Payment Gateway Saudi Arabia: Routes and Launch Checks

Start with the legal entity, store location, and acquiring arrangement. The Saudi Central Bank (SAMA) online-card circular distinguishes electronic stores within Saudi Arabia from stores outside it. A domestic Mada badge does not by itself establish offshore merchant eligibility.

Who this guide is for

This guide is for ecommerce, digital-content, gaming, and software merchants serving Saudi shoppers. It does not evaluate personal transfers, offline point-of-sale systems, or large business bank wires.

Disclosure: HaiPay publishes this guide about its own documentation and services. It is not an independent provider ranking or an account approval. Commercial terms need written confirmation; regulatory and tax interpretation require the appropriate adviser.

Source: SAMA, “Use MADA Bank Cards for Buying Products through Internet” (English translation of the 2018 circular, domestic/overseas store clauses); HaiPay public documentation listed below. Accessed 19 October 2026.

HaiPay Saudi Arabia commercial snapshot: supported methods, currencies, settlement, and fees

Before diving into route-by-route due diligence, use the table below to benchmark HaiPay's published Saudi Arabia payment methods, currency handling, settlement cadence, and fee structure against the items that must be confirmed in your merchant agreement:

Evaluate HaiPay for Saudi Arabia checkout: Review published method coverage on MENA Local Payment Coverage, check starting rates on HaiPay Pricing, model your transaction mix with the Credit Card Processing Fee Calculator, or contact HaiPay for a written Saudi Arabia quote.

How to choose between Mada, STC Bank, Apple Pay, and international cards

Start with the payment methods your customers can use and the routes your entity can obtain. Verify each route separately rather than assuming a single integration enables the entire Saudi method set.

Use the four-route selection matrix below to build your checkout shortlist before requesting a commercial quote:

Source: SAMA, “Use MADA Bank Cards for Buying Products through Internet”; STC Bank transformation notice; Apple issuer list; HaiPay Docs, “Saudi Arabia” (market and catalog facts). Method: Original route-selection checklist; accessed 19 October 2026. Scenarios are evaluation prompts, not measured customer behavior.

Market existence does not prove that a payment gateway, a foreign contracting entity, or a specific merchant account can activate any of these four routes.

Six lifecycle checks and plain-language definitions

A workable gateway shortlist must hold up across the entire payment lifecycle. Evaluate every candidate route against six operational questions:

• Shopper fit: Which card or wallet flow will your Saudi buyer recognise and complete without friction?
• Merchant fit: Which legal entity, registration country, website, app, and business model can pass underwriting?
• Route fit: Which payment route appears in public API docs, and which route is actually enabled for your merchant ID?
• Currency fit: What currency does the buyer see, what platform balance records the funds, and what currency reaches your bank?
• Operational fit: How do server-side status notifications (webhooks), pending payments, refunds, disputes, and order-to-payout reports work per route?
• Commercial fit: Which transaction fees, taxes, foreign exchange (FX) spreads, payout charges, and reserves appear in the signed contract?

To keep technical, finance, and legal reviews aligned, this guide uses seven plain-language terms and checks:

• Presentment: The currency and price displayed to the shopper at checkout.
• Platform balance: The internal ledger balance recorded inside the provider account after an eligible successful collection.
• Settlement: Funds becoming available under the provider’s stated arrangement. Check whether a quoted period refers to balance availability, payout release, or bank posting; those are separate events.
• Reconciliation: Matching merchant order IDs, gross collections, fees, refunds, and net payout batches across finance records.
• Issuer authentication: The card-issuing bank's identity or security verification step, such as 3D Secure or a one-time password (OTP).
• Underwriting: The provider's compliance, entity, and risk review required before enabling production payment routes.
• Acquiring check: Identify the institution responsible for the merchant’s card acceptance and confirm its contract, country, and supported routes. Do not infer that role from a gateway badge.

For broader multi-country gateway architecture, see our international payment gateway guide. For entity and routing trade-offs between domestic and offshore setups, review local acquiring and cross-border acquiring.

