The CMA binds Capital Market Institutions (~188) — not Tadawul-listed issuers. Its cybersecurity guidelines are non-binding but examined at licensing. Nota