Regulatory Legal Framework: SAMA Payment Services Regulations
The operation and integration of electronic payment gateways in Saudi Arabia are strictly governed by the Payment Services Law (نظام خدمات المدفوعات ومقدميها - Royal Decree No. M/26) and SAMA's Payment Service Provider (PSP) Regulations:
Statutory Pillars of Saudi Payment Gateway Compliance
Mandatory protections enforced by MHRSD & Saudi Labor Law
The regulatory architecture linking the customer checkout to your business bank account functions as follows:
┌────────────────────────────────────────────────────────────────────────┐
│ SAUDI ONLINE PAYMENT GATEWAY PROCESSING PIPELINE │
└────────────────────────────────────────────────────────────────────────┘
Customer Selects Mada / Apple Pay / Visa on Storefront (Salla/Shopify)
│
▼
3D Secure 2.0 OTP Authentication (SAMA / Mada Network Authorization)
│
▼
Licensed SAMA Gateway Aggregator (Moyasar / PayTabs / Tap Payments)
│
┌──────────────────────┴──────────────────────┐
▼ ▼
Transaction Approved Risk Engine Screening
(Tokenized PCI-DSS Vault) (Fraud & Chargeback Check)
│ │
└──────────────────────┬──────────────────────┘
▼
SARIE Interbank Automated Batch Settlement (T+1 to T+3 Days)
│
▼
Verified Commercial Bank Account (Freelance IBAN or Corporate CR IBAN)The Big Three Gateways Compared: Moyasar vs. PayTabs vs. Tap
Choosing the optimal payment gateway depends on your e-commerce platform, technical capabilities, and legal business structure:
| Evaluation Metric | Moyasar (ميسر) | PayTabs (بي تابس) | Tap Payments (تاب بيمنتس) |
|---|---|---|---|
| Headquarters & SAMA Status | Riyadh, KSA (SAMA Licensed) | Al-Khobar, KSA (SAMA Licensed) | GCC / Riyadh (SAMA Authorized) |
| Freelance Certificate Acceptance | Full Support (Wathiqat Amal Hurr) | Full Support (Wathiqat Amal Hurr) | Full Support (Wathiqat Amal Hurr) |
| Commercial Registration (CR) | Fully Supported | Fully Supported | Fully Supported |
| Setup & Integration Fees | SAR 0 (Free Setup) | SAR 0 (Free Setup) | SAR 0 (Free Setup) |
| Monthly Maintenance Fees | None | None | None |
| Mada Transaction Fee | 1.0% + SAR 1.00 | 1.0% + SAR 1.00 | 1.0% + SAR 1.00 |
| Visa / Mastercard Fee | 2.2% + SAR 1.00 | 2.4% + SAR 1.00 | 2.5% + SAR 1.00 |
| Apple Pay Support | Native Web & In-App (No fee markup) | Native Web & In-App | Native Web & In-App |
| STC Pay Integration | Direct Integration (1.7%) | Direct Integration (1.5%) | Direct Integration (1.75%) |
| Settlement Frequency | Daily / Weekly (SARIE Transfer) | Daily / Weekly (SARIE Transfer) | Weekly / Bi-Weekly |
| Best E-Commerce Platforms | Salla, Zid, WooCommerce, Custom API | Shopify, Magento, OpenCart, Custom | WooCommerce, Custom Web/Mobile Apps |
Merchant Document Checklist: Freelancers vs. CR Entities
Before submitting your merchant application on any gateway portal, ensure you have compiled the mandatory statutory documentation:
1. Requirements for Freelancers (وثيقة العمل الحر)
Under SAMA circulars, individual Saudi sellers must provide:
Freelancer Gateway Application Dossier:
1. Valid Saudi National ID (هوية وطنية) of the certificate holder.
2. Active Freelance Certificate (Wathiqat Amal Hurr) issued via freelance.sa with a scannable QR verification code.
3. Official Commercial Bank Account Letter / IBAN Certificate:
* Must be issued under a dedicated Freelance Business Account (Al Rajhi, SNB, Riyad Bank).
