Arabie saoudite KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Arabie saoudite.
- Dernière revue
- Dernière revue:
- Version
- Version 1.0
Réponse directe
Que couvre la checklist de conformité pour Arabie saoudite ?
La checklist pour Arabie saoudite traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 39 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- FIU
- Saudi Arabia Financial Intelligence Unit (SAFIU), under the Presidency of State Security
- Primary AML rule
- Anti-Money Laundering Law, Royal Decree M/20 dated 5/2/1439H, and Implementing Regulation
- Suspicion reporting
- Promptly and directly, including attempted transactions and regardless of amount
- Universal threshold
- No single universal CDD or transaction-reporting threshold is stated in the core AML Law
- AML retention
- At least 10 years; specified authorities may require longer retention
- Company BO test
- Resolution 99 applies 25% ownership, then control, then management fallback sequentially
- Privacy authority
- Saudi Data & AI Authority (SDAIA)
- FATF public lists
- Not listed at 19 June 2026
Détail d’implémentation
Exigences et actions de conformité pour Arabie saoudite
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities, and licensingIdentify the reporting perimeter and every competent supervisor before onboarding or launch.3 éléments+
Classify each entity and activity under the national AML perimeter.
- Action d’implémentation
- Determine whether the entity is a financial institution, designated non-financial business or profession, or nonprofit organisation and map its AML, CFT and CPF supervisor.
- Preuves à conserver
- Entity map, activity analysis, licence inventory, supervisor confirmation and legal opinion.
- Source primaire
- Anti-Money Laundering Law, Articles 1, 24 and 25; Implementing Regulation, Article 1
Obtain required financial and payment permissions before operating.
- Action d’implémentation
- Classify banking, finance, insurance, securities, payment, electronic-money and technical-support activity and secure the applicable SAMA, CMA or other licence, registration or non-objection.
- Preuves à conserver
- Perimeter memorandum, application, licence, conditions, regulator correspondence and renewal calendar.
- Source primaire
- Law of Payments and Payment Services, Royal Decree M/26; Implementing Regulations, Articles 4-7
Do not treat a technical role as exempt without analysis.
- Action d’implémentation
- Where the service supports e-commerce payments, document whether it is limited to linkage and technical support or enters regulated payment execution, custody, settlement or customer-funds activity.
- Preuves à conserver
- Service diagram, funds-flow map, contracts, technical permit and regulatory analysis.
- Source primaire
- SAMA Rules for Dealing with E-Commerce Payment Service and Support Providers, Circular 46004436
02Governance and risk assessmentControls must be risk-based, senior-approved, independently tested and responsive to new risks.4 éléments+
Maintain a documented and current ML risk assessment.
- Action d’implémentation
- Assess customer, country, product, service, transaction, delivery-channel and technology risks and provide the assessment to the supervisor on request.
- Preuves à conserver
- Methodology, assessment, source inputs, approvals, residual-risk decisions and remediation plan.
- Source primaire
- Anti-Money Laundering Law, Article 5
Assess new products, practices and technologies before use.
- Action d’implémentation
- Complete and approve a documented assessment before launching remote onboarding, biometrics, automation, new channels or materially changed products.
- Preuves à conserver
- Pre-launch assessment, model or vendor validation, controls, approval and monitoring plan.
- Source primaire
- Anti-Money Laundering Law, Article 5; SAMA Circular 472039915
Maintain senior-approved AML policies and accountable management.
- Action d’implémentation
- Cover CDD, reporting, sanctions, records, employee screening, training, group controls and an appropriately senior compliance officer.
- Preuves à conserver
- Policy suite, board or senior approval, appointment, authority matrix and reporting packs.
- Source primaire
- Anti-Money Laundering Law, Article 14; Implementing Regulation, Articles 14/1-14/3
Independently test programme effectiveness.
- Action d’implémentation
- Operate risk-based monitoring, ongoing training and an independent audit function; track findings to verified closure.
- Preuves à conserver
- Training records, audit plan, samples, findings, owners and closure evidence.
- Source primaire
- Implementing Regulation, Article 14/1
03Natural-person identificationIdentify and verify customers, beneficial owners and representatives using reliable independent material.4 éléments+
Apply CDD at all core statutory triggers.
- Action d’implémentation
- Perform CDD before a relationship, an occasional transaction, an occasional wire, whenever suspicion exists regardless of amount, and when prior identity information is doubtful; apply any supervisor-set threshold in addition.
