# SAMA KYC Requirements Checklist: Twelve Mandatory Documentation Points Examiners Verify in Every KYC File
When the Saudi Central Bank conducts an AML/CTF inspection, examiners sample individual and corporate customer files to verify that your institution has collected, verified and maintained the documentation required under the SAMA KYC requirements checklist embedded in the AML/CTF Rules. Missing elements, incomplete verification or outdated periodic reviews generate findings that require immediate remediation and, in some cases, file closure or enhanced monitoring.
Compliance officers, KYC team leads and onboarding managers need a clear reference to audit their own files before the next examination. This article lists the twelve documentation elements SAMA examiners verify in every sampled KYC file, grouped by category, with a brief explanation of why each matters. Use this SAMA KYC requirements checklist to identify gaps in your customer due diligence procedures and prepare your files for inspection.
Category One: Identity Verification and National Systems Integration
1. National Identity or Iqama Verification Through Nafath or Absher
Every Saudi national customer file must contain evidence that the institution verified the customer's identity through Nafath (the national digital identity platform) or Absher. For residents, Iqama details must be verified against the same platforms. Examiners check for system logs, timestamps and screenshots showing successful verification at onboarding and, where applicable, at periodic review.
Why it matters: SAMA expects financial institutions to use official government identity platforms to prevent identity fraud and ensure the customer is who they claim to be. Manual document checks alone are insufficient.
2. Beneficial Ownership Register for Corporate Customers
Corporate customer files must include a beneficial ownership register that identifies every natural person who ultimately owns or controls 10 per cent or more of the entity, or who exercises control through other means. The register must show names, nationalities, identity numbers, ownership percentages and the chain of ownership if the structure is tiered.
Why it matters: SAMA and the Financial Action Task Force require transparency in corporate ownership to prevent money laundering and terrorist financing through shell companies and nominee arrangements. Examiners will ask to see the supporting documentation—commercial registrations, shareholder lists, trust deeds—that substantiates the register.
3. Authorised Signatory List and Board Resolution
For corporate accounts, the file must contain a current list of authorised signatories, supported by a board resolution or equivalent document that grants each signatory the authority to operate the account. Examiners verify that the resolution is dated, signed by the appropriate authority and matches the signatories on record.
Why it matters: Unauthorised transactions create operational and legal risk. SAMA expects institutions to document and verify who may act on behalf of the corporate customer.
Category Two: Source of Funds and Wealth
4. Source of Funds Evidence for High-Risk or High-Value Customers
For customers classified as higher risk—politically exposed persons, non-resident customers, cash-intensive businesses—or for relationships involving large initial deposits or transfers, the file must contain documentary evidence of the source of funds. Acceptable evidence includes salary certificates, business income statements, sale-of-asset contracts or inheritance documents.
Why it matters: SAMA's AML/CTF Rules require enhanced due diligence for higher-risk customers. Examiners will check whether the institution collected and verified source-of-funds documentation and whether that documentation is consistent with the customer's stated occupation and transaction profile.
5. Source of Wealth Narrative for Politically Exposed Persons
When the customer is a politically exposed person (PEP)—domestic, foreign or from an international organisation—the file must include a narrative or documented explanation of the customer's source of wealth, not merely the source of the funds being deposited. This may include career history, business interests, family wealth or other legitimate origins.
Why it matters: PEPs present heightened corruption and bribery risk. SAMA requires institutions to understand and document the origin of a PEP's overall wealth, not just the immediate transaction.
Category Three: Risk Rating and Ongoing Monitoring
6. Customer Risk-Rating Worksheet or System Output
Every customer file must contain a risk-rating worksheet or system-generated output that shows how the institution classified the customer's money-laundering and terrorist-financing risk. The rating should reflect factors such as customer type, occupation, country of residence, product usage and transaction patterns. The worksheet must be dated and, if manual, signed or initialled by the officer who assigned the rating.
Why it matters: Risk-based customer due diligence is the foundation of SAMA's AML/CTF framework. Examiners verify that the institution applies a consistent, documented methodology and that the risk rating drives the level of due diligence and monitoring applied to the relationship.
7. Enhanced Due Diligence Checklist for High-Risk Customers
For customers rated high risk, the file must contain an enhanced due diligence checklist or equivalent documentation showing that the institution collected additional information, conducted more frequent reviews and obtained senior management approval to establish or continue the relationship. This may include additional identity verification, deeper source-of-funds inquiries or transaction-purpose declarations.
Why it matters: SAMA's AML/CTF Rules require enhanced measures for higher-risk customers. A missing or incomplete EDD checklist is a common examination finding.
