Saudi AML law amendments 2026: what changed and what to update

Saudi Compliance editorial teamPublished: 2026-10-11Updated: 2026-10-1114 min read

اقرأ بالعربية

Saudi Arabia amended its Anti-Money Laundering Law in April 2026 by Royal Decree M/223 dated 27/10/1447H, which approved Council of Ministers Resolution 748. The amendments to the Law deal mainly with enforcement and governance: deportation of convicted non-Saudis, confiscation of disproportionate wealth, a statutory role for the Permanent Committee for Combating Money Laundering (AMLPC) and a new route for issuing the Implementing Regulations. The operational changes came with revised Implementing Regulations, issued by the President of State Security and published in the Umm Al-Qura gazette on 26 June 2026. Pinsent Masons reports that the revised regulations formally recognise e-wallets and add e-money issuance and management to the list of financial activities. It also reports group-wide AML policies and information sharing, and a power to suspend a suspicious transaction for up to seven working days.

For SAMA licensees and CMA-licensed firms, the practical job is the same. Re-run the risk assessment, update beneficial-ownership and wallet onboarding rules, rework the suspicious transaction report (STR) and transaction-suspension process with the Financial Intelligence Unit (FIU), check sanctions screening, and take the revised programme to the board. Saudi Arabia's next FATF mutual evaluation onsite is shown as provisional for November or December 2026 in the FATF assessment calendar, so the window to do this before assessors arrive is short.

The April 2026 amendment changed the Law's enforcement and governance articles

The amendment went through the full legislative sequence, and the royal decree and the Council of Ministers decision are both on the Umm Al-Qura gazette website.

Some vendor summaries write the decree number as "D/223". The official form is M/223.

CMS's summary of the amendments lists these changes:

• References to non-profit organisations are removed from Articles 14, 15, 16 and 18. NPOs may still have AML duties under their own sector rules.
• Article 28 provides for the deportation of convicted non-Saudis, who may re-enter only for Hajj or Umrah.
• A new Article 33(2) allows confiscation of disproportionate wealth.
• A new Article 49 gives the AMLPC the job of setting national, risk-based AML policy. The Governor of the Saudi Central Bank (SAMA) may issue the committee's internal rules.
• Article 50 now provides that the Implementing Regulations are issued by the President of State Security in agreement with the Minister of Finance, the Public Prosecutor and the SAMA Governor.

The royal decree adds that the change to Article 50 does not affect the continued application of Implementing Regulations issued before the amendment took effect.

For a regulated firm, Articles 49 and 50 matter most. They put national AML policy on a statutory, risk-based footing and set out who issues the Implementing Regulations, which is where the detailed customer due diligence, record-keeping and reporting duties sit.

One practical point on texts: the English version of the AML Law hosted by the Ministry of Investment predates the 2026 amendment. If your policies quote article numbers or wording, check them against the amended Arabic text before you rely on them.

The June 2026 Implementing Regulations carry the day-to-day changes

The President of State Security updated the Implementing Regulations by Decision No. 266507 dated 9/12/1447H, using the power in the amended Article 50. Umm Al-Qura published the decision on 26 June 2026. That date is about 26 May 2026, and the decision states that it applies from its date. Sumsub (KYC vendor) gives the publication date, 26 June 2026, as the effective date, so confirm with counsel which date your programme should run from. The gazette page carries the decision but not the attached regulation text, so the table below reflects law-firm and vendor reporting and says which is which.

The suspension power is the change most likely to reach your operations team. If a transaction can be held for up to seven working days, you need a way to freeze the payment in your system and keep the customer file intact. You also need a script for answering the customer without revealing that a report exists, and a clear step to release or escalate the payment when the FIU responds.

If your onboarding relies on a 25% ownership threshold, confirm it against the Arabic text of the regulations. Sumsub reports that figure, and a vendor summary may differ from the gazetted wording.

SAMA licensees: the changes land through your policies and your senior appointments

SAMA publishes the AML Law and its own AML/CFT requirements in the AML/CFT section of the SAMA Rulebook. SAMA requires suspicious transaction reports to go to the FIU in the FIU's approved form and through its approved mechanism. A policy that still cites only the 2017 Law and the pre-June regulations will look out of date at the next inspection.

Staffing rules apply on top of the policy changes. SAMA's Requirements for Appointments to Senior Positions (the Arabic version prevails) say the CCO and the Director of AML/CTF must be Saudi nationals. Payment and fintech companies need SAMA's written non-objection before appointing either one.

