What it is
What is a payment gateway, and what does building one involve?
A payment gateway is the system that securely captures a customer's payment details, checks and routes the transaction to the acquiring bank and card scheme, and returns an approval or decline to the merchant in seconds. In Saudi Arabia it has to support mada alongside international cards and wallets, handle 3-D Secure authentication, keep card data out of your systems through tokenisation, and reconcile every payment into your accounts.
Companies come to us for two different jobs. Integrating an existing gateway or bank is the fastest route for merchants, retailers and enterprises: the provider carries the card-data burden and we connect it to your checkout, ERP and ledger. Building your own gateway or orchestration layer makes sense for banks, fintechs, marketplaces and groups whose volumes and rules no off-the-shelf product fits.
Whether what you build needs a SAMA licence depends on what it does with money. A gateway that only provides technology sits outside the licensed payment services, while acquiring, aggregating merchants' funds, issuing wallets and open banking services are licensed activities. We design to the perimeter you choose and flag the questions for your counsel early.
Key facts
- Integrate
- Payment providers and gateways, bank APIs, ERP and e-commerce platforms
- Build
- Custom gateway or orchestration, merchant portal, settlement and reconciliation
- Methods
- mada, Visa, Mastercard, Apple Pay, STC Pay, SADAD and real-time bank transfers
- Banks
- Statements, bulk and payroll payments, open banking AIS and PIS
- Security
- Tokenisation, 3-D Secure 2, PCI DSS v4.0.1 scope reduction and fraud rules
Why now
Payments are the part of finance that cannot wait
Saudi Arabia is moving to digital payments faster than most markets, and the regulator keeps publishing new standards.
85%
of retail payments were electronic in 2025, up from 79% in 2024
SAMA
14.6 bn
electronic transactions in 2025, up from 12.6 billion in 2024
SAMA
Jul 2025
SAMA launched a new e-commerce payments interface for mada and international networks
As reported
Sep 2024
SAMA published the second release of its Open Banking Framework, covering payment initiation
SAMA
Sources: SAMA announcements and press coverage. Details of the e-commerce interface were still being finalised when reported; we follow SAMA's published specifications.
Architecture
How a payment flows through a gateway we build
Seven steps, usually under a few seconds, with every event recorded so finance can reconcile it afterwards.
Customer
Pays by mada, card, Apple Pay or STC Pay on web, app or POS.
Checkout
Hosted fields or an SDK, so card numbers never touch your servers.
Gateway core
Tokenises, runs 3-D Secure 2 and fraud rules, then routes the payment.
Acquirer and schemes
mada, Visa and Mastercard networks, with failover between acquirers.
Issuing bank
Approves or declines and returns the result in seconds.
Settlement
Funds and fee files arrive from the acquirer or provider.
Ledger
Payments, fees and refunds are matched and posted to your ERP.
- Principles
Card data stays out of your systems.
Failover across acquirers.
Every event reconciled.
What we build and integrate
From a checkout button to the ledger entry
Seven workstreams. Most projects combine three or four.
A gateway built around your rules, not a vendor's
For banks, fintechs, marketplaces and groups, we design and build the gateway itself: merchant onboarding, APIs and SDKs, a tokenisation vault, routing and failover across acquirers, 3-D Secure 2, risk rules, settlement and back-office tools.
- Merchant onboarding and multi-tenant accounts
- REST APIs, SDKs and hosted payment pages
- Tokenisation vault and network tokens
- Smart routing and failover across acquirers
- 3-D Secure 2 and configurable risk rules
- Settlement, ledger and merchant reporting
What you get
Control over payment flows, cost and customer experience.
Connect the right provider to your checkout
We integrate Saudi and international payment providers into websites, apps, POS and ERP: hosted fields, webhooks, refunds, voids and recurring billing, built so that one provider's outage does not stop your sales.
- We integrate whichever provider you choose, for example HyperPay, PayTabs, Moyasar, Tap Payments, Checkout.com or Geidea
- Hosted fields and SDKs that keep you out of PCI scope
- Webhooks, idempotency and retry handling
- Refunds, voids, partial captures and chargebacks
- Recurring billing and saved cards
- Multi-provider routing when volumes justify it
What you get
Live payments quickly, without carrying card data.
The payment methods Saudi customers expect
mada is the default for Saudi cardholders, and Apple Pay, STC Pay, international cards, SADAD bill payments and real-time bank transfers complete the picture. We implement each with the right authentication and settlement behaviour.
- mada debit cards, with 3-D Secure
- Visa and Mastercard credit and debit
- Apple Pay and other wallets
- STC Pay
- SADAD bill presentment and payment
- Real-time bank transfers over SARIE through your bank
- Buy now, pay later through SAMA-licensed providers
What you get
Higher approval rates and a checkout that feels local.
