Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Financial services › CMA Cybersecurity Guidelines for Capital Market Institutions

CMA Cybersecurity Guidelines for Capital Market Institutions

Type	Guideline
Code	Cybersecurity Guidelines
Issuing authority	Capital Market Authority (CMA)
Framework	Financial services
Tier	Guidelines & circulars
Legal status	In force
Instrument number	Capital Market Authority
Dates	Called guidelines, but the Main Controls are mandatory for all CMIs
Last verified	2026-10-20

The CMA's Cybersecurity Guidelines are described as "guidelines" for all Capital Market Institutions (CMIs), but the document states that its Main Controls are mandatory. The CMA may apply it to any entity it supervises. They do not apply to listed issuers.

• Security monitoring may be outsourced only to providers within KSA.
• Cloud services must be within KSA.
• The SOC must sit in a dedicated restricted area, with qualified Saudi staff.
• The cybersecurity head must be a full-time qualified Saudi.
• Logs are kept for at least 12 months.
• Incidents: report to the CMA immediately on occurrence or detection; send an official report after recovery; coordinate with the CMA before any media statement. No hour-based deadline.

Sector rules and the PDPL. CMI client data is personal data under the PDPL. The CMA's in-Kingdom cloud and monitoring rules apply on top of PDPL Art 29 and the Transfer Regulation, and the October 2026 draft amendments to the PDPL Implementing Regulation (IR) would add an in-Kingdom storage default (draft Art 23(2); comments close 5 November 2026).

Documents

• Hosted official text (PDF, English)
• Official source (cma.gov.sa)

In this framework

• The Capital Market Law
• Saudi Central Bank Law
• Law of Payments and Payment Services and its Implementing Regulation
• Credit Information Law
• Banking Control Law
• Implementing Regulations of the Credit Information Law
• Payment Services Provider Regulations (2020)
• Capital Market Institutions Regulations
• SAMA Rules on Outsourcing (No. 41027017)
• Financial Consumer Protection Principles and Rules
• Cyber Resilience Fundamental Requirements (CRFR)
• Adherence to the PDPL and Data Governance Policies, Regulations and Rules (SAMA No. 43045328)
• SAMA Cyber Security Framework (CSF)
• Business Continuity Management Framework
• Counter-Fraud Framework (banks)
• Counter-Fraud Fundamental Requirements (finance and payment companies)
• Enhancement of Operational Resilience to Address Quantum Computing Risks
• Oversight Framework for Payment Systems and Their Operators
• Open Banking Framework
• IT Governance Framework
• Cyber Threat Intelligence Principles
• Ethical Red Teaming Framework
• Payment Services Provider Regulatory Guidelines

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21