15 Saudi CMA Licensing Questions

June 27, 2025

1. What are the types of CMA licenses available?

The Capital Market Authority (CMA) in Saudi Arabia regulates the financial services sector through five primary license categories, each tailored to specific types of capital market activity:

Advising This license permits the provision of investment advice to clients in relation to securities, whether on specific securities or on portfolio-level strategy. It is the lightest-touch license in terms of regulatory requirements and is suitable for investment advisory boutiques and family offices.

Arranging This license authorizes the firm to introduce or refer parties in relation to securities transactions, including corporate finance advisory, fundraising, M&A transactions, private placements, and investment banking-related work.

Managing Investments This license allows the firm to manage client portfolios and investment funds. It is split into two categories: M1: Managing Investments (without operating funds) – for portfolio management and mutual funds. M2: Managing Investments & Operating Funds – includes fund operation, administration, and real estate fund management. M2 allows acting as fund manager/operator for third-party funds.

Dealing The Dealing license enables brokerage activities in securities (buying/selling as agent or principal), underwriting, and market making. It is the most operationally and financially intensive license.

Custody This license allows a firm to hold client assets and maintain safekeeping and recordkeeping responsibilities, including for mutual funds and discretionary portfolios.

2. Do I need a Saudi partner or shareholder to apply for a CMA license?

No. There is no requirement to have a Saudi partner or shareholder to obtain a CMA license.

The CMA allows foreign ownership of licensed capital market institutions, subject to the following considerations:

The applicant must be a legally eligible person or entity, such as an individual, foreign company, family office, or investment firm, capable of owning shares in a Saudi company through the Ministry of Investment (MISA).

For foreign individuals or institutions, incorporation of a legal entity in Saudi Arabia is required. This typically involves first obtaining an investment license from MISA, followed by incorporation at the Ministry of Commerce (MOC), before the CMA license process begins.

Full foreign ownership (100%) is permitted for CMA-licensed firms, provided MISA eligibility criteria are met.

In practice, ValueExperts has successfully supported a wide range of fully foreign-owned applicants—from family offices and global asset managers to financial technology platforms—with no Saudi partners or shareholders.

3. What are the Registered Persons required under CMA licensing?

The CMA mandates the appointment of certain Registered Persons (RPs) to ensure appropriate governance, risk management, and operational oversight of licensed capital market institutions. These roles are mandatory and must be filled by individuals who meet the CMA’s fitness and propriety criteria, including professional qualifications, experience, and licensing exams.

The core Registered Persons include:

Chief Executive Officer (CEO) Responsible for overall strategic direction, operational management, and compliance with CMA obligations.

Compliance Officer Ensures the firm’s operations are in line with CMA regulations and reporting requirements. This function must be in-house for Dealing, Custody, and M2 (Managing & Operating Funds) licenses. For M1, Arranging, and Advising, this may be outsourced.

Finance Officer Oversees financial reporting, capital adequacy, and operational budgeting. Like the Compliance Officer, this must be in-house for Dealing, Custody, and M2.

Business Function Heads (Front Office) Required for each regulated activity the firm is licensed for. For example: Head of Advising Head of Arranging Head of Asset Management Head of Dealing Head of Custody

Each of these individuals must be registered with the CMA, possess relevant experience in regulated financial services, and in most cases, complete and pass the CMA’s CME (Capital Market Examination) requirements.

4. Can Registered Persons reside & work in other entities in addition to the Saudi entity?

In general, no — Registered Persons are expected to be full-time, Saudi-based individuals dedicating their time, solely for the Saudi entity that they are associated with.

The CMA considers the Registered Person roles as executive functions that must be performed within the Kingdom. The following requirements apply:

Residency Requirement: All Registered Persons are expected to reside in Saudi Arabia and hold a valid Saudi residency permit (Iqama). This ensures they are locally present to discharge their duties effectively and engage with the CMA and other stakeholders as needed.

Full-time Commitment: These are not part-time or advisory positions. CMA views these as full-time executive-level responsibilities requiring hands-on oversight.

Limited Exemptions: While rare, in specific transitional scenarios (e.g., initial setup or outsourcing arrangements), the CMA may temporarily accept a Registered Person residing outside Saudi, subject to approval and clear justification. However, long-term non-residency is generally not accepted.

In summary, applicants must plan early to onboard qualified executives who are either already resident in Saudi or willing to relocate — a point that ValueExperts routinely addresses during client onboarding.

5. What are the qualifications and suitability requirements for Registered Persons?

Registered Persons must meet strict fitness and propriety standards set by the Capital Market Authority (CMA). These requirements include:

Relevant Professional Experience: The individual must have direct experience in financial services, preferably in a regulated environment. For core roles like CEO or Head of Asset Management, prior leadership in a similar capacity is expected.

