Executive Summary
- Start with a genuine technology-supply structure, provided the Saudi financier has permission for the product and retains substantive credit responsibility. The Egyptian supplier should neither extend consumer credit nor receive instalments. Launch follows the required permissions and operational controls. Otherwise, postpone. (Saudi Finance Companies Control Law, arts. 4 and 10; SAMA Rules on Outsourcing for Finance Companies, paras. 6 and 15.)
- An Egyptian permission does not authorise Saudi lending. Naming a Saudi partner cannot cure a structure in which the Egyptian company contracts as creditor and conducts the financing. (Saudi Finance Companies Control Law, art. 4; Rules for Regulating Buy-Now-Pay-Later (BNPL) Companies, arts. 1–3.)
- Use the amended product limits. The ordinary BNPL ceiling is SAR10,000 outstanding per individual consumer, with no more than 12 instalments. The earlier administrative-fee allowance is suspended. (BNPL Rules, arts. 20 and 22; SAMA Circular 472038475, 24 December 2025.)
- Separate supplier access, funding and collection approvals. Material outsourcing requires SAMA's prior non-objection; group membership does not remove that requirement. Saudi consumer-data access from Egypt cannot be treated as routine technical support. (Outsourcing Rules, definitions and para. 15; Saudi Personal Data Protection Law, arts. 2 and 29.)
- An own Saudi BNPL company becomes sensible when the group wants credit control and can sustain the regulated business. Its ordinary minimum paid-up capital is SAR5 million, subject to SAMA's adjustment power. Settlement funding, losses and operating expenditure need separate provision. (Implementing Regulation of the Finance Companies Control Law, art. 8; BNPL Rules, arts. 5, 13 and 19.)
- Preserve the Egyptian business's permitted activities, confidential records and domestic credit controls. A Saudi project should not depend on diverting the regulated Egyptian company's resources or treating its licence as unrestricted authority to export financial services. (Egypt, Law 18/2020, as amended by Law 158/2022, arts. 3, 5, 8, 9 and 12; FRA Decision 56/2020, art. 2.)
The Saudi credit activity determines the permission
The group should choose its Saudi creditor before building the checkout integration. SAMA defines BNPL as financing purchases of goods or services without a term cost payable by the consumer. Article 3 prohibits that activity without SAMA's permission. The Finance Companies Control Law also prohibits unlicensed financing and holding out as a licensed financier. An interest-free product and an Egyptian licence do not displace those restrictions. (BNPL Rules, arts. 1–3; Finance Companies Control Law, art. 4.)
The proposed transaction has several separate steps: a resident selects instalments, receives approval, completes a purchase and repays the debt. Someone must fund the merchant before the consumer finishes paying. The allocation of those obligations determines which entity conducts the financing. The website's brand, server location and contractual label cannot replace that allocation. This is an application of the activity-based prohibition to the proposed transaction, rather than a separate statutory test. (Finance Companies Control Law, arts. 1 and 4.)
A merchant's own instalment sale presents a different statutory question. Article 4 preserves specified merchant credit for the merchant's own goods or services. That provision supplies no general exception for an independent Egyptian financier paying unrelated Saudi merchants. Nor should a generic finance-company licence be treated as permission for every BNPL product. The financier must hold the relevant activity permission and satisfy any required product non-objection. (Finance Companies Control Law, arts. 4(3) and 10; BNPL Rules, arts. 9(3) and 20(2).)
An own Saudi company would own the financing operation
Under the own-company proposal, a Saudi-incorporated, SAMA-licensed group entity would be the consumer's creditor. It would approve the credit under its own authorised policies, enter the finance contract and own the receivable. That entity would bear ordinary consumer default losses and fund its obligation to pay merchants. The merchant agreement would identify it as the settlement counterparty. An Egyptian group company could supply software under a separately permitted outsourcing arrangement. (BNPL Rules, arts. 13, 15, 19, 26 and 27.)
At checkout, the consumer would receive the Saudi company's terms and licensing disclosures. After acceptance, the Saudi company would settle the merchant, issue repayment notices and control refunds. It would also maintain credit-bureau records, handle complaints and oversee collections. A shared group brand would need to leave the Saudi creditor's identity intelligible throughout that process. (BNPL Rules, arts. 17, 19 and 23–27.)
