The Saudi Central Bank's Counter-Fraud and Reporting Framework places fraud-risk assessment at the centre of every regulated institution's fraud-control programme. Article 4.2 of SAMA CRFR requires licensed entities to conduct an annual SAMA CRFR fraud risk assessment that identifies, evaluates and documents fraud scenarios relevant to their business model, products and channels. Yet the framework does not prescribe a scenario taxonomy or catalogue, leaving Chief Risk Officers and compliance heads to determine which fraud types belong in the annual review.
This ambiguity creates a practical problem: risk teams must satisfy both the regulator's expectation of comprehensive coverage and the board's need for a structured, actionable assessment. Examiners look for evidence that the institution has considered the full spectrum of fraud threats, not merely the incidents that occurred in the past year. A gap in scenario coverage signals a gap in control design, and boards rightly ask whether the assessment truly reflects the institution's exposure.
This article sets out the seven fraud-scenario categories that examiners expect to see in every annual SAMA CRFR fraud risk assessment, drawn from supervisory practice and the framework's risk-based principles. For each category, we provide examples from payment and lending operations common to Saudi banks, payment firms and finance companies, so risk teams can structure their assessment to meet regulatory and governance requirements.
Why Scenario Taxonomy Matters Under SAMA CRFR
SAMA CRFR Article 4.2 requires the fraud-risk assessment to be comprehensive and risk-based. Comprehensive means the assessment covers all material fraud threats to which the institution is exposed, not only those that have materialised. Risk-based means the depth of analysis and control investment should reflect the likelihood and impact of each scenario.
Without a consistent scenario taxonomy, three problems arise:
Blind spots in control design. If the assessment omits a category—for example, third-party fraud or emerging digital threats—the institution will not design or test controls for those scenarios, leaving exposures unmanaged.
Inconsistent year-on-year comparison. Boards and senior management need to track whether fraud risk is rising or falling. If the scenario list changes each year, trend analysis becomes impossible.
Difficulty demonstrating completeness to examiners. During supervisory review, examiners will ask how the institution determined its scenario list and whether any material threats were excluded. A structured taxonomy provides the answer.
The seven categories below form a stable, comprehensive framework that addresses these concerns and aligns with the risk-based approach SAMA CRFR requires.
The Seven Fraud-Scenario Categories
1. Internal Fraud
Internal fraud involves employees, contractors or other insiders who exploit their access, knowledge or authority to misappropriate funds, manipulate records or facilitate external fraud. This category covers scenarios in which the perpetrator is directly employed or contracted by the institution.
Examples in payment and lending operations:
- A loan officer approves fictitious consumer loans to accomplices, who withdraw the proceeds and share them with the officer.
- A payment operations clerk manipulates batch files to divert a portion of outbound transfers to personal accounts.
- A branch manager overrides credit limits or collateral requirements in exchange for bribes from borrowers.
- An IT administrator with privileged access alters transaction logs to conceal unauthorised transfers.
Internal fraud scenarios should consider segregation of duties, approval workflows, privileged-access controls and employee background screening. The assessment should evaluate whether monitoring detects anomalies in employee behaviour, such as unusual approval patterns or after-hours system access.
2. External Fraud
External fraud involves third parties with no employment or contractual relationship to the institution. Perpetrators may impersonate customers, exploit weak authentication, or use social engineering to gain access to accounts or systems.
Examples in payment and lending operations:
- Account takeover through phishing, SIM swap or credential theft, followed by unauthorised transfers.
- Application fraud in which an individual submits false identity documents or income statements to obtain a loan or open a payment account.
- Cheque fraud, including forgery, alteration or counterfeit instruments presented for payment.
- Card-not-present fraud in e-commerce transactions using stolen card details.
External fraud scenarios should assess customer authentication strength, identity verification procedures, transaction monitoring rules and fraud-detection algorithms. The assessment should also consider the institution's exposure to new attack vectors, such as deepfake voice or video used to bypass biometric controls.
3. Customer Collusion
Customer collusion involves a legitimate account holder who conspires with an insider or external party to defraud the institution. The customer provides access, credentials or documentation that would otherwise be unavailable to the co-conspirator.
Examples in payment and lending operations:
- A customer applies for a personal loan with inflated income documents prepared by a loan officer, then shares the proceeds with the officer.
