Is Rizk Legal and Safe in Saudi Arabia? Evidence Review

Short answer: Rizk has a current Malta Gaming Authority record for Zecure Gaming Limited that lists rizk.com, but that record does not establish permission in Saudi Arabia. A primary regional report states that casinos, including internet casinos, are prohibited in Saudi Arabia. The evidence therefore supports an amber signal: the foreign licence and official domain can be checked, while Saudi legality, account eligibility and any individual withdrawal outcome must not be inferred from that licence.

Evidence verdict for Saudi Arabia

The available records answer several different questions, and they should not be collapsed into one claim. The MGA register supports the connection between Zecure Gaming Limited, a current B2C licence and the domain rizk.com. It does not establish Saudi authorisation. Separately, the MENAFATF mutual evaluation report records that casinos, including internet casinos, are prohibited in Saudi Arabia. That legal context is more directly relevant to a person located in the Kingdom than the existence of a foreign gaming licence.

Calling the brand simply “legit” or “a scam” would go beyond the records. The evidence establishes an identifiable licensed entity and a listed domain under the Maltese record. It does not establish Saudi-resident eligibility, a successful withdrawal test, the safety of a particular transaction or the outcome of an individual dispute. User reports about verification, withdrawals and service are contextual allegations rather than findings that apply to every account.

What the MGA licence proves—and what it does not

The MGA verification record, checked on 4 September 2026, displays Zecure Gaming Limited with Licensed status and B2C licence number MGA/CRP/1117/2025-02. It also records rizk.com among the associated domains. This is primary evidence for the foreign regulatory identity and the precise domain relationship.

The scope boundary matters. The MGA entry is not evidence of Saudi authorisation, and it should not be presented as one. It also cannot prove that a Saudi resident is eligible to open or use an account. Eligibility is not established by the supplied record, and the operator’s terms do not establish it either. The licence likewise does not demonstrate that a specific deposit or withdrawal will succeed.

A sensible licence check compares three exact elements rather than relying on a badge or promotional statement: the legal entity, the licence number and the domain. Here, the primary register supplies all three for the Maltese record. If any displayed domain differs from rizk.com, the available evidence cannot authenticate it. For broader distinctions between foreign registration and Saudi status, consult the Saudi legal-status guide.

Saudi legal status takes priority over foreign licensing

The regional legal record is direct: the MENAFATF report on Saudi Arabia records that casinos, including internet casinos, are prohibited in the Kingdom. The report does not assess a personal account, decide a contractual dispute or establish conduct by Rizk. Its relevance is the Saudi legal setting, not an operator-specific accusation.

This creates a crucial distinction. A company can appear in a foreign regulator’s register while that registration still does not amount to permission in Saudi Arabia. The supplied MGA record and the Saudi legal record are not interchangeable. One identifies a Maltese-licensed entity and domain; the other records the prohibition applicable to casinos, including online casinos, in Saudi Arabia.

Because the records answer different questions, the amber signal is not a safety certification. It indicates that some identity evidence is open and verifiable while material issues remain unresolved for the Saudi context. Anyone seeking a directory comparison can use the operator evidence directory without treating inclusion as legal approval.

Official domain and identity checks

The strongest domain fact in the packet is narrow and useful: the MGA register lists rizk.com. The operator terms also name Zecure Gaming Limited, company number C69036, and the current MGA licence. Agreement between the primary register and operator statement supports an identity cross-check, although the operator terms remain an operator-authored source rather than an independent regulatory finding.

Use the following sequence when checking whether a destination matches the supplied record:

1. Read the hostname exactly, including spelling and the final domain ending.
2. Compare it with rizk.com, the domain recorded by the MGA source.
3. Compare the named company with Zecure Gaming Limited.
4. Compare the displayed licence number with MGA/CRP/1117/2025-02.
5. Do not treat a visual badge, copied company name or similar-looking address as equivalent to the primary register.

This process verifies consistency with the supplied identity record only. It does not resolve Saudi legality, personal eligibility, payment acceptance, account access or withdrawal performance. A different hostname falls outside what these records authenticate and should not be assumed to be an official mirror or authorised alternative.

Account verification, KYC and account locks

The operator’s terms describe rules concerning accounts, betting and support. The available evidence does not enumerate the documents requested, processing times, language support or a guaranteed sequence for verification. Those details must not be invented. It is therefore possible to explain the evidence boundary without predicting what will happen to a particular account.

