· Jurisdiction Briefing

Saudi Arabia: SAMA’s financial institutions must register for the Security Council notification system and reply within 24 hours

On 1 October 2026 (20/4/1448H) the Saudi Central Bank (SAMA) issued circular No. 482028988, Integration with the Security Council Resolutions Notification System. SAMA's rulebook shows it as In-Force and marks the English text as a translated document. It is…

Illustration for “Saudi Arabia: SAMA's financial institutions must register for the Security Council notification system and reply within 24 hours”

On 1 October 2026 (20/4/1448H) the Saudi Central Bank (SAMA) issued circular No. 482028988, Integration with the Security Council Resolutions Notification System. SAMA’s rulebook shows it as In-Force and marks the English text as a translated document. It is four paragraphs long, but it adds something new to a sanctions team’s day: a notification that arrives from a government system, and a reply that has to go back through it within a fixed time.

Our 24 September briefing walked through SAMA’s Rules for the Implementation of Targeted Financial Sanctions: the screening calendar, the freeze and the notification to SAMA. This one stays narrow. It covers what the October circular requires, what the user guide attached to it says about the system, and where the new reply sits among the duties the Rules already set.

What the circular requires

The circular rests on SAMA’s powers under its Law, issued by Royal Decree No. (M/36) dated 11/04/1442H, and on the Rules for the Implementation of Targeted Financial Sanctions issued by circular No. (472035766) dated 16/06/1447H. It singles out one duty in those Rules: that financial institutions update their internal lists immediately when an announcement or notification is issued about the listing of any person or group of persons.

It then reports two things. The Security Council Resolutions Notification System has been established by the Permanent Committee Concerned with the Implementation of Security Council Resolutions Issued Pursuant to Chapter VII of the Charter of the United Nations. And a user guide explaining how to register for and use the system has been issued, and is attached.

From that, three obligations follow for all financial institutions:

  • Register in the Notification System.
  • Give feedback on any positive match, or on the absence of one.
  • Where there is a positive match, give details of the measures taken to freeze the funds concerned.

The time limit is “immediately and no later than twenty-four (24) hours from the date of receipt of the notification”. The obligations are subject to the Rules for the Implementation of Targeted Financial Sanctions, the Personal Data Protection Law and its Implementing Regulations, and all relevant conditions, controls and requirements.

The circular’s third paragraph repeats a point the Rules already make. Institutions must carry out daily and ongoing verification and update their internal lists from the official websites and channels of the Sanctions Committees, the Permanent Committee for Combating Terrorism and its Financing under the Presidency of State Security, the Permanent Committee on Chapter VII resolutions, and the United Nations Sanctions Committees. The new system sits alongside those channels; the circular does not take any of them away.

The last line sets the timing: institutions are to act on the circular within one week from the date of its publication on SAMA’s website. The circular does not state that publication date.

Who must register

The circular says “all financial institutions”. In SAMA’s own Rules a Financial Institution is any financial institution subject to SAMA’s regulation, monitoring and supervision that is tasked with combating money laundering, terrorist financing and proliferation financing. The circular is SAMA’s instruction to that population.

The system itself reaches further. The user guide says the supervisory authorities add all financial institutions to the notification system, including banks, exchange companies, finance companies, entities licensed by the Capital Market Authority and insurance companies. It also lists designated non-financial businesses and professions and non-profit organisations: notaries, law firms, the precious metals and stones sector, independent legal professionals, accountants and real estate brokers.

So two routes lead into the system. The guide describes supervisors adding institutions; the circular tells institutions to register. Read together, the safe course is to confirm both: that your institution is on the system, and that the contact details it holds are the ones you want notifications sent to.

What the user guide says

The guide is titled, in Arabic, the user guide for the Security Council resolutions system, for beneficiary entities, first edition (2026). The PDF linked as the original from SAMA’s English page is in Arabic. The summaries below are our translations.

What the system is for. The guide says the system aims to make communication on targeted financial sanctions related to terrorism, its financing and proliferation financing faster and more efficient. It does this by issuing immediate notifications whenever the Security Council lists or the unified national list (1373) are updated. It covers all decisions issued under Chapter VII, whether they list, amend or remove the names of persons or entities.

How a notification arrives. When a sanction is issued, the system sends an automatic notification to the entity by email or by text message to the registered phone number. The guide tells users to follow the notifications arriving at the registered email or phone number regularly, so that the time set for dealing with them, 24 hours, does not run out.

How to answer. On opening a notification, the entity reviews the details of the decision, checks its list of customers and counterparties, and makes sure the measures the decision requires are taken. If a listed name matches one of its counterparties, it selects “matching” and adds a short comment with the information available. If it compares the listed persons with its customers and counterparties and finds no match, it selects “not matching”. A confirmation screen shows that the reply has been submitted.