- A business account holder allows a third party to use the account for layering illicit funds, in exchange for a fee.
- A cardholder reports a legitimate transaction as fraudulent to trigger a chargeback, splitting the refund with a merchant.
- A customer provides online banking credentials to a money mule recruiter, who uses the account to receive and forward proceeds of fraud.
Customer collusion is difficult to detect because the account holder's participation makes the activity appear legitimate. The assessment should evaluate whether monitoring can identify inconsistencies—such as a sudden change in transaction patterns immediately after account opening, or a customer who repeatedly disputes transactions with the same merchant.
4. Third-Party Fraud
Third-party fraud involves vendors, service providers, agents or other entities with a contractual relationship to the institution. The third party may commit fraud directly, or introduce vulnerabilities that external actors exploit.
Examples in payment and lending operations:
- A payment gateway provider suffers a data breach, exposing customer card details that are later used for unauthorised transactions.
- A loan broker submits fabricated applications on behalf of non-existent borrowers, collecting origination fees.
- An outsourced call centre agent uses customer information obtained during service calls to open fraudulent accounts.
- A merchant acquirer onboards a shell company that processes fraudulent card transactions, then disappears before chargebacks arrive.
Third-party fraud scenarios should consider vendor due diligence, contract terms that allocate fraud liability, and ongoing monitoring of third-party performance and security posture. The assessment should also evaluate whether the institution has visibility into third-party sub-contractors who handle customer data or transaction processing.
5. Digital-Channel Fraud
Digital-channel fraud exploits vulnerabilities in online banking, mobile applications, ATMs, point-of-sale terminals or API integrations. This category overlaps with external fraud but focuses specifically on the technology layer and channel-specific attack methods.
Examples in payment and lending operations:
- Man-in-the-middle attacks that intercept and alter payment instructions between customer and bank.
- Mobile malware that overlays fake login screens on legitimate banking apps to capture credentials.
- ATM skimming or shimming devices that capture card data and PINs.
- API abuse in which an attacker exploits weak rate limits or authentication to enumerate account numbers or initiate unauthorised transfers.
Digital-channel fraud scenarios should assess multi-factor authentication, encryption, session management, device fingerprinting, and anomaly detection in channel usage. The assessment should also consider whether the institution tests its channels for common vulnerabilities, such as those listed in the OWASP Top Ten.
6. Product Misuse
Product misuse involves customers or third parties who exploit the design, terms or features of a financial product in ways the institution did not intend, often to facilitate money laundering, sanctions evasion or other financial crime. The activity may not involve deception but still results in loss or regulatory exposure.
Examples in payment and lending operations:
- Rapid movement of funds through multiple accounts to obscure the source, using the institution's instant-payment product.
- Structuring deposits or withdrawals below reporting thresholds to evade suspicious-transaction reporting.
- Using a personal loan product to fund a business, then defaulting when the business fails, because the institution did not verify the stated purpose.
- Opening multiple prepaid cards under different names to bypass transaction limits.
Product-misuse scenarios should evaluate product design, customer due diligence, transaction limits, and the institution's ability to identify patterns of abuse across accounts. The assessment should also consider whether the institution's anti-money-laundering and counter-fraud programmes share intelligence and coordinate investigations.
7. Emerging Threats
Emerging threats are fraud scenarios that have appeared recently in the threat landscape, are growing in prevalence, or represent novel attack methods enabled by new technology. This category ensures the assessment remains forward-looking and does not rely solely on historical incident data.
Examples in payment and lending operations:
- Synthetic identity fraud, in which attackers combine real and fabricated identity elements to create new credit profiles that pass automated verification.
- Authorised push-payment fraud, in which victims are socially engineered into authorising transfers to fraudster-controlled accounts.
- Fraud-as-a-service platforms that lower the barrier to entry for attackers by offering phishing kits, credential-stuffing tools or money-mule recruitment.
- Exploitation of instant-payment schemes, where the speed of settlement reduces the institution's ability to detect and reverse fraudulent transactions.
Emerging-threat scenarios should draw on industry intelligence, regulatory alerts, and information-sharing forums. The assessment should evaluate whether the institution has a process to monitor the threat landscape and update controls in response to new attack methods.
