Payment Gateway Integration Saudi Arabia (2026 Guide)

A vendor-neutral 2026 buyer's guide to payment gateway integration in Saudi Arabia — Mada routing, STC Pay, Apple Pay, Tabby and Tamara — with the Ijjad PAYGATE-5 Scorecard™, real merchant outcomes from Riyadh and Jeddah, and engineer-day estimates per platform.

Look — if you sell online in Saudi Arabia and your checkout does not natively route Mada, you are quietly declining nine out of ten Saudi debit cards before the customer even reaches the OTP screen. That is the single most expensive mistake we see Riyadh and Jeddah founders make, and it is also the easiest to fix once you understand how the Saudi payment stack actually works in 2026.

Here's the thing — “payment gateway integration in Saudi Arabia” is not a checkbox. It is a five-layer decision: which gateway, which payment methods, which BNPL, which compliance posture, and which platform (Salla, Zid, Shopify, WooCommerce, or custom). Get one layer wrong and you either bleed conversion or trigger a SAMA finding. Get them right and your authorization rate jumps double digits inside a quarter.

This is the guide we wish existed when we shipped our first Saudi checkout in 2019. It is opinionated, vendor-neutral, and built on a live audit of the Google + Bing SERP for “payment gateway integration saudi arabia” — every competing page measured, every gap documented. Ijjad has integrated HyperPay, Moyasar, Tap Payments, and Checkout.com across more than a dozen Saudi e-commerce builds since 2019. We disclose that bias openly in a dedicated section below, and we tell you exactly when a competitor will beat us on your specific project.

The 60-second answer for Saudi merchants

For a fast-launch SME in Riyadh or Jeddah: use HyperPay or Moyasar as your primary gateway, enable Mada + Apple Pay + STC Pay + Visa/Mastercard at minimum, layer Tabby or Tamara for BNPL, and budget five-to-twelve engineer-days for full integration. SAMA licensing sits with the gateway — you do not need your own licence unless you are operating funds yourself.

• Mada is non-negotiable. Over 90% of Saudi card-based transactions route through Mada (SAMA, 2026). Skip it and you lose them.
• BNPL is now table-stakes. Tabby or Tamara — pick at least one. Both push 35-40% of KSA checkout share.
• SAMA licence sits with the gateway. Pick a SAMA-licensed PSP (HyperPay, Moyasar, Tap, PayTabs) and you inherit compliance.
• Integration effort: 5-12 engineer-days for managed gateways on Salla/Zid/Shopify, 12-25 days for custom Next.js or WooCommerce.

Moyasar Payment Integration in Saudi Arabia — Full Setup Walkthrough

Watch on YouTube

A practical walkthrough of integrating Moyasar — one of the two Saudi-native, SAMA-licensed gateways we recommend by default. The setup pattern shown here (sandbox keys, callback URLs, webhook signing) is the same conceptual shape for HyperPay, Tap, and Checkout.com — only the SDK names change.

Why Mada changes every integration decision

Most Saudi customers carry a Mada-branded debit card issued by their local bank — Al Rajhi, Saudi National Bank, Alinma, Riyad Bank, and so on. When they enter that card at checkout, the transaction does not travel the Visa or Mastercard rails. It routes through the Saudi Payments Network (Mada), a domestic switch operated under SAMA supervision.

If your gateway only certified Visa/Mastercard and never bothered with Mada certification, the customer's issuing bank receives an out-of-network request. The result is either an instant decline or a soft decline with a generic “contact your bank” error. The customer assumes your site is broken. They leave.

This is exactly why a vendor decision that looks fine on the brochure can collapse in production. Stripe, for example, has no Mada acquiring in Saudi Arabia today — it can take Visa/Mastercard issued abroad, but a Riyadh shopper using a Saudi debit Mada card will fail at the gateway level. That is also why every serious Saudi merchant uses HyperPay, Moyasar, Tap, PayTabs, or Checkout.com instead.

The Ijjad PAYGATE-5 Scorecard™

To make this comparison repeatable, we score every gateway on five dimensions — the same scorecard we run internally when picking a stack for a new Saudi client. Each dimension is weighted 1-5; the total is out of 25.

Side-by-side: every major Saudi payment gateway compared

Every row below uses public pricing as of May 2026, plus our own engineering experience integrating each platform. Where pricing is “negotiated only”, we mark it explicitly — opacity is itself a data point.

Two patterns jump out. First, the spread on engineer-days is wider than the spread on per-transaction fees — meaning your gateway choice affects launch timeline more than it affects unit economics. Second, the gateways with the cleanest Mada + Apple Pay + STC Pay native trio (HyperPay, Moyasar, Tap) also happen to be the ones with the best PAYGATE-5 scores. That correlation is not accidental.

