that come before the choice: a store selling inside the Kingdom has to route local card payments through the mada network, and whoever signs the merchant agreement and settles money into your bank account has to hold a licence from the Saudi Central Bank. By the time you reach price, you will find that most providers do not publish one.

This guide is for an owner selling in Saudi Arabia or across several Gulf markets, and for the developer who will write the integration. Every figure and rule below comes from a regulator's page or a provider's own documentation, checked in September 2026. If Egypt is your main market instead, the stack differs all the way down, from the regulator to the payment methods people actually use, and we covered it separately in our guide to payment gateways in Egypt.

mada is not a local Visa card

mada is a national payments network owned by the Saudi Central Bank since 1990. It connects point-of-sale terminals, ATMs and e-commerce sites to a central switch that routes each transaction to the issuing bank. That is not marketing detail. SAMA Circular 391000075005, still in force, states that purchases at electronic stores inside the Kingdom must be processed through the mada system, in line with its commercial requirements and technical specifications, after testing and approval from the mada Authorization Centre. Purchases at stores outside the Kingdom go through the international schemes instead.

What that forces on your build:

• Running mada inside Saudi Arabia requires a merchant ID from a Saudi acquiring bank, a prerequisite Checkout.com's mada documentation states before any code.
• The same documentation says mada transactions must be captured in full, and that mada cards support neither partial captures nor authorization requests. Send an authorization or a partial capture and the acquirer captures anyway; the gateway then voids after seven days, and because mada does not support voids the acquirer turns it into a refund. There is a live disagreement here worth settling in writing: both Tap and HyperPay now market pre-authorization on mada. Ask for the documentation rather than trusting a product page.
• The bank identification numbers (BINs) that mark a card as mada change often. Checkout.com's published list was last updated on 2 September 2026. If your routing logic or your checkout badges depend on that list, it is recurring maintenance, not one-time setup.
• The same card can reach you with `scheme` set to MADA and `brand` set to VISA, as the sample payload in Tap's webhook documentation shows. Code that reads `brand` alone will book a mada debit payment as a Visa credit payment, and the gap will show up in your fee reconciliation at month end.

What a Saudi customer expects to see at checkout

A mada card can be loaded into Apple Pay, Samsung Wallet, Google Wallet or mada Pay, and the central bank describes all of them as using tokenization so the card number is never held on the device. In practice, the Apple Pay button in a Saudi store usually sits on top of a mada debit card rather than a credit card.

One detail teams forget: if you process from outside Saudi Arabia, Checkout.com's documentation tells you to remove `mada` from the `supportedNetworks` array and set `countryCode` to any code other than SA. Leave it as is and Apple forces the mada rail onto a transaction that will not be accepted.

"STC Pay" is also no longer the right name. Saudi Digital Payments Company announced its transformation into STC Bank, now licensed by the Saudi Central Bank to conduct digital banking, and it appears in the banks register under Digital Banks rather than in the payments register. Old wallets stayed active for only ten days after the transition message. If your team is writing checkout copy, the label and the logo both need a review.

SADAD is not a checkout button either. SAMA's SADAD page describes it as the national bill presentment and payment system launched in 2004, connecting billers with banking and non-banking entities through bank channels and licensed wallets. You join it as an invoice issuer through a bank or a SADAD intermediary, which suits recurring fees and subscriptions rather than an ordinary shopping cart. Together with mada and SARIE, SADAD is one of the three systems SAMA designates as systemically important.

How to check the licence yourself

SAMA's licensed entities register is public and takes a minute. On 21 September 2026 it listed 33 payment companies. Each row carries the company name, the activity type, the unified number, the licence expiry date and a link to the company website. There are three activity types: Payment Institution (PI), Electronic Money Institution (EMI) and E-commerce Payment Services.

Among the familiar names, Moyasar Financial is listed as a Payment Institution with a licence running to 13/01/2030, Tap Financial as a Payment Institution to 04/09/2029, Network International Arabia as a Payment Institution to 16/01/2029, and HyperPay as an Electronic Money Institution to 29/12/2029.

The step most readers skip is that there is more than one register. Digital banks sit in the banks register, which is where STC bank appears. Buy-now-pay-later is its own activity inside the finance companies register. A company missing from the payments register may be in another one, or may not need to be registered at all.