International card acceptance is an account-level question

International Visa and Mastercard acceptance operates on separate scheme rules from Saudi Arabia's domestic Mada network. Even when a provider publishes a global card product page, your approved card schemes, contracting entity, presentment currencies, and risk limits depend on written account terms.

Before relying on international cards for Saudi traffic, confirm three account-level items in writing:

• Enabled card schemes, issuer-authentication rules, supported transaction types, restricted merchant categories, and live per-transaction limits.
• Full and partial refund rules, chargeback (card-payment reversal) fees, dispute evidence deadlines, and rolling reserves (funds held back against risk).
• Payout timing, settlement currency, and outbound wire fees for your specific contracting entity.

Do not copy a generic global card rate or approval statement into a Saudi launch plan. A buyer's issuing bank, card type, 3D Secure result, and your merchant category code can all change acceptance outcomes. You can review the credit card product page for general capabilities, then lock your exact terms in the merchant quote.

Mada is a national card network, not a bank transfer

The Saudi Central Bank (SAMA) circular “Use MADA Bank Cards for Buying Products through Internet” describes the national MADA payment system and activation of bank cards for online purchases.

Its English translation distinguishes electronic stores within the Kingdom from stores outside it. Confirm your store’s location, legal entity, and acquiring arrangement before treating a local Mada route as available. The circular is not an approval of any particular gateway or offshore merchant.

Source: SAMA, “Use MADA Bank Cards for Buying Products through Internet” (2018 circular, shown In-Force; English translated text), accessed 19 October 2026.

However, the provider’s current public pages contain an internal classification conflict that merchants must resolve before contracting:

Mada classification chain: SAMA defines Mada as a national card network. The provider’s Middle East and North Africa (MENA) coverage page and Saudi Arabia API table group Mada under CARD and SA_CARD_USD. In contrast, the payment gateway pricing page places Mada under Bank Transfers, and the SAR Collection Application OpenAPI example shows payType: "ONLINE_BANKING" with inBankCode: "MADA".

The SAMA rulebook, the MENA product page, and the Saudi API route table all support treating Mada as a card-network flow. The pricing-page placement under bank transfers and the OpenAPI sample code conflict with that card classification. Do not use the pricing matrix placement to reclassify Mada as a wire transfer or to assume a bank-transfer fee rate.

Instead, ask the provider for a written method mapping before integration. That document should state the exact payType and inBankCode values, the applicable pricing category, the checkout authentication flow, the settlement scope, and the responsible product owner.

Source: SAMA, “Use MADA Bank Cards for Buying Products through Internet”; HaiPay Docs, “Saudi Arabia” and “Collection Application” (published route and sample classifications); HaiPay, “MENA Local Payment Coverage” and “Pricing” (method classification observed on each surface), accessed 19 October 2026.

STC Bank and the legacy STC Pay route label

STC Bank's official "Notice of Transformation to STC Bank" confirms that the former stc pay digital wallet business transformed into STC Bank under a Saudi Central Bank digital banking license. Use STC Bank when discussing that banking business, while retaining the labels actually shown by the gateway and issuer.

At the same time, the provider’s public product and technical pages still retain the legacy STC Pay route label:

STC Bank naming chain: The active consumer brand is STC Bank (licensed digital bank). The provider’s MENA local payment coverage page still displays the legacy STC Pay badge. The Saudi Arabia API documentation uses technical codes STCPAY (SAR) and SA_STCPAY_USD (USD), with "STCPay" in the sample JSON payload.

Do not silently rewrite the technical API code in your engineering specs, and do not describe STC Bank unconditionally as an unlicensed wallet in customer copy. Preserve both labels for their respective tasks. Require your written quote and sandbox plan to confirm that STCPAY and SA_STCPAY_USD connect to the active STC Bank authentication flow. Verify mobile number formatting, OTP prompts, transaction limits, refunds, and settlement before launch.

Source: STC Bank, “Notice of Transformation to STC Bank” (consumer banking transition); HaiPay Docs, “Saudi Arabia” (legacy STCPAY identifiers), accessed 19 October 2026. Route continuity remains an account question.

Apple Pay for a Saudi-facing checkout

Apple's official Saudi Wallet page and Africa, Europe and Middle East issuer list confirm that Apple Pay works online and in apps for shoppers using compatible Apple devices and eligible cards from participating issuers. This establishes a documented product and issuer scope, not customer adoption or compatibility with every gateway.

