Choosing a payment gateway in Saudi Arabia comes down to three questions: which payment methods your customers expect (mada first, then Apple Pay, cards and often buy-now-pay-later), whether your business documents pass the provider's onboarding, and how cleanly the gateway connects to your website or app. Get those three right and the code is usually the smallest part of the job. This guide walks through each decision, compares integration approaches, and ends with a go-live checklist you can use with any provider.
What a payment gateway does for a Saudi business
A payment gateway is the service that securely takes your customer's card or wallet details, sends the transaction for authorisation, and tells your system whether it succeeded. As a merchant you usually deal with one provider, one dashboard and one settlement into your Saudi bank account.
Most providers in the Kingdom work as aggregators: they onboard you under their own acquiring arrangements and settle funds to your IBAN on their schedule. So onboarding documents and settlement terms matter as much as the technology.
Payment methods Saudi customers expect at checkout
mada comes first
mada is the national debit network, and most Saudi shoppers carry a mada card. Online spending through mada has kept growing; official data reported by Arabian Business put it at a record SAR 30.7bn in October 2025. If your checkout does not accept mada smoothly, you are turning away a large share of local buyers before they even try.
Apple Pay and international cards
Apple Pay is widely used in Saudi Arabia, especially on mobile, and many customers add their mada card to their wallet. Visa and Mastercard credit cards remain important for higher-value orders and for visitors. A good gateway handles all of these through one integration. Wallets such as STC Pay are supported by some gateways but not all, so confirm them in writing during onboarding.
Buy now, pay later: Tabby and Tamara
Tabby and Tamara are common at Saudi checkouts, particularly in fashion, electronics and furniture. Tamara received a consumer-finance licence from SAMA in 2025. BNPL usually needs its own merchant agreement with the BNPL company, even when your gateway or platform offers a ready connector, so plan it as a separate onboarding track.
Payment gateway KSA providers you will come across
Providers commonly used by Saudi businesses include Moyasar, HyperPay, PayTabs, Tap Payments, Amazon Payment Services (formerly PayFort) and Checkout.com. Each publishes its own fees, supported methods and onboarding rules, and these change, so compare them on the official pages and in a written offer rather than on blog tables.
If you plan to sell elsewhere in the Gulf later, note that local methods differ by country: KNET in Kuwait, BenefitPay in Bahrain, NAPS and QPay in Qatar, OmanNet in Oman. Aggregators such as Tap Payments and Amazon Payment Services support several of these, subject to merchant account activation.
Questions to ask every provider
- Which methods are active on my account from day one: mada, Visa, Mastercard, Apple Pay, STC Pay?
- What documents do you require, and do you accept a freelance certificate?
- How long is the settlement cycle, and what does the settlement report contain?
- Do you offer a hosted payment page, embedded fields and native iOS/Android SDKs?
- Is there a full sandbox with test mada cards and webhook testing?
- Can refunds and partial refunds be issued through the API?
- Is your documentation and support available in Arabic?
Requirements before you apply: CR, freelance certificate and website policies
Providers need to know who they are paying. Expect to provide a commercial registration (CR) or an accepted alternative, a national ID for the owner or signatory, and a bank account in the same legal name as the business. Mismatched names between the CR and the IBAN are one of the most common reasons an application stalls.
Your website or app also needs to be ready for review. Under the Saudi E-Commerce Law, stores must disclose identifying details such as the business name, address or contact details, CR number and VAT number if registered. Online stores are documented through the Saudi Business Center's business platform, which replaced Maroof for store documentation. Add clear refund, delivery, privacy and terms pages before you apply, and confirm current rules with the Ministry of Commerce.
Is a payment gateway without a commercial registration possible?
Honestly, it depends on the provider. Individuals without a CR can sell under a freelance certificate, and some gateways state that they accept freelance certificate holders, while others accept registered companies only. Ask each provider directly and get the answer in writing.
There is also a route that avoids running your own gateway at first: selling through a hosted platform such as Salla or Zid, which include payment options under their own eligibility terms. PIXELSAA's IEP platform project works this way: subscriptions are sold through a Salla store and then activated inside the platform. If you are weighing that route, our Salla store design guide covers the storefront side.
