Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Financial services › SAMA Rules on Outsourcing (No. 41027017)

SAMA Rules on Outsourcing (No. 41027017)

Type	Rule
Code	41027017
Issuing authority	Saudi Central Bank (SAMA)
Framework	Financial services
Tier	Rules, controls & standards
Legal status	In force
Instrument number	41027017 · Saudi Central Bank (SAMA)
Issued	2019-12-15 (18/4/1441H)
Dates	No. 41027017, 18/4/1441H (15 December 2019); applies to banks
Last verified	2026-10-20

The Saudi Central Bank (SAMA) Rules on Outsourcing (No. 41027017, 18/4/1441H, 15 December 2019) apply to banks, including foreign bank branches. (2389 is the rulebook node, not the instrument number.)

• Material outsourcing: needs SAMA's written no objection at least 15 business days ahead (30 for foreign banks).
• Overseas outsourcing: needs written no objection, with reasons it cannot be done in the Kingdom and details of the data transferred and its disposal (Arts 41–42).
• Customer data: sharing is subject to Banking Control Law Art 19 confidentiality (Art 24).
• No express data-localisation rule: location rules come from CSF 3.4.3.
• A PDPL-compliant transfer does not replace SAMA's no objection.

Documents

• Hosted official text (PDF, English)
• Official source (rulebook.sama.gov.sa)

In this framework

• The Capital Market Law
• Saudi Central Bank Law
• Law of Payments and Payment Services and its Implementing Regulation
• Credit Information Law
• Banking Control Law
• Implementing Regulations of the Credit Information Law
• Payment Services Provider Regulations (2020)
• Capital Market Institutions Regulations
• Financial Consumer Protection Principles and Rules
• Cyber Resilience Fundamental Requirements (CRFR)
• Adherence to the PDPL and Data Governance Policies, Regulations and Rules (SAMA No. 43045328)
• SAMA Cyber Security Framework (CSF)
• Business Continuity Management Framework
• Counter-Fraud Framework (banks)
• Counter-Fraud Fundamental Requirements (finance and payment companies)
• Enhancement of Operational Resilience to Address Quantum Computing Risks
• Oversight Framework for Payment Systems and Their Operators
• Open Banking Framework
• IT Governance Framework
• Cyber Threat Intelligence Principles
• Ethical Red Teaming Framework
• CMA Cybersecurity Guidelines for Capital Market Institutions
• Payment Services Provider Regulatory Guidelines

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21