Your bank and your ERP, speaking the same language
We connect finance systems to Saudi banks for statements, payments and reconciliation: host-to-host, SFTP and API connections, the statement formats each bank provides, and payment files for suppliers and payroll.
- Host-to-host, SFTP and API connectivity
- Statement import in MT940, camt, CSV and bank-specific formats
- Bulk supplier payments and payroll payment files
- Virtual accounts and reference matching
- Approval workflows and dual control
- Audit trail for every instruction
What you get
Bank data flowing into the ledger without re-keying.
Open banking, as SAMA's framework defines it
SAMA's Open Banking Framework covers account information services and payment initiation. We build the consent, token and API layers for fintechs and banks, and test against SAMA's Open Banking Lab.
- Account information services (AIS) integration
- Payment initiation services (PIS) integration
- Customer consent capture and management
- Secure token handling and API gateways
- Testing in SAMA's Open Banking Lab
- Monitoring and audit logging
What you get
Open banking features that follow the framework from day one.
Every payment matched, every fee posted
Settlement files, fees, refunds and chargebacks are matched to orders and invoices automatically and posted to the ledger, with an exceptions queue for the few items that need a person.
- Auto-matching of payments to invoices and orders
- Settlement and fee posting to the ledger
- Refund, chargeback and dispute handling
- Multi-provider and multi-currency reconciliation
- Exceptions queue with ageing
- Reports for finance and audit
What you get
A close that does not wait for payment reconciliation.
Secure by design, tested before it handles money
We keep card data out of your systems wherever possible, design to PCI DSS v4.0.1 and SAMA's cyber security expectations, and build fraud controls that stop abuse without blocking good customers.
- Hosted fields and tokenisation to reduce PCI DSS scope
- 3-D Secure 2 authentication
- Velocity, device and amount rules
- Encryption, key management and access control
- Logging, monitoring and alerting
- Penetration testing with our security practice
What you get
A payment flow your security team and your bank will sign off.
How we work
From requirement to live payments
Payments projects fail at the edges: licensing, certification and reconciliation. We deal with those first.
Scope and licence check
We agree what you need to build or integrate, the volumes and methods, and check the design against the SAMA licence perimeter and your acquirer's rules.
Design
Architecture, data flows, security model, PCI DSS scope and reconciliation design, with the provider or bank specifications in hand.
Build
Gateway components or integrations, with idempotent APIs, retry logic, logging and a back office for support and finance.
Certify and test
Provider and bank UAT, 3-D Secure and scheme test cases, security testing and finance sign-off on reconciliation.
Go live
A phased launch with limits, monitoring and a rollback plan, then ramp up volumes.
Operate
Monitoring options, support, reporting and continuous improvement of approval rates and costs.
Reference
Build, integrate or buy, and what the regulator says
Three tables we use in the first workshop with every client.
Build, integrate or buy?
| Option | Best for | What you get | What you carry |
|---|---|---|---|
| Integrate one provider | Merchants, retailers and ERP users | A fast launch; the provider handles card data and most compliance | Provider fees and dependence on one provider |
| Orchestrate several providers | Higher volumes, marketplaces and groups | Routing, failover, cost control and one integration for many providers | More engineering and reconciliation across providers |
| Buy a gateway platform and customise | Mid-size providers and enterprises | Speed, with some control over rules and flows | Licence costs and vendor dependency |
| Build your own gateway | Banks, fintechs and large platforms | Full control of rules, experience and economics | PCI DSS scope, licensing questions and 24/7 operations |
Does it need a SAMA licence? A guide
| What you are building | Typical position | Notes |
|---|---|---|
| A gateway that links merchants to acquirers and provides technical support only | A technical service, outside the licensed payment services | Still subject to acquirer, scheme and security requirements |
| Merchant acquiring: settling funds to merchants | A licensed payment service (payee transaction acquiring) | Requires a SAMA licence |
| Payment aggregation or facilitation | A licensed payment service | Requires a SAMA licence |
| An e-wallet or stored value | A licensed activity (electronic money) | Requires a SAMA licence as an e-money institution |
| Payment initiation or account information (open banking) | Licensed payment services | A licence, plus participation in SAMA's Open Banking Framework |
| Buy now, pay later | A licensed finance activity | Offered through SAMA-licensed providers |
A summary of SAMA's Implementing Regulations for the Law of Payments and Payment Services (June 2023). It is not legal advice: confirm your model with SAMA or your counsel.