8. Periodic Review Record and Next Review Date
The file must show evidence of periodic review—a documented reassessment of the customer's risk rating, profile accuracy and supporting documentation—conducted at intervals appropriate to the customer's risk level. The review record should include the date of the last review, the name of the officer who conducted it, any changes to the customer's circumstances and the date of the next scheduled review.
Why it matters: Customer circumstances change. SAMA expects institutions to refresh customer information and risk ratings regularly, not only at onboarding. Examiners will check whether reviews are occurring on schedule and whether outdated files have been flagged for remediation.
Category Four: PEP and Sanctions Screening
9. PEP Declaration or Screening Result
Every individual customer file must contain either a signed PEP declaration from the customer or a system-generated screening result showing that the institution checked the customer's name against PEP databases at onboarding. For corporate customers, the institution must screen beneficial owners and authorised signatories. The screening result must be dated and retained in the file.
Why it matters: Failure to identify a PEP at onboarding means the institution did not apply the required enhanced due diligence. SAMA examiners will verify that screening occurred and that any positive matches were investigated and documented.
10. Sanctions and Adverse Media Screening Log
The file must include evidence that the customer's name was screened against sanctions lists—United Nations, domestic and, where applicable, other relevant jurisdictions—and adverse media sources at onboarding and at periodic intervals. The screening log should show the date, the lists checked, the result and any investigation of potential matches.
Why it matters: Transacting with a sanctioned person or entity exposes the institution to legal, regulatory and reputational risk. SAMA requires documented evidence that screening occurred and that the institution did not onboard a prohibited customer.
Category Five: Transaction and Relationship Purpose
11. Purpose of the Relationship or Account
The file must contain a statement or declaration, signed by the customer or recorded by the onboarding officer, describing the purpose of the relationship—for example, salary account, business operating account, savings or investment. For corporate customers, the statement should describe the nature of the business and the expected transaction types.
Why it matters: Understanding the purpose of the relationship allows the institution to set appropriate transaction monitoring parameters and detect unusual activity. Examiners will check whether the stated purpose aligns with the customer's actual transaction behaviour.
12. Expected Transaction Volume and Pattern
For higher-risk customers and corporate accounts, the file should include a documented estimate of expected transaction volume and pattern—monthly turnover, typical transaction sizes, geographic counterparties. This may be recorded on the onboarding form, the risk-rating worksheet or a separate EDD questionnaire.
Why it matters: Transaction monitoring systems and manual reviews rely on a baseline of expected activity. Without a documented expectation, the institution cannot effectively identify outliers. SAMA examiners will verify that the institution collected this information and used it to calibrate monitoring thresholds.
Using This Checklist to Audit Your Own Files
Compliance officers and KYC team leads should use this twelve-point checklist to conduct a file quality audit before the next SAMA inspection. Select a representative sample of individual and corporate files across risk segments—low, medium and high—and verify that each of the twelve elements is present, current and properly documented. Where elements are missing or incomplete, flag the file for remediation and investigate whether the gap reflects a procedural weakness that affects other files.
Common patterns that emerge from internal audits include:
- Missing or expired Nafath verification logs, especially for customers onboarded before the platform became mandatory
- Incomplete beneficial ownership registers that list names but lack supporting documentation or ownership percentages
- Generic or undated risk-rating worksheets that do not reflect the customer's current circumstances
- Overdue periodic reviews, particularly for medium-risk customers where the review interval is twelve or eighteen months
- PEP screening results that were never followed up when a potential match appeared
Identifying these patterns allows the institution to remediate files systematically and update procedures to prevent recurrence.
How CISO Consulting Supports KYC File Quality and CDD Program Integrity
When internal audits reveal gaps in customer files or when SAMA examination findings require a broader remediation effort, institutions need an independent assessment of their KYC and customer due diligence program. CISO Consulting's KYC, CDD and eKYC Program Review examines policies, risk-rating methodologies and onboarding journeys, tests a sample of customer files across segments and assesses gaps in CDD, EDD, beneficial ownership and PEP controls. The review also evaluates periodic review cycles and digital onboarding through Nafath. The engagement produces a KYC program assessment report, risk-rating model recommendations and a remediation plan for customer files. The assessment typically requires four to six weeks and covers both individual and corporate customers, including beneficial ownership and complex structures.
For institutions that need to validate the effectiveness of their sanctions screening and transaction monitoring tools after remediating files, the firm offers an AML Monitoring and Screening Model Validation service that tests data quality, thresholds, fuzzy-matching performance and coverage of the institution's risk assessment. Institutions that require help selecting or implementing new AML technology—customer risk scoring, sanctions screening, transaction monitoring and case management—can engage the firm's AML Compliance Solution service, which provides vendor-independent selection and implementation support.
Each of these services is designed to help Saudi banks and payment firms meet SAMA's AML/CTF requirements with documented, defensible customer due diligence procedures and files that will withstand examination.