User-context material contains dated reports concerning KYC, withdrawals and service. Those reports are unverified and cannot be generalised across all users. A report can show that somebody made an allegation; it cannot, by itself, prove the underlying events, establish fault or forecast another account’s result.

If an account is locked or verification is pending, keep a factual record of what is visible and what was communicated. Useful records include the account identifier used in correspondence, the date of each message, the exact request received, the response supplied and any reference number. Do not alter documents or state that a check has been completed unless the operator confirms that outcome. The purpose of this record is to preserve the sequence of events, not to assume why access changed.

Withdrawal evidence and payment risk

No personal withdrawal test is part of the evidence. The operator terms do not prove the result of any individual cash-out, while the user-report source cannot establish that every allegation is accurate or representative. Claims such as “instant withdrawals,” “guaranteed payment” or “withdrawals never work” would all exceed the record.

For a disputed transaction, separate facts into four categories: what the account displayed, what the operator communicated, what a payment statement records and what remains unconfirmed. Record dates, amounts exactly as shown, transaction references and complaint references. Avoid converting an estimate, pending status or user report into a confirmed outcome.

The Saudi Central Bank consumer-protection rules apply to institutions under its supervision. They require clear complaint channels, a reference number and fair handling, and they warn about unlicensed financial entities. Those rules do not grant a casino licence. The SAMA complaint service can receive a complaint concerning a supervised bank or payment company after the transaction and prior complaint have been documented. It does not decide a direct contractual claim against a foreign casino.

The distinction determines where a complaint belongs. A question about a regulated bank or payment company is not the same as a dispute over an operator account. The payment-risk guide explains how to organise transaction records without promising recovery or presuming liability.

Complaint routes and evidence preservation

Begin with a concise chronology. State what happened, when it happened, what amount or account status was displayed, which rule or response is relevant, and what resolution is requested. Ask for a complaint reference and preserve the response. The operator terms describe account, betting and support rules, but the evidence does not establish the result of a complaint submitted under those rules.

If the concern specifically involves a Saudi-regulated bank or payment company, the SAMA complaint service is relevant after documenting the transaction and the complaint made to that institution. SAMA’s rules require supervised institutions to provide clear complaint channels, reference numbers and fair handling. This route should not be described as a mechanism for deciding a direct contractual claim against a foreign casino, because the supplied primary record expressly limits that inference.

How to interpret user reports

The supplied user-context source aggregates dated reports about KYC, withdrawals and service. These reports can identify questions worth documenting, but they are not regulatory decisions, verified case files or proof of a general pattern. Positive and negative posts alike must not replace primary evidence.

When reading a report, distinguish the writer’s stated experience from facts independently established by a competent source. Check whether the report identifies dates, account status, requested action and a final outcome, but do not assume those details have been verified. Do not transfer one person’s allegation to another account or use it to label the entire business a scam.

Equally, the MGA licence should not be used to dismiss an individual complaint automatically. The licence supports entity and domain identification; it does not adjudicate a user’s withdrawal, KYC review or account lock. Both overstatement and dismissal would exceed the evidence.

A practical decision checklist

Before making any decision, apply the records in the correct order:

• Saudi context: recognise that the MENAFATF report records casinos, including online casinos, as prohibited in Saudi Arabia.
• Identity: match Zecure Gaming Limited, licence MGA/CRP/1117/2025-02 and rizk.com against the primary MGA register.
• Eligibility: do not infer that a Saudi resident is eligible from the foreign licence or operator terms.
• Payments: do not infer deposit availability, bank treatment or a withdrawal result where the evidence does not supply one.
• Complaints: distinguish an operator-contract dispute from a complaint concerning a Saudi-regulated bank or payment company.
• User reports: treat them as unverified context rather than findings applicable to every account.

The evidence signal remains amber because the primary MGA record supports the identity of a foreign-licensed entity and its recorded domain, while the same record does not establish Saudi permission. The Saudi legal source records a prohibition, and the supplied material leaves individual account, verification and withdrawal outcomes open.

Continue to the supplied destination

If gambling is causing distress or loss of control, use the gambling-help resources. That support route is separate from determining a licence, payment complaint or legal status.

rulebook.sama.gov.sa

Frequently asked questions