That last point is the one to understand before signing. SAMA's circular on technical support providers in e-commerce payments separates two kinds of company. A firm offering linkage and technical support only does not currently need a SAMA licence, but must hold the technical permits issued by Saudi Payments. A firm that goes further, by contracting with merchants directly, registering them and running KYC and anti-money-laundering checks, or by closing out settlement and paying the money into the merchant's own account, is doing licensed work. The same circular tells banks to deal only with licensed payment companies and to notify SAMA as soon as they find an unlicensed one providing payment services.

Two questions settle it: who runs KYC on me, and which entity's settlement reaches my bank account? If the answer to both is the company in front of you, its name belongs in the register.

Fees: what the rules set, and what nobody publishes

The same in-force circular carries the approved pricing model for mada transactions in the e-commerce environment, in three layers.

The last line is the one that hits your margin. The circular makes 1.75% a regulatory ceiling rather than a going rate, and calls the percentage negotiable between the acquirer and the merchant. Any quote you receive should sit below it, and anyone calling the rate "fixed" is choosing not to negotiate.

There is also a later circular on the unified pricing model for POS and e-commerce services, in force and dated 13/6/2022, but the public page follows up on compliance without publishing the rate table. So do not build a financial model on a percentage copied from a blog. Ask for the fee schedule in writing as part of the quote.

As for the providers, most of them publish nothing:

Unpublished pricing is not a red flag by itself, because rates in this industry follow volume, sector and risk profile. It does mean the real comparison starts with three written quotes rather than a table found online.

If you sell in more than one Gulf market

"One integration for the Gulf" is true at the API level and misleading at the operational level. Each market has its own national network, its own currency and its own bank account.

The UAE launched Jaywan, its first national card scheme, run by Al Etihad Payments, a subsidiary of the central bank. It was inaugurated on 20 July 2026, with card issuance beginning across banks, licensed financial institutions and exchange houses. Alongside it sits Aani, the instant transfer platform that moves up to AED 50,000 around the clock. Qatar has Himyan, a national card whose brand is owned by Qatar Central Bank, with local transactions carried on the NAPS network and online acceptance through the QPAY portal.

The constraint that surprises engineering teams is the currency. According to the ISO 4217 list maintained by SIX, in the edition published on 17 September 2026, the Kuwaiti dinar, the Bahraini dinar, the Omani rial and the Jordanian dinar all carry three decimal places, while the Saudi riyal, the UAE dirham and the Qatari riyal carry two. This is not an accounting footnote. Tap's documentation requires the amount to be formatted to its currency's exact number of decimals when you verify a webhook signature (3.000 for a Kuwaiti dinar against 2.00 for a riyal); get it wrong and your server rejects a valid payment because the hash will not match. Store amounts as integers in the minor unit and read the number of decimals from a currency table instead of assuming two everywhere.

Settlement deserves a direct question too. Moyasar, for example, accepts the dirham, the Bahraini and Kuwaiti dinar, the Qatari riyal and the dollar alongside the riyal, but settles everything in Saudi riyals at a fixed rate it sets, which includes a foreign exchange margin. Its documentation also warns that when a refund settles, the exchange rate may not be the one that was used when the original payment settled. The service is limited to Saudi Arabia, and requires a Saudi commercial registration or freelance licence with a Saudi bank account linked to it.

The technical clauses that belong in the scope

Put these in the scope before work starts, because adding them after launch means a full retest with the acquiring bank.

1. Run 3-D Secure on every card transaction, not only on high-value ones. SAMA describes mada's e-commerce service as working over that protocol, and most cards in this market are debit cards anyway. The standard itself, EMV 3-D Secure, is managed and versioned by EMVCo.
2. Keep a token with the provider for repeat payments and subscriptions, and never let a card number reach your own servers on any path.
3. Treat the webhook as the source of truth, not the browser returning to a success page. Tap's documentation notes that a failed delivery is retried twice before the POST is marked ERROR, that nothing is sent for transactions in INITIATED or ABANDONED state, and that delivery fails to a localhost address or to a server with an untrusted SSL certificate. So expose a public endpoint with a valid certificate, verify the signature, and make handling idempotent, because the message can arrive twice.
4. Treat refunds as a complete path rather than an edge case. Because mada requires full capture, cancelling an order means a refund rather than a released authorization, which needs a button in the dashboard, an audit trail and a link back to stock. Moyasar publishes clear windows: 24 hours to 3 business days for mada cards, 7 to 14 business days for credit cards, weekends excluded. Put the expected window on your refund policy page before a customer has to ask.
5. Store the provider's transaction reference and the acquirer reference against every order, so you can reconcile the settlement statement line by line. Without that you will notice a fee discrepancy three months later with no way to prove it.
6. Test on a real mada card. A sandbox will not expose routing problems or a specific issuer declining you, so make the launch plan include one small live transaction on every payment method, followed by a refund.

