# How to Map ISO 37001 Controls to SAMA Counter-Fraud Framework Requirements: A Clause-by-Clause Implementation Guide
The Saudi Central Bank's Counter-Fraud Framework establishes clear expectations for governance, prevention, detection and response at banks, payment service providers and other regulated institutions. Yet the framework does not prescribe how to structure your programme, assign roles or document processes. For compliance heads and fraud managers building or strengthening counter-fraud capabilities, this creates both flexibility and uncertainty: you know the outcomes SAMA expects, but the implementation path is yours to design.
ISO 37001, the international standard for anti-bribery management systems, offers a tested architecture that translates directly to fraud risk management. Its clause structure—leadership commitment, risk assessment, due diligence, controls, reporting, investigation—mirrors the elements SAMA requires. A deliberate ISO 37001 SAMA counter-fraud framework mapping allows you to build a single programme that satisfies both the international standard and the regulator's expectations, avoiding duplication and rework when SAMA conducts its review.
This article provides a clause-by-clause mapping, showing which ISO 37001 controls meet which SAMA Counter-Fraud Framework requirements, where the overlap is complete, and where you must add Saudi-specific elements to achieve full compliance.
Why ISO 37001 Fits the SAMA Counter-Fraud Framework
ISO 37001 was written for bribery, but its control logic applies to any integrity risk. Both bribery and fraud involve deliberate acts by insiders or third parties, require governance and tone from the top, depend on risk assessment and due diligence, and demand investigation and remediation when incidents occur. The standard's clause structure provides a ready-made skeleton for the counter-fraud programme SAMA expects.
Three features make ISO 37001 particularly suitable:
Three lines of defence by design. The standard separates the compliance function (second line) from operational management (first line) and requires independent assurance (third line). SAMA expects this separation explicitly.
Risk-based approach. ISO 37001 requires you to assess fraud risk by product, channel, geography and counterparty, then tailor controls accordingly. SAMA's framework demands the same risk-led prioritisation.
Documented processes and evidence. Every ISO clause calls for policies, procedures, records and periodic review. SAMA reviews rely on this documentation to verify that your programme operates as described.
Where ISO 37001 falls short is in sector-specific and jurisdiction-specific detail. The standard does not address payment fraud typologies, correspondent banking risks, or the Arabic-language policy requirements common in Saudi regulation. Your mapping must identify these gaps and specify the additions needed.
Clause-by-Clause Mapping: ISO 37001 to SAMA CFF
Clause 4: Context of the Organisation
ISO 37001 requirement: Understand external and internal issues, interested parties, and the scope of your anti-bribery system.
SAMA CFF requirement: Establish the scope of your counter-fraud programme, covering all products, channels, geographies and third parties.
Mapping: Direct alignment. Your context analysis under ISO 37001 should explicitly address fraud risk, not only bribery. Document the products you offer (retail accounts, corporate lending, payment services, remittances), the channels (branch, ATM, mobile, online), the jurisdictions you operate in, and the third parties you rely on (agents, vendors, correspondents).
Saudi-specific addition: Include a statement on how the programme aligns with SAMA's regulatory expectations and any sector-specific guidance SAMA has issued for your institution type.
Clause 5: Leadership
ISO 37001 requirement: Top management demonstrates commitment, establishes an anti-bribery policy, assigns roles and responsibilities, and ensures the compliance function has authority and independence.
SAMA CFF requirement: Board and senior management oversight, a dedicated counter-fraud function with sufficient authority, and clear accountability.
Mapping: Near-complete alignment. ISO 37001 Clause 5 delivers the governance structure SAMA expects. Your board-approved counter-fraud policy satisfies both. The compliance function required by ISO 37001 becomes your counter-fraud function under SAMA.
Saudi-specific addition: SAMA expects a counter-fraud governance committee at management level, reporting to the board or board risk committee. Your ISO 37001 governance may not specify this; add a committee charter, meeting frequency (typically quarterly), and escalation thresholds.
Clause 6: Planning
ISO 37001 requirement: Conduct a bribery risk assessment, set objectives, and plan actions to address risks and opportunities.
SAMA CFF requirement: Fraud risk assessment covering inherent and residual risk by product, channel and customer segment; a counter-fraud strategy and roadmap.
