Capital market regulator; regulates listed issuers and 215 Capital Market Institutions. Its cybersecurity Main Controls are mandatory for CMIs.
The Capital Market Authority (CMA) regulates listed issuers (disclosure, offers, governance) under the Capital Market Law, and licenses and supervises Capital Market Institutions (CMIs): 215 licensed CMIs at end-2025 (CMA annual report).
Cybersecurity Guidelines: apply to CMIs, not to listed issuers. Described as guidelines, but the document states its Main Controls are mandatory; the CMA may apply it to any entity it supervises.
Location: cloud services within KSA; security monitoring outsourced only to providers within KSA; SOC in a dedicated restricted area with qualified Saudi staff.
People and logs: a full-time qualified Saudi cybersecurity head; logs kept at least 12 months.
Incidents: report immediately on occurrence or detection; official report after recovery; coordinate with the CMA before any media statement. No hour-based deadline.
PDPL: CMI client data is personal data; the PDPL and its transfer rules apply alongside the CMA's location rules.
Regulates: Capital Market Institutions (215 at end-2025) · Listed issuers (disclosure, offers, governance)
Protects: Investors · Market integrity · CMI client data