The Saudi financier must conduct financing consistently with Islamic law, according to its Sharia committees' determinations. An interest-free label alone does not establish that the proposed contracts satisfy that requirement. The own-company plan must resource that review alongside its credit and control functions. (Finance Companies Control Law, art. 3; BNPL Rules, arts. 13–14.)
This route gives the group control over the Saudi credit business, but places the associated duties inside its Saudi entity. SAMA's inspection and final licensing decision follow the application and initial approval stages. Initial approval itself permits no lending. Commercial commitments therefore need conditions precedent tied to final permission and operational readiness, rather than a promised launch date. (BNPL Rules, arts. 7–9.)
A technology partner must remain a supplier
The preferred initial proposal places the financing with a SAMA-licensed Saudi BNPL company. That financier would contract with consumers, own their debts, bear ordinary default risk and fund merchant settlement. It would determine product terms, approve underwriting policy and retain authority over binding credit decisions. The Egyptian group would earn contractual technology-service fees. These allocations are recommended contractual conditions, not findings about an existing partner. (Finance Companies Control Law, arts. 4 and 10; Outsourcing Rules, para. 6.)
Another Saudi finance company is an alternative only where its activity and product permissions cover the offer. The BNPL-company requirements apply to companies licensed for BNPL activity. A bank partnership would require a separate assessment of the banking permissions and outsourcing rules. The proposed initial structure uses a licensed BNPL company to define the applicable duties. (BNPL Rules, arts. 2–3; Finance Companies Control Law, arts. 4 and 10.)
The same checkout could use Egyptian-developed software to collect an application and calculate a score within the financier's approved environment. The Saudi financier must be able to validate the model, change limits, stop approvals and audit decisions. Automated approval can implement its adopted policy; a human signature on every loan is not the proposed safeguard. A financier that merely accepts the supplier's decisions without effective control would fail the responsibility retained under the outsourcing rules. (BNPL Rules, arts. 13 and 19; Outsourcing Rules, paras. 6, 8 and 13.)
After approval, the financier would pay the merchant through its own settlement arrangements and receive instalments electronically into its controlled collection arrangements. The supplier would have no beneficial claim against the consumer and would handle no consumer funds. Refund instructions, reconciliation and failed-payment records would return to the financier. Consumer messages could use a contracted interface, but would identify the creditor and direct disputes to its accountable complaints function. (BNPL Rules, arts. 17, 22(3), 25–27; Outsourcing Rules, para. 6.)
The contract should give the supplier defined technical duties and compensation. An indemnity for a software defect differs from an undertaking to absorb every credit loss. Neither a guarantee nor funding alone automatically establishes consumer lending. Yet full first-loss protection, automatic receivable purchases and Egyptian control over pricing and approvals would require a fresh assessment of the financing actually conducted. The supplier-only recommendation excludes that combination; it cannot support a creditor that remains Egyptian in substance. (Finance Companies Control Law, arts. 1 and 4; BNPL Rules, art. 22(5); Outsourcing Rules, para. 6.)
A platform that matches consumers with financiers and displays financing options for remuneration raises another permission issue. SAMA's revised finance-support rules define digital brokerage separately. A software contract does not by itself authorise that consumer-facing activity. The proposed initial supplier should therefore serve the named financier's product without operating an independent credit marketplace. (Rules of Licensing Finance Support Activities, SAMA Circular 472038005, 22 December 2025, arts. 1–4; Finance Companies Control Law, art. 10(2).)
Postponement prevents an unauthorised live product
Postponement is the correct operational choice when neither a genuine authorised partner nor a ready Saudi entity can provide the credit. Under this proposal, Saudi merchants would not display the group's live instalment offer. The group would issue no credit approvals, pay no merchants against Saudi consumer debts and collect no instalments. Contract design and testing with synthetic records can continue without putting the proposed financing into operation. (Finance Companies Control Law, art. 4; BNPL Rules, art. 3(2).)
The commercial cost is deferred merchant revenue and delayed observation of Saudi repayment performance. Those disadvantages do not establish an exception to the licensing prohibition. A nominal partner arrangement should not be used to obtain the same lending outcome during the delay. The launch decision changes only when one of the authorised structures can perform the complete transaction. (Finance Companies Control Law, art. 4; Outsourcing Rules, para. 6.)