- Preuves à conserver
- Trigger matrix, aggregation logic, timestamps, customer file and exception log.
- Source primaire
- Implementing Regulation, Article 7/1
Verify the customer from authentic independent evidence.
- Action d’implémentation
- Obtain and verify identity information proportionate to the customer and risk and prohibit anonymous, obviously fictitious-name or numbered accounts.
- Preuves à conserver
- Identity copy, independent verification results, authenticity checks and discrepancy log.
- Source primaire
- Anti-Money Laundering Law, Articles 6-7; Implementing Regulation, Articles 7/2-7/3
Verify representatives and their authority.
- Action d’implémentation
- Identify and verify anyone acting for the customer and establish the authenticity and scope of the authority before permitting instructions or access.
- Preuves à conserver
- Representative KYC, power or mandate, verification result, limits and activity log.
- Source primaire
- Implementing Regulation, Article 7/2
Do not proceed when CDD cannot be completed.
- Action d’implémentation
- Do not open the account, establish the relationship or execute the transaction; terminate an existing relationship as required and consider an STR. If CDD would tip off the customer, stop that step and report the reason.
- Preuves à conserver
- Restriction, exit decision, suspicion assessment, approval and filing receipt.
- Source primaire
- Implementing Regulation, Articles 7/8-7/9
04KYB, registries, and beneficial ownershipVerify legal existence, authority, ownership and actual control; keep AML verification and company filing duties distinct.4 éléments+
Verify legal-person identity, purpose and authority.
- Action d’implémentation
- Obtain current constitutional and commercial-register information, principal address, business purpose, directors or managers and binding authority from reliable independent sources.
- Preuves à conserver
- Commercial-register extract, constitutional pack, licence, officer list, mandates and discrepancy log.
- Source primaire
- Implementing Regulation, Article 7/2
Identify and verify each AML beneficial owner.
- Action d’implémentation
- Trace the natural person who ultimately owns or controls the customer and take reasonable measures to verify identity; for legal arrangements identify the relevant controlling natural persons.
- Preuves à conserver
- Layered ownership chart, control analysis, source documents, verified identities and rationale.
- Source primaire
- Implementing Regulation, Article 7/3; SAMA AML/CTF Guide, section 3.17
Apply the current company-register beneficial-owner cascade.
- Action d’implémentation
- Where Resolution 99 applies, identify natural persons owning directly or indirectly at least 25%; only if none, identify control by other means; only if still none, apply the manager, board-member or chairperson fallback.
- Preuves à conserver
- Percentage calculations, control analysis, sequential fallback rationale and filing record.
- Source primaire
- Ministerial Resolution 99 dated 5/6/1447H; Ministry of Commerce announcement, 8 December 2025
Maintain and confirm the company beneficial-owner record.
- Action d’implémentation
- Keep the prescribed identity, contact, qualification and nature-and-extent information accurate; disclose and annually confirm it through the current Ministry process and preserve the internal register.
- Preuves à conserver
- BO register, reasonable-measures file, submission, annual confirmation and change log.
- Source primaire
- Ministerial Resolution 99 dated 5/6/1447H
05PEPs, EDD, and relianceDetect prominent public functions and strengthen controls where risk requires.3 éléments+
Identify customers and beneficial owners with prominent public functions.
- Action d’implémentation
- Use risk systems, declarations and reliable sources to identify domestic or foreign prominent public functions and senior international-organisation roles, including relationships covered by the regulation.
- Preuves à conserver
- Declaration, screening result, relationship map, rationale and refresh history.
- Source primaire
- Anti-Money Laundering Law, Article 8; Implementing Regulation, Article 8
Apply enhanced measures proportionate to higher risk.
- Action d’implémentation
- Obtain required senior approval, establish source of wealth and source of funds where applicable, and increase ongoing monitoring for higher-risk customers and relationships.
- Preuves à conserver
- Risk assessment, approval, source corroboration, monitoring plan and review record.
- Source primaire
- Anti-Money Laundering Law, Articles 7-8; Implementing Regulation, Articles 7/14 and 8
Retain responsibility when relying on a third party.
- Action d’implémentation
- Obtain required CDD information immediately, ensure underlying documents are available without delay, confirm the relied party is regulated and supervised, assess country risk and keep ultimate responsibility.
