Saudi Arabia's three must-support payment methods in 2026 are Mada (the national debit network; SAMA reports that e-payments made up 85% of retail payment transactions by individuals in 2025), STC Pay (digital wallet, over 12 million customers as of 2024), and Apple Pay (Apple devices generated about 52% of Saudi mobile web traffic in August 2026, per StatCounter). Tabby and Tamara are essential for BNPL.
You have two integration paths:
- 1.Direct integration with each provider's API — lowest per-transaction fees, ~6 weeks of dev, and you carry SAMA Payment Service Provider obligations yourself.
- 2.Via a SAMA-licensed aggregator (HyperPay, PayTabs, Moyasar, Checkout.com SA) — 1–2 weeks of dev, slightly higher fees, and the aggregator's licence covers you.
STC Pay hosted checkout requires a SAMA-licensed merchant account and supports both redirect and embedded-iframe flows. Plan for 3-D Secure 2.0 cardholder authentication on every Mada online payment, and confirm the exact requirement with your acquirer. Apple Pay needs a Saudi Apple Developer account plus merchant verification on each domain that accepts it.
Below: a side-by-side gateway comparison, integration architecture we recommend, the SAMA / ZATCA / PCI rules you cannot skip, and an FAQ covering the questions Saudi developers actually search for.
The Saudi payment landscape in 2026
- Mada: Saudi Arabia's national debit network, mandatory for all Saudi-issued cards. Around 30 million debit cards in circulation. Routed through SPAN; plan for 3-D Secure 2.0 online.
- STC Pay: Digital wallet with over 12 million customers as of 2024, instant P2P transfers and merchant payments. SAMA approved the beta phase of its transformation into STC Bank in April 2024 and authorised STC Bank to begin full operations in January 2025, so confirm which entity and licence your merchant agreement sits under.
- Apple Pay: Widely adopted among iPhone users — Apple devices generated about 52% of Saudi mobile web traffic in August 2026, per StatCounter. Tokenises Mada and international cards.
- Tabby: Regional BNPL leader, split-in-4 and pay-in-30 options. Settlement T+3.
- Tamara: Saudi BNPL provider with strong Saudi merchant adoption, similar settlement terms.
- International cards: Visa, Mastercard, Amex — increasingly used for online transactions; rarely the only method you'd offer.
Mada vs STC Pay vs Apple Pay vs Tabby — at a glance
| Method | Type | Typical fee | Dev effort | SAMA licence needed | Settlement | Best for |
|---|---|---|---|---|---|---|
| Mada | Debit | Percentage, capped per transaction | 3–6 weeks direct | Yes (or via aggregator) | T+1 | Everyone — required for in-Kingdom merchants |
| STC Pay | Wallet | Per merchant contract | 1–3 weeks | Yes (or via aggregator) | T+1 | Mobile-first, lower AOV, returning customers |
| Apple Pay | Wallet (tokenised cards) | Same as underlying card | 1–2 weeks | No extra | Same as underlying | iOS / Safari traffic, conversion lift |
| Tabby | BNPL split-in-4 | Merchant-paid, per contract | 1–2 weeks | No (Tabby is licensed) | T+3 | Fashion, electronics, AOV > SAR 200 |
| Tamara | BNPL pay-later | Merchant-paid, per contract | 1–2 weeks | No (Tamara is licensed) | T+3 | Same as Tabby; pair both for choice |
Fees move with volume and contract, so treat the table as a starting point. Mada merchant fees are a percentage with a per-transaction cap — for example, Tap Payments published its Mada rate as 1% capped at SAR 200 from September 2023 — while wallet and BNPL fees are set in each provider's merchant agreement. Get written quotes before you model margin.
Payment gateway options
HyperPay
The largest payment aggregator in Saudi Arabia. Supports Mada, Visa, Mastercard, STC Pay, Apple Pay, Tabby and Tamara through one integration. Hosted checkout or REST API. Strong for enterprise volumes.
Moyasar
Saudi-built gateway with the cleanest developer documentation in the market. Strong Mada integration, competitive fees, well-maintained client SDKs (PHP, Ruby, Node, Python). Good fit for SaaS and startups.
PayTabs
Regional gateway covering KSA, UAE, Egypt, Oman. Built-in fraud screening (PayTabs Shield). Multi-currency.
Checkout.com Saudi
Global gateway with a SAMA licence covering Saudi merchants. Best when you already use Checkout.com in another market and want one platform across MENA.
Integration architecture
We recommend a payment abstraction layer between your application and the gateway. The layer should:
- Normalise the API interface across Mada, STC Pay, card, Apple Pay, and BNPL flows.
- Verify webhooks (HMAC signature + replay window) and enforce idempotency on charge / refund.
- Manage retry logic for transient gateway errors (network 5xx, lock contention).
- Maintain a unified transaction log keyed by your own
order_idfor reconciliation against the gateway statement. - Simplify gateway migration — switching from HyperPay to Moyasar should be a config change, not a refactor.
SAMA, PCI and ZATCA — the rules you cannot skip
Payment processing in Saudi Arabia requires:
- SAMA Payment Service Provider compliance — directly licensed, or covered by a licensed aggregator.
- PCI DSS Level 1 for direct card data handling (most merchants outsource this to the gateway and stay at SAQ A).
- 3-D Secure 2.0 cardholder authentication on Mada online transactions — confirm the current requirement with your acquirer or aggregator.
- ZATCA e-invoicing (Phase 2) integration — every B2B standard tax invoice must be cleared through the Fatoora platform before it is shared with the buyer, and every B2C simplified tax invoice reported to Fatoora within 24 hours of issue.
- VAT at the 15% standard rate calculated and itemised on the receipt.
- Anti-money laundering transaction monitoring and reporting.
- Data residency — payment metadata for Saudi transactions stays in Kingdom or in an approved jurisdiction.
How Mantiqi can help
Mantiqi has built a high-volume e-commerce payment aggregator integrating the Easypaisa and JazzCash mobile wallets and deployed on AWS. For a Saudi gateway integration we would build on the architecture described above — abstraction layer, idempotent webhooks, statement reconciliation. From gateway selection to PCI scope reduction and the technical groundwork for SAMA filings, we can handle the implementation so you can focus on growing your business. Get in touch via the contact page to scope your integration.