The FATF Global Assessment Calendar lists Saudi Arabia's next mutual evaluation as a joint FATF and MENAFATF assessment, with a possible onsite visit in November 2026 and a possible plenary discussion in June 2027. It is a fifth-round evaluation under the FATF's 2022 Methodology, which rates effectiveness separately from technical compliance and, the FATF says, puts greater emphasis on a country's major risks and context.
For a fintech, the practical question is what evidence you can produce. Saudi supervisors will need to show assessors how licensed firms understand their risks, monitor customers, report suspicion and apply sanctions, and much of that evidence sits in firms' own files: risk assessments, suspicious transaction report (STR) decisions, screening logs and board minutes.
The FATF calendar lists a possible Saudi onsite in November 2026
The FATF publishes a Global Assessment Calendar of planned evaluations. Its rows for Saudi Arabia, Bahrain and the UAE read as follows.
| Country | Assessment body | Last evaluation | Possible onsite | Possible plenary discussion |
|---|---|---|---|---|
| Saudi Arabia | FATF and MENAFATF | September 2018 | November 2026 | June 2027 |
| Bahrain | FATF and MENAFATF | September 2018 | November 2026 | June 2027 |
| United Arab Emirates | FATF and MENAFATF | April 2020 | June 2026 | February 2027 |
The FATF describes these dates as possible, so treat them as a planning window. A group licensed in both Saudi Arabia and Bahrain should expect supervisory requests in both countries on the same timetable.
The plenary is where FATF members discuss and adopt the report, and the public report follows. Saudi Arabia's last report was adopted at the June 2018 plenary and published on 24 September 2018.
On the Saudi side, the Anti-Money Laundering Permanent Committee (AMLPC) has a mutual evaluation section on its website, and its secretariat has run awareness workshops for the private and public sectors, including on compliance with international standards (May and September 2025).
The 2018 report is the baseline assessors will start from
The 2018 evaluation was carried out jointly by the FATF and MENAFATF. Its headline was that Saudi Arabia was getting good results against terrorist financing but needed to focus more on pursuing larger-scale money launderers and confiscating their assets.
Several findings bear directly on regulated firms:
- Financial institutions generally understood their money laundering and terrorist financing risks and applied customer due diligence, record-keeping and beneficial-ownership checks. The FATF attributed this largely to effective and proactive supervision.
- The low number of suspicious transaction reports was a concern, particularly on suspected terrorist financing.
- Money exchangers, real estate agents, accountants and other designated non-financial businesses did not fully understand their risks, with correspondingly few STRs.
- The financial intelligence unit could not yet carry out sophisticated financial analysis.
- Measures to implement targeted financial sanctions for proliferation financing, and to prevent sanctions evasion, were weak.
On effectiveness, the 2018 report rated Saudi Arabia on 11 immediate outcomes: four at a substantial level, four moderate and three low. On technical compliance with the 40 Recommendations, these ratings matter most to fintechs:
| Recommendation | 2018 rating | January 2020 follow-up |
|---|---|---|
| R.6 Targeted financial sanctions (terrorism) | Partially compliant | Re-rated largely compliant |
| R.7 Targeted financial sanctions (proliferation) | Partially compliant | Re-rated largely compliant |
| R.10 Customer due diligence | Compliant | No change reported |
| R.15 New technologies | Largely compliant | No change reported; see the note below |
| R.16 Wire transfers | Largely compliant | No change reported |
| R.18 Internal controls and foreign branches | Compliant | Downgraded to largely compliant when reassessed against the revised Recommendation |
| R.20 Reporting of suspicious transactions | Compliant | No change reported |
| R.24 Beneficial ownership of legal persons | Largely compliant | No change reported |
The 2018 rating for R.15 predates the FATF's virtual-asset amendments to that Recommendation. In the FATF's July 2026 update on virtual assets, Saudi Arabia's R.15 rating is shown as not applicable, meaning it has not yet been assessed against the revised standard.
The 2020 follow-up also downgraded R.21 (tipping-off and confidentiality) from compliant to largely compliant for the same reason as R.18. After that report, Saudi Arabia was compliant on 17 of the 40 Recommendations, largely compliant on 21 and partially compliant on 2. Saudi Arabia has been a FATF member since 2019.
The fifth round rates effectiveness on 11 immediate outcomes
The FATF began its fifth round in 2024 under the 2022 Methodology, which was last amended in June 2026. The Methodology has two parts. Technical compliance checks whether the laws, regulations and other instruments required by the 40 Recommendations are in place. Effectiveness checks whether they work, across 11 immediate outcomes, with greater emphasis on a country's major risks and context.
Firms are not rated individually. The effectiveness ratings depend on what supervisors and other authorities can demonstrate, and for the private sector that comes down to records showing that:
- risk assessments reflect actual customers, products and corridors;
- monitoring alerts are reviewed, closed with reasons, and escalated when they should be;
- STRs reach the General Directorate of Financial Intelligence (SAFIU) when suspicion is formed;
- confirmed sanctions matches are frozen without delay.