The product must satisfy the amended SAMA BNPL rules
The ordinary outstanding-finance ceiling is now SAR10,000 for each natural-person consumer. SAMA raised it through Circular 472038475 of 24 December 2025 and retains power to adjust it. Article 22 also limits the number of instalments to 12. The checkout must check the company's outstanding exposure to that consumer before another purchase; SAR10,000 is not merely a per-order limit. Twelve instalments should not be restated as a universal 12-month tenor. (BNPL Rules, art. 22(1)–(2); Circular 472038475.)
Consumers must satisfy the rules' age and residency conditions. The age threshold is 18 Hijri years. Financing non-resident foreign consumers or purchasing goods or services in another currency requires SAMA's prior non-objection. The proposed initial product should remain Saudi-riyal financing for qualifying Saudi residents. (BNPL Rules, art. 20(3)–(5).)
The financier must assess creditworthiness and repayment capacity using a documented method. It must verify identity independently, check credit records with consent and report updated credit information. The exemption for total BNPL financing not exceeding SAR2,000 concerns specified responsible-lending deduction ratios only. It does not dispense with affordability assessment, identification or the remaining responsible-lending requirements. An Egyptian approval history therefore cannot substitute for the Saudi financier's decision process. (BNPL Rules, arts. 19 and 21; SAMA Circular 450360390000, 17 December 2023.)
Article 20 prohibits consumer fees, subject to its limited exception for lawful delay penalties and collection costs. SAMA's current text records suspension of the former administrative-fee allowance. The merchant must not pass the financier's charges to the consumer, and the financier must monitor that prohibition. The commercial model should fund the service through agreed merchant-side pricing without adding a consumer charge under another name. (BNPL Rules, arts. 19(7) and 20(1), including the suspension note dated 14/02/1446H.)
Before any dealings, the consumer contract must identify the parties and explain the financed purchase, instalments and duration. It must also address late payment, cancellation, refunds, early payment, default handling, credit reporting and disputes. The merchant contract needs corresponding rights, pricing, withdrawal provisions and complaint escalation. For this proposal, it should specify settlement timing, refund reconciliation and which party funds an unwound transaction. Those operational clauses implement the contractual duties; Article 27 does not prescribe a universal merchant-payment timetable. (BNPL Rules, arts. 26–27.)
The current implementing regulation exempts BNPL companies from its Articles 82–86 and 88. Those exemptions do not remove the BNPL contract requirements in Articles 26–27. A standard personal-finance fee or disclosure template therefore needs an activity-specific review before use. (Implementing Regulation, art. 93; BNPL Rules, arts. 20 and 26–27.)
Capital and merchant funding require separate decisions
An own BNPL-only company ordinarily requires SAR5 million fully paid-up capital. SAMA may raise or lower that amount. The current implementing regulation distinguishes BNPL-only companies from entities with several financing activities; the highest applicable activity minimum governs the latter. The statutory default company form is a joint-stock company, although SAMA may approve another form where the activity or business model justifies it. The group should seek an accepted Saudi incorporation structure rather than assume that any foreign branch or legal form qualifies. (Implementing Regulation, art. 8; Finance Companies Control Law, art. 5(1)(5), as amended by Royal Decree M/272.)
Capital is not a promise of sufficient liquidity. The group must separately budget merchant settlement, operating expenses, refunds and expected losses. The ordinary aggregate financing ceiling for a BNPL-only company is 20 times paid-up capital and reserves, with SAMA non-objection required to exceed it. That ceiling limits the book; it does not provide cash or permit the company to finance every applicant. (Implementing Regulation, art. 58(1)(c) and (3); BNPL Rules, arts. 19(8) and 22(4).)
Funding from the Egyptian parent is not an automatic substitute for local financing. Article 22 requires prior SAMA non-objection for financial facilities obtained from unlicensed financiers. The current implementing regulation separately requires prior non-objection for foreign funding or funding in a foreign currency. A proposed shareholder loan can engage several conditions at once. The initial supplier proposal should use funding arranged by the Saudi financier, without Egyptian financing or a group credit guarantee. (BNPL Rules, art. 22(5); Implementing Regulation, art. 72.)