HyperPay — the enterprise default for Saudi merchants

HyperPay is the gateway we recommend by default for any merchant doing more than a few hundred transactions a month. They are SAMA-licensed, PCI DSS Level 1, and ship native Mada acquiring with Saudi-bank settlement that lands in your account in one-to-two business days. Their SDK quality is the best in the region — Java, .NET, PHP, Node, Python, plus first-party iOS and Android libraries.

Best for: mid-market and enterprise Saudi e-commerce, brands needing predictable T+1 settlement, anyone running a custom Next.js/Laravel/Rails stack rather than Shopify or Salla.

Watch out: sales-led negotiation. The standard rate is around 2.5% + SAR 1, but bigger merchants negotiate down. Smaller merchants get the rack rate. Their docs are excellent but their dashboard analytics lag behind Moyasar.

Signature angle: HyperPay's “COPYandPAY” widget is the cleanest hosted-fields experience in the region — PCI-safe, brand-customisable, ~3% conversion lift over standard hosted checkout in our experience on Saudi catalog stores.

Moyasar — the Saudi-native, publicly-priced choice

Moyasar is the only major Saudi gateway that publishes Mada pricing on the homepage. That alone tells you something about the team — they bet on transparency as differentiation and they have stuck with it for nine years. SAMA-licensed, PCI DSS Level 1, Saudi-headquartered, Saudi-staffed support. The Authorization speed on Mada is the fastest we have measured in production.

Best for: Saudi-first SMEs, founders who want to launch in days not weeks, anyone on Salla / Zid / Shopify / WooCommerce / custom Laravel.

Watch out: dashboard exports are limited compared to HyperPay; reconciliation for finance teams requires a bit of plumbing. Also: Moyasar's opinionated Mada-first stance means non-KSA card volume runs a touch lower than Tap or Checkout.com.

Signature angle: public Mada pricing at ~2.5% means your CFO can model unit economics on day one. We have used Moyasar on Riyadh fashion and Jeddah grocery merchants — sub-30-second decision-to-live for new payment methods.

Tap Payments — the regional GCC operator

If your business operates across Saudi, UAE, Kuwait, Egypt — Tap is the move. One contract, one dashboard, one reconciliation file. Their Shopify integration is the deepest in the region; we use it for any client running a multi-country Shopify Markets setup.

Best for: GCC-wide merchants, Shopify shops that want zero custom integration code, retailers expanding from KSA into UAE or vice-versa.

Watch out: the per-transaction floor (SAR 0.30) hurts low-AOV stores. For an average basket under SAR 50, that floor adds an extra 60 basis points on top of the percentage rate. Run your blended cost before signing.

Signature angle: goSell hosted checkout + goCollect for invoicing — a two-product combo we lean on heavily for B2B GCC clients who need both online checkout and email-based collection.

PayTabs — the largest local processing volume

PayTabs has been around the longest among Saudi-headquartered PSPs and has the largest local card processing volume — a moat in itself. SAMA-licensed, PCI DSS Level 1, native Mada and STC Pay.

Best for: high-volume Saudi merchants who can negotiate hard on rates, B2B platforms that need invoicing-style flows alongside cart checkout.

Watch out: pricing is negotiated only — no public rate card, which means smaller merchants tend to pay more than they realise. Settlement timeline can extend to T+5 on the standard plan. SDK ergonomics lag Moyasar and HyperPay.

Signature angle: PayTabs PayPage (hosted) is genuinely battle-tested at scale; the underlying infrastructure has carried major Saudi retail volume since the early 2010s. Ijjad disclosure: we have not personally shipped a build on PayTabs. Our experience with it is via client handoff, not greenfield integration — so weigh our score accordingly.

Checkout.com — the technical heavyweight

Checkout.com is the gateway of choice if your engineering org is sophisticated, your volume justifies interchange-plus pricing, and you need fine-grained control over routing, retries, 3DS challenges, and tokenization. We have shipped two Saudi builds on Checkout.com — both were custom Next.js + Stripe-style headless checkout where the team needed maximum flexibility.

Best for: enterprise merchants with in-house payments engineers, multi-country merchants who want one global vault, anyone optimising for sub-100ms authorization latency.

Watch out: contracts are sales-led and start at meaningful monthly volume. Mada acquiring runs through a Saudi acquirer partner — the routing works but settlement and chargeback flows pass through one extra hop. For a Saudi-only merchant doing under USD 1M/year, the complexity is not worth it.

Signature angle: their Adaptive Authentication routes 3DS challenges based on issuer profile, which we have measured driving 5-8 percentage points of incremental authorization rate on cross-border Saudi cards.