However, market availability does not prove that a specific gateway account is configured for Apple Pay or that every underlying Saudi card token will pass through a third-party checkout. It also leaves entity eligibility, presentment currencies, refunds, disputes, recurring billing, and bank settlement to the provider contract.

Both the MENA local payment coverage page and the Saudi Arabia API table list Apple Pay surfaces (APPLE_PAY for SAR and SA_APPLEPAY_USD for USD under EWALLET). Before displaying an Apple Pay button to Saudi buyers, confirm production activation for your merchant ID and test live devices with both Mada and international cards.

Source: Apple, “Wallet — Saudi Arabia,” “Apple Pay Support,” and “Apple Pay participating banks in Africa, Europe, and the Middle East” (device/card scope); HaiPay Docs, “Saudi Arabia” (catalog entries), accessed 19 October 2026.

Market availability, public route, and merchant activation are three gates

Every Saudi payment route must pass three distinct verification gates before you commit engineering resources or launch traffic:

• Gate 1 — Market existence: An official regulator or payment operator source (such as SAMA, STC Bank, or Apple) confirms the payment network, consumer brand, and buyer requirements.
• Gate 2 — Provider public surface: Current provider product pages and API documentation list the payment method, currency endpoint, and catalog status.
• Gate 3 — Merchant activation: The provider approves your contracting entity, configures the route for your production application identifier (appId), and signs commercial terms.

No gate substitutes for another. The provider’s Merchant Payment Configuration documentation describes appId-specific payment methods, fees, and settlement settings. It says configs is empty when no payment product is configured. The documented limit field uses the intersection of platform and merchant-application limits. Check the returned route and its limit settings separately for the application you will use.

Source: HaiPay Docs, “Merchant Payment Configuration” (configuration response, PayMethod.limit, and empty-config note), accessed 19 October 2026.

Step 1: Verify Saudi market rules and payment brand definitions

Output: a market-scope record. Identify the payment rail, consumer brand, and customer eligibility conditions before asking about your merchant account.

Source: SAMA, “Use MADA Bank Cards for Buying Products through Internet”; STC Bank transformation notice; Apple issuer list; HaiPay, “Pricing” (market and commercial boundaries); accessed 19 October 2026. Account-specific questions are the publisher’s verification framework.

Step 2: Audit the provider’s public documentation and surface conflicts

Output: a discrepancy list for the provider to resolve. Keep each published value beside its source and environment. Do not let the integration team choose between conflicting limits without an account-specific answer.

Source: HaiPay, “MENA Local Payment Coverage” and “Pricing”; HaiPay Docs, “Saudi Arabia,” “Cash-In Code List,” “Collection Application,” and “Merchant Payment Configuration” (public-surface comparison); accessed 19 October 2026. Differences are documentation observations, not live account results.

No public provider page constitutes a Saudi merchant quote. Route activation, live transaction limits, final processing fees, tax treatment, and external bank payout currencies must be confirmed for your specific account.

Step 3: Confirm merchant account and production operations

Output: a launch-evidence checklist. Assign an owner to obtain and review the proof in each operating area:

Method: Original launch-control checklist; required proof is a proposed internal control, not a completed account test. Source: HaiPay Docs, “Saudi Arabia” and “Merchant Payment Configuration” (API routes, settings, and public status fields), accessed 19 October 2026.

Saudi payment routes: customer actions and documented status

Use this first matrix to compare route codes, checkout tests, and conflicting published ranges. Record the method-specific question you need the provider to answer.

Notice that "Available" in the table below means only that the provider’s public API catalog lists the row as available. It does not mean the route is active on your merchant account.

Source: SAMA bank-card circular; STC Bank transformation notice; Apple issuer list; HaiPay Docs, “Saudi Arabia” and “Cash-In Code List” (method names and published ranges); accessed 19 October 2026. Checkout steps describe tests to perform. Published ranges are not approved live limits.

