November 12, 2026 · Jurisdiction Briefing · 9 min read

Saudi Arabia: reporting a suspicion to SAFIU under SAMA’s AML rules, and what you may not tell the customer

In Saudi Arabia a suspicious transaction report has no minimum amount and no hours-based deadline. The law asks for it “promptly and directly”, and the Saudi Central Bank (SAMA) asks for more than the report itself: a detailed report, a technical report with six months of account history, and a written record of every internal case that was closed without a report.

This briefing works from three texts in SAMA’s rulebook:

Articles 15 and 16 of the Anti-Money Laundering Law (Royal Decree No. M/20, 5/2/1439H) and the paragraphs of its Implementing Regulation (No. 14525, 19/2/1439H, In-Force) that sit under them;
Section 8, Reporting of Suspicious Transactions, of SAMA’s AML/CTF Guide, issued by circular No. (18318/486) dated 20/3/1441H, corresponding to 17 November 2019, and shown as In-Force. We also use the Guide’s paragraphs on staff duties, record keeping and the compliance officer;
SAMA circular No. 606670000067 of 12 June 2019, The Electronic Report Approved by the SAFIU.

The receiving body is the General Directorate of Financial Intelligence, which the Guide calls the SAFIU. Article 17 of the Law makes it the national central agency for suspicious transaction reports, under the oversight of the President of State Security.

Who reports, and what triggers it

Article 15 applies to financial institutions, designated non-financial businesses and professions, and non-profit organisations, including attorneys and anyone providing legal or accounting type services. The duty arises when the institution suspects, or has reasonable grounds to suspect, that funds or part of them are proceeds of crime, are related to money laundering, or will be used in money laundering. Attempts count.

Three points widen it:

No amount. Article 15 says “regardless of their amounts”, and paragraph 15/2 of the Implementing Regulation repeats it. The Guide’s paragraph 8.4 asks for every suspicious transaction, including unsuccessful attempts, regardless of the transaction’s value.
Complex and large transactions. Paragraph 15/1(b) adds suspicion that complicated, high-volume or suspicious transactions relate to money laundering (see the Arabic note below).
Terrorism financing. The Guide defines a suspicious transaction as one with reasonable grounds to suspect a link to money laundering, terrorism financing, a predicate offence or the proceeds of crime. It notes that Articles 70 and 71 of the Law on Combating Terrorism Crimes and Financing set out reporting duties alongside Articles 15 and 16. We have not read those two articles for this briefing.

Paragraph 8.5 of the Guide adds a specific line: the institution informs the SAFIU when it suspects a wire transfer.

Not on a hunch. Paragraph 8.6 says the institution shall not report on the basis of speculation, or without information or reasonable grounds. It gives two cases where reasonable grounds exist: the institution knows, through its business or its investigations, that the activity is linked to a suspicious transaction; or it has sufficient information indicating that it is.

How fast

The Law’s English text says the institution shall “Promptly and directly” report. The Guide’s paragraph 8.3 says “immediately and directly”, on suspicion or on information or reasonable grounds to suspect. Among the compliance officer’s duties, paragraph 9.3(e) lists reporting to the SAFIU as soon as the suspicion is detected.

None of these texts gives a number of hours or days. A deadline counted in days, if one is set, would have to come from the SAFIU’s own reporting instructions, which we could not open (safiu.gov.sa did not load for us).

What goes in the report

Paragraph 15/4 of the Implementing Regulation says the report uses the form adopted by the SAFIU and contains, at a minimum:

the names, addresses and phone numbers of those carrying out the suspicious transactions;
a statement of the transaction, its parties, the circumstances of its detection and its current status;
the amount and the related bank or investment accounts;
the reasons for suspicion on which the employee made the report.

The SAFIU specifies the manner of reporting and what the report carries. SAMA’s circular 606670000067 cites Article 15 of the Law and paragraph 15/4, and told institutions that the first phase of electronic reporting through the SAFIU’s link started on Wednesday 24/9/1440H.

SAMA then adds two layers in the Guide:

A detailed report. Paragraph 8.8 ties the report on the SAFIU’s form to an additional detailed report with all the data and information the institution holds on the transaction and the parties. Article 15(1) of the Law itself asks for a detailed report including all available data.
A technical report. Under paragraph 8.9 the institution submits a technical report on the reported case, with the account statement or the transactions under the contract for six months, the due diligence documents, and a technical report examining the account or contract.

After the report goes in

The institution must respond promptly and fully to the SAFIU’s requests for more information (Article 15(2); Guide paragraph 8.3). Paragraph 18/1 of the Implementing Regulation sets the route. The SAFIU may ask a financial institution directly when the institution has filed a report and the request concerns a transaction or person in it. In all other cases the request, and the answer, go through the supervisory authority.

The internal machinery SAMA expects

Paragraph 8.1 requires documented reporting procedures, implemented effectively and approved at board level. The procedures may include:

internal steps for staff and senior officers when they suspect money laundering or terrorism financing;
a way for staff to reach the reporting officer with questions and suspicions;
internal investigation procedures, including the stages of an investigation;
levels of approval and review when a case is reported or closed;
the named employee or officer who reports to the SAFIU;
measures to keep reports confidential and avoid alerting the customer.

