iFynx Studio

Posted on Oct 7 Originally published at ifynx.com

SAMA’s Remote Account for Foreign Property Buyers Is a Purpose-Locked Product: A UX Spec for Rules 200.2.4 and 300.2.10

#fintech #product #ux #startup

The short answer

Since 1 July 2026, Saudi banks can open a bank account remotely for non-Saudis who live outside the Kingdom and want to buy property under the new foreign ownership law. But SAMA did not create a normal current account: it created a purpose-locked account with no cards, no joint holders, one remote account per customer, and payments routed through approved Saudi rails such as the Real Estate Registry, Ejar, SADAD bills or a licensed broker. For product teams, that means a new account type with its own eligibility gate, entitlement model, payee rules and lifecycle states, not a reskinned expat onboarding flow.

Key facts, with dates and primary sources

14 July 2025 (19/01/1447H): The Law of Real Estate Ownership by Non-Saudis is issued by Royal Decree No. (M/14). (SAMA Circular 482004268; Gregorian date per the Council of Ministers decision text)
22 January 2026: The law enters into force. REGA says non-residents begin their journey at Saudi missions and embassies abroad, which issue a digital identity, and then apply on the Saudi Properties portal. (REGA announcement)
23 June 2026 (08/01/1448H): Council of Ministers Decision No. (43) approves the Implementing Regulations. REGA announces the same day that the Saudi Properties portal is accepting foreign ownership applications. (Decision text; REGA release)
1 July 2026 (16/01/1448H): SAMA Circular No. 482004268 updates the Account Opening Rules with two new articles: 200.2.4 for non-Saudi natural persons outside the Kingdom and 300.2.10 for non-resident juristic persons covered by the law, effective from the circular's date. (SAMA Rulebook)
3 July 2026: The Implementing Regulations are published in Umm Al-Qura (issue 5169). Under them, non-resident individuals must obtain a digital identity, a Saudi bank account and a Saudi mobile number linked to that identity before acquiring property. Related payments must run electronically under SAMA's payment systems. (Decision text; Deloitte summary)
Fees users will ask about: a non-Saudi ownership fee currently set at 2% on disposals in Riyadh, Makkah, Madinah and Jeddah (statutory ceiling 5%), separate from the 5% Real Estate Transaction Tax. (Deloitte; Greenberg Traurig)
Already in force since 11 October 2022: SAMA's Counter-Fraud Framework control 4.2.2(e) for remote relationships (one application per phone number, biometric authentication via the national single sign-on, an OTP that explains a new account is being opened, completion notices to verified numbers, and restrictions until the customer is validated). (SAMA Rulebook 4.2.2)

Why this circular deserves a product read, not just a compliance memo

Most coverage of Saudi Arabia's foreign ownership regime so far comes from law and tax firms. It explains who may own what, where, and at what fee. That is useful for investors. It does not answer the question a bank's digital team now has on its desk: what exactly do we ship for a person in Cairo, Jakarta, London or Amman who has a Saudi digital identity, a Saudi number, and a reason to move money into the Kingdom for one specific purpose?

SAMA's circular answers that question with unusual precision. In under a page per customer type it sets the documents, the verification standard, the allowed account structures, the products that must not be issued, the payment channels the account should use, and a duty that lasts for the whole relationship. Every one of those clauses is a product surface. This field note maps them to flows, screens, states and metrics. It is not legal advice; each point cites the primary text so your compliance team can check it.

What the two new rules actually say

Rule 200.2.4: individuals outside the Kingdom. The bank collects five things: a copy of the digital ID "issued in accordance with the laws in force in the Kingdom to verify the identity of the person in the digital transaction for owning real estate"; a passport copy "if any"; the residential address in the country of residence, contact details, and a Saudi contact number in the customer's name linked to the digital ID; a copy of a contract or agreement with a licensed broker or developer in the Kingdom "if any"; and the customer's bank account details with an authenticated statement from their bank at home.

Four general controls follow. The customer is verified "via a reliable and independent source in the Kingdom, including using the biometric authentication." Joint accounts, and authorised signatories from outside the Kingdom, are not allowed. The account's purpose is restricted to owning property or acquiring other real rights over property in the Kingdom, with no more than one account opened remotely and no payment or credit cards issued. Property-related transactions go through "approved and reliable electronic means in the Kingdom", which the text illustrates with the Real Estate Registry platform, Ejar, SADAD bills, or paying a licensed broker. Finally, the bank must ensure the digital ID stays valid throughout the relationship and keep the customer's data up to date.

Rule 300.2.10: companies and other legal persons outside the Kingdom. The bank collects the registration certificate with the Ministry of Investment, the National Center for the Development of the Non-Profit Sector, or another body set by the Council of Ministers, with the unified number beginning with 7; the ID of the authorised representative issued under Saudi law; addresses and a Saudi contact number linked to that ID; constitutional documents showing capital structure, activity and the names and IDs of board members; and any broker or developer agreement. The authorised person is verified biometrically through a reliable Saudi source, and the same purpose lock applies: one remote account, no cards, and the same payment channels.