- Preuves à conserver
- Reliance assessment, agreement, information receipt, document test, supervision check and review.
- Source primaire
- Implementing Regulation, Articles 7/10-7/13
06Monitoring and suspicious reportingSuspicious funds and attempts are reported promptly and directly, regardless of amount.4 éléments+
Monitor relationships and keep CDD current.
- Action d’implémentation
- Scrutinise transactions against customer information, business activity, risk and source of funds where necessary; refresh higher-risk records more frequently.
- Preuves à conserver
- Monitoring scenarios, alerts, investigations, refresh schedule and dispositions.
- Source primaire
- Anti-Money Laundering Law, Article 13; Implementing Regulation, Articles 7/6-7/7
Examine complex, unusually large or purposeless patterns.
- Action d’implémentation
- Document the background and purpose of transactions or patterns with no clear economic or legal objective and escalate unresolved suspicion.
- Preuves à conserver
- Alert, customer explanation, corroboration, analysis and disposition.
- Source primaire
- Anti-Money Laundering Law, Article 13
Report suspicion and attempted transactions promptly and directly.
- Action d’implémentation
- When suspicion or reasonable grounds concern funds, proceeds or money laundering, regardless of amount, send SAFIU a detailed report with available information and respond promptly to follow-up requests.
- Preuves à conserver
- Suspicion chronology, report, submission receipt, acknowledgement and supplemental responses.
- Source primaire
- Anti-Money Laundering Law, Articles 15 and 18
Prevent tipping off and preserve report confidentiality.
- Action d’implémentation
- Restrict access and do not disclose that a report will be, is being or has been filed or that a criminal investigation is underway, except where lawfully permitted.
- Preuves à conserver
- Need-to-know matrix, access logs, communication controls, training and incident review.
- Source primaire
- Anti-Money Laundering Law, Article 16
07Payments, wires, thresholds, and agentsPayment permissions, wire data and agent oversight are product- and supervisor-specific.4 éléments+
Carry required originator and beneficiary information through the payment chain.
- Action d’implémentation
- Obtain and retain prescribed originator and beneficiary data and do not execute a wire when required information cannot be obtained.
- Preuves à conserver
- Field matrix, validation logic, sampled transfers, repair queue and rejection record.
- Source primaire
- Anti-Money Laundering Law, Article 10; Implementing Regulation, Article 10
Use the correct payment or electronic-money permission.
- Action d’implémentation
- Map the product to regulated payment services and secure the SAMA licence, registration or other approval before offering, marketing or arranging it in the Kingdom.
- Preuves à conserver
- Product classification, licence, conditions, terms, launch approval and renewal calendar.
- Source primaire
- Payments and Payment Services Implementing Regulations, Articles 4-7
Obtain SAMA non-objection before appointing payment agents.
- Action d’implémentation
- Submit the prescribed business plan and agent information, verify required permissions and maintain annual performance and incident reporting.
- Preuves à conserver
- Non-objection, due diligence, contract, agent register, annual report and monitoring.
- Source primaire
- Payments and Payment Services Implementing Regulations, Article 24
Obtain SAMA non-objection before material outsourcing.
- Action d’implémentation
- Assess materiality, risks, audit and access rights, continuity and exit; obtain non-objection before contracting a material payment function.
- Preuves à conserver
- Outsourcing assessment, regulator non-objection, contract, oversight and exit test.
- Source primaire
- Payments and Payment Services Implementing Regulations, Article 27
08Targeted financial sanctionsUse the current national, UN and supervisory framework; procedures differ by supervised sector.3 éléments+
Screen relevant parties against current sanctions designations.
- Action d’implémentation
- Screen customers, beneficial owners, controllers, representatives and transactions at onboarding, during the relationship and when applicable lists change.
- Preuves à conserver
- List inventory, update logs, screening configuration, tests and dispositions.
- Source primaire
- SAMA Targeted Financial Sanctions Rules, Circular 472035766 dated 7 December 2025
Freeze covered property without delay when a confirmed designation applies.
- Action d’implémentation
- Block covered funds or assets, prevent funds or services being made available and follow the current competent-authority reporting and release procedure without prior notice to the designated person.
- Preuves à conserver
- Match analysis, freeze timestamp, ownership-control analysis, asset inventory, report and system blocks.