* Personal checking accounts are rejected automatically.
4. Active E-Storefront URL:
* The store must be live and accessible (not password-locked).
5. Verified Saudi Business Center (SBC) / Maroof Link:
* URL proving the store is authenticated in the official registry.
2. Requirements for Commercial Companies (سجل تجاري)
For Sole Proprietorships (مؤسسة) and Limited Liability Companies (LLC / شركة):
Corporate Gateway Application Dossier:
1. Valid Commercial Registration (CR) containing e-commerce retail activity codes.
2. Active Chamber of Commerce Membership Certificate.
3. Unified National Number (700 Number).
4. Official Corporate Bank Account Certificate:
* Must be opened under the exact commercial establishment name.
5. ZATCA VAT Registration Certificate (or formal declaration of non-exceedance if annual revenue is below SAR 375,000).
6. National Address Certificate (SPL) for the registered business premises.
7. Authorized Signatory National ID and Power of Attorney (if managing on behalf of partners).
Mandatory Website Compliance Checklist
Payment gateway underwriting teams will physically audit your website before activating live processing keys. If your storefront lacks the following elements, your application will be immediately rejected:
┌────────────────────────────────────────────────────────────────────────┐
│ PAYMENT GATEWAY STOREFRONT COMPLIANCE CHECKLIST │
└────────────────────────────────────────────────────────────────────────┘
[ ] 1. Valid SSL Certificate (HTTPS)
Your domain must display an active SSL padlock (256-bit encryption).
[ ] 2. Live Products with Clear Pricing in Saudi Riyals (SAR)
Storefront must display at least 3 to 5 active, purchasable items.
"Test products", placeholder text, or "Lorem Ipsum" descriptions
trigger automatic compliance rejection.
[ ] 3. Statutory 7-Day Return & Refund Policy (سياسة الاسترجاع)
Must explicitly state consumer rights under Saudi E-Commerce Law:
customers can return defective/undamaged goods within 7 calendar days
(outlining sanitary and custom-made exceptions).
[ ] 4. Privacy & Data Protection Policy (سياسة الخصوصية)
Discloses how customer payment information, addresses, and mobile
numbers are secured under the Saudi Personal Data Protection Law (PDPL).
[ ] 5. Terms and Conditions of Sale (الشروط والأحكام)
Governs shipping timelines, delivery costs, and warranty terms.
[ ] 6. Transparent Merchant Contact Details in Website Footer
Must display: Verified Saudi customer care phone number, official
support email, physical/National Address, and SBC/Maroof badge link.
[ ] 7. Prohibited Merchandise Absence
Zero presence of restricted items: tobacco, e-cigarettes, unregistered
cosmetics, pharmaceuticals, counterfeit replicas, or adult goods.Step-by-Step Guide: Connecting Moyasar to Salla, Zid & Custom Stores
Moyasar is the most widely adopted independent gateway in the Kingdom due to its native SAMA infrastructure and rapid onboarding:
Step 1: Create a Moyasar Merchant Account
- Navigate to https://moyasar.com and click "Sign Up" (تسجيل حساب جديد).
- Enter your business email, secure password, and verified Saudi mobile number.
- Verify your email address via the confirmation link.
Step 2: Submit Underwriting KYC / KYB Information
- Log in to the Moyasar Dashboard.
- Select your Entity Type: "Freelancer" (ممارس حر / وثيقة عمل حر) or "Company / Establishment" (شركة / مؤسسة).
- Upload your PDF documents:
* Freelancers: National ID, Wathiqat Amal Hurr PDF, Freelance IBAN Certificate, SBC link.
* Companies: CR PDF, Chamber certificate, Corporate IBAN Certificate, 700 Number.
- Enter your live website URL and primary product category.
Step 3: Gateway Underwriting Review
- Moyasar's compliance team conducts an automated cross-check against MHRSD and SAMA databases.
