Reference to SAMA's Circular No. BCT/15631 dated 11/6/1433H Regarding the implementation of Regulatory Rules for Prepaid Payment Services, and Circular No. 361000092918 dated 2/7/1436H Regarding the update of those rules for the payroll card product and what it includes about the application of the Know Your Customer (KYC) principle. In accordance with the desire to support and develop prepaid payment services and to expand the offering of these products without violating supervisory and regulatory requirements, it has been decided as follows:

-The principle of "Know Your Customer" is applied to the primary account holder (the contracting entity, whether it is a legal entity or individuals), not to the cardholder, provided that there are no credit services for the product and no deposits are accepted except from the account of the contracting entity.

-The bank requests the contracting party to provide the necessary data required for the issuance process, which it deems sufficient to verify the cardholder. Additionally, the contracting party must authenticate and confirm the accuracy of the information and data provided, and commit to notifying the bank of any modifications made. The contracting party must also ensure appropriate procedures are in place to enable the bank to access or audit this data when needed.

-The issuing bank of the card must verify and match the information provided by the contracting entity with the information available at the National Information Center to ensure that the requested cards are not issued unless the information matches. Excluded from this requirement are closed-loop prepaid products.

- The issuing bank must develop monitoring systems for the transactions carried out through these products to ensure their integrity and consistency with the purpose for which they were issued and to ensure they are free from any incorrect practices.

As for the procedures for delivering and activating these cards, the issuing bank can deliver and activate them by personally meeting the beneficiary at the branches or at the premises of the contracting entity. Alternatively, the bank can deliver the cards in an inactive state to the contracting entity, its authorized representatives, or an entity contracted by the bank. The cards can then be activated through the bank's electronic channels after verifying the beneficiary's identity using the registered mobile number if it was obtained directly from the beneficiary, or through fingerprint matching systems and solutions available at the National Information Center.