A detail for bilingual teams. In SAMA's English translation, the opening sentence of 200.2.4 reads "Bank accounts shall be opened for juristic persons", even though the article's title is about natural persons. The Arabic original uses the term for natural persons (al-ashkhas al-tabi'iyyun). The rulebook labels the English as a translated document, so the Arabic text governs. If your product copy, help centre or partner FAQ is drafted in English and translated to Arabic, this is the moment to reverse that workflow for regulated text.

Map the dependency chain before you design a single screen

A non-resident applicant cannot simply download your app and start. The regime creates a strict order of prerequisites, and each one is controlled by a different party:

Digital identity, issued through a Saudi mission abroad (REGA's description of the non-resident journey).
A Saudi mobile number in the customer's name, linked to that digital identity (rule 200.2.4, requirement 3).
The bank account, opened remotely with biometric verification (rule 200.2.4, control 1).
The ownership application on the Saudi Properties portal, then registry and deed procedures on REGA's platform with payments over SAMA-regulated rails (Implementing Regulations, per Deloitte and Greenberg Traurig).

Most abandonment in this journey will not happen inside your app. It will happen between steps, when someone does not know what comes next or arrives at your bank without a prerequisite. That makes the first screen the most important one: a readiness gate.

Eight product surfaces the rules create

1. The readiness gate. Before any form, show a short checklist the user can tick: Saudi digital identity issued, Saudi number active in my name, passport available (optional), statement from my home bank, broker or developer agreement (optional). Mark the optional items as optional in the UI, exactly as the rule does, so applicants without a broker yet are not scared off. Each unticked item should link to where it is obtained, not to a dead end.

2. Identity and biometrics from abroad. The rule demands verification through a reliable, independent Saudi source with biometrics. Your users will be in other time zones, on varied devices, in poor light. Design a liveness step with honest guidance (lighting, glasses, framing), a clear retry counter, and a human-readable failure reason. Show a "what happens next" path after repeated failures instead of a generic error, because a remote applicant has no branch around the corner.

3. The phone-number loop. The Saudi number must be in the customer's name and linked to the digital ID. Under SAMA's existing counter-fraud control 4.2.2(e), remote onboarding also expects one application per number, an OTP that says a new account is being opened, and completion notices to verified numbers. For non-residents, that number may be roaming abroad or sitting in a second phone. Build an explicit "check your Saudi number" step before the OTP, a resend timer, and copy that says which number the code went to (masked). Log OTP delivery failures by country; they will be your hidden drop-off.

4. An account type, not a flag on a current account. Treat "property-purpose remote account" as a distinct product with its own entitlements: cards off, joint holders off, external signatories off, second remote account blocked. Do not just hide these features. Where a user would expect them (card tab, "add a joint holder"), show a one-line explanation: this account is for property transactions in Saudi Arabia and does not include cards. Silent absence reads as a bug, and bugs become complaints.

5. Payee rails and a purpose-aware transfer flow. The circular names the Real Estate Registry, Ejar, SADAD bills and licensed brokers as examples of approved channels. Because the list is illustrative ("for example"), your compliance team will define the final policy. Product's job is to make that policy usable: payee categories instead of free-text beneficiaries, licence verification when adding a broker, a property or contract reference on every transfer, and a confirmation screen that states the purpose in plain words in both languages.

6. Funding from home. The bank collects the customer's home-bank account details and an authenticated statement. The circular does not, on its face, restrict incoming transfers to that account. But many banks will treat it as the expected funding source for monitoring. Make that design decision explicit with compliance, then reflect it in the UI: show the registered home account on the "add money" screen, explain timing and correspondent fees where known, and give a clear state for funds received from an unexpected source.

7. Lifetime validity monitoring. The duty to keep the digital ID valid and data current lasts "throughout the relationship". This needs lifecycle states, not a one-off check: active, ID expiring soon, ID expired with restricted actions, data review required, and restored. Each state needs bilingual copy, a reminder schedule, and a single action button. Customers who have just paid a deposit on a flat in Riyadh must never discover a restriction at the moment of transfer.

8. The company path. For juristic persons the flow is multi-party: an authorised representative proves identity biometrically, while the bank gathers registration with the unified number starting with 7, constitutional documents and board identities. Design it as a workspace with a document tracker per party, not one long form. SAMA's rulebook already lists related integrations, including verifying beneficial owners through the "Wathq" service, which suggests where automation can replace uploads.