Saudi payment routes: account, currency, and settlement verification

Use the second matrix to record account, currency, and post-payment requirements for each shortlisted method. Shared settlement cautions apply to every row; the distinct refund and route questions still need separate answers.

Source: HaiPay Docs, “Saudi Arabia” and “Merchant Payment Configuration” (balances, methods and public refund table); SAMA bank-card circular, STC Bank notice and Apple issuer list (market scope); accessed 19 October 2026. Activation, settlement, and refunds remain account-specific.

SAR and USD presentment, platform balance, and bank settlement flow

The provider’s Saudi Arabia API documentation and SAR Collection Application specification state that calling /sar/collect/apply with a SAR-configured appId increases the merchant's SAR balance inside the platform when payment succeeds. Calling /usd/collect/apply with a USD-configured appId increases the merchant's USD balance inside the platform.

That technical rule governs collection presentment and internal platform ledger balances only. It does not prove that the provider wires SAR directly to a Saudi or offshore bank account. Nor does it show automatic SAR-to-USD conversion without FX terms or confirm that every entity can open both routes. The provider’s pricing page publishes a general USD settlement statement, with additional currencies available in selected markets. That statement does not assign a Saudi route’s payout currency, conversion point, or bank arrival date. Confirm those terms for your account.

Source: HaiPay Docs, “Saudi Arabia” (SAR/USD balance notes), and HaiPay, “Pricing” (general settlement statement), accessed 19 October 2026.

Keep all six money stages separate across your checkout architecture, treasury forecasts, and accounting close:

Method: Original six-stage reconciliation framework. Source: HaiPay Docs, “Saudi Arabia” (SAR/USD platform balances), and HaiPay, “Pricing” (general settlement statement, not a Saudi route assignment), accessed 19 October 2026.

Public settlement scopes do not assign a Saudi route

The provider’s payment settlement time guide explains how to read settlement notation and distinguishes internal balance availability from external bank arrival. However, public guidance does not assign a fixed settlement cycle (such as T+5 or T+7) to Mada, the STCPAY-labelled route, Apple Pay, or Saudi card transactions.

Do not assume that T automatically means the payment capture date or that day counts always use calendar days. In the provider’s Merchant Payment Configuration API, account settlement cycles use four distinct codes:

• D0: Natural day (Natural Day in the settlement cycle code table).
• TN: T+N working days (Working Day in the settlement cycle code table).
• WN: Weekly settlement (Weekly in the settlement cycle code table).
• MN: Monthly settlement (Monthly in the settlement cycle code table).

Source: HaiPay Docs, “Merchant Payment Configuration” (settlement enums); HaiPay, “Payment Settlement Time” (timing questions), accessed 19 October 2026. Quote fields are a verification checklist, not an assigned Saudi settlement cycle.

Require your contract to state the exact route, contracting entity, starting event for T, day-counting unit, daily cut-off time, rolling reserve percentage, and minimum payout threshold. Ask separately how the applicable weekends and banking holidays affect payout release, and how long receiving-bank transit takes after a wire is sent.

Fees, VAT, and contractual foreign exchange

The provider’s payment gateway pricing page and payment gateway fees guide publish card starting rates of 2.5% + US$0.30 for US-issued cards and 4.0% + US$0.30 for non-US-issued cards. Those card rates apply only to US merchants contracting through the provider’s US entity, subject to business and risk review. Similarly, the published 1.2% starting rate for local payment methods is a cross-market benchmark (for example, the listed Indonesian local-payment method).

Neither of those published starting rates establishes a Saudi merchant card rate or a quote for Mada, the STCPAY-labelled route, or Apple Pay in Saudi Arabia. Never copy a US-entity card rate or a generic local-method floor into a Saudi financial model without a route-specific written quote.

