Saudi Central Bank (SAMA)

Central bank; supervises banks, finance companies, payment providers and credit bureaus. Its Cyber Security Framework is binding.

The Saudi Central Bank (SAMA) supervises banks, finance companies, payment providers and credit bureaus.

Cyber Security Framework (CSF): binding. Member Organisations must operate at maturity level 3 or higher. A later SAMA circular reportedly requires banks to reach level 4 on specific subdomains; this is not confirmed.
Cloud and outsourcing: SAMA approval before cloud use (CSF 3.4.3); written no objection for material and overseas outsourcing (Outsourcing Rules Arts 41–42).
PDPL: SDAIA remains the PDPL regulator. SAMA has not been delegated PDPL oversight; SDAIA and SAMA signed a supplementary MoU on PDPL supervision of financial institutions on 5 February 2025. SAMA's own circular No. 43045328 requires PDPL adherence.
Insurers: supervised by the Insurance Authority since 2024. Whether SAMA instruments continue to apply to insurers until replaced is being checked.

Sector rules and the PDPL. Credit data and health data are sensitive data under the PDPL, so the registration trigger in draft Art 34 of the October 2026 amendments to the PDPL Implementing Regulation (IR) would capture most SAMA licensees. A PDPL-compliant transfer does not replace SAMA approval or no objection for offshore cloud or outsourcing. PDPL Arts 30(1) and 42 preserve SAMA's powers. Read with the PDPL, the IR, the Transfer Regulation and the October 2026 draft (comments close 5 November 2026).

Regulates: Banks (including foreign bank branches) · Finance companies · Payment service providers · Credit bureaus

Protects: Financial stability · Financial consumers · Customer data confidentiality

Official website

Instruments issued or administered (21)

Saudi Central Bank Law · Law
Law of Payments and Payment Services and its Implementing Regulation · Law
Credit Information Law · Law
Banking Control Law · Law
Implementing Regulations of the Credit Information Law · Implementing Regulation
Payment Services Provider Regulations (2020) · Regulation
SAMA Rules on Outsourcing (No. 41027017) · Rule
Financial Consumer Protection Principles and Rules · Instrument
Cyber Resilience Fundamental Requirements (CRFR) · Instrument
Adherence to the PDPL and Data Governance Policies, Regulations and Rules (SAMA No. 43045328) · Instrument
SAMA Cyber Security Framework (CSF) · Instrument
Business Continuity Management Framework · Framework
Counter-Fraud Framework (banks) · Framework
Counter-Fraud Fundamental Requirements (finance and payment companies) · Rule
Enhancement of Operational Resilience to Address Quantum Computing Risks · Instrument
Oversight Framework for Payment Systems and Their Operators · Framework
Open Banking Framework · Framework
IT Governance Framework · Framework
Cyber Threat Intelligence Principles · Framework
Ethical Red Teaming Framework · Framework
Payment Services Provider Regulatory Guidelines · Guideline

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21