That rule limits what outsourcing can do. An outsourced MLRO service can support a SAMA licensee with programme design, case review and training, but it cannot replace the Saudi-national CCO or Director of AML/CTF that SAMA expects in post. Our guide to outsourcing the MLRO function in Saudi Arabia sets out where that line falls.

CMA firms apply the national AML law directly

The CMA rescinded its own AML/CTF Rules in November 2018 (CMA announcement CMA_N_2486). The reason given was the new AML Law (Royal Decree M/20) with its Implementing Regulations and the Law on Combating Terrorism Crimes and its Financing (Royal Decree M/21). So when the Law and its regulations change, there is no separate CMA AML rulebook to reissue. The amended text applies to capital market institutions as it stands.

AML and KYC duties for a CMA firm now sit in four places:

• the AML Law and its Implementing Regulations, and the counter-terrorist financing law;
• the CMA's Investment Accounts Instructions, which cover KYC and account opening;
• the Capital Market Institutions Regulations, which make the MLRO and the Compliance Officer registrable functions that must be filled at all times;
• for FinTech Lab permit holders, the requirement to comply with the AML and CTF Laws before starting business.

The aml.gov.sa website still hosts the 2017 English text of the CMA's AML/CTF Rules with no rescission notice, so do not build a 2026 programme on it.

A CMA firm limited to managing investments, arranging or advising may delegate the Compliance Officer or MLRO function to another capital market institution, a SOCPA-licensed accounting firm or a Saudi law firm. The individuals assigned must pass the CMA qualification exams or hold an exemption. In May 2026 the CMA consulted on draft amendments (CMA_N_4054) that would link KYC to each client's ML/TF risk rating, with three standard forms. We found no CMA announcement adopting them up to 5 October 2026. For licence scope questions, see our CMA licences overview.

Payment, e-money and wallet providers feel the scope change first

SAMA-licensed e-money and payment firms already have AML duties: Article 36 of the Payments Implementing Regulations requires a risk-based AML/CTF approach. The explicit reference to e-wallets and e-money that Pinsent Masons reports removes room for argument, especially for wallets with lighter onboarding. Micro EMIs already work within SAR 20,000 per-user holding and monthly transaction caps. Expect each wallet product's limits and checks to be read against the regulations directly.

Three areas need attention in a payments business:

• Wallet limits: document why each product's limits match the due diligence you perform, and what triggers an upgrade to full verification.
• Group information-sharing: a foreign group entering Saudi Arabia needs a written basis for sharing customer and suspicion information between the Saudi entity and the parent, checked against Saudi personal-data transfer rules.
• Transaction suspension: payment flows move fast, so the seven-working-day hold needs a defined process for merchants, payees and refunds while the FIU decides.

Crypto-adjacent firms should note that Saudi Arabia has no VASP or crypto-exchange licence, and a firm that touches virtual assets still carries the full AML Law and sanctions duties. Our digital asset perimeter advice covers where those models sit.

Saudi Arabia's FATF evaluation is the reason to finish this in 2026

Saudi Arabia is a FATF member and a MENAFATF member. Its last mutual evaluation was adopted in 2018, it was placed in enhanced follow-up, and it was re-rated in a 2020 follow-up report.

The AMLPC has a mutual evaluation section on its website and has run workshops to prepare for the assessment with FATF and MENAFATF. The amended Law and the June regulations arrive a few months before the onsite, so expect supervisors to ask how firms have applied them.

For an individual firm, the useful question is what you could show a supervisor in the coming months. A board-approved programme updated after June 2026, with trained staff and some evidence that the changes work, is far easier to defend than a 2017 policy with a cover note promising an update.

Checklist: updating your AML programme for the 2026 changes

Work through these in order. Each item should leave a document or record behind.

Risk assessment and beneficial ownership

1. Re-run the enterprise-wide ML/TF risk assessment, in writing, against your current products, channels, customers and geographies.
2. Add e-wallet and e-money risk explicitly if you issue stored value or wallets.
3. Update the beneficial-ownership procedure to identify natural persons with ownership or effective control, and confirm the percentage threshold against the Arabic text.
4. Refresh beneficial-ownership data on existing corporate customers, starting with the highest-risk relationships.
5. If you belong to a financial group, adopt a group-wide AML policy with a documented information-sharing basis.
6. SAMA licensees: use SAMA's guidance on assessing ML, TF and proliferation financing business risks (31 December 2025) for the risk assessment, and SAMA's March 2026 circular on verifying beneficial owners through the Wathq service.