When reviewing commercial terms with the provider, verify four fee and tax boundaries in writing:

• Setup, annual, and exception fees: Public pricing lists US$0 setup and annual fees with no minimum monthly billing (confirm any optional monthly service fee in your quote). It also lists US$0.30 ($0.30) per processed refund and US$20 ($20 per dispute) per dispute. Confirm whether these exact exception fees apply to your contracting entity and approved Saudi routes.
• Value-added tax (VAT): Do not apply a general Saudi VAT percentage directly to a provider fee. The provider’s pricing page states that applicable local taxes are listed separately in your quote. Ask which legal entity invoices the service, whether tax is included in the quoted rate, and how the invoice presents it.
• Foreign exchange (FX): If money is converted between currencies, confirm the conversion point, reference rate, spread, and fee bearer. Neither the buyer’s location nor a SAR collection endpoint alone proves when conversion occurs. Obtain the applicable FX terms in your merchant contract.
• Outbound settlement wire charges: Public pricing lists US$15 per wire ($15 per wire) for USD bank wires, with intermediary-bank charges borne by the recipient. Confirm the applicable payout fee, minimum withdrawal threshold, and fee bearer for your specific settlement currency and bank country. Ask separately whether the receiving bank charges an additional fee.

Source: HaiPay, “Pricing” (published references and entity-scoped card rates), accessed 19 October 2026. The questions above request account-specific confirmation and do not assign Saudi route prices.

Merchant entity and underwriting requirements

A payment route can appear as "Available" in public API documentation while a specific merchant application remains ineligible under provider or acquirer compliance rules. Confirm your contracting structure and entity eligibility before starting technical integration.

Prepare an underwriting preflight package containing these eight items:

• Legal entity name, country of incorporation, commercial registration number, and physical operating locations.
• Live website URL or mobile app store links, product or service description, and customer-support contact details.
• Projected monthly Saudi transaction volume, average order value, and maximum single-transaction amount in SAR or USD.
• Refund policy, order-fulfilment timing, subscription or recurring billing model, and historical chargeback ratio.
• Requested Saudi checkout routes (CARD, Mada, STCPAY, APPLE_PAY) and desired presentment currencies (SAR, USD, or both).
• Intended external bank settlement currency and corporate bank account country.
• Ultimate beneficial owner (UBO) identification, corporate registry extracts, and compliance verification documents.
• Designated technical integration lead, finance reconciliation contact, and production support escalation owner.

Request a written preflight response that lists which Saudi routes are approved for your entity and which conditions remain open. Do not treat a sales conversation, a public route table, or a successful sandbox call as final production underwriting approval.

Integration, status, refunds, disputes, and reconciliation

A Saudi checkout integration is not finished when the hosted payment page redirects the shopper back to your site. Browser redirects can drop when mobile users switch between a banking app, an OTP screen, and Safari. Your backend must rely on verified server-side notifications and status queries before fulfilling an order.

Establish three operational controls before enabling live Saudi traffic:

• Authoritative payment status: Verify server-side notifications and use the applicable collection-query endpoint before fulfilling an order. In the Saudi Arabia query response, status is 0: Not Started, 1: In Progress, 2: Success (final), 3: Failed (final), or -1: Exception Pending Confirmation. Confirm the schema for each endpoint: a request-envelope status is not automatically the payment’s final status. Test pending, failure, delayed notification, and duplicate-event handling.
• Method-level refunds and disputes: As documented in the Merchant Payment Configuration API, public refund documentation currently lists USD + CREDIT_CARD, USD + GOOGLE_PAY, and USD + APPLE_PAY, without listing SAR endpoints, Mada, or STCPAY. Obtain written confirmation of whether your approved Saudi routes support API or dashboard refunds, partial refunds, refund fees, and dispute representment workflows.
• Net-settlement finance reconciliation: When fees, refunds, or rolling reserves are netted out of payout batches, order-level collection logs alone will not balance your bank statement. Confirm that your settlement reports include merchant order and provider references, route code, gross amount, fee deductions, refunds, currency, and payout batch reference. Confirm field names for the API version and report you actually use; the Saudi guide calls the merchant reference orderId.

Source: HaiPay Docs, “Saudi Arabia” (collection-query response schema) and “Merchant Payment Configuration” (public refund-support table), accessed 19 October 2026. Reconciliation fields are a proposed reporting requirement.