- Storefront content is audited for consumer protection policies.
- Underwriting approval is typically issued within 24 to 48 business hours.
Step 4: Retrieve API Keys (Publishable & Secret Keys)
- Once approved, navigate to the "Settings" -> "API Keys" section in the Moyasar dashboard.
- You will receive two sets of credentials:
* Test Keys (for sandbox testing).
* Live Production Keys: Publishable Key (pk_live_...) and Secret Key (sk_live_...).
Step 5: Platform Integration
- On Salla: Navigate to App Store -> Moyasar -> Install App. Paste your Live Publishable and Secret Keys.
- On Zid: Navigate to Settings -> Payment Gateways -> Moyasar. Input API keys and activate Mada/Apple Pay.
- On WooCommerce / Shopify: Install the official Moyasar Payment Gateway plugin from the repository. Enter API keys and configure webhooks.
Step 6: Execute a SAR 1.00 Live Test Transaction
- Place a real order on your storefront using a personal Mada card.
- Confirm that the 3D Secure OTP screen renders smoothly.
- Verify that the transaction reflects as "Paid" in your Moyasar dashboard.
- Issue an instant refund of SAR 1.00 through the dashboard to confirm settlement reversal pathways.
Step-by-Step Guide: Connecting PayTabs
For merchants utilizing PayTabs, the integration follows an enterprise-level compliance pipeline:
Step 1: Portal Registration
- Access https://www.paytabs.com/en-sa/ and select "Merchant Registration".
- Choose your operating market: "Saudi Arabia (SAR)".
Step 2: KYB Document Submission
- Submit your commercial profile, authorized signatory details, and tax status.
- Upload your Bank Account Confirmation Letter (must clearly display bank stamp and IBAN).
- Enter your verified Maroof / SBC e-store authentication number.
Step 3: Risk Assessment & Gateway Configuration
- PayTabs assigns a dedicated merchant account manager.
- Choose your payment method package: Mada, Apple Pay, Visa, Mastercard, STC Pay, and international currency acceptance.
- Approval is finalized within 1 to 3 business days, generating your "Profile ID" and "Server Key".
Step 4: Storefront Plugin Setup
- In your e-commerce backend (Shopify / Magento / WooCommerce), install the PayTabs plugin.
- Enter your Profile ID, Region (SAU), and Server Key.
- Configure instant payment notification (IPN) webhooks to handle automated order status updates upon successful card charges.
Native Platform Gateways: Salla Pay & Zid Pay vs. Third-Party Aggregators
Entrepreneurs building their stores on Salla or Zid frequently ask whether they should use the platform's native payment solution (Salla Pay / Zid Pay) or connect an independent third-party gateway (Moyasar / PayTabs / Tap):
┌────────────────────────────────────────────────────────────────────────┐
│ NATIVE PLATFORM GATEWAY VS. THIRD-PARTY AGGREGATOR │
└────────────────────────────────────────────────────────────────────────┘
[OPTION A: NATIVE (Salla Pay / Zid Pay)]
├── Built directly into platform subscription.
├── Zero manual API key setup; 1-click activation.
├── Unified dashboard for orders, refunds, and payouts.
├── Automated daily or weekly SARIE bank deposits.
└── Limitations: Tied strictly to the hosted platform; cannot migrate
checkout logic to independent custom mobile apps or Shopify.
[OPTION B: THIRD-PARTY (Moyasar / PayTabs / Tap)]
├── Independent merchant relationship with the fintech provider.
├── Full multi-platform flexibility (run Salla, Shopify, and mobile apps
under a single master acquiring account).
├── Direct negotiation of volume discount rates for GMV > SAR 100,000/mo.
├── Advanced developer webhooks, recurring subscriptions, and tokenization.
