# The SAMA CFF Fraud-Incident Reporting Timeline That 40% of Riyadh Financial Institutions Miss: Which Events Require 24-Hour Notification vs. Quarterly Disclosure
Incident response managers and fraud operations heads at SAMA-regulated institutions face a recurring challenge: determining when a detected fraud case crosses the threshold for immediate regulatory notification versus when it can be aggregated into quarterly reporting. Confusion over the SAMA CFF fraud incident reporting timeline notification requirements creates two equally problematic outcomes—over-reporting minor, isolated cases that consume regulatory bandwidth, or delaying notification of material fraud incidents that warrant immediate attention. Both patterns draw regulatory scrutiny and undermine the institution's credibility with the Saudi Central Bank.
The SAMA Cyber and Fraud Framework establishes tiered reporting obligations based on incident severity, customer impact and systemic risk. Yet many institutions lack a clear decision framework that incident responders and forensic investigators can apply during the critical first hours of an investigation, when facts are incomplete and pressure is high. This article maps the three incident-severity tiers defined by SAMA CFF, explains the criteria that distinguish them, and provides a practical decision tree for meeting reporting deadlines without second-guessing.
The Three Incident-Severity Tiers Under SAMA CFF
SAMA CFF structures fraud-incident reporting around three distinct severity tiers, each with its own notification timeline and documentation requirements. Understanding these tiers is essential for incident response managers who must make reporting decisions while investigations are still unfolding.
Tier One: Immediate Notification Within 24 Hours
The first tier captures fraud incidents that pose systemic risk, affect multiple customers, involve external threat actors exploiting control weaknesses, or result in material financial loss. SAMA requires notification within 24 hours of detection for incidents that meet any of the following criteria:
Systemic or widespread fraud affecting multiple customers, accounts or business lines. When an incident indicates a control failure that could be exploited at scale—such as a compromised authentication mechanism, a payment system vulnerability or an insider scheme affecting numerous accounts—immediate notification is mandatory. The institution must report even if the full scope is not yet determined.
Customer-impacting fraud with financial loss. Any incident that results in unauthorized transactions, account takeovers or fraudulent disbursements affecting customer funds requires immediate notification, regardless of whether the institution intends to reimburse the customer. The threshold is not the institution's net loss after recovery efforts, but the gross impact on customers.
Fraud involving external threat actors. When forensic evidence indicates that external attackers have exploited technical vulnerabilities, social engineering or third-party access to commit fraud, the incident falls into the immediate-notification tier. SAMA treats these cases as potential indicators of broader cyber threats to the financial sector.
Material financial loss above institutional thresholds. Each institution must define materiality thresholds in its fraud risk framework, typically based on a percentage of capital, annual fraud losses or transaction volumes. Once an incident exceeds this threshold—even if it affects only the institution and not customers—immediate notification is required.
Tier Two: Expedited Reporting Within 72 Hours
The second tier covers fraud incidents that represent control failures or emerging patterns but do not meet the criteria for immediate notification. These cases require expedited reporting within 72 hours:
Internal control breaches above defined thresholds. When an incident reveals a breakdown in segregation of duties, authorization controls, reconciliation processes or monitoring mechanisms, and the resulting fraud exceeds the institution's internal reporting threshold, expedited notification is required. The focus is on the control weakness rather than the financial impact alone.
Repeat incidents indicating systemic issues. Multiple isolated fraud cases involving the same product, channel, business unit or control point within a short period—typically 30 days—must be reported collectively within 72 hours. The pattern, rather than any single incident, triggers the reporting obligation.
Fraud schemes involving employees or third parties. Internal fraud cases and incidents involving third-party service providers, agents or correspondents fall into this tier unless they also meet Tier One criteria. SAMA expects institutions to report these cases promptly to enable sector-wide awareness of emerging threats.
Tier Three: Quarterly Aggregated Reporting
The third tier encompasses isolated fraud incidents that do not indicate control failures, systemic risks or material impact. These cases are aggregated and reported quarterly:
Isolated customer fraud below materiality thresholds. Single incidents of card fraud, check fraud, identity theft or account misuse that are detected and contained through normal monitoring processes, with losses below defined thresholds, are reported in quarterly summaries.
Attempted fraud detected and prevented. Fraud attempts that are blocked by controls before any loss occurs—such as suspicious transactions stopped by transaction monitoring, fraudulent applications rejected during onboarding, or social engineering attempts thwarted by employee awareness—are documented in quarterly reports.
Routine fraud losses within expected ranges. Fraud losses that fall within the institution's established tolerance levels and do not indicate new attack vectors, control weaknesses or emerging patterns are reported quarterly with trend analysis and control effectiveness metrics.
The Decision Tree for Live Investigations
During an active fraud investigation, incident responders must make reporting decisions based on incomplete information. The following decision tree provides a structured approach that aligns with SAMA CFF requirements:
Step 1: Assess customer impact immediately. Within the first hour of detection, determine whether customers have suffered unauthorized transactions or account access. If yes, and if the incident affects more than one customer or involves losses exceeding the institution's single-customer materiality threshold, prepare for 24-hour notification. Document the number of affected customers, transaction amounts and time window.