Wallet limits and KYC

1. Map each wallet product or limit level to the identity checks performed and the monitoring rules applied.
2. Set clear triggers for moving a customer to full verification, such as approaching a limit or unusual activity.
3. Record the risk rationale for each product or limit level so you can explain it at inspection.

SAFIU STR process and transaction suspension

The FIU is the General Directorate of Financial Intelligence (SAFIU), formerly the General Directorate of Financial Investigations, under the Presidency of State Security. It receives and analyses STRs.

1. Confirm that your SAFIU STR filings use the FIU's approved form and mechanism, as SAMA requires.
2. Name who drafts, approves and files each report, with a backup when the MLRO (or, at a SAMA licensee, the Director of AML/CTF) is absent.
3. Write a procedure for a suspension of up to seven working days: system hold, customer communication, record-keeping and release.
4. Train front-line and customer service staff on what they may and may not tell a customer whose transaction is held.

Sanctions screening

SAMA's Rules for the Implementation of Targeted Financial Sanctions (circular 472035766, December 2025) set the standard for SAMA licensees. They cover the UN Security Council lists and the national lists, including those of the Permanent Committee for Counter-Terrorism under the Presidency of State Security, which maintains the National Terrorism List. The Rules require screening before an account or relationship is opened (e-wallets included), before outgoing payments are executed and immediately after any list update. A confirmed match must be frozen without delay, which the Rules define as within hours, and without waiting for internal approvals. SAMA must then be notified.

SAMA's circular of 1 October 2026 (482028988) to payment and finance licensees deals with integration with the Security Council Resolutions Notification System. Check whether it applies to you and record how and when you connected.

CMA firms fall outside SAMA's Rules, so confirm with the CMA how designations reach you and document the answer. Whatever your regulator, test that a confirmed match leads to an immediate freeze and a report.

Governance, training and testing

1. Take the revised policy, risk assessment and procedures to the board and minute the approval.
2. Update the AML officer's report to the board to cover the 2026 changes and the remaining gaps.
3. Deliver targeted training on the amended Law, the June 2026 regulations, beneficial ownership, wallet red flags and the suspension procedure, and keep attendance records.
4. Commission an independent AML review to test whether the changes work in practice before the FATF onsite.
5. Put the programme on a review cycle through your ongoing compliance arrangements so the next regulatory change does not need a rebuild.

Getting the programme ready before the onsite

Start with the risk assessment and beneficial-ownership rules, since everything else depends on them, and check every reported detail against the official Arabic text as you go.

Saudi Compliance builds and updates AML programmes for SAMA and CMA licensees and supports MLROs alongside the Saudi-national roles that SAMA requires. If you want a gap review against the 2026 changes, see our AML programme and compliance function support.

Sources

• Umm Al-Qura: Royal Decree M/223 amending the Anti-Money Laundering Law
• Umm Al-Qura: Council of Ministers Resolution 748 on the Anti-Money Laundering Law
• Umm Al-Qura: Update to the Implementing Regulations of the Anti-Money Laundering Law (Decision No. 266507)
• CMS: The recent changes on the AML Law, what you need to know
• Pinsent Masons (Out-Law): Saudi Arabia updated AML rules and compliance obligations
• Sumsub: Saudi Arabia strengthens AML and beneficial ownership rules
• Ministry of Investment: Anti-Money Laundering Law (English, pre-2026 text)
• SAMA Rulebook: AML/CFT section
• SAMA Rulebook: Rules for the Implementation of Targeted Financial Sanctions
• SAMA Rulebook: Implementing Regulations of the Law of Payments and Payment Services
• SAMA Rulebook: Guidance on assessing ML, TF and PF business risks
• SAMA Rulebook: Requirements for Appointments to Senior Positions (English)
• SAMA Rulebook: Requirements for Appointments to Senior Positions (Arabic, latest)
• Anti-Money Laundering Permanent Committee: Home
• Anti-Money Laundering Permanent Committee: Law on Combating Terrorism Crimes and its Financing
• CMA: AML/CTF Rules rescinded (CMA_N_2486)
• CMA: Capital Market Institutions Regulations
• CMA: FinTech Experimental Permit Instructions
• CMA: Draft amendments to the Capital Market Institutions Regulations (CMA_N_4054)
• FATF: Saudi Arabia country page

General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.