You cannot hand the MLRO post itself to an outside provider at a SAMA licensee. SAMA requires the Chief Compliance Officer (CCO) and the Director of AML/CTF to be Saudi nationals, and payment and fintech companies need SAMA's written non-objection before either person takes up the post. Outsourcing a material function at a SAMA payment company also needs SAMA's non-objection, and the licensee stays responsible for whatever it outsources.
At a CMA-licensed capital market institution, the MLRO is a registrable function that must be filled at all times. The holder must be registered, qualified and resident in the Kingdom unless the CMA exempts them, and only firms limited to managing investments, arranging or advising may delegate the function. So an outsourced MLRO in Saudi Arabia is a narrow option for some CMA firms and unavailable for the post itself at SAMA firms. The work around the role is different: programme design, monitoring, testing, training and recruitment can all be bought in.
SAMA licensees: MLRO duties sit with Saudi-national officers you appoint
An outsourced MLRO service cannot replace a SAMA licensee's Saudi-national Chief Compliance Officer and Director of AML/CTF: both are Saudi-only posts, and payment and fintech companies need SAMA's written non-objection for the named individual before they act. SAMA's Requirements for Appointments to Senior Positions apply across SAMA-supervised firms, payment and fintech companies included. Neither the Saudi-only list in Article 4 nor the payment and fintech list in Appendix 6 names an MLRO. On our reading, MLRO duties sit with the CCO and the Director of AML/CTF, and the rules attached to those posts are strict.
| Requirement | What the rule says | Where |
|---|---|---|
| Nationality | CCO, Director of AML/CTF, Anti-Financial Crimes Director and Anti-Fraud Director are Saudi-only positions | Art. 4 |
| Prior approval | Payment and fintech companies need SAMA written non-objection for the CCO and Director of AML/CTF, as well as the CEO, CFO, CRO, board members and other senior roles | Appendix 6 |
| Start date | A candidate may not act or be announced before non-objection | Art. 8 |
| Interim cover | Interim appointments longer than 20 business days need non-objection and last up to 6 months, renewable once | Art. 9 |
| Succession | The firm needs a replacement and succession policy | Art. 5 |
The English rulebook page states that it is not the latest version of these requirements, and the Arabic text prevails. Check article numbers against the Arabic page before you quote them in a policy.
Put together, these rules leave no practical route to buy the post itself as a service. A non-Saudi officer fails Article 4. A Saudi individual supplied by a vendor still needs SAMA's non-objection as a named person, requested through the eSAMA portal, before acting, and the vendor arrangement would itself be an outsourcing arrangement. Under Article 27 of the Payments Implementing Regulations, a payment company needs SAMA's non-objection for material outsourcing and remains liable for the outsourced work. Finance companies have an outsourcing chapter in their amended Implementing Regulation, which also lists the compliance officer within Senior Management, appointed with SAMA non-objection.
If you are applying for a payment institution licence, plan for these appointments from the first draft of the business plan.
Compliance officer Saudization at SAMA firms
Saudization reaches beyond the two named posts. Finance companies must be 50% Saudi at commencement across all levels, rising by 5% a year to 75%, and non-Saudis in control departments need SAMA non-objection. The BNPL Rules and the debt-based crowdfunding Rules set the same 50% to 75% path. We found no fixed Saudization percentage in the Payments Implementing Regulations and have not confirmed whether a separate ratio applies. Article 29 requires compliance with the rules on non-Saudi employment, and the application business plan must show the planned share of non-Saudi staff by department and level.
Company-wide Nitaqat quotas from the Ministry of Human Resources and Social Development also apply. EY reports that the ministry introduced the next phase of the Nitaqat framework in April 2026.
CMA firms: a registered, resident and qualified MLRO at all times
Article 19 of the Capital Market Institutions Regulations (CMIR) lists the Compliance Officer and the MLRO among the registrable functions. Article 20(b) requires the CEO, CFO, Compliance Officer and MLRO to be registered at all times. The MLRO seat therefore cannot be left empty between hires.
The person in the seat must pass two tests, and one structural rule applies around them:
- Qualification: applicants for registration must pass the CMA qualification exams or obtain an exemption (Art. 21(d)).
- Residency: a registered person must be resident in the Kingdom unless the CMA exempts them (Art. 24(b)).
- Separation: the CEO, CFO and Compliance Officer must be separate people unless the CMA approves otherwise, and the Compliance Officer must not perform a client function. The rule as stated does not name the MLRO, so check with the CMA before combining the MLRO with another role.
The CMA exam guide sets a "Compliance and AML/CTF" route (CME-1B, CME-2A and CME-2B), and the new exam series has been mandatory since 1 February 2023. We have not confirmed that the guide names the MLRO function in that route, so confirm the exam set for your candidate with the CMA.