Educational Qualifications: A minimum of a bachelor's degree is typically required, often in finance, economics, accounting, business administration, or law. Higher degrees or recognized financial certifications (e.g., CFA, CPA, CAIA) are viewed favorably.

CMA Certification: Candidates must pass the CME Exams administered by the CMA or submit evidence of equivalent qualifications and seek exemption. The exam requirement depends on the role: CEO and business heads (e.g., Head of Advising, Head of Asset Management) must pass CME-1 & CME-4 respectively. Compliance Officers must pass and CME-2. Finance Officers may need to demonstrate accounting proficiency or submit equivalent credentials.

Character and Integrity: The CMA assesses the individual's history regarding any prior regulatory sanctions, bankruptcy, or criminal convictions. Clean regulatory and financial conduct is essential.

6. What are the capital requirements for each type of CMA license?

The CMA applies different capital requirements depending on the type of license being sought. These fall into two categories: fixed capital and variable (expenses-based) capital.

Fixed Capital Requirements:

Custody License: SAR 50 million This applies to entities holding client assets and acting as custodian.

Dealing License (as Principal or Agent): SAR 50 million This applies to brokers, traders, and investment dealers.

Managing Investments & Operating Funds (M2): SAR 20 million Required for firms that operate and manage funds, including real estate funds, and act as fund administrators or distributors.

Expenses-Based Capital Requirements:

For the following license types, there is no fixed minimum capital. Instead, the applicant must inject paid-up capital equal to or slightly higher than their projected first-year expenses:

Advising

Arranging

Managing Investments (M1)

This capital must cover:

Staff salaries and benefits

Office and IT costs

Systems and regulatory compliance tools

Insurance and professional fees

Any outsourced services

ValueExperts supports clients in calculating and documenting these estimates as part of the Regulatory Business Plan, which must be submitted in Phase 1 of the CMA application process.

7. What systems, controls, and infrastructure are required for CMA licensing?

The CMA requires applicants to demonstrate that they have appropriate internal systems, policies, infrastructure, and physical presence to conduct licensed activities in a compliant and secure manner. The key requirements include:

Physical Registered Office: A physical office must be established in Saudi Arabia. The CMA typically does not accept virtual or co-working spaces unless they are properly secured, dedicated, and approved.

IT and Cybersecurity Infrastructure: Applicants must maintain: Secure data storage (preferably local or CMA-approved cloud providers) Controlled access systems Business continuity and disaster recovery plans Cybersecurity policies aligned with relevant regulatory frameworks (e.g., NCA requirements)

Internal Policies and Procedures: The firm must adopt a full suite of compliance and operational policies covering: AML/CFT Compliance monitoring Risk management Internal audit (if applicable) Conflict of interest and client classification Suitability, disclosure, and fiduciary duty rules

Organizational Charts and Segregation of Duties: Roles and responsibilities must be clearly defined, with no conflict between revenue-generating and control functions.

Vendor and Outsourcing Arrangements: If any key services (compliance, finance, IT) are outsourced, formal outsourcing agreements must be in place and meet CMA standards.

These systems and controls must be finalized and demonstrated during Phase 2 (Commencement of Business License) to obtain final approval from the CMA.

8. Is a Board of Directors mandatory under CMA rules?

The requirement for a Board of Directors depends on the type of license and the legal form of the company.

Mandatory for CJSC and Higher tiered licenses:

Managing Investments (M1 & M2)

Dealing

Custody

Arranging (if conducted through a CJSC)

For these licenses, a Closed Joint Stock Company (CJSC) is required, and the CMA mandates:

A Board with at least 3 directors

At least one-third independent directors or a minimum of 3 independents, whichever is greater (for M2, Dealing and Custody)

An independent Chairman, especially if the company is managing funds or client money

Also, where a shareholder holds significant control, the Chairman must not be from the controlling shareholder group, to avoid governance conflicts.

Not Mandatory:

Advising license (if set up as an LLC). This licenses does not require a Board of Directors. A General Manager/CEO suffices.

In all cases, governance arrangements must align with CMA’s expectations around accountability, oversight, and conflict mitigation.

9. What are the capital requirements for each CMA license?

The capital requirements vary depending on the license type:

Dealing and Custody licenses require a fixed minimum paid-up capital of SAR 50 million.

Managing Investments and Operating Funds (M2) requires a fixed capital of SAR 20 million.

Managing Investments (M1), Arranging, and Advising licenses do not have a fixed capital requirement. Instead, the minimum paid-up capital must be equal to or greater than the first year’s projected total expenses, including staff, operations, and systems.

 10. Can a foreign individual or entity apply for a CMA license? Is a Saudi shareholder required?

No, a Saudi shareholder is not required. The CMA allows 100% foreign ownership of capital market institutions, subject to the applicant obtaining an investment license from the Ministry of Investment of Saudi Arabia (MISA). The CMA does not impose nationality restrictions on ownership or shareholding.

