Saudi Arabia

The AML Framework of Saudi Arabia, which is mainly regulated by Royal Decree No. M/20 and its Implementing Regulations, requires the implementation of a stringent, risk-based financial crime program at all banks and other financial, securities, and non-financial institutions under the close monitoring of regulatory bodies such as the Saudi Central Bank (SAMA) and the Capital Market Authority (CMA). In order to meet the tough international FATF standards, these programs should include in their legal requirements enterprise-wide risk assessment, automated real-time transaction monitoring, UBO checks, auditing, and 10-year record-keeping. A critical component of this structure is the Money Laundering Reporting Officer (MLRO), which has to be a Saudi national position and be granted absolute autonomy in decision-making and direct access to board committees. At the same time, this compliance officer has strict legal responsibility to identify and report suspicious financial transactions "without delay" to SAFIU, with the simultaneous risk of administrative and criminal sanctions in case of failure to report and breaking the law of anti-tipping-off.

The Saudi Arabian AML Document Retention Scheme, which has been laid down under the Royal Decree No. M/20 and which is managed by SAMA, stipulates that all regulated organizations must keep in safe custody all financial intelligence data, transaction data, and CDD/EDD data for at least 10 years. The legal trigger point to set the retention period would be either the day when each specific transaction takes place, or in case of larger banking arrangements, the day when the bank account gets closed. In order to make these documents easily available to judicial officials and SAFIU, SAMA insists that all these documents must be retained onshore within the territory of Saudi Arabia in such a way that these can support Arabic language search functions.

The Saudi Arabia KYC/CDD Program, as per Royal Decree No. M/20 and regulated by SAMA and CMA, follows a rigorous risk-based model that compels financial institutions to ensure the identity check of all their clients via government official records before onboarding. This KYC/CDD system works through the verification process divided into three different tiers, namely Standard, Simplified, and Enhanced Due Diligence, which mandates the identification of Ultimate Beneficial Ownership of the client down to any natural person owning 25% or more interest in the corporate client. The identification of a natural person entails the use of a National ID or Iqama, which needs to be updated dynamically; otherwise, SAMA rules state that failure to renew the expired identification record leads to automatic freezing of the bank account. This rigorous onboarding process, along with transaction monitoring, provides for a continuous lifestyle review mechanism that compels the immediate re-evaluation of accounts at any behavioral change.

The Saudi STR Framework, created by Royal Decree M/20 and monitored by SAMA, legally binds all financial firms to file any transactions suspected to have been made using proceeds from illegal or terrorist activities to the Saudi Financial Intelligence Unit (SAFIU) through the centralized SAFIU-Connect website. The compliance officials are mandated to file such STR documents in a timely fashion, according to the guidelines, within three days after the suspicion is raised. This applies to all transactions, whether successful or not. To ensure the confidentiality of the investigations, the Saudi STR Framework strictly prohibits tipping off, which is considered a serious criminal act in this regard. However, to ensure the complete safety of the compliance officials, total civil and criminal immunity from legal action is guaranteed in case of any disclosure.

The Saudi Personal Data Protection Law (PDPL), which was introduced through Royal Decree No. M/19 and is regulated by the Saudi Data and Artificial Intelligence Authority (SDAIA), is an extensive legislative system for the control of personal data processing in the country. The organization has to ground each of its data processing procedures on one of the six possible legal bases for data processing, such as explicit consent, contractual necessity, or legal obligation, while excluding the processing of sensitive data on the grounds of legitimate interest. At the same time, before the data collection process, the organization has to provide a Privacy Notice informing about the purpose of the data processing, its minimization, retention period, and disclosure to third parties. Moreover, Saudi citizens have been granted significant and mandatory Data Subject Rights, such as the right to information, access, rectification, portability, erasure, and consent withdrawal, to be fulfilled within 30 days of the request being filed to avoid substantial administrative fines.

Saudi Arabia’s Personal Data Breach Notification Requirements under the Personal Data Protection Law (PDPL), which is implemented by SDAIA, impose a mandatory requirement for the data controller to notify the authority regarding any personal data breach within 72 hours since becoming aware of it. There is no minimum limit imposed for the data breach notification requirement, which must be provided via electronic means on the National Data Governance Platform and should contain a technical description of the data breach, amount of data breached, associated risks, and any action taken in relation to the incident. Moreover, if the data breach causes a risk of harm or financial loss for the individual concerned, then the organization shall notify the individuals in question immediately in a plain language manner. Not adhering to such reporting periods, along with the breach logbook, makes organizations vulnerable to sanctions ranging from administrative fines of SAR 5 million and operational suspension.