Delegation under CMIR Article 20(e)
A capital market institution limited to managing investments, arranging or advising may delegate the Compliance Officer or MLRO function to another capital market institution, a SOCPA-licensed accounting firm or a Saudi law firm. The individuals assigned must pass the CMA exams or hold an exemption. Expect the CMA to look at the delegated individual's registration and residency too, and confirm the position before you sign. Under Article 20(f), firms limited to managing investments or arranging need at least two registered persons, one of them the CEO, and advising-only firms need one registered CEO; other functions may be outsourced.
On our reading of Article 20(e), firms licensed for dealing, custody or managing investments and operating funds fall outside the delegation route and should plan for an in-house, registered MLRO. The CMA's May 2026 draft amendments (CMA_N_4054) would give advising-only firms more flexibility in combining registrable functions, but we found no CMA announcement adopting them up to 5 October 2026.
No Saudization quota in the CMIR
The CMIR contain no Saudization quota for compliance or MLRO roles, and residency is the only localisation-type rule we found. King & Spalding writes that certain roles must be held by Saudi nationals depending on the licence, but we found no ministry decision fixing a quota for these posts. Argaam, citing CMA reports, puts aggregate Saudization at capital market institutions at about 75% to 77% for 2022 to 2023.
CMA firms apply the national AML Law (amended by Royal Decree M/223 in April 2026) directly, since the CMA rescinded its own AML/CTF Rules in 2018. Our guide to the 2026 AML law amendments covers what changed, and our CMA licences overview covers licence scope.
What you can outsource or co-source
In most cases the model is the same in both regimes: the appointed officer owns the decisions and an outside team does the build and support work. Article 20(e) delegation at eligible CMA firms is the exception. At a SAMA payment company, assess whether each piece is a material function before you sign, because material outsourcing needs SAMA's non-objection.
| Work | What a provider can do | What stays with the appointed officer or the firm |
|---|---|---|
| Programme design | Draft the ML/TF risk assessment, policies, procedures and the targeted financial sanctions process | Approval, board sign-off and ownership of the risk appetite |
| Monitoring | Design and tune scenarios, review first-level alerts, run screening | Escalation and the decision to report to SAFIU (the General Directorate of Financial Intelligence) |
| Testing | Independent review, file testing and quality assurance | Remediation plans and deadlines |
| Training | Build content, deliver sessions, keep attendance records | Setting the annual plan and enforcing attendance |
| Interim support | Extra capacity under the appointed officer during leave, backlogs or inspections | Any interim holder of the post, who at a SAMA firm must be Saudi (Art. 4) and, beyond 20 business days, approved (Art. 9) |
| Recruitment and fit and proper | Candidate search, reference checks, the SAMA Fit and Proper Form, certificate authentication and CME exam planning | The appointment decision and the filing with the regulator |
| Regulatory change | Map new rules into procedures, such as SAMA's 1 October 2026 circular on the Security Council Resolutions Notification System | Deciding priorities and signing off changes |
SAMA's own texts give providers a clear brief: the AML/CTF Guide (November 2019), the Rules for the Implementation of Targeted Financial Sanctions (December 2025) and the ML, TF and PF business risk guidance (31 December 2025).
Most firms buy this as compliance function support while the team is being built, then shift to an ongoing compliance retainer and a periodic independent review.
SAMA vs CMA vs unlicensed and pre-licence firms
| Question | SAMA licensee | CMA capital market institution | Unlicensed and pre-licence firms |
|---|---|---|---|
| Who carries MLRO duties | CCO and Director of AML/CTF | Registered MLRO, alongside the registered Compliance Officer | The officer named in the application or permit file |
| Nationality | Saudi national (Art. 4) | No CMIR quota | Follows the target regime |
| Residency | None stated for these posts in the texts reviewed | Resident in KSA unless exempted (Art. 24(b)) | Follows the target regime |
| Approval | SAMA written non-objection before acting | CMA registration through the Unified Business Sector Portal | Fit and proper forms (SAMA) or registration applications (CMA) go in with the licence file |
| Can the role be outsourced | No: the post holder is a Saudi national approved by name; providers support that person | Only at firms limited to managing investments, arranging or advising, to a CMI, SOCPA-licensed accounting firm or Saudi law firm | No for SAMA's named posts; CMA depends on the licensed activity |
| Support work | Yes; material outsourcing needs non-objection and the licensee stays liable | Yes | Yes; providers can draft the AML/CTF policy SAMA expects with the application |
| Test-stage rules | Sandbox: AML/CFT and fit and proper rules are unlikely to be relaxed | FinTech Lab: comply with the AML and CTF Laws before commencing | As the regime you test in |
An outsourced MLRO does not cure unlicensed activity: the Payments Law (Article 4) and the Securities Business Regulations (Article 5) both prohibit the activity without authorisation.