When to use it. The guide lists the cases in which entities are to use the system:

  • on receiving a notification that a name has been added to, amended in or removed from a sanctions list, national or UN, to check for a match and take the appropriate action;
  • before establishing a business relationship or starting to deal with a new customer;
  • before carrying out any transaction for a customer, in line with the applicable rules and the entity’s due diligence procedures;
  • when a match is suspected between a customer or related party and a listed name;
  • in any other case the rules or the entity’s own policies require.

Searching. Entities can search the UN sanctions list or the national terrorism list (1373), for individuals, entities or vessels, by Arabic or English name or by reference number.

Where the reply sits in the Rules

The circular adds one output to a process the Rules already define. The Rules decide what has to happen before that reply goes, and what else goes with it.

The receipt is a list update. Paragraph 4.1 requires an institution to update its internal lists immediately on an announcement or notification of a listing, and to keep a record of when each update was received, applied and confirmed in internal systems. Paragraph 4.3 asks for all updated lists to be consolidated into one approved internal list. A notification from the system is such an update, and its time of receipt now starts a 24-hour clock as well.

“Not matching” is a screening result. Paragraph 3.6(c) says that when a list update is issued, all customer and transaction data, beneficial owners, directors, authorised signatories and related parties are screened against the updated list, with a record of the update, the screening and any action taken. In our reading, a “not matching” reply is only as good as that run. If the population screened was incomplete, the reply was given on an incomplete basis.

The freeze comes before the reply. The Rules define “without delay” as within hours of the designation of a listed person on the sanctions lists, or of delisting. The circular’s 24 hours is the outer limit for feedback, and in a positive match that feedback has to include the freezing measures taken. The freeze is therefore already done when the reply is sent. Do not read the 24 hours as extra time to freeze.

The other notifications still apply. After taking freezing measures, paragraph 5.9 requires the institution to notify SAMA by email, with the customer and transaction details, the freezing measures, the nature and value of the funds and the listing information. Paragraph 5.10 requires a suspicious activity report to the General Directorate of Financial Investigations where there are indications of evasion or circumvention. The circular does not say the system reply replaces either.

Two record points follow from the same Rules. Paragraph 5.6 lists what every alert record must hold, including the source of the alert, such as the United Nations Security Council lists or the national lists. Paragraph 5.12 requires periodic reports to the board or senior management that include timetables for updating sanctions lists. Records under Chapter Seven are kept for not less than ten years from the completion of the transaction or procedure.

Reading the English against the Arabic

The English is a translation, and three points are worth checking against the Arabic text.

  • “Through the system”. The Arabic says the feedback on matches, and on the freezing measures, is given عبر النظام, through the system. The English sentence does not repeat this. The reply goes in the system, not by letter or email.
  • One committee, several English names. The circular’s English calls the body that set up the system the “Permanent Committee Concerned with the Implementation of Security Council Resolutions Issued Pursuant to Chapter VII”. The English Rules call it the “Standing Committee” in paragraph 4.2 and the “Permanent Committee” in paragraph 9.7. The Arabic uses one name in both documents, اللجنة الدائمة المعنية بتطبيق قرارات مجلس الأمن الصادرة وفق الفصل السابع, and the Rules place it at the Ministry of Foreign Affairs.
  • Twenty-four hours from “the date” of receipt. Both texts measure the limit from the date of receipt of the notification (من تاريخ استلام الإشعار). The guide, for its part, speaks of 24 hours as the time set for dealing with notifications. Our advice is to count from the time the notification arrives, not from the start of the next business day.

What to do with it

  1. Confirm the registration and the contacts. Check that the institution is on the system and which email address and phone number it holds. In our view these should reach a monitored team channel, not a single person’s inbox, with cover for leave and out-of-hours.
  2. Log receipt to the minute. Paragraph 4.1 already asks for the time of receipt. Use the same log to show the reply went within 24 hours.
  3. Freeze, then reply. Write the order into the procedure: screen the full population, escalate, freeze without delay on a confirmed match, then submit “matching” with the freezing details. A “not matching” reply follows a completed post-update screening run.
  4. Keep three outputs apart. The system reply, the email to SAMA under paragraph 5.9 and any suspicious activity report under paragraph 5.10 are different steps with different recipients. Give each an owner and a record.
  5. Use the search, and record that you did. The guide lists onboarding, transactions and suspected matches among the cases for using the system. Decide where a search of the system sits beside your screening tool, and keep the evidence.
  6. Close the gap now. The circular is dated 1 October 2026 and gave one week from its publication on SAMA’s website. If the registration and the reply procedure are not yet in place, they come first.

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu