SAMA Regulatory Sandbox: The Cybersecurity and Cyber Resilience Requirements Fintechs Must Meet
To enter and graduate from the SAMA Regulatory Sandbox, a fintech must meet the Cyber Resilience Fundamental Requirements (CRFR), a SAMA baseline issued in January 2022 for entities joining the sandbox or seeking a licence. On top of that, the sandbox's operational readiness checklist covers cybersecurity policy, penetration testing, data sovereignty, incident management and data privacy. The CRFR requires, among other things, penetration testing at least twice a year and immediate reporting of medium or higher incidents to SAMA. It does not replace the full SAMA Cyber Security Framework (CSF), which applies once you are licensed.
| Arabic names | البيئة التجريبية التشريعية · المتطلبات الأساسية للمرونة السيبرانية |
|---|---|
| Regulator | Saudi Central Bank (SAMA) |
| Sandbox stages | Application, Operational Readiness, Testing, Exit (Graduation) |
| Timelines | Application up to 60 days; readiness 120 days; testing 6 to 12 months |
| CRFR version | Version 1.0, January 2022, in force |
| CRFR applies to | Entities joining the sandbox and entities seeking a SAMA licence |
| Penetration testing | At least twice a year and after major changes (CRFR 3.2.6) |
| Incident reporting | Immediately to SAMA for medium or higher incidents (CRFR 3.2.16) |
| After licensing | Full SAMA CSF (maturity level 3 or higher) and the Business Continuity Management Framework |
What is the SAMA Regulatory Sandbox?
The SAMA Regulatory Sandbox lets local and international firms test new digital financial products with real customers in a controlled environment, with a view to launching them in Saudi Arabia. SAMA published the framework in 2018, moved to an always-open application model in 2022, and relaunched the sandbox as an online service on its e-services portal in June 2026.
Three kinds of applicant can join: SAMA-licensed institutions, unlicensed Saudi fintechs and start-ups, and unlicensed international fintechs, either directly or through a licensed partner. SAMA assesses four things: genuine innovation, consumer and market benefit, a minimum viable product with technology ready to test, and an exit plan. It does not accept models already covered by existing regulations or attempts to avoid them.
Stages and timelines
| Stage | Duration | What happens |
|---|---|---|
| 1. Application | Up to 60 days (the Guidance Notes say 60 business days) | SAMA reviews the application form, test scenarios and exit plan |
| 2. Operational Readiness | 120 days | You meet SAMA's readiness assessment criteria, including the cybersecurity areas below |
| 3. Testing | Minimum 6 months, maximum 12 months | Live testing under the permission SAMA grants; extensions can be requested in writing |
| 4. Exit (Graduation) | After testing | Apply for a licence, exit without one, or receive SAMA confirmation that no licence is needed |
The first approval letter only allows you to set up or update your company with the Ministry of Commerce as a fintech. It does not allow operations. Going live needs SAMA's further permission after the readiness checklist is met (the framework calls it a Letter of Acceptance; the Guidance Notes refer to a No Objection Letter). Before that point, testing is allowed only in development environments with dummy data.
What cybersecurity SAMA checks at sandbox entry
Stage 2 uses SAMA's Operational Readiness Assessment Criteria, which SAMA says it reviews and updates periodically. The security and data areas currently include:
- technology and cyber risk management;
- vulnerability assessment and penetration testing;
- cybersecurity policy, standards and processes;
- data sovereignty;
- cyber response and business continuity plans;
- security monitoring and incident management;
- cybersecurity regulatory compliance;
- data privacy compliance.
The application form also asks for risk and fraud tables that must cover cyber risk, and for three or four test scenarios with key risk and performance indicators. SAMA's framework states it is unlikely to relax consumer data protection or cyber resilience requirements in the sandbox, so plan to meet them in full.
What is the CRFR?
The Cyber Resilience Fundamental Requirements (CRFR) are a SAMA baseline, version 1.0, dated January 2022. They apply to entities intending to qualify for the sandbox and entities seeking a licence to operate in the Kingdom. SAMA positions them as the minimum cyber resilience a new entrant must show before licensing.
The CRFR does not replace the SAMA Cyber Security Framework or the Business Continuity Management Framework; each CRFR control maps to sections of those frameworks. The document names three domains: Leadership and Governance, Operations and Technology, and Resilience, with about two dozen numbered controls in total. Entities self-assess against a questionnaire and send a copy to SAMA, which may audit at any time and may refuse graduation or a licence if compliance cannot be shown.
Key CRFR controls to plan for
| Control | Requirement |
|---|---|
| 3.2.5 Vulnerability assessment | Periodic assessments covering both application and infrastructure layers |
| 3.2.6 Penetration testing | At least twice a year, and after major changes |
| 3.2.11 Logging | Security logs kept for at least one year |
| 3.2.15 Sessions | Idle sessions time out within 5 minutes |
| 3.1.5 Access | Accounts locked after 3 failed password attempts |
| 3.2.16 Incident reporting | Immediately inform SAMA of any cyber, fraud or disruptive incident rated medium or above |
| 3.3.1 and 3.3.2 Resilience | Business continuity and disaster recovery plans, and backups, defined and tested |
The CRFR sets no hour count for incident reporting; it says "immediately". It also sets no fixed self-assessment frequency.