Subscriptions and platform compatibility need separate answers

A listed payment route does not establish that your subscription or store integration is ready. Ask the provider to confirm these four items for your actual platform and merchant account:

• Renewals: Does this route support recurring charges, and what consent, stored-credential, cancellation, and customer-notification steps apply?
• Platform: Is the proposed connection a maintained plugin, a hosted checkout, or a custom API integration? Record the supported platform and plugin versions.
• Return and status handling: Test a cancelled checkout, an app switch, a delayed notification, and a repeated event. Define when your store may mark the order paid.
• Launch ownership: Name the team that resolves plugin, route, underwriting, and settlement issues. Keep the written answer with your launch checklist.

Treat business registration or freelance-document eligibility as an underwriting question. Do not infer that a particular certificate, entity type, subscription flow, or plugin is accepted from a public method badge.

Method: Original account-verification questions informed by sampled merchant discussions. They are not claims that a provider supports these features or that a specific registration document qualifies.

Saudi Quote Verification Checklist

Copy the 14-point table below and ask your payment provider to complete every row in writing before signing a contract or starting development:

Method: Original 14-point quote-verification template; not a regulator-mandated form or an account approval. Source: HaiPay, “Pricing” (US$15 reference for USD wires, subject to actual account terms), accessed 19 October 2026.

Provider fit, limits, and sources

When to request an account assessment

HaiPay is worth evaluating when your cross-border business needs a single integration surface to explore international cards, Mada, the STCPAY-labelled route (for STC Bank), and Apple Pay for Saudi shoppers. Its Saudi Arabia API documentation (/sar/collect/apply and /usd/collect/apply) and /common/payment/config architecture give technical and finance teams a concrete structure for preflight verification.

To move from research to an account-specific evaluation, review the local payment product overview, the MENA local payment coverage page, and public pricing. Then submit the completed 14-point checklist through the provider contact page to request a written preflight assessment and route quote.

When this route set may not fit

This route set will not fit merchants that require a guaranteed Saudi onshore entity setup, direct domestic SAR bank account settlement without underwriting review, or unverified plug-and-play activation. Consumer transfers, offline point-of-sale payments, and large business invoice wires require a separate evaluation; this article does not establish their availability.

Disclosure and limitations

The publisher provides this commercial and technical guide about its own services. It is not an independent market ranking. The sources below were read through the channels recorded on 19 October 2026. Public documentation remains separate from authenticated merchant tests. Because route eligibility, limits, fees, and settlement terms depend on underwriting and contract execution, always obtain current written terms before relying on any route, rate, or timeline. Nothing in this guide constitutes legal, regulatory, tax, accounting, or financial or investment advice.

Primary sources

1. SAMA, “Use MADA Bank Cards for Buying Products through Internet” — English translation of the 2018 circular, shown In-Force; bank-card use and the domestic/overseas electronic-store distinction. Accessed 19 October 2026.
2. STC Bank, “Notice of Transformation to STC Bank” — wallet-business transition and banking license statement; does not certify continuity of a third-party STCPAY route. Accessed 19 October 2026.
3. Apple, “Wallet — Saudi Arabia”, Apple Pay Support, and participating issuers in Africa, Europe and the Middle East — product use and issuer/card eligibility; not gateway activation. Accessed 19 October 2026.
4. HaiPay, “MENA Local Payment Coverage” — observed Saudi method badges and grouping. Accessed 19 October 2026.
5. HaiPay Docs, “Saudi Arabia” — Saudi Arabia API page as served on the access date, route catalog, SAR/USD balance notes, documented limits, test instructions, and collection-query status definitions. Accessed 19 October 2026.
6. HaiPay Docs, “Cash-In Code List” — Saudi section’s separately published route limits. Accessed 19 October 2026.
7. HaiPay Docs, “Collection Application” — sandbox-oriented SAR example showing 500.00, ONLINE_BANKING, and MADA; not a production test or a limit commitment. Accessed 19 October 2026.
8. HaiPay Docs, “Merchant Payment Configuration” — appId-specific settings, limit-field intersection, empty-config note, settlement enums, and the public refund-support table. Accessed 19 October 2026.
9. HaiPay, “Pricing” — US-scoped starting card rates, published fee references, taxes, and general currency statements; not a Saudi-specific offer. Accessed 19 October 2026.
10. HaiPay, “Payment Settlement Time” — settlement terminology and verification questions. Accessed 19 October 2026.