└── Limitations: Requires manual API plugin configuration and separate
gateway reconciliation dashboards.Critical Compliance Traps & Underwriting Rejection Pitfalls
Navigating payment gateway underwriting requires avoiding several hidden statutory pitfalls:
1. The Personal Bank Account Rejection Trap
2. Prohibited & Restricted Products (The Blacklist)
Gateways operating in Saudi Arabia are prohibited by law from processing payments for:
3. The Chargeback & "Rolling Reserve" Trap
Real-World Case Studies: Payment Gateway Onboarding
Case Study 1: The Shopify Merchant Mada Integration
1. The owner applied for an official Moyasar merchant account using their Commercial Registration and corporate Al Rajhi IBAN.
2. Submitted their verified Saudi Business Center (SBC) Golden Badge.
3. Installed the Moyasar Shopify integration app within 15 minutes.
Case Study 2: Overturning a PayTabs Rejection
* Fahad updated his website footer with an explicit, compliant policy explaining that digital goods are non-refundable once downloaded, but offering a full refund if file corruption or technical defects are proven within 7 days.
* Added his verified Saudi mobile support line and Saudi Business Center authentication badge.
* Requested a compliance re-review.
Case Study 3: The Expired Freelance Document Settlement Freeze
freelance.sa within 10 minutes (free of charge) and uploaded the renewed PDF to the gateway dashboard. Payouts were unlocked and transferred to their bank account within the next business banking settlement cycle.Frequently Asked Questions (FAQs)
Can I accept Mada payments without a Commercial Registration (CR)?
Yes. Under SAMA regulations, independent Saudi citizens who hold an active Freelance Certificate (*وثيقة العمل الحر*) and a dedicated Freelance Business Bank Account can legally accept Mada and Apple Pay payments through licensed gateways like Moyasar, PayTabs, Tap, and Salla Pay.
What is the typical payout settlement timeframe into my bank account?
Settlement timelines depend on your gateway agreement and risk profile:
Do payment gateways charge a monthly subscription fee?
No. Standard merchant accounts on Moyasar, PayTabs, and Tap operate on a pure pay-as-you-go transaction fee model (no setup fees, no monthly software maintenance charges). You only pay when a customer completes a successful purchase. However, if you use hosted platforms like Salla or Zid, you pay the platform's monthly tier subscription (e.g., Salla Plus or Pro) in addition to transaction interchange fees.
What happens if a customer disputes a transaction (Chargeback)?
Under SAMA payment rules, if a customer claims an unauthorized card charge or non-delivery of goods, their issuing bank submits an electronic Chargeback Dispute. The gateway notifies you via email and locks the disputed amount. You have 5 to 7 calendar days to upload evidence (proof of delivery with courier tracking number, customer signature, invoice, and delivery confirmation). If your documentation is valid, the dispute is won and the funds are released. If you fail to respond, the funds are refunded to the customer along with a standard chargeback penalty fee (typically SAR 50 to SAR 100).
Can I accept international currencies with Saudi payment gateways?
Yes. Gateways like PayTabs and Tap Payments support multi-currency payment processing across over 168 global currencies (USD, EUR, GBP, AED, KWD). International customers pay in their local currency, and the gateway automatically converts the funds into Saudi Riyals (SAR) at competitive foreign exchange rates for settlement into your Saudi commercial IBAN.
Conclusion & Action Checklist for Online Merchants
Integrating a licensed payment gateway is the definitive milestone that transforms your online store from a static digital catalog into an automated revenue-generating business. In Saudi Arabia's mobile-first economy, enabling frictionless Mada and Apple Pay checkout is the single most effective way to maximize conversion rates and scale your sales.
Your 5-Step Gateway Integration Action Plan:
Regulatory References
Was this compliance guide helpful?
Your feedback helps our legal editorial team maintain authoritative KSA guidance.
Advocate High Court (Punjab Bar Council) and ATT GCC VAT Certified Specialist. Author of comprehensive regulatory commentaries on Saudi corporate law, ZATCA e-invoicing protocols, and Labor Reform Initiatives.