One last clause sits outside the payment gateway but inside the same project: the invoice. Every sale in a Saudi store has a tax document behind it, and the integration phase with the Zakat, Tax and Customs Authority makes issuing and sharing that invoice part of the same flow the payment closes, rather than an accounting task left to month end. What actually changes inside the system is in our guide to phase two of e-invoicing.

On the customer's side, SAMA's circular on mada claim fees obliges banks to refund incorrect or incomplete transactions, e-commerce among them, within two working days of the transaction. It helps if your support team knows that window before promising a customer something different.

Six questions to send before you sign

Ask for the answers in writing rather than on a call.

1. What is your name in SAMA's licensed entities register, what activity type, and when does the licence expire? If you are a technical linkage provider, which licensed entity holds the merchant agreement and the settlement?
2. What is the merchant service charge on mada, on credit cards and on wallets, itemised, per currency?
3. How many days from transaction to money in the account, and does that window change after a refund or a dispute?
4. Do you support pre-authorization on mada, and where is that stated in your documentation?
5. Which currencies do you accept, which currency do you settle in, and what foreign exchange margin applies?
6. Where is the webhook documentation and the signature verification method, and is there an open sandbox before we sign?

A provider who answers all six clearly has earned the comparison. One who stalls on the first question has not earned the second.

At Snaabble we build stores and order systems with the payment integration inside the same project, and we walk this list before the first line of code. If a store or an order system in Saudi Arabia or the wider Gulf is on your desk, put the idea in front of the Snaabble team: within one working day you get a first view of the scope and an estimate of duration and cost, at no charge and with nothing to commit to.

Frequently asked questions

Can a store outside Saudi Arabia accept mada cards?

Yes. A mada card is co-badged with Visa or Mastercard, and Checkout.com's documentation notes that it behaves as a debit card when processed outside the Kingdom, with no special configuration. Routing inside the Kingdom is different: running mada locally requires a merchant ID from a Saudi acquiring bank, and the transaction itself travels over the mada network.

What is the difference between a payment institution and an electronic money institution in SAMA's register?

They are two of SAMA's licence types for payment service providers. The rulebook lists four in total: micro and major payment institutions, and micro and major electronic money institutions for wallets. What matters to a merchant is not the label but that the entity signing your agreement and settling your funds actually appears in the register with a licence that has not expired.

Do I need a Saudi commercial registration to open an account with a Saudi provider?

It depends on the provider, but the requirement is common. Moyasar's FAQ, for example, asks for a valid Saudi commercial registration or a freelance licence plus a Saudi bank account linked to it, and says approval usually takes two to five business days. Ask for the document list before you fix a launch date.

Sources

• Saudi Central Bank: mada
• Saudi Central Bank: SADAD
• Saudi Central Bank: licensed entities register, payments
• Circular on using mada cards for internet purchases, with the approved pricing model
• SAMA circular: technical support providers in e-commerce payments
• The unified pricing model for POS and e-commerce services
• Systemically important payment systems and charging fees on mada claims
• Checkout.com documentation on mada and Tap's webhook documentation
• Moyasar FAQ and Moyasar multi-currency guide
• Notice of transformation from stc pay to STC Bank
• Al Etihad Payments: Jaywan and Aani and Qatar News Agency on the Himyan launch
• SIX: financial data standards and the ISO 4217 list and EMVCo on EMV 3-D Secure
• Telr pricing, Checkout.com pricing, Amazon Payment Services pricing, HyperPay, Tap in Saudi Arabia