· Jurisdiction Briefing

Saudi Arabia: who supervises a fintech’s AML, and where STRs go

Saudi Arabia's fintech count has been running ahead of its targets. As reported by the Saudi Press Agency in October 2024, the Vice Minister of Finance said the number of fintech companies had reached 224 by the end of the second quarter of 2024, against a…

Illustration for “Saudi Arabia: 224 fintechs, one AML standard”

Saudi Arabia’s fintech count has been running ahead of its targets. As reported by the Saudi Press Agency in October 2024, the Vice Minister of Finance said the number of fintech companies had reached 224 by the end of the second quarter of 2024, against a target of 168 for that quarter. The Financial Sector Development Program’s 2024 Annual Report puts the figure at 261 companies operating in the Kingdom by the end of 2024, above the programme’s 2025 target of 230, with a goal of 525 by 2030.

The same report shows that those companies do not share one licensing regulator. By the end of 2024 the Saudi Central Bank (SAMA) had licensed 138, the Capital Market Authority 52 (the report’s English text calls it the Financial Market Authority), and the Insurance Authority’s fintech companies numbered 14. For an MLRO, that split is the starting point for working out which supervisor you answer to.

The law defines a financial institution by what it does

Under the Anti-Money Laundering Law (Royal Decree No. M/20, 5/2/1439H), a financial institution is anyone who conducts, as a business, one or more of the financial activities listed in its Implementing Regulation, for or on behalf of a customer. That list includes lending and other financing, money or value transfer services, issuing and managing means of payment (electronic money among them), securities activities, and life and other investment-related insurance.

SAMA’s rulebook follows the same line for payments firms. Its AML section for payment systems and payment service providers says the instructions “should be read in conjunction with the Anti-Money Laundering Law and its Implementing Regulations”, and it lists the AML/CTF Guide issued by circular on 17 November 2019, as the rulebook’s banking section also does.

Who supervises

Article 1/4 of the Implementing Regulation (No. 14525, dated 8 November 2017) names the supervisory authorities: the Saudi Central Bank, the Capital Market Authority, the Ministry of Commerce and Investment, the Ministry of Justice, the Ministry of Labor and Social Development, and any other authority mandated by law to monitor or supervise financial institutions, DNFBPs or NPOs. The 2018 FATF/MENAFATF mutual evaluation shows how that worked out by sector at the time.

BodyWhat the documents say
SAMAIn 2018, the supervisor and regulator of every financial institution except the securities sector: banks (including remittances), finance companies, money exchangers and, at that time, insurers. Had licensed 138 fintechs by end-2024.
Capital Market AuthorityThe securities sector, including the exchange, the depository and the firms it licenses to carry on securities business (Authorised Persons), on all matters including AML/CFT (2018). Had licensed 52 fintechs by end-2024.
Insurance AuthorityThe authorised regulator of the insurance industry since 23 November 2023. 14 fintechs by end-2024.
Ministry of Commerce and Investment (the name used in the regulation)In 2018, the supervisor of real estate agents, dealers in precious metals and stones, and accountants.
Ministry of JusticeSupervises law firms, and makes sure notaries, who are its employees, comply with AML/CFT requirements, including when registering real estate transfers (2018).

Insurance is the allocation that has moved. The 2018 evaluation placed insurance companies under SAMA; since 23 November 2023 the Insurance Authority has been the insurance regulator, a change that postdates the 2017 regulation. The Authority says current insurance-sector laws and regulations remain in effect until further instructions are issued.

Where STRs go

Article 15 of the AML Law requires financial institutions, DNFBPs and NPOs that suspect, or have reasonable grounds to suspect, that funds are proceeds of crime or linked to money laundering, including attempted transactions and whatever the amount, to report promptly and directly to the General Directorate of Financial Intelligence (SAFIU). The Directorate operates under the oversight of the President of State Security, with operational independence, and receives and analyses reports and disseminates the results to competent authorities.

Article 15/4 of the Implementing Regulation says a report uses the Directorate’s form and must include at least: the names, addresses and phone numbers of those carrying out the transaction; a statement of the transaction, its parties, how it was detected and its current status; the amount and the accounts involved; and the reasons for the suspicion. Article 16 prohibits telling the customer, or anyone else, that a report has been or will be made.

Electronic filing is not new. In a circular dated 12 June 2019 (No. 606670000067), SAMA told firms that the first phase of electronic reporting through the Directorate’s link had started, and asked them to keep SAMA’s AML department informed of any updates.

Supervisors have teeth, and SAFIU hears about their use. Under Article 25 of the AML Law a supervisory authority can issue warnings and compliance orders, fine a firm up to SAR 5 million per violation, ban individuals, and suspend, restrict or revoke a licence. The law says it should inform the Directorate of the actions it takes.

Three things worth doing this week

  1. Name your supervisor for each licence. SAMA, the CMA and the Insurance Authority each licensed fintechs; if your group holds more than one licence, write down which supervisor covers which activity.
  2. Test your STR template against Article 15/4. Check that every report carries the four minimum items, and that it goes directly to SAFIU through its electronic channel.
  3. If you are licensed by the Insurance Authority, confirm which AML instructions apply. Current insurance-sector rules remain in effect until further instructions are issued, so keep a dated record of what you rely on.

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu