How to Integrate with Saudi Banks: Server Requirements

Saudi Bank Integration Requirements

Integrating with Saudi payment gateways and banking systems requires meeting strict technical and security requirements. These requirements are not optional — failing to meet them means rejection or service termination.

This guide covers integration requirements for Saudi Arabia's major payment gateways: mada, Noon Payments, and others.

The Golden Rule: Saudi Server Is Mandatory

SAMA (Saudi Central Bank) requires that financial data of Saudi users be processed on servers within the Kingdom. This is a regulatory requirement, not negotiable.

Banks and payment gateways verify:
- IP address submitted in the integration request
- ASN (Autonomous System Number) — must be Saudi
- SSL certificate and its issuing authority
- Transaction data storage mechanism

mada Requirements

Technical Requirements

# 1. SSL/TLS
# - TLS 1.2 minimum
# - Certificate from internationally recognized CA
# - HSTS enabled

# 2. PCI-DSS Compliance
# - Never store card data
# - Use Tokenization only
# - Complete audit trail

# 3. Network requirements
# Static Saudi IP registered in the integration request

nginx Configuration for mada Requirements

# /etc/nginx/conf.d/payment-security.conf
server {
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384;
 ssl_prefer_server_ciphers on;

 add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
 add_header X-Frame-Options DENY always;
 add_header X-Content-Type-Options nosniff always;
 add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'" always;

 location /checkout {
 add_header Cache-Control "no-store, no-cache, must-revalidate" always;
 add_header Pragma "no-cache" always;
 }
}

Noon Payments Requirements

# Registration requires:
# - Valid Saudi commercial registration
# - Saudi IBAN for transfers
# - Static Saudi server IP
# - Domain linked to the business
# - Valid SSL (not self-signed)

class NoonPaymentService
{
 public function initiateOrder(Invoice $invoice): array
 {
 $authHeader = base64_encode(
 sprintf('Key_%s:%s:%s',
 config('noon.business_id'),
 config('noon.app_name'),
 config('noon.app_key')
 )
 );

 $response = Http::withHeaders([
 'Authorization' => "Basic {$authHeader}",
 'Content-Type' => 'application/json',
 ])->post(config('noon.base_url') . '/order', [
 'apiOperation' => 'INITIATE',
 'order' => [
 'reference' => (string) $invoice->id,
 'amount' => $invoice->total / 100,
 'currency' => 'SAR',
 'channel' => 'Web',
 'category' => 'webstore',
 ],
 'configuration' => [
 'returnUrl' => route('portal.payment.callback'),
 'locale' => 'en',
 'paymentAction' => 'SALE',
 ],
 ]);

 return $response->json;
 }
}

PCI-DSS Database Configuration

// Migration: never store card data
Schema::create('payments', function (Blueprint $table) {
 $table->id;
 $table->foreignId('invoice_id');
 $table->string('gateway_order_id');
 $table->string('gateway_reference');
 $table->string('token')->nullable; // secure token, NOT card number
 $table->decimal('amount', 10, 2);
 $table->string('currency', 3)->default('SAR');
 $table->string('status');
 $table->string('payment_method')->nullable;
 // Never: card_number, cvv, expiry_date
 $table->timestamps;
});

Audit and Logging Requirements

# Every financial transaction must be documented
# SAMA requirement: retain records for 5 years

# Dedicated payment log in nginx
log_format payment_log '$time_iso8601 $remote_addr '
 '"$request" $status $body_bytes_sent '
 '$request_id $request_time';
access_log /var/log/nginx/payments.log payment_log;

# Protect payment logs
chmod 640 /var/log/nginx/payments.log

SAMA Compliance

Saudi Central Bank (SAMA) requirements:
- Financial data stored in Saudi Arabia
- Daily encrypted backup
- Transaction records for 5 years
- Encryption for data at rest and in transit
- Annual security review (for large integrations)

On cloud.net.sa Servers

cloud.net.sa in Riyadh and Jeddah meets all SAMA requirements:

• Data stored within the Kingdom
• Static Saudi IP (400 SAR/year)
• uptime عالي مع ضمان تعاقدي guaranteed by contract
• Daily backup included in all plans

With a dedicated IP and a contractually documented SLA, you can apply for payment gateway accreditation with confidence.

Summary

Integration with Saudi banks requires serious compliance. Saudi server, static IP, strict HTTPS, and comprehensive logs — these are not technical details but regulatory requirements. Do things correctly from the start and you will avoid rework later.