- Source primaire
- SAMA Targeted Financial Sanctions Rules, Circular 472035766; Law on Combating Terrorism Crimes and Financing
Scope proliferation-sanctions procedures to the relevant sector.
- Action d’implémentation
- Apply SAMA's in-force rules to supervised financial institutions and the Ministry of Commerce guide to dealers in precious metals and stones; do not generalise a sector filing route without authority.
- Preuves à conserver
- Sector analysis, applicable rule version, procedure map, training and test case.
- Source primaire
- SAMA Circular 472035766; Ministry of Commerce Guide for Dealers in Precious Metals and Stones, April 2026
09Records and authority accessRecords must reconstruct transactions and remain available for at least ten years.3 éléments+
Retain transaction and relationship records for at least ten years.
- Action d’implémentation
- Keep domestic, international, commercial and monetary transaction records from transaction completion or account closure and CDD, account, correspondence and analysis material from the relevant statutory trigger.
- Preuves à conserver
- Retention schedule, trigger calculations, archive sample, legal holds and deletion controls.
- Source primaire
- Anti-Money Laundering Law, Article 12
Extend retention when lawfully required.
- Action d’implémentation
- Apply Public Prosecution extensions for criminal investigation or prosecution and preserve relevant material under controlled legal hold.
- Preuves à conserver
- Authority request, validation, hold notice, affected records and release approval.
- Source primaire
- Anti-Money Laundering Law, Article 12(3)
Reconstruct and promptly produce records.
- Action d’implémentation
- Organise records to reconstruct individual transactions, authenticate official requests and make responsive material readily available while protecting STR confidentiality.
- Preuves à conserver
- Request register, authority validation, production index, delivery log and receipt.
- Source primaire
- Anti-Money Laundering Law, Articles 12(4), 18 and 25
10Privacy, biometrics, and transfersIdentity and monitoring data must follow the PDPL, its Implementing Regulation and Transfer Regulation.4 éléments+
Map scope, purpose and lawful basis for each processing activity.
- Action d’implémentation
- Document the controller or processor role, purpose, statutory or consent basis, notice, source and recipient for identity, screening, monitoring and biometric data.
- Preuves à conserver
- Data inventory, role and lawful-basis analysis, notices, consent records and exception register.
- Source primaire
- Personal Data Protection Law, Articles 2, 5-6 and 10-15
Minimise and secure personal and sensitive data.
- Action d’implémentation
- Collect only necessary data, apply purpose limitation, accuracy, access, security and destruction controls, and give sensitive and biometric data heightened safeguards.
- Preuves à conserver
- Field justification, security design, access reviews, retention configuration and tests.
- Source primaire
- PDPL; Implementing Regulation, Articles 8, 19 and 23
Govern processors and breaches.
- Action d’implémentation
- Select processors providing sufficient guarantees, include required contract terms, control subprocessors and operate the applicable authority and data-subject breach-notification process.
- Preuves à conserver
- Due diligence, contract, subprocessor register, incident assessment, notices and chronology.
- Source primaire
- PDPL Implementing Regulation, Articles 17 and 24
Use a lawful route for transfers outside the Kingdom.
- Action d’implémentation
- Assess national and vital interests, necessity and minimisation; use adequacy, an approved appropriate safeguard or a permitted exception and complete a transfer risk assessment when required.
- Preuves à conserver
- Transfer map, legal route, safeguard, risk assessment, approvals and monitoring.
- Source primaire
- PDPL, Article 29; Regulation on Personal Data Transfer Outside the Kingdom, Articles 2-8
11Practical evidence packsEvidence should reproduce onboarding, monitoring and launch decisions end to end.3 éléments+
Maintain a reconstructable onboarding pack.
- Action d’implémentation
- Bundle identity, authority, KYB, beneficial ownership, PEP and sanctions screening, risk, approvals, privacy records and exceptions under stable identifiers.
- Preuves à conserver
- Complete sampled onboarding pack and retrieval result.
- Source primaire
- Operational control supporting Anti-Money Laundering Law, Articles 7-8 and 12
Maintain a reconstructable reporting and sanctions pack.
- Action d’implémentation
- Link transactions, alerts, analysis, timing, report, acknowledgement, supplements, freeze actions, authority communications and access logs.
- Preuves à conserver
- Complete sampled case pack and controlled access log.
- Source primaire
- Operational control supporting Anti-Money Laundering Law, Articles 15-18 and applicable TFS rules
Maintain a regulator-scoped launch pack.