Cloud and data sovereignty
The CRFR text does not cover cloud hosting or data localisation. For sandbox entrants those questions fall under the "data sovereignty" area of the readiness checklist. Once licensed, the full CSF applies: in principle only cloud services located in Saudi Arabia should be used, cloud services outside the Kingdom need SAMA's explicit approval, and SAMA approval is needed before using cloud services at all (CSF section 3.4.3; private internal cloud excluded). Personal data transfers abroad are also subject to the PDPL, covered in our guide to cross-border data transfers.
CRFR vs the full SAMA Cyber Security Framework
| CRFR | SAMA CSF | |
|---|---|---|
| When it applies | Sandbox entry and the path to a licence | Licensed member organizations |
| Scope | A focused baseline of about two dozen controls in three named domains | Four domains with detailed principles and control considerations |
| Maturity target | No maturity level stated | At least maturity level 3 (structured and formalized) |
| Assessment | Self-assessment questionnaire shared with SAMA | Self-assessment and SAMA supervision and audit |
Our SAMA CSF guide explains the full framework and its maturity levels.
From sandbox to licence
SAMA's framework describes three exits: apply for a full licence (or amend an existing one), leave without a licence through an exit plan that protects customers, or receive SAMA's confirmation that no licence or oversight is needed. The sandbox FAQ indicates licensing should start after at least six months of testing and by month nine. A recent example: in March 2026 SAMA moved open banking from the sandbox to a licensing regime, and applicants must show cybersecurity and operational resilience readiness (Clyde & Co).
Documents to prepare
- Cybersecurity policy and supporting standards, approved by management.
- Cyber risk assessment and risk register covering the product under test.
- CRFR self-assessment with evidence for each control.
- Penetration test and vulnerability assessment reports, with remediation tracking.
- Incident response procedure that includes immediate reporting to SAMA.
- Business continuity and disaster recovery plans with test records.
- Data sovereignty and hosting statement, and a PDPL privacy pack for customer data.
SAMA sandbox cybersecurity checklist
- We mapped our product to the sandbox criteria and drafted the exit plan.
- Our risk and fraud tables in the application cover cyber risk.
- We completed a CRFR self-assessment with evidence.
- Penetration testing is scheduled at least twice a year.
- Our incident procedure reports medium or higher incidents to SAMA immediately.
- Security logs are kept for at least one year.
- Business continuity, disaster recovery and backups are tested.
- We know where data is hosted and what SAMA approval that needs.
- We have a plan to reach CSF maturity level 3 after licensing.
Frequently Asked Questions
Does the CRFR apply before I get a SAMA licence?
Yes. SAMA's Cyber Resilience Fundamental Requirements apply to entities joining the sandbox and to entities seeking a licence. After licensing, the full SAMA Cyber Security Framework and the Business Continuity Management Framework also apply.
How long does the SAMA sandbox take?
Up to 60 days for the application decision (60 business days in the Guidance Notes), 120 days for operational readiness, then 6 to 12 months of testing. An extension can be requested in writing.
How often must a sandbox fintech run penetration tests?
At least twice a year under CRFR control 3.2.6, and also after major changes.
Can a sandbox fintech host data in a cloud outside Saudi Arabia?
The CRFR does not address cloud. The sandbox readiness checklist covers data sovereignty, and the full SAMA CSF says that in principle only cloud services located in Saudi Arabia should be used, with SAMA's explicit approval needed for cloud services abroad.
How fast must incidents be reported to SAMA?
CRFR control 3.2.16 requires entities to inform SAMA immediately of any cyber, fraud or disruptive incident rated medium or above. It does not set a number of hours.
What happens after the sandbox?
You either apply for or amend a full licence, exit through an exit plan, or receive SAMA's confirmation that no licence is needed. SAMA may refuse graduation if CRFR compliance cannot be shown.
Related guides
Sources
- SAMA — Regulatory Sandbox
- SAMA Rulebook — Regulatory Sandbox Framework
- SAMA Rulebook — Sandbox application and readiness criteria
- SAMA Rulebook — Operational readiness and go-live
- SAMA Rulebook — Sandbox Guidance Notes (PDF)
- SAMA Rulebook — Cyber Resilience Fundamental Requirements
- SAMA Rulebook — CRFR scope
- SAMA Rulebook — Cyber Security Framework maturity levels
- Okaz — SAMA launches enhanced sandbox e-service (Jun 2026)
- Clyde & Co — SAMA licensing framework for open banking (Mar 2026)
This guide is general information, not legal advice. Always check the official text from the relevant authority before making decisions.