Integration approaches compared
How you connect the gateway affects security scope, user experience and effort. The table below compares the common options.
| Approach | How it works | Card data on your servers? | Checkout experience | Best for |
|---|---|---|---|---|
| Hosted payment page | Customer is redirected to the provider's page, then back | No | Leaves your site briefly | First launch, small teams |
| Embedded fields / drop-in form | Provider's secure fields load inside your checkout | No (fields are provider-hosted) | Stays on your page | Most custom websites |
| Native mobile SDK | Provider's SDK inside your iOS/Android app | No | Native sheet, Apple Pay button | Mobile apps |
| Direct server-to-server API | Your servers collect and send card data | Yes, full PCI DSS burden | Fully custom | Large businesses with a compliance team |
| Platform checkout (Salla, Zid) | The platform runs payments for you | No | Platform's standard flow | Stores that do not need custom checkout |
For most Saudi SMEs, embedded fields on the web and the provider's SDK in the app give the best balance. Direct API card handling is rarely worth the compliance cost.
mada payment integration and Apple Pay integration: technical details
If we build the website or backend system for you, these are the points we design for from the start.
Verify on the server, not the redirect
Never mark an order as paid just because the customer returned to a "success" URL. Your backend should confirm the payment status with the provider's API or a signed webhook, then update the order. Webhooks should be verified, idempotent (safe to receive twice) and logged. If orders also involve drivers and cancellations, as our article on delivery app development cost explains, payment status must stay in sync with order status.
3-D Secure and failed payments
mada and most cards in the Kingdom go through 3-D Secure authentication. Design for the customer who closes the OTP screen, the bank that declines, and the payment that stays "pending". Show a clear message and let them retry without creating a duplicate order.
Refunds and reconciliation
Build refunds and partial refunds into your admin panel, linked to the original payment ID. Each order should store the provider's transaction reference so finance can match orders, payments and settlement reports. Your tax invoice also has to be issued correctly; if you are in scope for Fatoora, read our guide to ZATCA e-invoicing phase 2 integration.
Apple Pay specifics
Apple Pay on the web requires domain verification for each domain that shows the button, usually arranged through your provider. In an iOS app you need an Apple merchant identifier and the provider's certificate setup. Remember that Apple's App Review Guidelines require in-app purchase for digital content and subscriptions consumed inside an iOS app; physical goods and real-world services can use your gateway.
Test like a customer
Use the sandbox to test every method, declined payments, refunds and webhook retries, then run a few small live transactions before launch.
Go-live checklist for your payment gateway
Copy this list and tick it off with your developer and your provider:
- Merchant account approved, with mada, cards and Apple Pay activated in live mode
- Legal name matches across CR (or freelance certificate), bank account and provider profile
- Store identity details, refund, delivery, privacy and terms pages published
- Live API keys stored on the server only, never in the app or front-end code
- Payment status confirmed by API or signed webhook before fulfilment
- Duplicate-order protection and retry flow tested
- Refund and partial refund tested end to end
- Transaction reference saved on every order and visible in the admin panel
- Settlement report matched against orders for the first live week
- Apple Pay domain verified and tested on a real device
- Privacy notice covers payment data processing, in line with the PDPL
Frequently asked questions
Can I get a payment gateway in Saudi Arabia without a commercial registration?
It depends on the provider. Individuals without a CR can sell under a freelance certificate, and some gateways say they accept freelance certificate holders, while others onboard registered companies only. Ask each provider in writing which documents they accept for your activity. Another option is selling through a platform such as Salla or Zid, which offer payments under their own eligibility terms.
Does a Saudi payment gateway need to support mada and Apple Pay?
For almost any business selling to Saudi consumers, yes. mada is the national debit network and most local shoppers carry a mada card, and Apple Pay is widely used on mobile. Confirm that both are activated on your live account, not just listed on the provider’s website, and test mada through Apple Pay on a real device before launch.
Should I use a hosted payment page or an embedded checkout?
A hosted payment page is the quickest and keeps card data entirely with the provider, which suits a first launch. Embedded fields keep the customer on your page while the provider still hosts the sensitive inputs, so your security scope stays small. For mobile apps, use the provider’s native SDK. Direct server-to-server card handling is rarely worth the PCI DSS effort for SMEs.
Do I need a separate agreement for Tabby or Tamara?
Usually, yes. BNPL providers assess and onboard merchants themselves, even when your gateway or e-commerce platform offers a ready-made connector. Start that application in parallel with your gateway onboarding, check which product categories they accept, and plan the checkout so the BNPL option, its terms and refunds all work correctly with your order system.
Ready to add payments to your website or app?
Planning to accept mada, Apple Pay or BNPL on a new or existing Saudi website or app? Send us your requirements with the provider you are considering, and we will review the flow and propose a clear integration scope before you commit.
