SAMA Compliance Advisory

01

What does SAMA compliance mean?

The Saudi Central Bank (SAMA) supervises specified financial institutions and publishes regulations, frameworks, circulars and supervisory directions. Compliance is therefore not a single certificate or generic checklist. It means understanding the requirements applicable to a particular legal entity and activity, implementing them, retaining suitable evidence and responding to supervisory expectations through the organisation’s established governance.

The right scope depends on the institution’s licence, services, legal structure, current rulebook text and communications. A bank, finance company, payment service provider and technology supplier do not necessarily have identical obligations. Group entities should determine which requirements apply to each entity and how shared services, outsourcing, branches and third parties are governed. Confirm interpretations through legal and compliance functions and, where necessary, the regulator.

JODOR can support structured assessment and implementation planning. We do not speak for SAMA, grant regulatory approval, provide a compliance certificate, or guarantee a supervisory outcome. Management retains responsibility for compliance decisions, risk acceptance and submissions. This distinction matters when turning advisory findings into formal statements or board reporting.

02

Who should consider support?

Financial institutions seeking a baseline, preparing for a change, responding to audit findings or strengthening control evidence may benefit from a scoped review. A programme can also help a new product team understand security dependencies before launch, or help a control owner make a remediation plan understandable to executives. The engagement must begin with applicability, not a presumption that every SAMA publication applies to every client.

Insurance entities should separately verify their current regulator and obligations with the Insurance Authority. Do not treat all insurers as SAMA-supervised. Suppliers may have contractual requirements arising from a regulated customer, but that does not automatically make the supplier itself directly subject to the customer’s entire rulebook.

03

A disciplined compliance workstream

Start with a requirements register. Record each source, publication date or version, legal entity, activity, applicability rationale, accountable owner and review date. Separate mandatory requirements from guidance and internal commitments. Cross-reference overlapping obligations while retaining traceability to the original source. Flag ambiguities for legal review instead of converting assumptions into requirements.

Map requirements to policies, procedures, technology and operating evidence. Review governance minutes, risk records, control operation, incident handling, supplier oversight, training and relevant technical configurations. Interviews help verify ownership and reveal the gap between policy design and daily practice. Evidence should be current, attributable and representative; a screenshot or policy alone may not prove continuous operation.

Assess design and implementation, then agree risk and priority criteria. Validate findings with control owners so the report distinguishes confirmed gaps from evidence limitations or open interpretation. Build a remediation plan with action, owner, dependency, target checkpoint and closure evidence. Escalate urgent exposure through agreed channels rather than waiting for a final report.

Track remediation through governance and retest meaningful controls. For major changes, include architecture and operational readiness reviews, not only document updates. Prepare management reporting that states scope, method, exceptions and residual risk. Regulatory submissions and formal attestations remain the institution’s responsibility and should be reviewed by its authorised compliance and legal functions.

04

Deliverables and timing

Depending on scope, outputs may include an applicability register, requirements-to-evidence matrix, control gap report, risk-ranked action plan, executive briefing and evidence-readiness recommendations. Optional support can include workshops, policy and procedure development, control design, implementation tracking or retesting. Scope documents should state exclusions and assumptions clearly.

A targeted review may take weeks; a broad programme spanning multiple entities, frameworks or technology estates can require several phases. Schedule depends on access, evidence readiness, number of interviews, legal reviews, sampling and remediation complexity. Any timeline is indicative and subject to discovery, not a promised deadline or assurance of compliance.

05

Primary SAMA sources

Use the SAMA Rulebook as the authoritative public source for applicable framework texts, including IT governance and counter-fraud materials: https://rulebook.sama.gov.sa/en/ . Confirm current status, effective dates and entity scope in the relevant official publication.