Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
Correspondent banking due diligence and regulatory reviews demand robust sanctions compliance. We explain our five-phase method from regime inventory through Wolfsberg questionnaire readiness, showing what artefacts you hold at each gate and how long realistic implementation takes.
SAMA examiners verify twelve specific documentation elements in every individual and corporate KYC file during AML/CTF inspections. This checklist shows compliance officers and KYC team leads exactly what to audit in their own files before the next examination.
Most RTOs are set by asking IT how fast they can restore a system. SAMA BCM Section 4.3 requires the opposite: start with business-impact analysis, define maximum tolerable disruption, then design recovery strategies to meet it. This article walks through the four-step method to derive defensible RTOs.
Most banks combine cyber oversight with enterprise risk, but two institutions found this diluted both agendas and slowed incident escalation. This article shows the three triggers that justify separate committees, the charter clauses that changed, and the reporting-line adjustments that preserved board efficiency.
A SOC maturity assessment NCA ECC engagement examines whether your security operations can detect the threats the National Cyber Security Authority expects you to monitor. We explain our five-phase method from use-case inventory to capability heatmap.
Cyber risk quantification insurance premium decisions hinge on three scenarios where formal loss modelling changes underwriter confidence. We explain when your control posture justifies the exercise, or whether remediation comes first.
Most institutions schedule KYC refresh by calendar, creating compliant-looking dates with stale risk profiles. FATF Recommendation 10 requires event-driven refresh based on trigger events, not annual review cycles.
SAMA's Counter-Fraud Framework requires specific monitoring of domestic mada transactions, yet many institutions rely on generic rules that miss the patterns regulators expect you to catch. This article identifies five fraud scenarios in card-not-present, account-takeover and mule activity that your detection logic must address.
Article 18 requires controllers to take appropriate measures to demonstrate compliance, but does not list them. Drawing on SDAIA inspection reports and enforcement decisions, this guide identifies the seven documented measures inspectors request first and shows the minimum content and retention period for each.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
