../BACK_TO_CURRICULUM
⚖️
MODULE_02
Regulations and Compliance in Saudi Market
SESSION_OBJECTIVES
- Understanding regulatory requirements for Fintech companies
- Learning Saudi regulations (PDPL, AML, CTF)
- Exploring CMA and SAMA requirements
- Understanding licensing and compliance process
Learning Path
01 //
Regulatory Framework in Saudi Arabia
Regulatory Authorities and Powers
- SAMA: Banks, Payments, Transfers, Lending
- CMA: Securities, Crowdfunding, Robo-Advisors
SAMA Fintech Licenses
- Payment License (PSP): Capital 5-50M SAR, duration 6-12 months
- Lending License: Capital 30-100M SAR, SIMAH integration
- Money Exchange License: Capital 10+M SAR
- Licensing steps: Initial → Assessment → Documents → Review → Sandbox → Final
CMA Requirements for Investment and Trading
- Crowdfunding: Capital 5+M SAR, investment limit 100K SAR/year
- Robo-Advisors: Advisory license, capital 5-10M SAR, approved algorithms
- Licensed platforms: Scopeer, Manafa, Fundable, Wahed
02 //
Core Compliance Regulations
Personal Data Protection Law (PDPL)
- Protected data: Identity, Financial, Location, Digital, Health, Biometric
- Principles: Consent, Minimization, Security, Transparency, Access & Deletion rights
- Requirements: Explicit consent, encryption, clear privacy policy
- Penalties: Fines up to 3M SAR, service suspension
Anti-Money Laundering & Counter Terrorist Financing
- KYC: Identity verification (Absher/Nafath), contact info, source of funds
- Transaction monitoring: Large amounts, frequent transfers, high-risk countries, unusual patterns
- SAR: Report suspicious activities within 15 days
- Sanctions Screening: Check UN, OFAC, EU, Saudi lists
- Penalties: Fines up to 50M SAR, license revocation, imprisonment
Other Requirements
- Cybersecurity: ISO 27001, PCI DSS, SAMA Cybersecurity Framework
- Reporting: Monthly, quarterly, annual
- Consumer protection: Fee transparency, complaint mechanism, response within 15 days
03 //
Practical Application - Compliance Checklist
Group Activity: Building Digital Wallet
- Licensing: PSP from SAMA, capital 10M
- KYC/AML: Absher integration, transaction monitoring, Sanctions Screening
- PDPL: Privacy policy, consent forms, encryption
- Security: ISO 27001, PCI DSS, MFA
- Consumer protection: Transparency, complaints system
- Technical infrastructure: Cloud, Disaster Recovery, backups
REFERENCES
- PDPL Full Text
- SAMA Rules for Payment Service Providers
- AML Guide - SAMA