Enter the Quantum State
Burraq Quantum

Commercial due diligence · Riyadh

Commercial due diligence for fintech companies in Riyadh

We test whether a Riyadh fintech's growth story holds up before money moves. That covers funded accounts, payment volume and the pipeline with banks and large groups, for investors and for founders who are raising.

Enter the Quantum State

The problem

In Riyadh fintech, the growth story usually rests on one of two numbers, and both can mislead. A consumer lending app or a neobank, which offers accounts through an app with no branches, can show strong install growth while most new users drop out at know your customer (KYC) identity checks and never fund an account. The figure that matters is conversion to funded account. Next to it sits customer acquisition cost, meaning what it takes to win each funded customer. Many firms cannot show either clearly.

B2B fintechs that sell to banks, government-linked companies and large private groups face a different gap. These buyers decide at senior levels, often through several rounds of review, and government buyers often follow formal procurement. A pipeline can look full while deals sit in security and compliance review for a long time. A forecast that assumes quick closes needs testing against how these buyers actually buy.

Then there is what the company depends on. Many fintechs run on a partner bank or a card network. Many also need a license from SAMA, the Saudi Central Bank, or authorization from the Capital Market Authority for investment-related services. Claims about AI in fraud, underwriting or support may rest on a third party's model. Before you invest, you need to know which parts of the story the company controls.

What you get

  • Market and position: Where the company really competes across payments, lending, wealth or infrastructure sold to banks, and how large that segment is in Saudi Arabia.
  • Customer interviews: Merchants, users, banks or corporate buyers on why they chose the product, what they pay and what would make them switch providers.
  • Funnel and revenue quality: Conversion to funded account, payment volume, churn, discounting, and how much revenue rests on a few large bank or group contracts.
  • Go-to-market behind the plan: Whether the sales cycle, approval layers and procurement steps of Riyadh buyers fit the timeline the plan assumes.
  • AI claims tested: For fraud, underwriting or support, what the company built itself and what runs on a third party's model.
  • Plan stress test and report: Unit economics, lifetime value and the main risks tested, with early calls on deal stoppers and a written report for your investment committee.

What it looks like

A payments company serving Riyadh merchants

An investor is weighing a payments company that sells to mid-size merchants through a small sales team and reports fast growth in payment volume. In a case like this, merchant interviews often show volume concentrated in a few accounts, with some merchants trialing other providers. The pipeline may rest on deals stuck in security review after a good first demo. The investor then sees revenue quality clearly and can weigh that risk in the deal before committing.

A B2B fintech selling software to Saudi banks

A founder preparing a Series A has a plan built on AI agents that handle support and back-office checks for bank clients. Diligence separates what the team built from the third party's model underneath. It tests whether the controls can be explained to a cautious bank buyer under Saudi data and cybersecurity rules. It also checks whether the bank pipeline fits how long approvals take. The founder goes to investors with a plan that matches the evidence.

The rules that apply in Riyadh

SAMA, the Saudi Central Bank, oversees banking, payments and the licensing of financial technology firms. The Capital Market Authority (CMA) covers securities markets and investment-related financial services. Which applies depends on what the company does. Where a plan assumes a license it does not yet hold, we flag it as a commercial risk for your legal advisers. For tokenized or crypto-related products, the position depends on the activity and the regulator, and should be confirmed for each case.

The Personal Data Protection Law (PDPL), overseen by SDAIA, governs how customer data is collected, used, stored and transferred. The National Cybersecurity Authority sets national standards, including the Essential Cybersecurity Controls. AI governance here is a mix of data law, sector regulators and SDAIA's published AI ethics principles. We test AI claims against that mix and suggest you confirm current requirements.

How we work with companies in Riyadh

We work with fintech companies and their investors in Riyadh from Dubai, and we have no office in Riyadh. Decisions here are formal and relationship driven. Where we can, we arrange customer and market interviews through introductions from the company or the investor. Habib Mehmoodi, our founder, brings more than 20 years building and selling B2B technology across five regions to the commercial questions behind each deal.

Questions

Do you review a fintech's SAMA license or other regulatory approvals?

No. We do not do legal or regulatory due diligence, and we work alongside the advisers who do. We look at the commercial side. That means whether the growth plan depends on a license, a partner bank or a permission the company has not confirmed, and what that means for revenue. Those questions go to your legal advisers early.

How long does commercial due diligence on a Riyadh fintech take?

It depends on the deal, the questions and the access we get. We agree the timeline in the scope before work starts. Interviews with senior buyers in Riyadh can take longer to arrange, so we plan for that. Anything that could stop the deal is raised the day we find it.

Can a fintech founder use this before raising a Series A?

Yes. It shows founders their story the way an investor will see it. We test conversion to funded account, payment volume, the pipeline with banks and large groups, unit economics and AI claims. Then we show where the evidence is thin, so you can prepare for the hard questions before investors ask them.

More for Fintech in Riyadh

Start here

Start witha straightanswer.

A 30-minute call to see whether we can really move your numbers. You leave with a clear next step, even if we never work together.

Enter the Quantum State