The Whistle Blowing Policy for Financial Institutions is an approved reference for determining the financial institution’s policy frameworks to be adhered to as a minimum when receiving and processing violation reports. The general framework of this Policy is summarized by the following main points:

Such Policy is a key element in protecting the integrity of financial institutions. It requires active support from all financial institution employees and stakeholders who must report any incidents suspected of involving violations. These employees and stakeholders must also cooperate in the investigation of such incidents, and financial institutions should encourage full cooperation by creating a reliable environment and providing maximum protection.

This Policy aims to provide the minimum controls necessary to receive and process reports so that it is easy for financial institution employees and stakeholders to report violations without being negatively affected.

The purpose of this Policy is to establish secure channels of communication between whistle blowers and financial institution units responsible for receiving and processing reports on any violations that have been committed, are being committed or are about to be committed. This is in order to combat fraud, embezzlement and corruption as well as unlawful, unethical or unprofessional conduct in financial institutions.

This document applies to financial institution employees and stakeholders regarding all actions taken to address a report on a violation committed in a financial institution supervised by SAMA.

A financial institution shall observe the following:

1. It shall prepare a policy on whistle blowing to be approved by its board of directors. If the financial institution does not have a board of directors, this policy shall be approved by a chief executive officer or a general director and reviewed annually.
2. It shall submit a periodic report to its board of directors and audit committee on the cases received and actions taken.
3. . It shall encourage its employees and stakeholders to report any violation committed inside or outside the financial institution within the scope of their work.
4. . It shall raise awareness among, and reassure, its employees and stakeholders about the confidentiality of the whistle blowers’ identity and the information contained in reports for all stages of the processing of each report.
5. It shall protect whistle blowers against any retaliation.
6. It shall encourage its employees and stakeholders not to hesitate to report any violation due to being uncertain of the authenticity of the report and whether or not it can be supported with facts. The financial institution shall also stress that all employees and stakeholders are expected to refrain from rumors, irresponsible behavior and false allegations, and that, if a claim is made in good faith but has not been established as valid during investigation, no action will be taken against the whistle blower.
7. It shall provide its employees and stakeholders with information on all channels for whistle blowing, which should include as a minimum: a direct telephone number, website, postal service, and e-mail address.
8. It shall prepare awareness programs that urge its employees and stakeholders to report violations and clarify their responsibilities.

Financial institutions shall establish an independent administrative unit to receive and process violation reports and to report to the compliance department.

Financial institutions must encourage their employees and stakeholders to report incidents that might lead to correcting errors or actions, detecting violations or promoting values. Such reports may include any of the following cases:

1.  Financial and administrative corruption, which is any illegal exploitation of financial resources or administrative organization in a financial institution; 
2.  Breach of the laws, regulations, instructions and policies which must be followed as required by the financial institution's scope of work; 
3.  Violations related to the environment, health and safety in the workspace, including any negative behavior that might harm the environment or workplace or threaten the safety of any individual; 
4. Indecent conduct contrary to public order, Islamic ethics, customs and traditions; 
5.  Misuse of the financial institution's property or assets; 
6.  Abuse of power or decision making by employees of the financial institution, which may go against the financial institution's interest; 
7.  Passing of illegal operations of the financial institution, circumvention of laws, or concealment of regulatory errors; 
8.  Conflict of interest in any business arrangement or contract carried out by the financial institution; 
9.  Misuse of the powers granted by the financial institution to its employees, such as exchanging passwords, etc.;
10.  Obtaining undeserved benefits or rewards; 
11. Unlawful disclosure of confidential information; 
12. Acts of concealment involving bad faith or intentional negligence, destruction of official documents, or concealment of fraudulent financial reports; 
13. Serious negligence which may result in damage to the financial institution; and 
14. Concealment of any of the acts mentioned above.

A whistle blower shall:

1. ensure credibility in reporting by avoiding rumors and allegations that are not based on facts, and report whenever real and reasonable information indicating a suspicion of violations is found; 
2.  avoid malicious reports aimed at defaming others, taking reprisal or retaliation against them, or undermining confidence in the financial institution, its employees or stakeholders; 
3.  exercise due diligence by ensuring accuracy in reporting, providing all necessary details relating to the case reported, and attaching all documents containing details and evidence as required by the nature of the violation; 
4.  report violations as soon as possible; 
5.  maintain full confidentiality of the report for the good of the financial institution; and 
6.  bear the responsibility for malicious allegations that defame or damage the financial institution or any of its employees or stakeholders.

Upon receiving a violation report, a financial institution shall:

1.  treat such report with the necessary seriousness, regardless of the nature, language, adequacy of information, impact or importance of the report; 
2.  take all necessary measures to protect the whistle blower; 
3.  notify the whistle blower of receipt of the report and, if possible, the decision made; 
4.  take corrective actions for the violation if proved; 
5.  take into account the interest of its employees and stakeholders; 
6.  refer reports to the department responsible for control and investigation, either inside or outside of the financial institution; 
7.  keep violation reports and relevant documents, including recordings, for the durations specified by the laws and instructions; and 
8.  prepare reports on whistle blowing instances and the procedures followed.

