Financial services

Saudi Central Bank (SAMA) and Capital Market Authority (CMA) laws, frameworks and rules for banks, finance and payment companies, credit bureaus and Capital Market Institutions. Insurers are now supervised by the Insurance Authority.

24 instruments in this framework.

Primary law: niẓām (Royal Decree M/…)

The Capital Market Law
Saudi Central Bank Law
Law of Payments and Payment Services and its Implementing Regulation · Royal Decree M/26 (22/3/1443H); Implementing Regulation 18/12/1444H (6 July 2023)
Credit Information Law · Royal Decree M/37 (6/7/1429H); in force
Banking Control Law · Royal Decree M/5; dates to verify

Cabinet instruments: CoM Resolution

Implementing Regulations of the Credit Information Law · No. أق/13709, 22/9/1432H; in force

Implementing & executive regulation

Payment Services Provider Regulations (2020) · August 2020; superseded by the Payments Law Implementing Regulation (6 July 2023)
Capital Market Institutions Regulations · Formerly the Authorised Persons Regulations; in force 1 November 2020; Art 59 outsourcing

Rules, controls & standards

SAMA Rules on Outsourcing (No. 41027017) · No. 41027017, 18/4/1441H (15 December 2019); applies to banks
Financial Consumer Protection Principles and Rules · No. 44006639, 26/1/1444H (23 August 2022)
Cyber Resilience Fundamental Requirements (CRFR)
Adherence to the PDPL and Data Governance Policies, Regulations and Rules (SAMA No. 43045328) · No. 43045328, 19/5/1443H (23 December 2021); rulebook revision reflects the PDPL as amende
SAMA Cyber Security Framework (CSF) · Version 1.0, May 2017; binding SAMA supervisory requirement
Business Continuity Management Framework · No. 381000058504, 27 February 2017 (reported); in force
Counter-Fraud Framework (banks) · No. 000044021528, 11 October 2022; effective 29 June 2023
Counter-Fraud Fundamental Requirements (finance and payment companies) · Ref. 106897184, 14 April 2025; full compliance by 13 April 2026 (reported)
Enhancement of Operational Resilience to Address Quantum Computing Risks · No. 482021280, 27 August 2026; deadlines 31 December 2026 and 31 March 2027 (reported)
Oversight Framework for Payment Systems and Their Operators · Circular 472047719, 8 March 2026 (reported)
Open Banking Framework · Release 1 (2022); Release 2 (2 September 2024); licensing from 26 March 2026
IT Governance Framework · SAMA reference 43028139 (reported); in force
Cyber Threat Intelligence Principles · SAMA reference 43065348 (reported); in force
Ethical Red Teaming Framework · SAMA reference 562240000067 (reported); in force

Guidelines & circulars

CMA Cybersecurity Guidelines for Capital Market Institutions · Called guidelines, but the Main Controls are mandatory for all CMIs
Payment Services Provider Regulatory Guidelines · January 2020; historical

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21