Mapping: Strong alignment in process, but scope differs. ISO 37001 risk assessment focuses on bribery scenarios (procurement, licensing, third-party intermediaries). For SAMA, expand the assessment to cover:
- Payment fraud (card-not-present, account takeover, authorised push payment)
- Application fraud (identity theft, synthetic identities)
- Internal fraud (unauthorised transactions, data theft)
- Third-party fraud (agent misconduct, vendor collusion)
Your risk assessment output should be a fraud risk register with inherent risk scores, existing controls, residual risk, and mitigation actions. This satisfies both ISO 37001 Clause 6.1 and SAMA's expectation for documented risk assessment.
Saudi-specific addition: Include fraud typologies observed in the Kingdom (SIM swap fraud, social engineering targeting Absher credentials) and any risks flagged in SAMA circulars or industry alerts.
Clause 7: Support
ISO 37001 requirement: Allocate resources, ensure competence, raise awareness, manage documented information.
SAMA CFF requirement: Adequate resourcing of the counter-fraud function, training for staff in fraud awareness and detection, and documented policies and procedures.
Mapping: Direct alignment. ISO 37001 Clause 7.2 (competence) and 7.3 (awareness) cover the training SAMA expects. Your training programme should be role-based:
- All staff: fraud awareness, reporting channels
- Front-line staff: red flags, customer due diligence
- Fraud analysts: investigation techniques, evidence handling
- Senior management: governance, reporting, regulatory obligations
ISO 37001 Clause 7.5 (documented information) requires you to maintain policies, procedures, risk assessments, training records and investigation files. This is the evidence base SAMA will review.
Saudi-specific addition: Policies and key procedures must be available in Arabic. SAMA expects this even if your working language is English. Ensure version control so Arabic and English documents remain aligned.
Clause 8: Operation
ISO 37001 requirement: Implement due diligence on third parties, establish financial and non-financial controls, and manage projects and transactions with bribery risk.
SAMA CFF requirement: Preventive and detective controls across the customer lifecycle, transaction monitoring, and third-party risk management.
Mapping: Clause 8 is where ISO 37001 and SAMA CFF overlap most closely, but also where you must translate bribery controls into fraud controls.
Due diligence (ISO 37001 Clause 8.2): For SAMA, this becomes customer due diligence (CDD) and enhanced due diligence (EDD) for fraud risk, not just financial crime. Apply risk-based checks at onboarding (identity verification, document authentication, sanctions and PEP screening) and periodically thereafter.
Financial controls (ISO 37001 Clause 8.3): Segregation of duties, dual authorisation, and reconciliation. These controls prevent internal fraud. SAMA expects them in payment processing, account maintenance, and any function with access to customer funds or data.
Non-financial controls (ISO 37001 Clause 8.4): Fraud awareness, whistleblowing channels, and conflict-of-interest declarations. SAMA requires a confidential reporting mechanism, accessible to employees and customers, with protection against retaliation.
Saudi-specific addition: SAMA expects transaction monitoring rules tailored to your products. ISO 37001 does not prescribe this. Document your monitoring scenarios (velocity checks, geo-location anomalies, beneficiary changes), thresholds, and alert-handling procedures. If you operate a fraud management system, map its rule set to your risk assessment.
Clause 9: Performance Evaluation
ISO 37001 requirement: Monitor, measure, analyse and evaluate the anti-bribery system; conduct internal audits; and perform management review.
SAMA CFF requirement: Ongoing monitoring of fraud metrics, periodic self-assessment against the framework, and independent assurance (internal audit or external review).
Mapping: ISO 37001 Clause 9 delivers the assurance SAMA expects. Your monitoring (Clause 9.1) should track:
- Fraud incidents by type, channel and outcome
- Alert volumes and false-positive rates
- Investigation turnaround times
- Training completion rates
- Policy exceptions and breaches
Internal audit (Clause 9.2) provides third-line assurance. SAMA expects internal audit to review the counter-fraud programme at least annually, testing control design and operating effectiveness.
Management review (Clause 9.3) becomes your counter-fraud committee's quarterly review, escalating material issues to the board.
Saudi-specific addition: SAMA expects board reporting on fraud incidents, trends, control effectiveness and remediation. ISO 37001 requires management review but does not specify board reporting. Prepare a quarterly board pack with metrics, case summaries (anonymised), and forward-looking risk commentary.
