The short answer

Embedded SME lending arrived in the Gulf as a mainstream product on 13 October 2026, from two directions on the same day. In the UAE, Botim launched Botim Business SME Lending: working-capital finance of AED 10,000 to AED 500,000, repayable over up to 12 months, offered inside the Botim Business app and, through a partnership with Geidea, to eligible LLCs and sole proprietorships in Geidea's UAE merchant network, with the lending done by Botim Finance, a finance company licensed by the Central Bank of the UAE. In Saudi Arabia, restaurant-software company Foodics made a strategic investment in Funding Souq, a SAMA-licensed debt-crowdfunding platform that already finances Foodics merchants through Capital 2.0, which pre-qualifies restaurants from their own sales data and collects repayments as small deductions from each daily settlement. The news is not "another fintech raised money". It is that SME credit is moving inside the software a business already runs on, and is underwritten on the transactions that software sees. That changes what the product team owns: the offer screen, the consent to share sales data, the disclosure of cost, and what happens when a repayment is missed. This guide reads the primary announcements and the SAMA and CBUAE rules as a product brief.

Key facts, with dates and primary sources

  • Botim Business SME Lending (UAE), 13 October 2026: financing of AED 10,000 to AED 500,000 with repayment terms of up to 12 months, for cash flow, payroll, equipment and expansion; risk assessment uses "transaction data, cash flow insights and credit behaviour provided during onboarding or, where available, through participating ecosystem partners"; the first rollout, with Geidea and other partners, is "estimated to reach more than 30,000 merchants"; "Financing is provided by Botim Finance and is subject to eligibility, credit assessment, applicable terms and conditions, and regulatory requirements." (Botim press release via ZAWYA, 13 October 2026; Aletihad, 13 October 2026)
  • Who lends in the UAE: Botim Finance LLC is "regulated by the UAE Central Bank with registration number CN-3762786" according to its own published lending terms, and Astra Tech lists July 2024 as the month Botim Finance received a full Finance Company License from the CBUAE. The profit or interest rate for SME Lending was not published in the launch material. (Botim Finance terms, CashNow site; Astra Tech)
  • Foodics × Funding Souq (Saudi Arabia and UAE), 13 October 2026: Funding Souq, "regulated by the Saudi Central Bank (SAMA) and the Dubai Financial Services Authority (DFSA)", announced a strategic investment from Foodics; the amount was not disclosed. Funding Souq will extend financing to Foodics' restaurant merchants "using restaurant sales and performance data to assess creditworthiness". Foodics intends to deploy USD 100 million through Capital 2.0 in its first year. (Funding Souq press release via ZAWYA, 13 October 2026)
  • Foodics Capital 2.0, launched 14 September 2026 at Money20/20 Middle East: pre-qualification from a restaurant's operational and financial performance with "an embedded AI layer handling the underwriting", funds "disbursed 24 hours after approval", amounts from about SAR 20,000 in working capital to SAR 2 million or more for expansion, repayments "through small deductions from each daily settlement", a first-year target of SAR 375 million, and Shariah-compliant financing in the Kingdom "provided through Funding Souq, as well as other financing partners licensed by the Saudi Central Bank". (Foodics press release, 14 September 2026)
  • Funding Souq's SAMA licence: SAMA licensed Funding Souq to provide debt-based crowdfunding on 3 April 2024, making it the tenth such company in the Kingdom. (SPA, 3 April 2024)
  • Saudi debt-crowdfunding rules: finance is limited to commercial enterprises registered in the Kingdom and may not be for consumer purposes; existing finance per micro, small or medium enterprise is capped at SAR 7.5 million unless SAMA does not object; repayment periods may not exceed 60 months; repayment must be electronic; the finance contract must state the term cost, the annual percentage rate (APR), the consequences of late payment and early-repayment procedures. (SAMA Rulebook, Rules for Engaging in Debt-Based Crowdfunding, Articles 25 to 28)
  • UAE SME conduct rules: the CBUAE SME Customer Protection Regulation (Circular No. 2/2026, issued 17 February 2026, addressed to all banks and finance companies) came into force on 13 September 2026. It requires bilingual Arabic and English disclosure, a Key Facts Statement acknowledged before the contract, written reasons for rejection, and help for customers in financial difficulty. (Lexis Middle East, Circular No. 2/2026; CBUAE Rulebook)

What happened on 13 October 2026: two launches, one pattern

Read side by side, the two announcements describe the same machine from opposite ends. Botim is a consumer super-app with a business suite (payment gateway, point of sale, payroll, Wage Protection System services and merchant acquiring) that now adds a loan product of its own, licensed in-house through Botim Finance, and then borrows distribution from a payments company, Geidea, whose terminals already sit on merchants' counters. Foodics is a restaurant operating system that processes orders, payments and settlements for its merchants, and it has chosen not to become the lender. It partners with a regulated platform, Funding Souq, and now owns a piece of it.