- Action d’implémentation
- Record activity classification, licences, current legal sources, filing readiness, ownership duties, sanctions procedure, privacy analysis, vendor controls and validation before launch and material change.
- Preuves à conserver
- Signed launch pack, source register, regulator map, uncertainty log, tests and approvals.
- Source primaire
- Official sources listed below
Registre des sources primaires
17 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Anti-Money Laundering Law and Implementing RegulationSaudi Central Bank Rulebook · Primary legislation and official regulation
- Law on Combating Terrorism Crimes and Financing and Implementing RegulationsSaudi Central Bank Rulebook · Primary legislation and official regulation
- AML/CTF Guide for SAMA-supervised financial institutionsSaudi Central Bank Rulebook · Official supervisory guidance
- Guidance on assessing ML, TF and PF business risksSaudi Central Bank Rulebook · Official in-force circular
- Targeted Financial Sanctions Rules, Circular 472035766Saudi Central Bank Rulebook · Official in-force rules
- Targeted-financial-sanctions guide for dealers in precious metals and stonesMinistry of Commerce · Official sector guidance
- Beneficial Ownership Rules approved by Resolution 99Ministry of Commerce · Official binding rules
- Ministry announcement of Resolution 99 and sequential BO criteriaMinistry of Commerce · Official explanatory announcement
- Ministry guidance on BO confirmation and register accessMinistry of Commerce · Official explanatory announcement
- Implementing Regulations of Payments and Payment Services LawSaudi Central Bank Rulebook · Official in-force regulation
- Rules for e-commerce payment service and support providersSaudi Central Bank Rulebook · Official in-force rules
- Personal Data Protection LawSaudi Data & AI Authority · Primary legislation
- PDPL Implementing Regulation and Transfer RegulationSaudi Data & AI Authority · Official regulations
- Saudi Arabia mutual evaluationFATF · Authoritative assessment
- FATF jurisdictions under increased monitoring - 19 June 2026FATF · Authoritative current status
- FATF high-risk jurisdictions subject to a call for action - 19 June 2026FATF · Authoritative current status
- United Nations Security Council consolidated sanctions listUnited Nations · Authoritative sanctions list
Réponses directes
Questions KYC, KYB et AML pour Arabie saoudite
Who receives suspicious transaction reports?+
The Saudi Arabia Financial Intelligence Unit (SAFIU), the national central agency under the Presidency of State Security. Use the current authorised reporting channel for the entity's sector.
When must suspicion be reported?+
Promptly and directly when suspicion or reasonable grounds concern criminal proceeds or money laundering, including attempted transactions and regardless of amount. Do not wait for proof or a monetary threshold.
Is there one universal CDD threshold?+
No single universal monetary threshold is stated in the core AML Law for all sectors. CDD applies at statutory triggers, and sector supervisors may prescribe additional thresholds or rules.
How is beneficial ownership determined?+
For AML CDD, identify and verify the natural person who ultimately owns or controls the customer. Separately, Resolution 99 applies a sequential company-register test: at least 25% ownership, then control by other means, then a management fallback.
How long are AML records retained?+
At least ten years under Article 12 of the AML Law. The Public Prosecution may require longer retention for an investigation or prosecution.
What happens on a sanctions match?+
Apply the current list and sector rule, confirm identifiers, freeze covered property without delay where required, prevent prohibited availability, report through the competent route and release only under verified authority.
Does a payment business need SAMA permission?+
Regulated payment services and payment-system operation require the applicable SAMA licence or approval. Agents and material outsourcing also trigger prior non-objection requirements under the implementing regulations.
Is Saudi Arabia on a FATF public list?+
No. Saudi Arabia was absent from both FATF public lists dated 19 June 2026. That does not make a customer, product or transaction low risk.
What privacy rules apply to KYC data?+
The PDPL, its Implementing Regulation and Transfer Regulation govern scope, lawful processing, security, processors, breaches, destruction and overseas transfers, subject to any applicable sector rule.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General regulatory information, not legal advice or a licence determination. Reviewed as applicable on 16 September 2026. Confirm the controlling Arabic text, later amendments, sector circulars, SAFIU filing mechanics, sanctions-list procedures, Ministry of Commerce filing workflow and product-specific SAMA or CMA requirements with the competent authority and qualified Saudi counsel before launch.