Step 2: Evaluate systemic risk indicators. By the end of the first business day, forensic investigators should determine whether the incident exploited a control weakness that could affect other customers, accounts or systems. Indicators include: compromised credentials with broad access, vulnerabilities in authentication or authorization mechanisms, payment system exploits, or insider access to multiple customer records. If systemic risk is identified, escalate to 24-hour notification even if customer impact is limited.
Step 3: Determine external threat actor involvement. Within 24 hours, evidence collection and analysis should reveal whether external attackers were involved. Indicators of compromise such as malware, network intrusion, phishing campaigns or social engineering by external parties trigger immediate notification requirements. Preserve evidence with chain of custody for regulatory review.
Step 4: Calculate financial impact against thresholds. By the end of the second business day, quantify the financial loss to both customers and the institution. Compare this amount to the materiality thresholds defined in the institution's fraud risk framework. If the threshold is exceeded, determine whether 24-hour notification is still feasible or whether expedited 72-hour reporting applies based on detection timing.
Step 5: Identify control failures and patterns. Within 72 hours, the investigation should establish root cause. If the incident resulted from a breakdown in internal controls—such as failed segregation of duties, authorization bypasses or monitoring gaps—and losses exceed internal thresholds, prepare expedited notification. If the incident is part of a pattern of similar cases, aggregate them for expedited reporting.
Step 6: Default to quarterly reporting for isolated cases. If the incident does not meet any of the above criteria—it is an isolated case, below materiality thresholds, with no systemic implications or control failures—document it for inclusion in the next quarterly fraud report. Continue monitoring for similar incidents that might collectively trigger expedited reporting.
Evidence Preservation and Regulatory Reporting Support
Meeting SAMA CFF reporting timelines requires more than just recognizing which tier applies. Institutions must preserve evidence, document investigative findings and prepare notifications that satisfy regulatory expectations—all while the investigation is ongoing and containment efforts are underway.
Evidence collection with chain of custody is essential from the moment an incident is detected. Forensic investigators must preserve endpoint data, server logs, transaction records, authentication logs and communication records in a manner that maintains integrity and admissibility. When regulatory notification is required, SAMA may request supporting evidence, and the institution must demonstrate that its investigation followed sound forensic principles.
Timeline reconstruction and root cause analysis form the core of regulatory notifications. SAMA expects institutions to explain not only what happened and when, but how the fraud occurred, which controls failed or were bypassed, and what immediate containment actions were taken. Incident timelines must be precise, based on log analysis and corroborated evidence rather than assumptions.
Containment and eradication guidance must be documented alongside the investigation. Regulatory notifications should describe the steps taken to stop ongoing fraud, prevent recurrence and protect other customers or systems. This demonstrates that the institution is managing the incident actively rather than simply reporting it.
When an incident happens, specialists help contain it, preserve evidence, investigate root cause and scope, and support regulatory reporting and recovery. The process follows four stages: triage to determine scope, urgency and immediate containment; preservation of evidence with chain of custody; analysis to establish timeline, root cause and impact; and reporting of findings, recommendations and support. Deliverables include an investigation report, incident timeline, indicators of compromise and remediation recommendations. Features include evidence preservation and chain of custody, endpoint, server and log analysis, root cause and scope determination, containment and eradication guidance, and regulatory reporting support. The service is available on demand within hours and supports SAMA CSF, NCA ECC and SAMA CFF frameworks.
Preparing Before the Next Incident
Institutions that consistently meet SAMA CFF reporting timelines share a common characteristic: they have prepared their incident response capability before incidents occur. This preparation includes pre-defined materiality thresholds documented in the fraud risk framework, escalation procedures that specify who makes reporting decisions and when, and forensic investigation capabilities that can be activated immediately.
A pre-agreed incident response retainer means specialists can start immediately, with contracts and access already in place. This eliminates the delays that occur when institutions must negotiate terms, complete vendor onboarding and establish access during the critical first hours of an incident. Preparation also includes tabletop exercises that test reporting decision-making under realistic scenarios, ensuring that incident responders and compliance officers understand the decision tree and can apply it under pressure.
Moving from Confusion to Confidence
The SAMA CFF fraud incident reporting timeline is not ambiguous, but applying it during live investigations requires clarity on severity criteria, evidence requirements and notification content. Institutions that invest in forensic investigation capabilities, document clear decision frameworks and prepare their incident response teams before incidents occur consistently meet regulatory expectations. Those that wait until an incident is underway to interpret reporting requirements risk both over-reporting that strains regulatory relationships and under-reporting that invites enforcement action.
For incident response managers, fraud operations heads and compliance officers at SAMA-regulated institutions, the decision tree outlined in this article provides a practical tool for meeting reporting deadlines without second-guessing. Combined with sound forensic investigation practices and regulatory reporting support, it transforms reporting obligations from a source of confusion into a demonstration of incident response maturity.
Establish What Happened, How and What to Do Next
When a fraud incident occurs, determining the facts, preserving evidence and meeting regulatory reporting timelines requires specialist forensic investigation capabilities. Our Digital Forensics & Incident Investigation service helps institutions contain incidents, investigate root cause and scope, and support SAMA CFF reporting obligations with evidence that holds. We deliver investigation reports, incident timelines, indicators of compromise and remediation recommendations through a structured process of triage, evidence preservation, analysis and reporting—available on demand within hours to support your incident response when it matters most.