A hiring plan that matches the licence timeline
The MLRO hire is on the critical path, because SAMA wants fit and proper forms for all senior positions in the first submission and the CMA needs a registration application for each registrable function.
| Stage | SAMA payment or finance company | CMA capital market institution |
|---|---|---|
| Before filing | Shortlist Saudi candidates for both posts; prepare fit and proper forms, the draft AML/CTF policy and a Saudization plan | Choose in-house or Article 20(e) delegation; confirm the candidate's CME exams and residency |
| Regulator review | PSPs: decision within 90 calendar days of the completeness notice, unless SAMA sets a revised timeline. Finance companies: initial decision within 60 working days | The CMA may ask for more information within 30 days; portal services run 0 to 60 business days |
| Appointment | Non-objection through eSAMA; no acting before it; notify SAMA within 5 days of the start | The MLRO is registered before the function is performed and kept registered at all times |
In practice, work through it in this order:
- Confirm which regulator licenses you and for which activities, then choose the structure: in-house officer, in-house officer with co-sourced support, or (for eligible CMA firms only) Article 20(e) delegation.
- Write the role: reporting line to the board, authority to file reports, access to systems and data, and a named deputy.
- Search early. For SAMA posts, search only among Saudi nationals and plan the eSAMA requests; for CMA firms, check the candidate's CME exams and residency.
- Prepare the fit and proper file with authenticated certificates, or the CMA registration and exam evidence.
- Have advisers build the risk assessment, policies and monitoring design while the regulator reviews the appointment, then hand over formally with a written record of open items.
- Before the first vacancy, adopt a succession policy and an interim plan that respects SAMA's 20-business-day and 6-month limits.
Red flags in "outsourced MLRO" offers aimed at Saudi Arabia
Be wary of a provider that:
- offers to act as your SAMA CCO or Director of AML/CTF, or names a non-Saudi officer for either post;
- proposes a start date before SAMA's non-objection, or "interim" cover with no plan for the 20-business-day and 6-month limits;
- offers CMA delegation without being a capital market institution, a SOCPA-licensed accounting firm or a Saudi law firm, or offers it to a firm licensed for dealing, custody or operating funds (on our reading of Article 20(e));
- names an individual without CME exams or an exemption, or who lives outside the Kingdom without a CMA exemption;
- supplies policies citing the CMA's 2017 AML/CTF Rules, which were rescinded in 2018, or only the pre-2026 AML Law text;
- leaves unclear who decides on and files suspicious transaction reports with SAFIU;
- claims a regulator affiliation or "pre-approved" status without documents to back it;
- offers a contract with no condition for SAMA's outsourcing non-objection where needed, no access rights for you or the regulator, and no exit plan.
Checklist before you appoint or sign
Outsourcing terms
- List each outsourced task and assess whether it is material; seek SAMA non-objection where needed.
- Build in regulator access, audit rights, data protection terms and an exit plan.
After appointment
- Notify SAMA within 5 days of a start or departure.
- Keep the CMA registration current at all times.
- Test the programme independently, and have the board review and minute the AML officer's report on a set cycle.
Getting the structure right before you apply
The decision that matters is made before the application goes in: who will hold the post, how that person will be approved, and which work you will buy in around them. Saudi Compliance helps fintechs recruit and prepare Saudi-national CCOs and Directors of AML/CTF and provides co-sourced AML programme work under the appointed officer.
Sources
- SAMA Rulebook: Requirements for Appointments to Senior Positions (English)
- SAMA Rulebook: Requirements for Appointments to Senior Positions (Arabic, latest)
- SAMA: eSAMA portal trial launch (news-1068)
- SAMA Rulebook: Implementing Regulations of the Law of Payments and Payment Services
- SAMA Rulebook: Law of Payments and Payment Services
- SAMA Rulebook: Guidelines to Apply for Payment Service Providers License
- SAMA Rulebook: Fit and Proper Form
- SAMA Rulebook: Finance Companies Control Law Implementing Regulation (as amended)
- SAMA Rulebook: Rules Regulating Buy-Now-Pay-Later Companies
- SAMA Rulebook: Rules for Engaging in Debt-Based Crowdfunding
- SAMA Rulebook: Regulatory Sandbox exemptions and waivers
- SAMA Rulebook: AML/CTF Guide
- SAMA Rulebook: Rules for the Implementation of Targeted Financial Sanctions
- SAMA Rulebook: Guidance on assessing ML, TF and PF business risks
- SAMA Rulebook: Anti-Money Laundering Law
- Umm Al-Qura: Royal Decree M/223 amending the Anti-Money Laundering Law
- CMA: Capital Market Institutions Regulations
- CMA: Securities Business Regulations
- CMA: Qualification exams guide
- CMA: New qualification exam series approved (CMA_N_3218)
- CMA: Unified Business Sector Portal service card
- CMA: AML/CTF Rules rescinded (CMA_N_2486)
- CMA: FinTech Experimental Permit Instructions
- CMA: Draft amendments to the Capital Market Institutions Regulations (CMA_N_4054)
- King & Spalding: Establishing a regulated financial institution in Saudi Arabia, capital market institutions
- Argaam: Report citing CMA Saudization figures for capital market institutions
- EY: Saudi Arabia introduces next phase of Developed Nitaqat framework
General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.