SAMA Counter-Fraud Framework (CFF)

01

What is the SAMA Counter-Fraud Framework?

The Saudi Central Bank (SAMA) Counter-Fraud Framework (CFF) establishes a structured approach to countering fraud for entities within its scope. Its four domains are Governance, Prevent, Detect and Respond. These domains connect leadership and oversight with prevention controls, identification of suspicious activity and coordinated investigation, containment and learning after an event.

Fraud risk is broader than a cyber incident. It can involve customers, employees, suppliers, channels, products and processes, with digital activity forming one important source of evidence. Effective controls require cooperation among fraud, financial crime, cybersecurity, operations, legal, compliance and business teams. Detection technologies can support analysts, but decision rights, quality assurance, privacy safeguards and escalation remain essential.

The CFF should not be confused with the separate Counter-Fraud Fundamental Requirements (CFFR). SAMA’s Rulebook states that the CFFR is effective from 13 April 2026 and replaces the Anti-Fraud Rules for Finance Companies; it applies to selected institutions as specified in the official requirements. Confirm which instrument applies to the legal entity and period under review. Do not imply that the CFFR is simply the full CFF under another name.

02

Who needs the framework?

Institutions should establish applicability from the current SAMA Rulebook and supervisory communications, considering entity type, licence, activities and effective dates. The full CFF and CFFR have distinct wording and scope; neither should be applied to an organisation by assumption. Legal and compliance owners should record the basis, confirm selected-institution status where relevant and review amendments.

Fraud programmes often need cross-functional participation even where a particular rule does not directly apply. A supplier supporting analytics or case management may help implement controls, but the institution remains accountable for its own governance and decisions. Any use of personal data, automated indicators or customer interventions should be reviewed against applicable privacy, conduct and regulatory duties.

03

A four-domain delivery approach

Governance begins with a documented fraud-risk appetite, accountable leadership, roles, reporting and oversight. Review the fraud risk assessment, policy, committee arrangements, escalation and management information. Confirm that risks are revisited when products, channels, threats and operating models change. Board-level reporting should be useful for decisions rather than a volume of unprioritised alerts.

Preventive work examines controls across onboarding, authentication, payments, account changes, staff access, supplier relationships and customer communications. The exact design depends on product and risk. Review segregation, approval thresholds, secure configuration, staff awareness and customer safeguards. Test whether controls are usable and monitored, not merely present in policy.

Detection combines reporting channels, transaction and behavioural signals, threat intelligence, case triage and appropriate analytics. Define alert ownership, quality measures, thresholds, escalation and evidence handling. Automated or AI-assisted detection should be governed for data quality, bias, explainability and human review appropriate to the decision. Avoid treating a model score alone as proof of fraud.

Response procedures should support timely triage, containment, investigation, evidence preservation, customer and stakeholder handling, required notifications and recovery. Responsibilities vary by event and applicable rule, so determine notification duties from current requirements and facts rather than assuming one deadline. Post-incident review should feed lessons into control design, training and risk assessment.

04

Deliverables and timeline

Typical deliverables include a scope and applicability note; four-domain control map; fraud-risk and evidence assessment; detection and case workflow review; gap register; and prioritised improvement plan. Optional work may include table-top exercises, analytics governance design, playbooks or implementation planning. Define the balance between advisory review and operational testing before access is granted.

A focused diagnostic may take weeks; multi-product programmes, historical case sampling and analytics validation can take longer. Effort depends on data access, privacy approvals, event volumes, stakeholder coordination and the number of entities. Timing is indicative, not guaranteed, and does not promise fraud reduction or regulatory approval.

05

Official SAMA sources

Read the SAMA Counter-Fraud Framework at https://rulebook.sama.gov.sa/en/counter-fraud-framework-0 and the separate Counter-Fraud Fundamental Requirements at https://rulebook.sama.gov.sa/en/entiresection/10530 . Confirm current status, effective date and entity applicability in the official text.