What I Think About When I Walk Around Riyadh

I've been walking a lot lately.

Sometimes with purpose. Mostly without. The city has a rhythm you only pick up when you leave the car behind and move at the speed of your own feet. You notice the uneven curbs. The cats under the parked SUVs. The way three-story buildings stretch out for kilometers in every direction. The mosque that was here before the compound next to it. The compound that was here before the café on the corner.

I think of it as a kind of meditation. I'm not solving anything on these walks. I'm just letting my mind sit with things long enough to feel them properly. And the thing I keep sitting with, the thing I can't stop turning over, is how deliberate all of this is. Nothing I'm seeing is an accident.

Someone wrote a rule. And the rule wrote the city.

Once you see that, you can't unsee it. Every building height. Every sidewalk width. Every vendor license. Every apartment minimum. Every fintech that exists. Every fintech that doesn't. There's a document somewhere, probably sitting quietly in a government gazette, that made this particular thing possible and ruled out a hundred alternatives. The regulator is the biggest product manager in this market, and they shipped the product a long time before any of us started walking through it.

That's the frame I want to hold for the rest of this post. Not because I think every rule is wrong. Plenty of them are extraordinary. It's because I think we've collectively forgotten to ask a very important question:

What if this was a choice, and what if we made it differently?

Let me walk you through three places I've been sitting with.

---

1. ساما and the fintech that exists on paper

I've spent enough time in Saudi fintech to see what the SAMA framework actually produces on the ground, not what the slide deck claims.

Here's what you find if you look inside a typical licensed fintech in Riyadh.

A CTO who is Saudi, because the framework requires it. A Head of Security who is Saudi, because the framework requires it. A compliance officer, a risk officer, a BCM lead, all Saudi, all present, all carrying the titles the framework asked for.

And then, quietly, you find the actual engineers. Most of them are not in this office. Most of them are not in this country. They are in Cairo or Islamabad or Bangalore or Kyiv, connected through a VPN, pushing code to a repo that the Saudi team reviews on its way in and its way out. The Riyadh office becomes a kind of gateway. Check-in, check-out, tickets moving through a pipeline, most of the real building happening somewhere else.

For the roles the framework insists on keeping onshore, there's a second workaround. People flown in from Dubai every two weeks. They sign. They review. They certify. They leave.

I want to say something carefully here, because I am not trying to criticize the teams doing this. Every one of them is following the rules as written. This is what the framework rewards. This is what the framework built.

But step back for a moment. Really step back.

Is this what we wanted?

We wrote a framework that requires specific onshore roles because we wanted Saudi capability. What we got was Saudi titles around offshore work.

We wrote rules for security because we wanted the financial system to be safer. What we got was a pattern of certified signatures on systems built by people who will never walk into a Saudi data center.

I don't think the framework is bad. I think the framework is incomplete. It optimized for the layer it could measure, meaning licenses, titles, physical presence, and didn't measure the thing it was really trying to build: a Saudi fintech engineering culture.

Now ask yourself: what would we write if we were designing this from scratch today?

Maybe we'd stop counting heads and start counting commits. Maybe licensing would tier around how much of the actual product is being built by people who live here. Maybe we'd subsidize Saudi technical bootcamps tied directly to fintech apprenticeships instead of, effectively, subsidizing Dubai flights. Maybe the framework would grow teeth around capability transfer. Real, measurable, code-level transfer. And it would let companies figure out the rest of the org chart on their own.

And then there's the data.

SAMA regulations are, at their deepest level, data regulations. The localization rules created local cloud regions. They created a local compliance industry. They moved enormous amounts of financial data inside the kingdom, which was the intended outcome, and a good one.

But there's a layer the framework hasn't focused on yet: the citizen's view. What if the localization rules came with a citizen-facing dashboard? What if you could see, in one place, every entity that has access to your financial data and what they've done with it? We have the capability. We've already built Absher and Tawakkalna. We know how to do citizen-facing transparency when we decide we want to.

Do we want to?

That's the question I keep sitting with.

---

2. منافسات الحكومة and the five-CR trick

The second thing I can't stop thinking about is how government procurement actually works in this country.

If you've never sat near it, here's the trick nobody puts in a presentation.

A serious vendor does not enter the Saudi market with one commercial registration. They enter with five. Sometimes ten. Enough that they can field multiple "competing" partners on the same tender, all of them, quietly, routing to the same software behind the scenes.

The buyer is going to end up with GitLab anyway. Or ServiceNow. Or Oracle. Or SAP. The product was decided long before the tender opened. What the framework does is force a performance: multiple local partners "competing" for the implementation, each with its own CR, its own pricing, its own local-content score. The scoreboard says we ran a fair competition. The reality is that the outcome was determined the day the product was selected.

I am not saying this is corrupt. Most of the people I know who play this game are honest, hardworking operators trying to win in the system as designed. The framework produced this behavior. The framework rewards this behavior. The actors are rational.

But, again, is this what we wanted?

اعتماد and the Local Content & Government Procurement Law were designed to do two things: make procurement transparent, and grow Saudi capability through preference multipliers. Both are real goals. Both are worth pursuing. Neither is being served by a market where five CRs pretend to compete while one foreign product gets purchased.

And the costs are real.

Every layer of ceremonial competition adds weeks to procurement cycles. Every fake-competitive tender trains a generation of consultants to be very good at paperwork and not very good at building anything. Every multiplier that rewards headcount without rewarding capability is a tax on the future, paid in exchange for a number that looks good today.