Around that list the Guide sets these duties:

Staff. Each employee reports immediately to the AML/CTF compliance officer when there are reasonable grounds for suspicion (Guide, Chapter VII, Section 3).
Resources. Enough to follow up and investigate every internal report and decide whether a report to the SAFIU is justified (8.2).
Closing a case. If the decision is not to report an internal case, the reporting officer documents it, with the reasons, in a detailed and sufficient way, following the approval levels in 8.1(d) (8.10).
Records. Copies of reports sent to the SAFIU, and internal reports that were investigated but not reported for lack of grounds, are kept separately, with named people allowed access (8.11). Paragraph 6.7 sets the period: no less than ten years from the date of reporting or of the decision not to report.
Learning loop. Suspicion cases, internal reports and feedback from the SAFIU feed the institution’s indicators and typologies (8.12). The Implementing Regulation’s paragraph 15/3 requires indicators of suspected money laundering, updated continuously.
Awareness. Staff, the board and senior management should be made aware of the reporting requirements, the liability attached to breaches of confidentiality, and the rules against alerting customers (8.13).

The last two paragraphs of Section 8 (8.14 and 8.15) deal with notifying SAMA of matches against the UN Security Council and national lists; we covered that route in our 22 October briefing.

When due diligence itself would tip off the customer

Paragraph 8.7 covers a case most reporting procedures meet sooner or later. Where the institution suspects money laundering or terrorism financing and has strong justifications and reasonable grounds to believe the customer may become aware of the suspicion if due diligence is applied, it may decide, at its discretion, not to apply due diligence. It must then file a suspicious transaction report with the SAFIU that sets out the reasons and justifications for not applying due diligence.

Paragraph 3.14 in the due diligence section says the same, but refers to paragraph 8.8 rather than 8.7, in both the English and the Arabic text. The rule it describes is the one in 8.7.

Tipping off

Article 16(1) of the Law prohibits institutions, and their board members, directors, executive or supervisory managers and employees, from disclosing to a customer or any other person that a report or related information will be, is being or has been submitted to the SAFIU, or that a criminal investigation is being or has been carried out.

It does not prevent disclosures or communications between directors and employees, or communications with lawyers or competent authorities.

The Guide turns this into staff behaviour. Employees refrain from disclosing or implying any information about suspicious transactions linked to a customer, or that transactions are under investigation internally or externally. They take appropriate measures to ensure that no clues are given when asking a customer for information.

The protection for reporting in good faith

Article 16(2) protects the institution and its board members, managers and employees from any liability toward the person reported, if they report their suspicions to the SAFIU in good faith. Paragraph 16/1 of the Implementing Regulation spells out the reach: criminal, civil, contractual, disciplinary or administrative liability. The protection applies even where the reporter did not know precisely what the underlying crime was, and regardless of whether illegal activity actually occurred.

If the rules are not followed. Article 25 of the Law lets a supervisory authority take measures against an institution, or its directors and managers, that fail to comply with the Law, its Implementing Regulation or relevant circulars. They range from a written warning to a fine of up to SAR 5,000,000 per violation, a ban on individuals working in the sector, and suspension or revocation of the licence.

Reading the English against the Arabic

SAMA’s rulebook carries the Law, the Implementing Regulation and the Guide in Arabic too. The readings below are our own translations and have not been checked by a sworn translator.

Article 15: “promptly” or “immediately”. The Arabic says فوراً وبشكل مباشر, which we read as “immediately and directly”. That matches the Guide’s English paragraph 8.3, and is stronger than the English Law’s “promptly”.
Paragraph 15/1(b): “suspicious” or “unusual”. The English lists “complicated, high-volume, or suspicious” transactions. The Arabic says المعقّدة أو الضخمة أو غير الطبيعية, which we read as complex, large or unusual. In our reading the Arabic brings unusual transactions within the reporting provision when they are suspected of a link to money laundering.
Article 16(2) and paragraph 16/1: what the protection covers. The Arabic of 16(2) covers reporting to the SAFIU or providing information to it in good faith; the English mentions only reporting suspicions. The Arabic of 16/1 also says the protection applies where the report breaches confidentiality obligations under other laws, regulations or contracts, which the English does not say.
“Should” in the Arabic Guide. Paragraphs 8.6 (no report on speculation), 8.9 (the technical report), 8.11 (records of reports) and 6.7 (the ten-year period) open with ينبغي, “should”, where the English says “shall”. Paragraphs 8.3 (report immediately) and 8.8 (the form and the detailed report) open with على المؤسسة المالية, “the financial institution must”. In our reading the Arabic grades these duties more finely than the English does; we would still treat all of them as expected by SAMA.

What to do with it

These are our suggestions, not SAMA’s.

Remove any amount filter from your escalation path. Neither the Law nor the Guide sets a value below which a suspicion need not be reported, and attempts count.
Measure time from suspicion to filing. With no number in the texts, set your own internal target and record the dates so you can show “immediately” was met.
Build the report pack, not just the form. Prepare the detailed report and the six-month technical report with the filing, so they are not assembled after the SAFIU asks.
Make “not reported” a documented decision. Each closed internal case needs its reasons, the approval level that closed it, and a ten-year retention date.
Write the 8.7 route down. Say who can decide to stop due diligence to avoid tipping off, and make sure the STR states the reasons.
Script customer contact during a live case. Front-line requests for information should not hint at an investigation. Train on it, and include the board.
Route SAFIU requests correctly. A direct request is answered directly only when it relates to your own report; otherwise expect it through SAMA.

Sources

This article draws on the following sources. Follow the links for the original text.

For information only. This briefing is not legal advice: check the cited sources and take advice on your own position.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator saudi-arabia