Identity verification in Saudi Arabia
Saudi Arabia is a Tier-1 MENA market of ~37 million people, the Gulf's largest economy, and the single most ambitious fintech build-out on the planet under Vision 2030. Identity verification here is unusual: the Kingdom operates what is effectively a national eKYC stack — Nafath (نفاذ), Yakeen (يقين), Absher (أبشر) — that lets a regulated institution onboard a Saudi citizen in seconds with zero do
Documents supported
(Government IDs from 220+ countries)
Average verification time
Countries covered
(Government-issued IDs validated)
Market overview
Saudi Arabia is the 18th largest economy in the world and the largest in the GCC, with a population of roughly 37 million — ~21 million Saudi nationals and ~13-16 million expatriates on an Iqama. Smartphone penetration is above 97% and banked population near-universal. It is one of the few markets where government identity apps have higher MAUs than most commercial banks: Nafath has passed 17 million downloads (~75% of the adult population) and Absher is used daily by essentially every resident. Vision 2030 has made financial services modernization a top national priority. The licensed fintech count has risen from ~10 in 2018 to 224+ by end-2024, the fastest growth in the Middle East. Flagship names include STC Pay / STC Bank (first digital banking license, 2023), Tabby (first BNPL with a
Supported documents
Didit templates cover national IDs, passports, residence permits and regional documents — plus 14,000+ documents globally for cross-border flows.
National Information Center (NIC), Ministry of Interior
Polycarbonate card with chip; ICAO-compliant MRZ on the back; Arabic + English data fields
The universal identifier — a 10-digit national ID number beginning with 1 for Saudis. Photo substitution and tampered DOB/expiry are the classic attack surfaces on older generations. New generatio
General Directorate of Passports (Jawazat), Ministry of Interior
Polycarbonate card, Arabic + English, embedded photo, validity tied to sponsor
The de-facto ID for expats — Iqama numbers begin with 2. Contains sponsor (employer), profession, nationality, validity. Banks freeze accounts when Iqama expires. Common fraud: expired Iqama, mism
General Directorate of Passports
ICAO e-passport with chip
Primary document for cross-border onboarding and for Saudis who lack a current National ID card on hand.
UAE, Bahrain, Kuwait, Oman, Qatar authorities
Polycarbonate card
Accepted for some KYC scenarios but SAMA expects higher verification rigor than for Saudi ID.
Issuing country + MoFA KSA
Book + visa sticker / e-visa
Used by marketplaces, mobile operators and hospitality fintech but rarely sufficient for full banking CDD.
General Directorate of Traffic
Polycarbonate card
Secondary ID. Not sufficient on its own for banking CDD.
Ministry of Defense
Card
Acceptance limited for regulatory and operational reasons.
Regulators
Royal Decree M/21 of 1439H
first issued 2018, updated 2019 and 2021
rulebook
live since 2019; widely regarded as one of the most effective in the world
NIC (National Information Center)
regulated
Ministry of Interior
regulated
E-authentication platform
Government technology company
regulated
Semi-government entity providing identity verification services
MCI
open
Government & regulated databases
Compliance framework
AML framework
Supervised by Law on Combating Terrorism Crimes and Its Financing
Primary AML law. The Anti-Money Laundering Law was issued by Royal Decree No. (M/20) dated 05/02/1439H (corresponding to October 2017), with Implementing Regulations issued under Decision of the Presidency of State Security No. (14525) dated 19/02/1439H. The law takes a broad view of money laundering — it covers any operation with funds known or reasonably suspected to come from criminal activity, and captures transfer, movement, use, retention, concealment and ownership structuring. It is compl
Data protection
Supervised by National DPA
- Primary personal data should, by default, be processed and stored inside the Kingdom. SAMA's outsourcing circular and the NCA Cloud Cybersecurity Controls (CCC-1:2020) both steer regulated entities to Saudi-based cloud regions. - Cross-border transfer of personal data is permitted only if (a) the
Penalties for non-compliance
Saudi regulators are active. SAMA's public AML enforcement framework authorizes fines up to SAR 5,000,000 per violation and escalation to license suspension or revocation; penalties under the AML Law itself reach SAR 7,000,000 and 15 years imprisonment. SAMA publishes enforcement actions under its I
Use cases
Neobanks, EMIs, payment institutions, lenders, brokerages.