Amazon Payment Services — the legacy default

Amazon Payment Services (formerly PayFort) is the gateway many older Saudi stores still run because they integrated it before HyperPay and Moyasar matured. Native Mada, native Apple Pay, SAMA-licensed, PCI DSS L1, T+2-T+3 settlement.

Best for: existing PayFort merchants who want to stay put without re-integration, stores already on Amazon ecosystem partnerships.

Watch out: the dashboard UI feels dated, support response times have lengthened, and the SDK is showing its age (we still ship PHP and Node integrations but the iOS/Android stories are weaker). For a new Saudi build in 2026, we would not start here.

Signature angle: longevity. If your CFO wants “the established option”, Amazon Payment Services is it. Just price the engineer-time tax of an older SDK into the decision.

MyFatoorah — the invoicing-first option

MyFatoorah is genuinely interesting for any merchant whose checkout flow looks more like “send an invoice” than “present a cart”. B2B services, education, healthcare, professional consultancies. PCI DSS L1, native Mada and STC Pay, multi-country GCC coverage.

Best for: B2B Saudi merchants, education and professional services who invoice rather than sell from a cart, hybrid checkout-plus-collection flows.

Watch out: consumer-facing checkout UX is less polished than HyperPay or Moyasar. If your business is pure D2C retail, you have better options. Settlement on the standard plan is T+3.

Signature angle: SMS-and-WhatsApp payment links generated from a dashboard — surprisingly effective for service businesses that close on chat, especially in Riyadh where WhatsApp Business is the default sales channel.

Stripe — why it does not work for Saudi-resident merchants in 2026

This question comes up in every kickoff call so we will answer it directly. Stripe is not currently licensed by SAMA to acquire payments for Saudi-resident merchants. You can sell to Saudi customers via Stripe if your business entity is incorporated elsewhere — but Mada acquiring will not work, STC Pay will not work, and your Saudi bank will not settle directly into your local account.

Practically: for a startup with a Cayman or Delaware entity selling SaaS into Saudi, Stripe is fine for the international card portion of your revenue. For a Saudi-CR company invoicing Saudi customers and trying to take Mada, you need a SAMA-licensed PSP. That is not a Stripe limitation — that is how the Saudi payments licensing regime works, and it applies equally to every non-licensed international processor.

BNPL — when (and how) to layer Tabby and Tamara

BNPL hit 35-40% of KSA e-commerce checkouts in early 2026 (Astute Analytica / Yahoo Finance, 2026). For any catalog AOV above SAR 200, leaving it off the checkout is leaving money on the table — and Sharia-compliant structure means uptake is broader than in Western markets.

Tabby originated in the UAE, holds unicorn valuation, and runs strong in Saudi luxury and fashion. Merchant Discount Rate sits in the 2.79%-5.99% band depending on category and tenor. Native Shopify + Salla + Zid + WooCommerce plugins; a clean REST API for custom builds.

Tamara doubled down on Saudi from day one. Tamara removed late fees entirely to land 100% Sharia compliance, which has solidified its share among conservative KSA buyers. MDR runs 2.5%-6%. Deep integrations with Jarir and SHEIN; Saudi-first product team in Riyadh.

Our take: enable both. The marginal engineer-time is roughly two days for the second integration once the first is in place, and we routinely see 8-15% incremental conversion uplift from offering both rather than one. If you can only pick one, Tamara for Saudi-only stores with conservative buyer base; Tabby for fashion or lifestyle with GCC-wide ambition.

SAMA + PCI DSS — what your gateway choice actually covers

This is where most blog posts on this topic stay vague. Here is the concrete breakdown.

Saudi payment licensing flows from the Implementing Regulations of the Law of Payments and Payment Services. If you are accepting card payments online, the SAMA-licensed entity in the chain is your Payment Service Provider (HyperPay, Moyasar, Tap, PayTabs, Amazon Payment Services, MyFatoorah). You — the merchant — do not need a SAMA licence to operate. You inherit the PSP's licensing posture for the activity you perform through their rails.

PCI DSS works the same way. PCI DSS Level 1 certification is held by the PSP. Your obligation as a merchant depends on how you implement checkout:

• Hosted redirect (PayPage / hosted checkout) — PCI scope is minimal (SAQ A). Cheapest path for compliance.
• Hosted fields (COPYandPAY-style iframe) — SAQ A-EP scope. Modest annual work, but full visual control.
• Direct API (you handle the PAN) — SAQ D / full QSA audit. Only worth it if you absolutely cannot lose UX control. Annual cost meaningful.

For 95% of Saudi merchants, hosted fields is the right answer. You get a branded checkout that looks like your site, your PCI scope stays small, and your engineer-time investment is reasonable. We typically lean on HyperPay COPYandPAY or Moyasar's Components for this.

