Co-sourced support
- Compliance monitoring plans and testing
- Transaction monitoring alert review and tuning
- KYC file reviews and periodic refresh
- Regulatory returns and SAMA or CMA correspondence
- SAFIU suspicious transaction reporting procedures and quality checks
- Board and committee compliance reporting
Personal data (PDPL)
The Personal Data Protection Law, overseen by SDAIA, has been enforced since September 2024. In October 2026 SDAIA opened controller registration to overseas organisations. We map your data flows, cross-border transfers and records, and align them with the PDPL and its regulations.
Regulatory change
Saudi rules moved quickly in 2026: AML Law amendments in April, a new AML Implementing Regulation, open banking licensing and a CMA capital consultation. We track what changes and tell you what it means for your controls.
Training
- AML/CFT training for staff, management and board, in Arabic and English
- Role-specific modules for onboarding, operations and customer support
- Records that evidence training to an examiner
Primary sources
Last reviewed: 11 October 2026
General information, not legal advice. Saudi rules change; we confirm every requirement against the regulator's current text before you file.