Outsourcing and data access need their own approvals
A genuine supplier structure still involves regulated outsourcing. SAMA treats arrangements involving consumer-data processing, storage, sharing or transfer as material. Intragroup arrangements are covered. For a new material outsourcing contract, the financier must request SAMA's written non-objection at least 30 working days before its proposed commencement. Renewal and material changes need a separate review under paragraph 15. That submission period is not a regulatory approval promise. (Outsourcing Rules, definitions and para. 15; BNPL Rules, art. 15.)
The agreement must support regulator and auditor access, confidentiality, service standards, continuity and exit. The financier needs practical rights to recover records and replace the provider. It must retain consumer files for at least ten years after the relationship ends. The agreement must prohibit subcontracting of material functions. The financier should contract separately with any necessary host rather than presume that the supplier may subcontract those functions. The group should not sign an arrangement that leaves SAMA dependent on an Egyptian affiliate's voluntary cooperation. (Outsourcing Rules, paras. 8, 11, 13 and 18; BNPL Rules, art. 13(2).)
For the initial structure, deploy the credit system in Saudi Arabia under the financier's control. Keep identifiable consumer records and operational support access within that approved arrangement. Exclude Egyptian access to live records and cross-market model training from the initial supplier scope. These are proposed risk-reducing limits; local hosting alone does not prove compliance with all processing duties. Third-party disclosure also requires SAMA's prior written non-objection and compliance with applicable law. Saudi personal-data law covers relevant processing abroad as well as processing within the Kingdom. (BNPL Rules, art. 29(3); Saudi Personal Data Protection Law, arts. 2, 8 and 29.)
Public or hybrid cloud use adds SAMA's specific approval requirements. Its cyber controls require approval before cloud use or contracting, and explicit approval for hosting outside Saudi Arabia. Personal-data transfer requirements remain a separate legal question. A contractual processing clause or consumer consent should not be treated as a substitute for the applicable sectoral approval. (SAMA Cyber Security Framework, control 3.4.3(4)(a)–(b); Personal Data Protection Law, arts. 29–30.)
Collections and financial crime controls remain Saudi responsibilities
The financier must operate customer due diligence and comply with SAMA's anti-money-laundering and counter-terrorist-financing instructions. Phone verification and national-address checks form part of the BNPL onboarding controls. Merchant onboarding and the funding structure also need accountable financial-crime review. A supplier may provide tools, but the financier must retain the responsible function and records. (BNPL Rules, arts. 13–14 and 21; Outsourcing Rules, para. 6.)
The October 2026 sanctions-notification circular adds a current operational requirement. Financial institutions must register in the designated notification system and provide feedback immediately, and no later than 24 hours after receiving a notification. Daily and continuous screening duties remain. The launch checklist must cover this obligation alongside identity checks, rather than rely on a static screening list embedded in the Egyptian platform. (SAMA Circular 482028988, 1 October 2026.)
For repayment, BNPL companies must use electronic collection channels. SAMA's March 2025 collection rules require creditor identification in communications, protect consumer information and prohibit visits to a consumer's home or workplace. They also require the financier to pause arrears reminders while it handles an objection to the claimed amount. Refund disputes and collection workflows must therefore communicate with each other. (BNPL Rules, art. 22(3); Debt Collection Regulations and Procedures, arts. 4–6.)
SAMA abolished its separate licensing requirement for debt-collection activity in December 2025. Outsourcing collection by a finance company still requires prior non-objection under the current implementing regulation, which specifies a Saudi-established collection company. Selling the debt to that collector is prohibited. The initial structure should retain collection with the Saudi financier or use a qualifying Saudi contractor, rather than send collection calls to Egypt by default. (SAMA Circular 472039028, 28 December 2025; Implementing Regulation, art. 96.)
The Egyptian entity needs a distinct domestic compliance record
Egypt's operative consumer-finance statute is Law 18/2020, amended by Law 158/2022. It distinguishes a licensed consumer-finance company from a merchant or producer providing finance for its own business. Its consumer-finance definition uses a term determined by FRA, which cannot be less than six months. The group's description as BNPL therefore does not identify its precise Egyptian statutory category. Under the proposed structure, the Egyptian operating entity must satisfy the rules for the category it actually uses. (Law 18/2020, art. 1; FRA Decision 56/2020, arts. 2–4.)