Here's another flaw worth naming. The framework pretends that "local content" and "capability" are the same thing. They're not. A 100-person local services firm that resells the same foreign product for a decade has high local content and almost no durable capability. A 10-person local team that has built one real product of their own has low local content on paper and extraordinary capability in reality. We're scoring the wrong thing.

What would a better version of this look like?

Maybe it would measure local content the way SAMA should measure onshore engineering: by the thing itself, not by its proxy. How much of the code was written here? How many Saudis shipped a feature this quarter? How much of the operational runbook was authored in Riyadh? How much of what the vendor sells can actually be owned, extended, and maintained by Saudis after the contract ends?

Maybe we'd shrink the tender theater. If the buyer already knows the product, say so. Put the evaluation into which local partner is actually going to implement this well, and score that seriously. Less paperwork. More honesty. More Saudi engineering talent rewarded for real work.

Maybe we'd build public dashboards for every multi-million-riyal tender showing what was bought, who implemented it, and what happened two years later. Did the system actually work? Did the local partner actually gain capability? Did the money buy us anything durable?

This is another one of those places where the framework is trying to do the right thing and ending up somewhere else entirely. Not because anyone is acting in bad faith. Because the incentives point where they point.

---

3. Why is Riyadh only three floors?

The third thing, and the one I think about most, because I can literally see it while I'm walking, is the shape of the city itself.

Why is Riyadh mostly three floors?

Drive in any direction. You'll see the same thing. A low, sprawling carpet of villas and three-story apartment blocks running to the horizon. A few tall towers clustered downtown and along King Fahd Road. In between, an enormous amount of underused vertical space, enforced by zoning rules that most people have never read.

Now walk the same streets. You'll notice something else: the cars. Every wall of every villa is surrounded by a chaotic accordion of double-parked vehicles, because the villa itself was built without any meaningful parking. The sidewalks, or rather, the absence of them. Most residential streets in Riyadh are walled car corridors with almost no space for humans. You can't walk to the shop. You can't walk your kid to school. You can't walk at all, in most places, because the infrastructure was not built for you.

Why?

Because the rules were written for a city where everyone drives, no one walks, and three floors was what the building codes of the 1980s decided was appropriate for residential blocks. Those rules have been updated, slowly. But the city we live in today is still largely shaped by the old ones.

Take the parking rule. About a decade ago we allowed one underground parking level, and that single change effectively gave a building one extra floor above ground. It was a good change. Real progress. But the question I keep walking past is: why did we stop at one? Why not two underground levels? Why not three? Every level underground is a level of chaos taken off the street. Every level is another family that doesn't have to leave its car on the pavement in front of someone else's wall. The engineering isn't exotic. Most serious cities in the world build five, six, ten underground levels without drama.

Now imagine the same plot of land. Same square meters, same block, same neighborhood. Built differently.

Imagine a five-story building with three levels of underground parking, enough for every resident and every visitor, with no one ever needing to park on the street. Imagine that building fronted by a real sidewalk, shaded by trees, wide enough for a stroller and a wheelchair to pass each other without anyone stepping into the road. Imagine the same block with a bakery on the corner, because the zoning allowed mixed use and the residents above would walk down for their morning bread.

Now imagine a cluster of those blocks near a metro station, and ask yourself why on earth we still require parking minimums for buildings within walking distance of transit. The answer: we wrote the rule before the metro existed, and we never fully went back and updated it. The city is still paying the cost.

Why not ten floors in some districts? Why not twenty? Why not, in the right places, a hundred?

I know the usual answers. Water capacity. Electricity grids. Sewage. Emergency access. Conservative planning preferences. Aesthetic character. Every one of those is a real constraint. None of them is a permanent one. Dubai does not have better bedrock than Riyadh. Singapore does not have magic water. The reasons Riyadh is three floors are not geological. They are regulatory, and they were chosen.

So let me ask the question that might make some people uncomfortable.

What kind of city do we actually want?

Because the city we have right now is the city our regulations asked for. A car-dependent, low-density, hard-to-walk, hard-to-cycle, hard-to-meet-your-neighbor-on-the-sidewalk city. That's what the rules produced. The rules can produce something else.

I am not saying tear everything down and build Manhattan. I am saying the regulator is the biggest product manager in this city, and the product can be redesigned.

---

So what are we actually talking about?

Three different places. Fintech offices, government tenders, the streets outside my building. And one shared pattern.

In each case, we wrote rules because we wanted something. Safer finance. Fairer procurement. Orderly growth.

In each case, the rules produced something. A compliance theater around offshore work. A competitive theater around predetermined products. A car-dependent sprawl that nobody fully intended.

None of this is anyone's fault. Regulations are written by people doing their best with the knowledge they had at the time. The work is iterative. The first draft is never the last.

But the invitation I want to leave here is simpler than any specific fix:

When you encounter a system that doesn't feel right, ask what rule built it.

The rule was a choice. A choice can be made differently. The people who understand this, in any industry, in any country, are the ones who don't just complain about the city they live in. They ask who wrote the blueprint, and whether the blueprint is up for revision.

The regulator is the biggest product manager we'll ever have. The city is the product. So is the fintech sector. So is the procurement system. So is the street outside your window.

What would you change, if someone handed you the pen?