Who can apply? Foreign corporates (e.g., asset managers, investment banks, family offices) Foreign individuals (for certain licenses, subject to MISA approval) GCC nationals and GCC-registered entities

Requirements: The applicant must demonstrate ability to establish a Saudi company and obtain legal residency rights (for individuals functioning as registered persons). No local partner or JV is mandated unless voluntarily structured for strategic purposes.

11. What systems, controls, and infrastructure are required to operate a CMA-licensed entity?

The CMA places strong emphasis on governance, risk management, and operational readiness. To obtain and maintain a license, applicants must implement the following:

Registered Office & Physical Presence: Must have a legal office address in Saudi Arabia. For smaller licenses (Advising, Arranging), a serviced office is acceptable. For larger licenses (Managing, Dealing, Custody), a dedicated office space is required with proper infrastructure.

IT Systems & Cybersecurity: Secure and segregated systems for data storage and protection. Email and document management systems. Cybersecurity controls aligned with CMA Cybersecurity Framework.

Books & Records: All communications, investment advice, transaction logs, compliance documents, and governance records must be archived locally for the duration required by law (typically 10 years).

Policies and Procedures: The applicant must submit a full suite of manuals, including: Compliance Manual Risk Management Policy AML/CTF Policy Business Continuity Plan Code of Conduct IT Governance and Cybersecurity Manual Internal Audit & Oversight Framework

Third-Party Agreements: Outsourced arrangements (e.g. IT, compliance, legal) must be documented, assessed for risk, and approved by the CMA. The licensee must retain full accountability for outsourced functions.

12. Is a Board of Directors required for CMA-licensed entities?

A Board of Directors is required for the following license categories:

Managing Investments (M1)

Managing Investments and Operating Funds (M2)

Dealing

Custody

Arranging

The CMA mandates a formal board structure to ensure governance and oversight for these activities. For Advising licenses, however, a Board is not mandatory, making it a more flexible option for entry-level market participants.

Additionally, for licenses involving asset management or dealing, the Chairman must be independent from the controlling shareholder.

 13. What roles must be appointed as Registered Persons under CMA rules?

Under CMA regulations, every licensed entity must appoint certain key personnel as Registered Persons. These typically include:

Chief Executive Officer (CEO)

Compliance Officer

Finance Officer

Anti-Money Laundering & Counter-Terrorist Financing (AML/CTF) Officer

Risk Manager (mandatory for asset management, dealing, and custody licenses)

Business Function Head(s) — for example, Head of Arranging, Head of Advisory, or Portfolio Manager, depending on the license scope

Each Registered Person must satisfy the CMA's fit and proper criteria, including relevant qualifications, experience, and successful completion of CMA certification exams. These roles are also subject to CMA registration and approval prior to assuming responsibilities.

14. Can Registered Persons reside overseas?

The CMA generally requires all Registered Persons to reside in Saudi Arabia.

Key regulatory expectations:

Saudi Residency (Iqama): All RPs must hold a valid Saudi residency. For expatriates, this means being sponsored by the licensed entity.

Physical Presence: CMA expects the RP to be physically available for inspection, supervision, and day-to-day responsibility.

Exceptions: Very rare and typically limited to: Group-level internal audit or risk management oversight for foreign-owned institutions (with strong justification and CMA pre-approval). Advisory board members, if not performing RP roles.

15. What are the qualification and experience requirements for Registered Persons?

The CMA applies a fit-and-proper test to all individuals proposed as Registered Persons. The criteria are rigorous and assessed across four dimensions:

1. Experience

Minimum of 3–5 years’ experience in a similar or related role.

For Managing, Dealing, or Custody licenses, the CMA prefers candidates with institutional background and experience with regulated firms.

2. Academic & Professional Qualifications

A university degree (preferably in finance, law, economics, accounting, or business).

Relevant certifications are highly regarded, such as: CMA CME-1, CME-2 (Saudi exams required for all RPs) CFA, CPA, ACCA, CA, or MBA can strengthen the case.

3. CMA Licensing Exams

Most RP roles require passing the CME-1 exam (offered by the CMA).

Business function heads, portfolio managers, and dealing staff may also need to pass CME-2 or specialized modules.

4. Good Standing & Character

No regulatory breaches, disqualifications, or criminal records.

The CMA may request reference letters or conduct interviews.

In short, technical competence, ethical integrity, and Saudi-specific licensing exams are all essential to qualify as a Registered Person.

Disclaimer: The information above is intended as a high-level overview of the key considerations for obtaining a Capital Market Authority (CMA) license in Saudi Arabia. It does not constitute legal or regulatory advice. Interested parties should contact ValueExperts for a full explanation, as licensing requirements can vary depending on the applicant’s structure, intended activities, and other nuanced factors. info@valueexperts.sa