Both bets rest on one claim that every product team in this space should test rather than repeat: that the data a business generates inside your software is a better credit signal than the documents a bank asks for. Botim says its "AI-native capabilities" assess risk from transaction data and cash-flow insights. Foodics says Capital 2.0 identifies qualifying operators "automatically", "removing the need for a traditional application process". Funding Souq's chief executive called the result "Saudi Arabia's first fully automated business loan". That is the commercial claim. The product questions sit underneath it: which data, with whose consent, shown how, at what cost, and what the merchant sees when the answer is no.

What is embedded SME lending?

Embedded SME lending is business credit offered inside a non-bank product the business already uses, such as a point-of-sale system, a restaurant management platform, a payments app or an accounting tool, where the platform's own data feeds the credit decision and the platform's interface carries the offer. The lender is still a regulated institution. The difference is distribution and data. Instead of a business owner visiting a bank with twelve months of statements, the offer appears on the dashboard where they close the day's sales, often pre-sized, and repayment can be wired into the same money flow.

Three models now coexist in the Gulf, and they are worth naming precisely because the regulator, the disclosure duties and the failure modes differ:

  1. Platform as licensed lender. Botim Finance lends directly under a CBUAE finance-company licence; Botim Business is both the distribution and the balance-sheet brand.
  2. Platform as distributor for a licensed marketplace. Foodics surfaces the offer and supplies the data; Funding Souq, licensed by SAMA for debt-based crowdfunding, arranges the finance through Shariah-compliant structures.
  3. Platform as referral channel to banks. The software routes a business to bank products and the bank keeps the credit decision. Saudi Arabic search for "tamweel nuqat al-bay'" (POS financing) is dominated by this bank model: Google's suggestions on 14 October 2026 were Al Rajhi, the Social Development Bank, SNB (Al Ahli), Hala, Emkan, Alinma, Arab National Bank and Riyad Bank.

How does Botim Business SME Lending work, and what are the requirements?

From the launch material, the product works like this. Eligible micro and small businesses, including LLCs and sole proprietorships, can request AED 10,000 to AED 500,000 with up to 12 months to repay. Eligibility and the amount are assessed from transaction data, cash-flow insights and credit behaviour, which come either from what the business submits at onboarding or, "where available", from partners such as Geidea. Geidea extends the offer to eligible merchants in its UAE network. The money can be used for cash flow, payroll, equipment and expansion.

What the announcement does not say matters as much for anyone searching "Botim loan requirements" or "Botim loan interest rate in UAE". It does not publish the profit or interest rate, the fees, the documents required, whether collateral or a personal guarantee is needed, or the repayment mechanism. We will not guess. What we can say is where those answers must appear. Under the CBUAE SME Customer Protection Regulation, a licensed finance company must give a Key Facts Statement before the contract and obtain an acknowledgement, disclose fees and the consequences of late payment, and do so in Arabic and English. Botim Finance's published consumer lending terms already say that fees, including late-payment fees, will be set out "in the relevant Credit Agreement and the related key facts statement". If you are a merchant, the KFS is the document to read before you accept.

How does Foodics Capital 2.0 work with Funding Souq?

Capital 2.0 inverts the application. Instead of the restaurant asking for money, the platform scores restaurants continuously from their operational and financial performance and tells the ones that qualify. The operator picks terms in the Foodics app, completes the process online, and receives funds within 24 hours of approval. Amounts run from about SAR 20,000 of working capital to SAR 2 million or more for expansion, and the product also supports invoice factoring for suppliers. Repayment is the defining design choice: small deductions from each daily settlement rather than one larger monthly instalment.

Two numbers circulate and both are correct as stated. Foodics' September release targets SAR 375 million in the first year; Funding Souq's October release says Foodics intends to deploy USD 100 million in the first year. At the official peg of about 3.75 riyals to the dollar these are the same figure. Funding Souq separately says it is on track to facilitate USD 1 billion of SME financing over three years and has more than 10,000 investors on its platform.