Structuring the Annual Assessment
A comprehensive SAMA CRFR fraud risk assessment addresses each of the seven categories by:
- Identifying specific scenarios within each category that are relevant to the institution's products, channels and customer base.
- Assessing inherent risk for each scenario, considering likelihood and potential impact before controls are applied.
- Evaluating control effectiveness by testing whether preventive, detective and responsive controls are designed and operating as intended.
- Calculating residual risk after controls, to determine whether the remaining exposure is acceptable or requires additional mitigation.
- Documenting the rationale for risk ratings and control assessments, so examiners and the board can understand the basis for conclusions.
- Producing an action plan that prioritises control enhancements, new monitoring rules, or process changes to reduce residual risk.
The assessment should be documented in a format that supports year-on-year comparison, typically a risk register or matrix that lists scenarios, inherent risk, controls, residual risk and action items. The board summary should highlight the highest residual risks and the status of the previous year's action plan.
Common Gaps in Fraud-Risk Assessments
In practice, many institutions' annual assessments fall short of SAMA CRFR expectations in predictable ways:
Omission of third-party and emerging-threat categories. Risk teams often focus on internal and external fraud because those categories align with historical incident data. Third-party and emerging threats require proactive intelligence gathering, which many institutions have not yet embedded in their assessment process.
Lack of scenario granularity. Listing "external fraud" as a single scenario is insufficient. The assessment should break the category into specific attack methods—account takeover, application fraud, payment fraud—each with its own control evaluation.
No linkage between scenarios and controls. The assessment should map each scenario to the specific controls designed to prevent, detect or respond to it, and test whether those controls are effective. A generic control inventory does not satisfy this requirement.
Inadequate board reporting. Boards need to understand the institution's top fraud risks, the trend over time, and the investment required to close gaps. A technical control-testing report does not provide this context.
Static scenario lists. If the assessment uses the same scenario list year after year without considering new products, channels or threat intelligence, it will miss emerging exposures.
How CISO Consulting Supports SAMA CRFR Fraud-Risk Assessments
Regulated institutions preparing their annual fraud-risk assessment under SAMA CRFR often require external expertise to ensure comprehensive scenario coverage, rigorous control testing and clear documentation that satisfies both examiners and the board.
CISO Consulting delivers compliance assessments against SAMA CRFR and other regulatory frameworks through a structured four-phase process: scope definition to confirm the frameworks, entities and systems in scope; evidence collection through questionnaires, interviews and document review; control-by-control assessment with evidence testing and maturity scoring; and reporting that includes findings, a gap register, a remediation roadmap, and a board and management summary.
Each compliance assessment includes control-by-control assessment, evidence testing and sampling, maturity scoring by domain, cross-framework mapping, and a prioritized remediation plan. Deliverables comprise an assessment report and maturity scores, a gap register with evidence, a remediation roadmap, and a board and management summary. The assessment phase typically requires four to eight weeks, depending on the institution's size and complexity.
For institutions that need to develop or update fraud-related policies, standards and procedures to reflect the findings of the risk assessment, the firm develops or updates cybersecurity policies, standards and procedures, mapped to the frameworks the institution must meet and written in Arabic and English.
Where the assessment identifies gaps in third-party fraud controls, the firm sets up and runs third-party cyber risk programs, including vendor tiering, due-diligence questionnaires, contract clauses, assessments and ongoing monitoring.
Closing
SAMA CRFR Article 4.2 requires an annual fraud-risk assessment that is both comprehensive and risk-based. The seven scenario categories—internal fraud, external fraud, customer collusion, third-party fraud, digital-channel fraud, product misuse and emerging threats—provide a stable taxonomy that ensures complete coverage, supports year-on-year comparison, and demonstrates to examiners that the institution has considered the full spectrum of fraud threats.
Risk teams that structure their assessment around these categories, document specific scenarios within each, and rigorously test the effectiveness of controls will produce an assessment that satisfies regulatory expectations and equips the board to make informed decisions about fraud-risk appetite and control investment.
For Chief Risk Officers and compliance heads preparing the annual review, the question is not whether SAMA CRFR requires a fraud-risk assessment—it does—but whether the assessment will withstand supervisory scrutiny and provide a reliable foundation for the institution's counter-fraud programme. A structured, scenario-based approach is the answer.