One more thing: SAMA Cybersecurity Framework sits on top of PCI DSS for any entity holding customer data. Aligned with PCI DSS, ISO 27001/27002, NIST, ISF, and Basel — Saudi-specific enforcement applied on top. Practically, this means your hosting environment (whether self-hosted or PaaS) needs a defensible posture: encryption-at-rest, access logging, change management. Salla and Zid handle this implicitly. Shopify and custom builds need you to do the work.

Original SERP audit — measurable data from every competing page

Before writing this guide, we ran a live audit of the Google + Bing top results for “payment gateway integration saudi arabia”. The dimensions measured: Word count, Schema types, FAQ count, image density, missing angles. We Audited every page in the SERP — here is the original data table from that audit, not opinion.

Read this table not as a humblebrag — it is more useful as a diagnostic. The dominant gap across the SERP is the combination of fee transparency, integration effort estimates, and SAMA compliance walk-through. Most pages cover one or two; almost none cover all three. That is the wedge.

Engineer-day estimates by platform

If you are picking your platform first and your gateway second, this table maps roughly how long full integration takes — including testing, sandbox setup, ZATCA invoice handoff, and Mada/Apple Pay/STC Pay/BNPL all live. Engineer-days are by a mid-senior full-stack engineer familiar with the gateway. We deliberately do not quote retail SAR fees here — implementation is per-project and we price on scope, not on a price-list.

The honest read: if you are on Salla or Zid, payment integration is essentially free engineer-time and you should choose your gateway on settlement and authorization quality, not on integration cost. If you are on custom code, your gateway choice quietly determines two-to-four weeks of your launch timeline. Build the spreadsheet, then choose.

What we have shipped — real Saudi outcomes (anonymized)

Who's actually behind this guide

Karam Abdalqader — Ijjad founder. 10+ years shipping web and e-commerce platforms — including work on national-scale digital products across 10+ Saudi ministries, plus the Saudi National Design System.

Full bio · Saudi National Design System case study

Our Amman office: Amman, Jordan. Hours: Sunday-Thursday 9am-6pm. WhatsApp / phone: +962 79 565 0502.

Where this ranking might be biased

Honest disclosure — we owe you this. Ijjad has shipped on HyperPay, Moyasar, Tap, and Checkout.com directly. We have not shipped a greenfield PayTabs build. Our PayTabs experience is via client handoff and competitive benchmarking, not first-hand integration scars. That means our PayTabs score has more uncertainty than the others.

Three other places we might be biased:

• We score HyperPay first by default. That is because we have shipped more HyperPay than anything else. There are scenarios where Moyasar is the better pick (Saudi-first SMEs prioritising transparent pricing) — we say so in the deep-dive, but a different agency with a different track record would honestly rank Moyasar #1.
• We are skeptical of Stripe for Saudi-resident merchants. That is a regulatory reality, not a Stripe critique. If SAMA licensing changes, we will update this guide.
• We did not score Tabby vs Tamara head-to-head as a dedicated category. Both belong on your checkout. A dedicated BNPL-only post would weight them differently — read the Salla vs Zid vs Shopify comparison for the platform-side of BNPL fit.

The PAYGATE-5 Scorecard is itself opinionated — it weights authorization quality and engineer-effort more than fee absolutism. If you are a price-optimiser CFO, you would weight differently. Use the framework, but recalibrate weights for your situation.

Download — the Ijjad Saudi Payments Readiness Checklist

Authoritative references we lean on

• SAMA Rulebook — Payment Systems and Payment Services Providers (regulatory primary source)
• Schema.org — PaymentService type (for structured data tagging)
• web.dev — Payment and address form best practices (Google's checkout UX guide)
• Google Pay API documentation (now Mada-integrated since October 2025)

Related Ijjad reading for Saudi e-commerce teams

• E-commerce development in Saudi Arabia — full build-side scope for KSA stores
• Salla vs Zid vs Shopify for Saudi retailers — platform-side companion to this gateway guide
• Shopify vs WooCommerce for Saudi retailers — for Saudi merchants on international platforms
• Best e-commerce development companies in Saudi Arabia (2026) — who to hire

Frequently asked questions

Where to go from here

If you are mid-build and stuck on gateway choice, the fastest path to a clean answer is a 30-minute scoping call. We will run your scenario through the PAYGATE-5 Scorecard, pull engineer-day estimates for your platform, and tell you the honest answer — including if the right call is to do nothing and stay on what you have.

For broader context, read our Saudi e-commerce development overview or our Jeddah e-commerce case study. To start a project, get in touch via Get Started.