Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Financial services › Cyber Resilience Fundamental Requirements (CRFR)

Cyber Resilience Fundamental Requirements (CRFR)

Type	Instrument
Issuing authority	Saudi Central Bank (SAMA)
Framework	Financial services
Tier	Rules, controls & standards
Legal status	In force
Instrument number	Saudi Central Bank (SAMA)
Version	1.0
Last verified	2026-10-20

The Cyber Resilience Fundamental Requirements (CRFR), issued by the Saudi Central Bank in January 2022 (version 1.0), set the minimum cyber-resilience bar for entities entering the financial sector: applicants intending to qualify for SAMA's Regulatory Sandbox and/or seeking a licence to operate in the Kingdom.

The CRFR act as a catalyst for meeting SAMA's minimum cyber-resilience licensing requirements. They are explicitly not a substitute for SAMA's full Cyber Security Framework and Business Continuity Management framework, with which entities must comply once licensed, and are to be read alongside the Regulatory Sandbox Framework.

The control requirements follow a risk-based approach across three domains (Cyber Security Leadership and Governance; Cyber Security Operations and Technology; and Resilience), with compliance verified through entity self-assessment and SAMA audit. In practice the CRFR are the first SAMA cyber instrument a fintech encounters: a compact set of fundamentals bridging the gap between an unregulated start-up and the full CSF obligations that apply after licensing.

Sector rules and the PDPL. Credit data and health data are sensitive data under the PDPL, so the registration trigger in draft Art 34 of the October 2026 amendments to the PDPL Implementing Regulation (IR) would capture most SAMA licensees. A PDPL-compliant transfer does not replace SAMA approval or no objection for offshore cloud or outsourcing. PDPL Arts 30(1) and 42 preserve SAMA's powers. Read with the PDPL, the IR, the Transfer Regulation and the October 2026 draft (comments close 5 November 2026).

Documents

• Hosted official text (PDF, English)

In this framework

• The Capital Market Law
• Saudi Central Bank Law
• Law of Payments and Payment Services and its Implementing Regulation
• Credit Information Law
• Banking Control Law
• Implementing Regulations of the Credit Information Law
• Payment Services Provider Regulations (2020)
• Capital Market Institutions Regulations
• SAMA Rules on Outsourcing (No. 41027017)
• Financial Consumer Protection Principles and Rules
• Adherence to the PDPL and Data Governance Policies, Regulations and Rules (SAMA No. 43045328)
• SAMA Cyber Security Framework (CSF)
• Business Continuity Management Framework
• Counter-Fraud Framework (banks)
• Counter-Fraud Fundamental Requirements (finance and payment companies)
• Enhancement of Operational Resilience to Address Quantum Computing Risks
• Oversight Framework for Payment Systems and Their Operators
• Open Banking Framework
• IT Governance Framework
• Cyber Threat Intelligence Principles
• Ethical Red Teaming Framework
• CMA Cybersecurity Guidelines for Capital Market Institutions
• Payment Services Provider Regulatory Guidelines

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21