Clause 10: Improvement
ISO 37001 requirement: Respond to nonconformities, take corrective action, and continually improve the system.
SAMA CFF requirement: Investigation of fraud incidents, root-cause analysis, remediation, and continuous improvement of controls.
Mapping: ISO 37001 Clause 10.1 (nonconformity and corrective action) aligns with SAMA's expectation for incident response and remediation. When fraud occurs, you must:
- Contain the incident and prevent further loss
- Investigate to establish facts and causation
- Identify control failures or gaps
- Implement corrective actions
- Update risk assessment and controls
- Report to SAMA if the incident meets regulatory thresholds
ISO 37001 Clause 10.2 (continual improvement) requires you to learn from incidents, audits and reviews. For SAMA, this means updating your fraud typology library, refining monitoring rules, and adjusting due diligence based on emerging threats.
Saudi-specific addition: SAMA requires regulatory reporting of significant fraud incidents within specified timeframes. ISO 37001 does not address this. Document your incident classification (materiality thresholds) and reporting procedures, ensuring alignment with SAMA's incident-reporting requirements.
Where ISO 37001 Does Not Cover SAMA Expectations
Three areas require explicit additions beyond ISO 37001:
Fraud typology library. ISO 37001 does not require a catalogue of fraud scenarios. SAMA expects you to maintain a current library of fraud types relevant to your business, with case studies, red flags and control mappings. Update this library as new typologies emerge.
Fraud management technology. ISO 37001 is technology-neutral. SAMA does not mandate specific systems, but expects institutions of a certain size and complexity to deploy automated monitoring and case management. If you operate such a system, document its role in your control framework, including rule governance, model validation, and system change control.
Recovery and restitution. SAMA expects you to pursue recovery of fraud losses and, where customers are victims, to have a fair and transparent restitution process. ISO 37001 focuses on prevention and investigation, not recovery. Add procedures for loss recovery (civil action, insurance claims) and customer reimbursement (liability assessment, claims handling).
Building Once, Satisfying Both
A well-executed mapping allows you to design and document your counter-fraud programme once, satisfying both ISO 37001 and SAMA's Counter-Fraud Framework. The approach:
Start with ISO 37001 as your structural backbone. Adopt its clause numbering for your policy and procedure set. This gives you a logical, auditable structure and makes gap analysis straightforward.
Expand each clause with SAMA-specific requirements. Where ISO 37001 is silent or generic, add the detail SAMA expects: fraud typologies, transaction monitoring, board reporting, Arabic documentation.
Document the mapping explicitly. Maintain a compliance matrix that lists each SAMA CFF requirement, the corresponding ISO 37001 clause, the control or procedure that satisfies it, and any additional measures. This matrix becomes your evidence during SAMA reviews and your guide for internal audit.
Test through self-assessment. Before engaging with SAMA, conduct a self-assessment against the Counter-Fraud Framework, using your mapping as the basis. Identify any residual gaps and close them before the regulator arrives.
How We Support SAMA Counter-Fraud Framework Implementation
We design and implement the governance, policies, roles, processes and reporting your institution needs to meet the SAMA Counter-Fraud Framework—a complete counter-fraud program, built to SAMA expectations.
The engagement follows four stages: baseline gap assessment against the framework; design of governance, policy, operating model and reporting; implementation through roll-out, training and process adoption; and assurance via self-assessment and readiness for regulator review.
Deliverables include a counter-fraud strategy and roadmap, a policy and procedure set, a RACI and operating model, and a compliance self-assessment against the framework. Features of the programme include counter-fraud governance and committee charter, fraud policy, standards and procedures, a three-lines-of-defense operating model, and board and regulator reporting.
Typically, implementation takes three to six months, depending on your starting point and size. We write the policies for you, in Arabic and English, tailored to your products and approved through your governance.
The frameworks we apply are the SAMA Counter-Fraud Framework and ISO 37001, mapped as described in this article to ensure you build once and satisfy both.
If your institution is implementing the SAMA Counter-Fraud Framework, or strengthening an existing programme, a structured mapping to ISO 37001 provides the tested architecture you need and the evidence SAMA expects.