The data-to-credit pipeline: what a POS or super-app can actually use

The engineering work behind "pre-qualified" is a data product, and it is where most of the risk sits. A restaurant POS sees gross sales by hour and day, order counts, average ticket, refunds and voids, payment mix (cash, mada or card, wallets, delivery aggregators), settlement amounts, tips, menu and branch changes, and how long the merchant has been on the platform. A super-app with acquiring and payroll sees card volumes, payouts, salary runs through the Wage Protection System and incoming transfers. From those, a credit model typically derives:

  • Revenue level and trend, smoothed for seasonality. In the Gulf this is not a footnote. Ramadan shifts restaurant revenue from lunch to iftar and late-night, Eid and school calendars create peaks, and summer depresses sales in some cities. A model trained on generic monthly averages will over-lend in peaks and decline good merchants in troughs.
  • Volatility and concentration: how much of revenue comes through one delivery aggregator or one branch.
  • Refund and chargeback ratios as an early warning of operational trouble.
  • Platform tenure and data completeness: a merchant who processes only part of their sales through the POS looks smaller than they are.
  • Existing obligations, which the platform cannot see on its own and must get from a credit bureau with the business's consent.

Three design rules follow. First, show merchants the inputs, not just the output: "Based on your last 6 months of sales through Foodics" is honest, explains a low limit, and gives the merchant a reason to route more sales through the system. Second, freeze the data window at the moment of the offer and store it with the decision, because both SAMA's rules (credit-assessment methods must be "clear, transparent and documented") and any complaint will need it. Third, separate the scoring service from the offer service, so that the lender, not the software company, owns the credit decision when they are different legal entities.

The offer screen: what the in-app loan card must show

The single most important screen in embedded lending is the pre-approved offer card on the dashboard. It is also where the business model is most tempted to blur things. The regulatory floors in both markets give a concrete checklist:

  1. Who the lender is, by legal name and licence, on the card itself, not three taps away: "Financing provided by Botim Finance LLC, licensed by the Central Bank of the UAE" or "Financing arranged by Funding Souq, licensed by SAMA". Both releases name the lender; the interface should too.
  2. The amount and term range, and whether the limit is firm or indicative.
  3. The total cost in money and as an annual rate. SAMA's crowdfunding rules require the finance contract to state the term cost and the APR. A daily-deduction product should also show the cost as a percentage of each settlement and an example: "If you sell SAR 8,000 a day, about SAR X is deducted". When the effective annual rate of a short, revenue-based advance is high, saying so plainly is cheaper than the complaint that follows.
  4. The Shariah structure, where stated. Funding Souq describes its products as Shariah-compliant; label the structure in plain words rather than a badge.
  5. How repayment works: fixed instalments or a share of daily settlement, and what happens on a day with no sales.
  6. What data was used and what will be shared with the lender and a credit bureau (see the consent section).
  7. Early repayment and its cost, which SAMA lists among required contract terms.
  8. What happens if a payment is late, before the merchant accepts, not after.

In the UAE, the CBUAE SME Customer Protection Regulation adds that disclosure must be in both Arabic and English, must not show only the positive aspects up front, and must be acknowledged before the contract through a Key Facts Statement. Our field note on that regulation turns its articles into screens.

Consent and data sharing between the software platform and the lender

Sharing a merchant's sales data with a lender is the step that makes embedded lending possible, and it is also the step most likely to go wrong. The legal analysis differs by market, and the product answer is the same in both: ask once, specifically, and make it easy to undo.

In Saudi Arabia, the Personal Data Protection Law protects natural persons. A limited company's sales totals are not personal data, but the owner of a sole establishment, the guarantor, the signatories and the customers inside an order history are. The PDPL Implementing Regulations require explicit consent when processing involves credit data and when decisions are made solely by automated processing (Article 11), and require controllers to obtain consent and notify data subjects of any request to disclose their credit data under the Credit Information Law (Article 27). A Capital 2.0-style flow that scores automatically and then shares data with a lender therefore needs a separate, explicit, logged consent, not a line in the platform's general terms. Our Saudi PDPL compliance checklist covers the consent ledger and withdrawal path.

In the UAE, the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) does not apply to "banking and credit personal data and information that is subject to legislation regulating the protection and Processing thereof" (Article 2(2)(f)), nor to free-zone entities with their own data law (Article 2(2)(g)), such as those in the DIFC. That does not mean no rules. It moves the duty to the CBUAE: the SME Customer Protection Regulation requires minimal data collection and lets customers make informed choices about consent to data use and sharing. For a super-app, the cleanest design is a sharing screen that names the recipient, lists the data categories (transactions, cash-flow summaries, bureau data), states the purpose and duration, and puts a revoke button in settings.