A consumer-finance company must confine its business to that activity unless FRA authorises other non-bank financial activities. FRA's current Decision 56 repeats that restriction. The proposed supplier contract should sit with a group entity whose objects and permissions support the services, without presuming that the regulated Egyptian lender can perform every group function. (Law 18/2020, arts. 8–9; Decision 56/2020, art. 2, as amended by Decision 94/2023.)
The Egyptian operating company cannot accept deposits under the consumer-finance law. Its confidentiality duties and prudential obligations also continue while the group develops Saudi operations. A group funding plan should identify the actual investor or lender, the source of funds and the effect on the Egyptian regulated entity. Law 158/2022's provisions for registered paid-guarantee activity do not establish a general right for every consumer-finance company to guarantee Saudi receivables. (Law 18/2020, arts. 3, 5, 6 bis and 12, as amended.)
FRA's technology-outsourcing rules require covered Egyptian institutions to use registered providers for the covered services. Registered providers must notify FRA when they enter outsourcing contracts or make material amendments. Decision 279/2025 separately regulates providers of credit-risk assessment systems: Egyptian non-bank financiers must use registered external providers, notify FRA before contracting and obtain approval before using their own relevant systems. A shared group scoring service therefore needs a separate Egyptian compliance assessment even when the Saudi financier controls Saudi approvals. (FRA Decision 141/2023, as amended by Decision 68/2025, First and Fourth; Decision 279/2025, arts. 1 and 7.)
Domestic systems must also accommodate the September 2026 changes. FRA Decision 2863/2026 requires digital verification before financing or renewal; the behavioural-score requirement begins on 1 April 2027, conditional on the credit-bureau system being ready. Decision 2864/2026 requires linkage for real-time financing data, with implementing controls to follow its stated process. Those duties concern the covered Egyptian activity and do not, merely through common ownership, convert a Saudi partner's loan into Egyptian lending. (FRA Decisions 2863/2026, arts. 1–3, and 2864/2026, arts. 1–3.)
The Egyptian business must plan for the new unified solvency standards without treating future provisions as already operative. Decision 137/2025 provides for replacement of the earlier standards from 1 January 2027, with preparatory work and trial reporting beforehand. A Saudi investment decision should account for that transition. (FRA Decision 137/2025, arts. 1–3.) Licentium's Egypt licensing hub provides broader jurisdiction background.
Implementation should follow the allocation of credit responsibility
First, approve one transaction map identifying the consumer creditor, receivable owner, default-risk bearer, decision-maker, merchant settler, funder, collector and data operator. Draft the consumer terms and merchant settlement obligations against that map. The preferred starting allocation puts those financing obligations with the Saudi financier and limits the Egyptian supplier to documented technical services. An unresolved creditor or funding obligation prevents approval of the proposed launch structure. (BNPL Rules, arts. 13 and 26–27; Outsourcing Rules, para. 6.)
Next, establish the proposed counterparties' corporate authority and activity permissions. Complete the applicable product, outsourcing, data-disclosure, cloud and funding non-objections before their respective regulated commitments. Contracting and technical testing must preserve those conditions. The Saudi financier should approve underwriting, disclosures, merchant controls, refund handling, electronic collections and continuity before accepting the first live application. (BNPL Rules, arts. 19–22, 25–27 and 29(3); Outsourcing Rules, paras. 13 and 15; Cyber Security Framework, control 3.4.3.)
An own Saudi licence becomes the preferred next route when the group needs direct control of credit terms and receivable economics. Before applying, it should commit the required capital and additional funding, appoint eligible Saudi-resident management, and resource credit, compliance, cyber security, complaints and collections. Its business plan must justify those commitments after expected losses and merchant refunds. This commercial inference rests on the duties the Saudi entity would assume; no statutory revenue or merchant-count threshold makes an own licence sensible automatically. (BNPL Rules, arts. 4–6, 13–14 and 17–19; Implementing Regulation, art. 8.)
Until those conditions support either structure, postpone live origination. A later transfer from the partner to an own entity must address existing consumer rights and receivable-transfer requirements separately. Disposal of financing assets or related rights requires SAMA's prior written non-objection. Obtaining a new licence does not by itself move the partner's contracts, records or debts to the group. (Implementing Regulation, arts. 71 and 89; BNPL Rules, arts. 26–27 and 28(3).)