Payment methods in Saudi Arabia
| Method | What it is | Good to know |
|---|---|---|
| mada | Saudi Arabia's national debit card scheme, operated under SAMA | The default for Saudi cardholders, for e-commerce and POS |
| Visa and Mastercard | International credit and debit cards | Use 3-D Secure 2 for online payments |
| Apple Pay | A wallet that works with mada and international cards | Needs domain verification and merchant set-up |
| STC Pay | A digital wallet | Offered alongside cards at checkout |
| SADAD | The national bill presentment and payment system | Used for bills and recurring obligations |
| SARIE | SAMA's real-time interbank payment system | Bank transfers through participating banks |
Built for Saudi Arabia and the GCC
Payments built to what SAMA expects
The Saudi payments rulebook has changed quickly. We keep projects aligned to the version in force.
- SAMA
Law of Payments and Payment Services
Licensing and conduct rules for payment services under SAMA's Implementing Regulations (June 2023). We scope your design against the licence perimeter before you build.
- Open banking
Open Banking Framework
Account information from the first release (2022) and payment initiation from the second release (September 2024), with testing in SAMA's Open Banking Lab.
- E-commerce
The e-commerce payments interface
SAMA's July 2025 interface moves e-commerce integration towards common specifications for mada and international networks. We follow the published requirements as they are finalised.
- PCI DSS
PCI DSS v4.0.1
The only valid PCI DSS version since 31 December 2024, with the future-dated requirements mandatory from 31 March 2025. Architectures that keep card data out of scope are cheaper to certify.
- Cyber security
SAMA Cyber Security Framework and NCA
Financial institutions in the Kingdom work to SAMA's cyber security framework and the NCA's controls. We design logging, access and resilience to match.
- PDPL
Data residency and PDPL
Payment and customer data are personal data. We design storage, retention and transfers to meet the PDPL and your sector's residency rules.
Where we deliver
Riyadh · Jeddah · Dammam & Al Khobar · Madinah · the Eastern Province · Dubai & the UAE · Qatar · Kuwait · Bahrain · Oman
Clients
Banks and regulated organisations that trust GoAgile
A selection of the financial institutions and public bodies we deliver for in Saudi Arabia.
- Al Rajhi BankFinancial AI reporting
- GIBBanking client, Saudi Arabia
Saudi Credit Bureau (SIMAH)ZATCA Phase 2 e-invoicing
Why GoAgile
Why teams build payments with GoAgile
Payments have no quiet hours. These are the habits that keep money moving and books balanced.
We build and we integrate
Custom gateways and orchestration for platforms that need control; integrations for teams that need speed. We tell you honestly which you need.
Bank and ERP experience
Statement formats, payment files, reconciliation rules and ERP posting are everyday work for us, not edge cases.
Security from the first design
Tokenisation, 3-D Secure 2, PCI DSS v4.0.1 scope reduction and fraud rules are designed in, not added later.
Licence-aware design
We map what you build against SAMA's licensed payment services early, so a surprise does not arrive after launch.
Reconciled by design
Every payment, fee, refund and chargeback is matched and posted, with an exceptions queue instead of spreadsheets.
Saudi first, GCC ready
mada, SADAD, SARIE and Arabic experiences, with multi-currency and regional providers for the wider GCC.
More from GoAgile
Explore our other financial services
Invoices, books and payments are one flow of money. Each service stands on its own and works better with the others.
- e-Invoicing | KSA, UAE & OmanConnect your ERP, POS and custom systems to ZATCA in Saudi Arabia and, through our accredited service provider channels, to the UAE and Oman: clearance, reporting, archiving and 24/7 support.View
- Accounting & Financial ServicesAccounting platforms set up for Saudi VAT, Zakat data and IFRS, with a clean month-end close and management reporting.View
- Systems & API IntegrationConnect finance systems to the rest of the business with secure, monitored integrations.View
- ERP ServicesOdoo, Dynamics 365, SAP, Oracle, Zoho and TallyPrime, implemented and supported by dedicated teams.View
Planning a gateway, a provider switch or a bank integration?
Tell us what you accept, how much, and where it needs to land in your books. We will propose build, integrate or buy with the trade-offs written down.
Plan a payments projectQuestions answered
Payment Gateway & Banking Integration FAQs
Can you build a custom payment gateway?
Do I need a SAMA licence to run a payment gateway?
Which payment methods can you integrate in Saudi Arabia?
How long does a payment gateway integration take?
What is PCI DSS and how do you reduce our scope?
What is open banking in Saudi Arabia?
How do you connect our ERP to our bank?
Can payments be reconciled automatically?
What is SAMA's e-commerce payments interface?
How do you prevent fraud and chargebacks?
Talk to a payments specialist
Tell us what you accept, your volumes and your bank or provider. We will respond with a scoped approach.
Why GoAgile for payments?
Engineers who build gateways and connect banks and ERPs every day.
- Gateway development and provider integration
- Bank and ERP connectivity with reconciliation
- PCI DSS v4.0.1-aware, licence-aware design
- Support after go-live