Do not hide the bureau. Botim Finance's published terms say it may obtain and report information to licensed credit bureaus including Al Etihad Credit Bureau (AECB); SAMA's crowdfunding rules require platforms to register a beneficiary's credit information with a licensed bureau once the beneficiary approves, and to decline the request without that approval. Searches like "botim finance credit bureau data" show that users already wonder about it. Say it on the offer card.

Who is the regulated lender? A regulator map

  • Saudi Arabia, debt-based crowdfunding (Funding Souq): licensed by SAMA under the Finance Companies Control Law and the Rules for Engaging in Debt-Based Crowdfunding. Beneficiaries are commercial enterprises registered in the Kingdom; finance may not be for consumer purposes; per-beneficiary cap of SAR 7.5 million for micro, small and medium enterprises; repayment up to 60 months; electronic repayment only; participants' money held in separate collection accounts; risk disclosures and a pop-up risk acknowledgement for participants; notification to participants within 72 hours of a default or an approved early repayment.
  • Saudi Arabia, other finance companies and banks: Foodics says it also works with "other financing partners licensed by the Saudi Central Bank". The bank POS-financing products that dominate Arabic search are bank credit, under bank regulation.
  • UAE, finance company (Botim Finance): licensed by the CBUAE; subject to the SME Customer Protection Regulation for SME customers, including sole proprietors.
  • UAE, DIFC (Funding Souq's DFSA side): a separate regulator and data-protection regime; the platform must keep the two customer journeys and their disclosures distinct.

Is debt crowdfunding different from a bank's POS financing?

Yes, in ways a merchant feels. A bank's POS-financing product is bank credit, usually requiring a bank relationship, statements and sometimes a guarantor, which is why the Arabic for "without a guarantor" appears in Arabic search suggestions. Debt-based crowdfunding in Saudi Arabia raises money from many participants, institutional and retail, through a licensed platform and lends it to a registered business under a finance contract. Under SAMA's rules a fund-raising campaign can run for up to 60 days, the business's information must be visible to participants for at least 24 hours before fund-raising starts, and funds go to the business within five working days of being fully raised. How an embedded product disburses within 24 hours of approval inside that framework is not explained in the releases; Funding Souq describes a separate "Infrastructure vertical" that provides "a regulated gateway to finance SMEs in Saudi Arabia". Product teams integrating with such a platform should ask the partner exactly which funding path their merchants are on, because it determines what the merchant must agree to be shown to investors.

Repayment from daily settlement versus fixed instalments

Deducting a share of each settlement is elegant: repayment flexes with sales, there is no due date to miss, and the platform that pays out the money is the one that collects. It also has costs that the interface must surface. The merchant's daily cash shrinks on every sale, which can surprise an owner who budgets from settlement. The effective cost depends on how fast the merchant sells, so a fixed fee repaid quickly is expensive when annualised. And if the merchant moves sales off the platform, repayment slows and the relationship sours.

Show a projected payoff date and update it daily. Show "deducted today" on every settlement line. Offer a cap on the daily percentage, and a clear early-repayment path. For fixed-instalment products like a 12-month Botim facility, the equivalent is an instalment calendar, an auto-debit consent that names the account, and reminders before, not after, the due date.

Failure states: declined, partly approved, and "loan not paid"

Google's suggestions for "botim loan" on 14 October 2026 included "not paid" and "is safe or not". People ask what happens when it goes wrong before they borrow. Design for those states first.

  • Declined: the CBUAE regulation requires the reason for rejection in writing, with narrow exceptions. Write a reason a business owner can act on ("We could not see at least 6 months of sales" rather than "Not eligible"), and say when they can try again.
  • Partly approved: explain why the limit is lower than requested and what would raise it.
  • First missed payment: the CBUAE regulation asks institutions to help proactively when payment irregularities first appear, offer restructuring, avoid excessive pressure in collection communications, and explain arrears consequences in writing before they happen. Under SAMA's crowdfunding rules, a default is defined as non-payment for more than 90 consecutive days, and participants must be notified within 72 hours of one. Use calm, specific language in Arabic and English. Our guide to failed payments without shame has patterns that transfer directly.
  • Bureau reporting: if repayment history is reported to AECB or a Saudi bureau, say so at the offer and again at the first late notice.

