Saudi Arabia

The AML Framework of Saudi Arabia, which is mainly regulated by Royal Decree No. M/20 and its Implementing Regulations, requires the implementation of a stringent, risk-based financial crime program at all banks and other financial, securities, and non-financial institutions under the close monitoring of regulatory bodies such as the Saudi Central Bank (SAMA) and the Capital Market Authority (CMA). In order to meet the tough international FATF standards, these programs should include in their legal requirements enterprise-wide risk assessment, automated real-time transaction monitoring, UBO checks, auditing, and 10-year record-keeping. A critical component of this structure is the Money Laundering Reporting Officer (MLRO), which has to be a Saudi national position and be granted absolute autonomy in decision-making and direct access to board committees. At the same time, this compliance officer has strict legal responsibility to identify and report suspicious financial transactions "without delay" to SAFIU, with the simultaneous risk of administrative and criminal sanctions in case of failure to report and breaking the law of anti-tipping-off.

The Saudi Arabian AML Document Retention Scheme, which has been laid down under the Royal Decree No. M/20 and which is managed by SAMA, stipulates that all regulated organizations must keep in safe custody all financial intelligence data, transaction data, and CDD/EDD data for at least 10 years. The legal trigger point to set the retention period would be either the day when each specific transaction takes place, or in case of larger banking arrangements, the day when the bank account gets closed. In order to make these documents easily available to judicial officials and SAFIU, SAMA insists that all these documents must be retained onshore within the territory of Saudi Arabia in such a way that these can support Arabic language search functions.

The Saudi Arabia KYC/CDD Program, as per Royal Decree No. M/20 and regulated by SAMA and CMA, follows a rigorous risk-based model that compels financial institutions to ensure the identity check of all their clients via government official records before onboarding. This KYC/CDD system works through the verification process divided into three different tiers, namely Standard, Simplified, and Enhanced Due Diligence, which mandates the identification of Ultimate Beneficial Ownership of the client down to any natural person owning 25% or more interest in the corporate client. The identification of a natural person entails the use of a National ID or Iqama, which needs to be updated dynamically; otherwise, SAMA rules state that failure to renew the expired identification record leads to automatic freezing of the bank account. This rigorous onboarding process, along with transaction monitoring, provides for a continuous lifestyle review mechanism that compels the immediate re-evaluation of accounts at any behavioral change.

The Saudi STR Framework, created by Royal Decree M/20 and monitored by SAMA, legally binds all financial firms to file any transactions suspected to have been made using proceeds from illegal or terrorist activities to the Saudi Financial Intelligence Unit (SAFIU) through the centralized SAFIU-Connect website. The compliance officials are mandated to file such STR documents in a timely fashion, according to the guidelines, within three days after the suspicion is raised. This applies to all transactions, whether successful or not. To ensure the confidentiality of the investigations, the Saudi STR Framework strictly prohibits tipping off, which is considered a serious criminal act in this regard. However, to ensure the complete safety of the compliance officials, total civil and criminal immunity from legal action is guaranteed in case of any disclosure.