SAMA-regulated fintechs run a two-track remote-onboarding flow: a Nafath / Yakeen-first path for Saudi nationals and most Iqama holders, and a document + liveness fallback for cases where the government stack cannot complete.
Exchanges, custodians, wallets, on/off-ramps.
There is no licensed VASP regime in Saudi Arabia. SAMA, jointly with the Ministry of Finance and a Standing Committee of regulators, has repeatedly warned (2018, 2019, 2020, 2024) that virtual currencies are not legally recognized, no individuals or entities are licensed to trade them, and they fall
Sports betting, online casinos, age-gated platforms.
iGaming is prohibited in Saudi Arabia under Sharia law. Online and offline gambling, casinos, sports betting, lotteries and fantasy-cash prize games are unlawful. The Basic Law of Governance and Sharia-derived criminal statutes criminalize any form of maisir (gambling). There is no licensing regime
Gig platforms, delivery, creator economy, e-commerce.
Marketplace KYC in Saudi Arabia covers seller onboarding, rider/driver onboarding and high-value buyer verification. The applicable frameworks are the E-Commerce Law (Royal Decree M/126 of 1440H), the Consumer Protection Law, PDPL and, where the marketplace operates payments or an embedded wallet, S
Biometric liveness
Neither SAMA nor PDPL prescribes a specific liveness standard, but SAMA's Digital-Only Bank Rules, the PSP Regulations and the AML/CTF Rules all require "adequate measures to prevent identity spoofing and impersonation in non-face-to-face onboarding". In practice this is interpreted as ISO/IEC 30107-3 PAD Level 2 passive or active liveness, with NCA cybersecurity-controls-compliant storage of biometric templates and PDPL-compliant consent capture. Biometric data is explicitly Sensitive Data unde
CERTIFICATIONS
Our platform meets the highest international standards for information security, data privacy, and biometric accuracy.
Full EU data protection compliance
Information security management
PAD (liveness + face match)
TRUSTED WORLDWIDE
Join thousands of companies that trust Didit for their verification needs
Didit’s NFC + active biometrics technology blocks the most advanced fraud scenarios, offering a level of security equivalent to or superior to in-person verification.
Spanish Financial Sandbox
CNMV, SEPBLAC & Spanish Treasury — Conclusions Report
Didit is an exceptionally valuable partner, delivering a stable and highly adaptable solution”.
Vuk Adžić
Head of the E-Business Department at Crnogorski Telekom
Didit offered us a robust technology with a simple implementation and adaptability to different markets”.
Fernando Pinto
CEO & CoFounder at TucanPay
Thanks to Didit we have been able to reduce manual processes and improve data extraction accuracy”.
Diana Garcia
Trust & Safety Executive at Shiply
Didit’s integration slashed verification times and costs, freeing resources for other projects”.
Guillem Medina
COO at GBTC Finance
Didit removed KYC costs, enabling faster scaling with high verification standards and less fraud.”
Paul Martin
VP Marketing & Growth at Bondex
Didit’s secure, user-friendly verification boosts customer trust and optimizes our process.”
Cristofer Montenegro
Executive assistant to the CEO at Adelantos
Didit ensures a precise, secure digital onboarding without slowing negotiations or client time.”
Ernesto Betancourth
Gerente de riesgos at CrediDemo
FAQ
Yes. Saudi Arabia permits remote KYC onboarding under its national AML framework, including document verification, biometric liveness and video identification where required by regulation.
Didit verifies all major national IDs, passports and residence permits issued in Saudi Arabia, plus 14,000+ document types globally for cross-border flows.
Didit charges $0.30 per verification with 500 free checks per month. No contracts, no minimums. Competitors typically charge $1.00–$2.50+ per verification.
Yes. Didit screens against 1,000+ global watchlists including PEP databases, sanctions lists (EU, UN, OFAC, OFSI), and adverse media — covering all AML obligations in Saudi Arabia.
Most regulated sectors in Saudi Arabia require or strongly recommend biometric liveness detection for remote onboarding. Didit provides ISO 30107-3 PAD Level 2 certified liveness.
Yes. Didit supports document verification, liveness, AML screening and ongoing monitoring aligned with Saudi Arabia’s crypto regulatory framework, including EU Travel Rule compliance where applicable.
Yes. Didit provides document-based age verification and identity confirmation suitable for Saudi Arabia’s iGaming regulatory requirements.
500 free verifications per month. No contracts, no minimums. $0.30 per verification after the free tier.