What this means for other SaaS and POS platforms in MENA

If you run vertical software for clinics, salons, retailers, logistics firms or schools in Saudi Arabia, the UAE or Egypt, these launches will reach your sales meetings within weeks: "Can your platform offer financing like Foodics?" A short go/no-go list:

  • Do you process enough of the customer's money (payments or settlements) to see revenue reliably, or only orders?
  • Can you name a licensed partner in each market, and agree in writing who owns the credit decision, the customer complaint and the collections process?
  • Can you capture explicit, per-purpose consent for data sharing and store it with a timestamp and notice version?
  • Can your settlement engine deduct repayments safely, with a cap and an audit trail?
  • Do you have bilingual disclosure copy reviewed by the lender's compliance team before launch?
  • Is your support team trained to answer "why was I declined?" and "why is my payout smaller today?"

If the answer to the first two is no, start with a referral model and earn the data.

Metrics that tell you it is working

  • Offer-to-acceptance rate, split by limit size and by whether the merchant opened the cost details.
  • Time from acceptance to funds received, against the promised window.
  • Share of merchants who read the Key Facts Statement or cost breakdown before accepting.
  • Early-arrears rate by cohort and by season (Ramadan cohorts versus others).
  • Complaints per thousand facilities, and the top three complaint reasons.
  • Consent withdrawals and their reasons.
  • Effect on churn: financed merchants should stay on the platform longer; if they leave, ask why.

Risks, trade-offs and honest limits

The releases do not publish pricing, fees, collateral rules or the full product terms for either product; we have not seen the in-app flows, and nothing here is a review of either company's actual screens. The SAMA rules quoted are from the SAMA Rulebook as published on 14 October 2026. We could not load the CBUAE Rulebook page from our network on 14 October 2026; the CBUAE provisions summarised here come from our reading of the text published at the regulation's entry into force and from the Lexis Middle East record of Circular No. 2/2026. Some versions of Funding Souq's release call Foodics a "major investor" and others its "largest investor"; the stake and amount were not disclosed. Automated underwriting on platform data can encode bias against merchants who sell in cash or through other channels, and a revenue-share repayment can hide a high annualised cost. Platforms gain stickiness from lending, and that is exactly why the merchant needs a clear exit. This article is product and engineering guidance, not legal or financial advice.

Related reading on iFynx

Frequently asked questions

What is Botim Business SME Lending?

It is a digital working-capital product launched by Botim on 13 October 2026 for micro and small businesses in the UAE, including LLCs and sole proprietorships. Eligible businesses can access AED 10,000 to AED 500,000 with repayment terms of up to 12 months. Financing is provided by Botim Finance, a CBUAE-licensed finance company, and Geidea extends the offer to eligible merchants in its UAE network.

What is the Botim business loan interest rate?

Botim did not publish a profit or interest rate, fees or collateral rules in its launch announcement. Under the CBUAE SME Customer Protection Regulation, a licensed finance company must give a Key Facts Statement with pricing, fees and late-payment consequences, in Arabic and English, and get the customer's acknowledgement before the contract. Read that document before accepting an offer.

How does Foodics Capital 2.0 financing work?

Foodics scores restaurants from their own sales and performance data and tells qualifying operators they are pre-qualified, without a traditional application. The operator chooses terms in the Foodics app and funds are disbursed within 24 hours of approval. Amounts range from about SAR 20,000 to SAR 2 million or more, and repayment is taken as small deductions from each daily settlement. In Saudi Arabia, Shariah-compliant financing is provided through Funding Souq and other SAMA-licensed partners.

What is debt-based crowdfunding under SAMA?

It is SAMA-licensed lending in which a platform raises money from participants and lends it to a commercial enterprise registered in Saudi Arabia under a finance contract. Consumer-purpose finance is not allowed, existing finance per small or medium enterprise is capped at SAR 7.5 million unless SAMA does not object, repayment may run up to 60 months, and the contract must state the term cost and the APR. Funding Souq was licensed for this activity on 3 April 2024.

What data does a POS platform share with a lender, and do I have to agree?

Typically sales, settlement, refund and payment-mix data, plus credit-bureau information. In Saudi Arabia, the PDPL Implementing Regulations require explicit consent for processing credit data and for decisions made solely by automated processing, and SAMA's crowdfunding rules require the business's approval before its credit record is checked and registered with a bureau. In the UAE, the CBUAE's SME rules require minimal data collection and informed consent choices. A well-designed product asks separately, names the lender and lets you withdraw consent.

Sources

Closing craft note

The easy headline is that Gulf SMEs can now borrow from their apps. The more useful one for builders is that the loan has become a feature of someone else's product, and features are judged by their worst day. A merchant who sees who is lending, what it costs per sale, which data was used and what happens if Ramadan is slow will trust the next offer. One who discovers those things from a smaller payout will not.

Originally published on iFynx.