Blockchain & Web3 Development Company in Riyadh

Budget tracks the build, and the build is usually one of three: a scoped permissioned-chain proof of concept at Riyadh rates, a production tokenisation platform (real-estate fractional ownership, sukuk tokenisation, supply-chain provenance for Aramco affiliates), or full sovereign-grade interbank settlement networks aligned with Project Aber patterns. Scope drivers include regulatory mapping, a working consortium network on Hyperledger Fabric or Besu, one smart-contract suite with Sharia screening if Islamic finance is in scope, and an audit-ready evidence pack for SAMA or CMA review. Riyadh rates carry a sovereignty and Sharia-advisor premium because qualified Sharia screeners, NCA-cleared engineers, and CMA-experienced legal counsel are scarce. We quote fixed fees in SAR with a milestone schedule.

SAMA has consistently warned against unlicensed virtual-asset trading for retail consumers, and the Capital Market Authority (CMA) governs any token that meets the legal test for a security. There is no general crypto licence regime today, and unlicensed retail exchange businesses are not permitted. That said, SAMA has run Project Aber (wholesale CBDC with the UAE Central Bank) and continues exploring wholesale digital-currency patterns, PIF giga-projects are exploring asset-backed tokens for international investors, and supply-chain provenance is unregulated infrastructure work. We build inside that envelope: permissioned consortium chains for banks, asset-backed tokens with CMA-aligned legal structuring and Sharia advisor sign-off, and non-financial blockchain infrastructure. We do not build unlicensed exchange products or retail trading platforms in KSA.

Sharia compliance is enforced at three layers in our Islamic-finance tokenisation work. At the legal layer we structure the underlying asset and SPV with Saudi or Bahraini Sharia counsel to ensure the offering itself is permissible (asset-backed, no riba interest, no gharar excessive uncertainty, no maysir gambling, no haram underlying business). At the smart-contract layer we encode AAOIFI standard requirements into Solidity or Corda contract logic, including profit-and-loss sharing for musharakah and mudarabah structures, ijara lease mechanics with proper asset transfer, and sukuk certificate accounting that reflects true asset ownership rather than debt. At the operational layer every smart contract ships with a Sharia advisory board sign-off, a screening pipeline that filters incoming counterparties and underlying assets, and an event log that the Sharia auditor can review quarterly. We have worked with Saudi-licensed and GCC-recognised Sharia advisors and we will introduce you to a panel if you do not have one.

Yes. Project Aber, run jointly by SAMA and the UAE Central Bank with technical leadership inside Saudi Arabia, demonstrated a working permissioned-chain wholesale CBDC capable of real-value cross-border interbank settlement on Hyperledger Fabric variants with central-bank-controlled validators, atomic settlement, and confidentiality features. We build adjacent patterns (not the CBDC itself, which is sovereign work): interbank reconciliation rails between Saudi banks on a permissioned Fabric or Besu network, trade-finance letter-of-credit tokenisation on R3 Corda, supply-chain finance rails for SAMA-licensed financiers, and sukuk tokenisation that interoperates with sovereign-CBDC settlement if and when SAMA opens that infrastructure to commercial participants. Architecture defaults to SAMA Cyber Security Framework level 3 or 4 controls and the NCA ECC plus CSCC dual-stack mapping when the workload is classified as critical.

PIF giga-projects (NEOM, Red Sea Global, Diriyah Gate, Qiddiya, ROSHN) are exploring fractional ownership of completed assets (hotels, branded residences, retail) for accredited international investors. The legal wrapper is typically a Saudi or Cayman SPV that owns the underlying property and issues digital certificates representing fractional beneficial ownership, with CMA security-token rules governing offering and trading. We build the SPV-backed token contract on Polygon Supernets or a permissioned Corda network, with KYC and AML gating tied to Nafath government identity for Saudi residents and to international KYC providers (Sumsub, Onfido) for foreign investors. Secondary trading runs through a CMA-licensed venue (not a public DEX) with Fireblocks or BitGo institutional custody. Distribution of rental yields and capital gains happens on-chain with PDPL-compliant investor records. Sharia sign-off is mandatory because most Saudi accredited investors require Sharia certification.

Aramco and its Dhahran-headquartered downstream and petrochemical affiliates buy provenance and chain-of-custody pipelines for petrochemical exports, lubricants distribution, and supply-chain finance for cleared Saudi Customs shipments. We build permissioned Hyperledger Fabric or Besu networks with Aramco, the downstream affiliate, freight forwarders, customs agents, and counterparties as validators. Every shipment writes immutable events (origin, refinery batch, inspection certificates, customs clearance, port handoff, final delivery) signed by the responsible party. Integration with Aramco operational-technology systems follows IEC 62443 zones-and-conduits with a strict one-way data diode from OT into the blockchain ingest layer. Carbon-credit tokenisation aligned with the Saudi Green Initiative runs on the same network. PDPL Article 29 governs any personal data (driver names, signatures) in the chain, so we encrypt PII at the field level with off-chain key custody.

Tabby (Riyadh-headquartered, valued above USD 1B post-2023) and Tamara (Riyadh-headquartered, backed by SNB Capital and Sanabil) dominate Saudi BNPL split-payment checkout. On-chain settlement is an emerging pattern for merchant reconciliation across the Mada switch and for cross-border settlement when the BNPL provider, the merchant, and the consumer-financing bank operate in different GCC jurisdictions. We build permissioned settlement smart contracts that reconcile Tabby and Tamara installment cashflows against merchant payouts, expose webhook-driven settlement events to the BNPL provider's existing reconciliation stack, and produce SAMA-acceptable evidence trails for the annual SAMA reviewer audit. The financing tranche stays with the SAMA-licensed lending partner; the blockchain layer is reconciliation and provenance, not a regulated lending product. Sharia screening is applied because Tabby and Tamara products are structured to be Sharia-compliant for the Saudi market.

Saudi Arabia's Personal Data Protection Law (PDPL) became fully enforceable in September 2024 under SDAIA and NDMO. The hard parts for blockchain are the right to erasure (immutable chains cannot delete data) and Article 29 cross-border transfer (validators or nodes outside the Kingdom touching Saudi personal data). We design around both. Personal data is never written on-chain in plaintext; we write field-level encrypted commitments with off-chain key custody inside AWS me-central-2 Dammam, so the right to erasure is honoured by destroying the off-chain key (rendering the on-chain commitment cryptographically unreadable). Validators for permissioned chains live in-Kingdom (AWS me-central-2 Dammam, GCP me-central2 Dammam, or sovereign Saudi data centres like STC Center3 or Mobily Bayanat) so cross-border transfer does not arise. Every engagement ships with a PDPL data-protection impact assessment, an NDMO four-tier classification of every field, and an SDAIA-ready record of processing activities.