Microcopy that respects the rule and the reader

Purpose banner (EN): "This account is for buying or holding property in Saudi Arabia. Payments go through approved Saudi channels such as the Real Estate Registry, Ejar, SADAD and licensed brokers."
No-card notice (EN): "Cards aren't available on this account type. You can pay property-related bills and approved payees directly from the app."
ID expiry (EN): "Your Saudi digital identity expires on [date]. Renew it to keep making payments without interruption."
Write each string in Arabic first, then English. Have one owner sign off both, using the Arabic rule text as the reference.

Show the full cost before the first payment

Foreign buyers will ask what owning costs, and the bank app is where they will look. Under the Implementing Regulations, the non-Saudi ownership fee is currently 2% on disposals in Riyadh, Makkah, Madinah and Jeddah, with zero-rated cases such as disposals outside those four cities, and the 5% Real Estate Transaction Tax remains a separate charge. A simple, clearly labelled estimate screen ("estimate, final amounts are set by the authorities") builds trust. Link to the official REGA portal rather than restating rules you do not control.

Metrics that tell you whether the journey works

Readiness-gate pass rate, and the most common missing prerequisite by country.
Biometric success on first attempt, and median attempts per approved applicant.
OTP delivery success to Saudi numbers while roaming, by country and operator.
Time from application start to account number, and to first approved property payment.
Share of transfers rejected for payee or purpose, which shows whether your payee UI teaches the policy.
ID-expiry restrictions avoided by reminders, which shows whether lifecycle copy works.

A two-sprint checklist

Model "property-purpose remote account" as its own product type with an entitlement matrix (cards, joint, signatories, second remote account).
Build the readiness gate with optional items labelled as optional, and deep links for each prerequisite.
Add pre-OTP number confirmation, masked destination, resend timer and country-level OTP telemetry.
Replace free-text beneficiaries with payee categories that reflect your compliance policy, including broker licence checks.
Require a property or contract reference on property transfers, and show the purpose on the confirmation screen.
Implement digital-ID lifecycle states with reminders at fixed intervals before expiry.
Design the company workspace with per-party document tracking and the unified-number field.
Write all regulated strings Arabic-first, reviewed against SAMA's Arabic text.

Risks and trade-offs

Over-blocking. A purpose lock can easily become a wall. If every non-standard payment is rejected without explanation, customers will escalate. Pair restrictions with reasons and a path to request review.

Prerequisite limbo. Users may open an account and then stall waiting on the ownership application. Show progress across the whole journey, including the steps outside your bank, without claiming control you do not have.

Partner drift. Brokers and developers will publish their own "how to open your Saudi account" guides. Offer them an official, versioned explainer so the market does not spread outdated steps.

Assumption creep. Some details, such as which payees beyond the named examples are acceptable, are for each bank's policy and REGA's procedural guide. Keep those decisions in configuration, not hard-coded screens.

What this means for proptech and developers

Developers and brokers selling to foreign buyers now have a banking step in the middle of their funnel. The best partners will embed a status-aware handoff: "you're ready for the bank step" when the buyer has a digital ID and a Saudi number, and a return path once the account exists. This is product work that sits between institutions. It is the kind of journey iFynx designs with fintech and platform teams in the region: one clear flow across several owners.

Frequently asked questions

Can a non-resident foreigner open a Saudi bank account remotely to buy property?

Yes. Since SAMA Circular 482004268 of 1 July 2026, banks may open an account remotely for non-Saudis outside the Kingdom who are covered by the Law of Real Estate Ownership by Non-Saudis, for the purpose of owning property or acquiring real rights over property in Saudi Arabia.

What documents does the account require?

A copy of the Saudi digital ID, a passport copy if available, the home address and contact details, a Saudi contact number in the customer's name linked to the digital ID, a broker or developer agreement if available, and home-bank account details with an authenticated statement.

Does the property-purpose account come with a debit or credit card?

No. Rule 200.2.4 prohibits issuing payment or credit cards on this account. It also bars joint accounts, signatories from outside the Kingdom, and opening more than one account remotely.

How are property payments made from the account?

Through approved and reliable electronic channels in Saudi Arabia. SAMA gives examples: the Real Estate Registry platform, the Ejar platform, SADAD bills, or payment to a licensed real estate broker.

What should product teams build first?

A readiness gate that checks prerequisites before the application starts, a distinct account type with clear entitlements, purpose-aware payee flows, and lifecycle states that keep the digital ID valid for the whole relationship.

Sources

Closing craft note

SAMA wrote a short rule, but it describes a whole product: who can start, what they must bring, how they prove who they are, what the account cannot do, where money may go, and what must stay true for years. Banks that bolt it onto an expat onboarding flow will ship confusion. Teams that model it as its own account type, with a readiness gate, honest restrictions and lifecycle states, will turn a regulatory opening into a journey foreign buyers can actually finish.

Originally published on iFynx.

DEV Community