Saudi Arabia has changed its framework since 2018
Assessors will look at the framework as it stands at the onsite, and several pieces are new.
| Change | Date | What it means for a SAMA licensee |
|---|---|---|
| AML Law amended by Royal Decree M/223 | April 2026 | CMS reports governance and enforcement changes, including a statutory role for the AMLPC in setting national risk-based AML policy |
| Revised AML Implementing Regulations published in Umm Al-Qura | June 2026 | Pinsent Masons reports that they cover risk assessment, beneficial ownership and group information sharing; see our guide to the 2026 AML amendments |
| SAMA Rules for the Implementation of Targeted Financial Sanctions | December 2025 | Screening at onboarding, before outgoing payments and after each list update, with confirmed matches frozen without delay |
| SAMA circular 482028988 on integration with the Security Council Resolutions Notification System | 1 October 2026 | Addressed to banking, finance, payments, money exchange and credit bureau licensees |
The sanctions changes stand out against the 2018 findings, because proliferation-financing sanctions were one of the weak areas then. Expect SAMA to check that licensees can show the screening and freezing process working, with timestamps. CMA-licensed firms fall outside SAMA's sanctions Rules, so they should confirm with the CMA how designations reach them and keep a record of the answer.
An evidence pack built around the 2018 findings
Our guide to the 2026 AML amendments has the checklist for updating policies and procedures. For the evaluation, the useful exercise is different: take each area the 2018 report questioned and decide what record would answer that question today.
| 2018 finding | What a supervisor may be asked to show | Record to have ready |
|---|---|---|
| Too few STRs, especially on terrorist financing | That firms detect and report suspicion | An STR register covering decisions to file and not to file, with reasons, dates and any follow-up from SAFIU |
| Weak proliferation-financing sanctions | That freezes happen without delay | Screening logs for onboarding, payments and list updates; records of any matches, freezes and notifications |
| Money exchangers did not fully understand their risks | That cross-border payment firms understand corridor risk | Corridor and counterparty risk ratings, and the monitoring rules that follow from them |
| Supervision was effective and proactive | That supervision still finds and fixes problems | Inspection findings, the remediation plan and evidence that each item was closed |
| Beneficial ownership was checked | That checks still work under the 2026 rules | Corporate customer files showing the natural persons identified and how they were verified |
A sample test is worth running before the onsite. Pick five closed alerts, five STR decisions and five sanctions hits at random, and check whether someone outside the team could follow each decision from the file alone. Where they cannot, the gap is in the record or the decision, and either is quicker to fix now than after a supervisor asks.
At a SAMA licensee, the Chief Compliance Officer and the Director of AML/CTF must be Saudi nationals, and payment and fintech companies need SAMA's written non-objection before appointing either. Outside support can strengthen the programme, but it cannot fill those posts. Our guide to outsourcing the MLRO function explains where the line falls.
Where fintech business models draw attention
Cross-border payment and e-money firms sit closest to the 2018 finding on money exchangers. A firm with international flows should be able to explain its corridor risk ratings and show that the required payer and payee information travels with each wire transfer.
Virtual assets are a separate case. The FATF's July 2026 update records Saudi Arabia as having explicitly prohibited virtual assets and virtual asset service providers, and Saudi Arabia has no VASP or crypto-exchange licence. A firm with crypto exposure, such as customers funding exchange accounts abroad, should cover it in its risk assessment and monitoring. Our digital asset perimeter advice covers where those models sit.
After the onsite: what happens until the report is published
The onsite is one stage in a longer process. The assessment team writes up its findings, the report goes to plenary for discussion (provisionally June 2027) and is published after adoption. If the 2018 timetable repeats, publication would follow some months after the plenary. Gaps the report identifies will need fixing afterwards, so the records you put in order now also serve whatever supervisory follow-up the findings lead to.
Saudi Compliance runs independent AML reviews that test the risk assessment, STR and sanctions records against the evidence a supervisor is likely to ask for. See our independent AML review and FATF readiness support.
Sources
- FATF: Global Assessment Calendar
- FATF: Saudi Arabia country page
- FATF: Mutual Evaluation of Saudi Arabia, 2018
- FATF: Saudi Arabia follow-up report, January 2020
- FATF: 2022 Methodology for assessing technical compliance and effectiveness
- FATF: Seventh Targeted Update on Virtual Assets and VASPs, July 2026
- Anti-Money Laundering Permanent Committee: Home
- Anti-Money Laundering Permanent Committee: News
- Umm Al-Qura: Royal Decree M/223 amending the Anti-Money Laundering Law
- Umm Al-Qura: Update to the Implementing Regulations of the Anti-Money Laundering Law
- CMS: The recent changes on the AML Law, what you need to know
- Pinsent Masons (Out-Law): Saudi Arabia updated AML rules and compliance obligations
- SAMA Rulebook: Rules for the Implementation of Targeted Financial Sanctions
- SAMA Rulebook: SAMA circulars (482028988, 1 October 2026)
- SAMA Rulebook: Requirements for Appointments to Senior Positions (Arabic, latest)
General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.