Financial Compliance Guide for Saudi Arabia, an Emerging Hub in the Realm of Technology and Finance

In the Kingdom of Saudi Arabia, fintechs and financial institutions are expected to maintain strict compliance with anti-money laundering (AML) regulations, as outlined by the Anti-Money Laundering Law (AMLL) and supervisory guidelines issued by the Saudi Central Bank (SAMA). These regulations are consistent with the Financial Action Task Force (FATF) global standards.

Saudi Arabia enforces a risk-based approach (RBA), where institutions must prioritise enhanced due diligence (EDD) for high-risk customers and transactions. The Saudi Central Bank conducts regular inspections and has imposed fines for non-compliance, particularly for inadequate risk assessments and outdated models.

Fintechs are expected to implement robust AML compliance programs as part of their licensing conditions, including real-time transaction monitoring aided by AI and machine learning technologies to detect subtle laundering patterns. Regulators promote innovation and have established fintech sandboxes that facilitate the testing of new digital payment solutions and open banking APIs under strict governance and data localization rules.

Key obligations for fintechs and financial institutions include:

Complying with the AMLL and SAMA AML guidelines.
Implementing thorough customer due diligence (CDD) and know-your-customer (KYC) procedures.
Monitoring transactions continuously with advanced AML technologies.
Reporting suspicious activities to the Saudi Financial Intelligence Unit (SAFIU).
Complying with sanctions and terrorism financing screening regulations.
Participating in regulatory sandboxes and adhering to data localization.
Cooperating regionally on AML/CTF efforts under MoUs and FATF frameworks.

Non-compliance can lead to significant fines and criminal penalties, reflecting the Kingdom’s rigorous stance on combating money laundering and terrorism financing. Leniency may be granted if a criminal reports associates, leading to arrests or seizures of funds, instrumentalities, or proceeds of the crime.

Annual testing of supervisory tools is required to ensure effectiveness and adequacy. A Money-Laundering Compliance Officer (MLCO) must be appointed by the financial institution's board to fulfil the AML/CTF compliance function.

Institutions affected by AML regulations in Saudi Arabia include banks, exchange bureaus, investment companies, insurance companies, commercial companies, sole proprietorships, and companies engaged in vocational and other similar activities. Violation of AML regulations may result in up to 15 years imprisonment. A Saudi citizen convicted of money laundering will be banned from travelling outside the country for a period similar to the prison sentence.

If third parties process, collect, or manage client information, businesses must collect all necessary information from them. Financial institutions are obligated to continuously monitor transactions, documents, and data to ensure consistency with customer information. Record keeping is also a requirement for financial institutions in Saudi Arabia.

The Saudi Arabia Anti-Money Laundering Law of 2003 and the Implementing Regulations to the Anti-Money Laundering Law of 2017 are the main AML laws in Saudi Arabia. The Saudi Central Bank (SAMA) has updated its Regulatory Sandbox Framework to an "Always Open Approach". Any suspicious transactions must be reported to the SAFIU, and procedures for reporting must be approved at the board of directors level.

Financial institutions in Saudi Arabia must retain due diligence data on clients for a minimum of ten years. The Kingdom of Saudi Arabia saw a 37 percent year-on-year increase in active financial technology companies in 2021. Non-Saudi individuals convicted of money laundering would face deportation from the country.

Financial Compliance Guide for Saudi Arabia, an Emerging Hub in the Realm of Technology and Finance