1.  Financial institutions shall protect whistle blowers providing unmalicious reports from any potential retaliatory action taken by their employees. 
2.  A whistle blower, whose identity was not revealed and could not be discovered by the financial institution, may not claim protection as prescribed by Clause (e/ 2) under Part (III). 
3.  Financial institutions shall not disclose any information about any whistle blower except to competent authorities, such as investigation and judicial authorities.

There should be an indicator for each stage of the working procedures aimed to determine the performance level by measuring the extent of meeting all the requirements of each procedure established by the financial institution.

According to information currently available to SAMA, this shall be done through the website of the Ministry of Human Resources and Social Development. However, for the purpose of obtaining a unified number in BULK PACH from an official electronic channel, SAMA is currently examining how to obtain the same, whether for customers of financial institutions or for credit information companies. The conclusion will be circulated to everyone as soon as this is possible, but efforts should be made to obtain them in order to avoid not being able to find the channel, and to save time.

SAMA is currently coordinating with the relevant authorities regarding commercial registers that have not been issued a unified number for any reason, whether they have been cancelled, or a unified number is provided for them but they are suspended for any reason and their data is active, and commercial registers that are valid and do not have a unified number. They will be circulated to everyone upon completion of their arrangements.

You should consider what is related to the forms and contracts as you deem appropriate until the completion of the requirements and the cancellation of the commercial register field in the future as stated in paragraph No. (2).
 

It should be taken into account that some requirements may have different applications from one sector to another.

Other measures may be taken at as deemed appropriate by the financial and credit institution, provided that this does not prejudice or conflict with the above instructions.

The following terms and phrases, where used in these Rules, shall have the corresponding meanings unless the context requires otherwise:

Central Bank: The Saudi Central Bank.

Rules: Rules Governing the Calculation of the Annual Percentage Rate (APR).

Finance Providers: Banks, and Finance Companies Licensed to engage in retail lending.

Borrower: a person receiving finance.

Financing Agreement: an agreement whereby financing is granted for the activities listed in the Laws and Regulations.

Amount of Finance: the ceiling or the total amounts made available to the borrower under a finance agreement.

Annual Percentage Rate (APR): The discount rate at which the present value of payments and installments that are due from the borrower representing the total amount payable by the borrower equals the present value of all payments of the amount of financing available to the borrower on the date on which the financing amount or the first payment thereof is available to the borrower.

Total Amount Payable by the Borrower: the sum of principal loan amount and the total cost of finance.

Total Cost of Finance: All the costs to be paid by the borrower under a financing agreement other than the amount of Finance, including term cost, fees, commissions, administrative services fees, insurance, and any charges required to obtain finance excluding any expenses the borrower can avoid such as costs or fees payable by the borrower due to his breach of any of his obligations contained in the financing agreement.

Finance providers shall utilize the Excel based calculator issued by Saudi Central Bank for the purpose of implementing the Rules.

1.  Finance providers shall update the relevant policies and procedures to comply with the requirements included in the Rules.
2. Finance providers are responsible for implementing adequate internal controls and audit mechanisms to safeguard the integrity of the APR Calculator deployed. In case where the APR Calculator is automated, finance providers should verify the results obtained using the automated tool by comparing those results to the figures obtained by using Excel based APR Calculator provided by Saudi Central Bank.
3. Finance providers shall also ensure that the APR Calculator made available to customers through their websites is updated to align with the Rules requirements and the enclosed Calculator.

The APR should be calculated based on the net present value method using the following formula:

Where:

The total cost of finance shall not include:

Finance providers must consider the following while calculating the APR:

1. The periods between the date on which the amount of finance or the first payment is available to the borrower and the date of each payment received or payable by the borrower shall be calculated on the basis of 365 days a year.
2. The APR shall be calculated on the assumption that the amount of finance is valid for the term agreed upon and the parties’ adherence to their obligations according to the conditions stipulated in the financing agreement.
3. The APR must be calculated and expressed in percentage points with a minimum of two basis points, rounding half basis points to the nearest full basis points.
4. In case the finance agreement contains a clause allowing variations in term cost and fees contained in the APR (e.g. floating) which is not quantifiable at the time of financing, the APR must be calculated on the assumption that the term cost and other charges remain fixed in relation to the initial term cost applied and will remain applicable until the end of the financing agreement.

Finance providers while calculating the APR for credit cards shall assume the following:

1. The amount of finance is provided for a period of 1 year starting from the date of the initial drawdown or card allotment/approval date, and that the final payment made by the borrower clears the principal payment, term cost and other charges, if any.
2. The principal payments and term cost are repaid by the borrower in 12 equal monthly payments, commencing 1 month after the date of the initial drawdown.
3. If the ceiling of the credit card has not been determined, that ceiling shall assumed to be SAR 10,000 when calculating the advertised APR.
4. At the pre-contractual stage, the amount of finance shall be equal to the financing limit or credit card limit requested by the customer or offered to the customer.
5. At the contractual stage, the amount of finance shall be equal to the financing limit or credit card limit based on the agreement concluded with the borrower.

The internal audit function shall review the APR calculation process at least annually. Any control deficiencies highlighted by the internal auditor shall be addressed by management in a timely and effective manner.

These Rules shall enter into force (90) days after the date of their publication on Saudi Central Bank’s official Website.