Licensing Provisions
Types of Licenses
- Domestic Bank.
- Digital Bank.
- Branch of a Foreign Bank
Licensing Guidelines
Licensing Guidelines and Minimum Criteria
Date(g): 1/12/2018 | Date(h): 23/3/1440 Status: In-Force 1. Objective of the Licensing Guidelines/Criteria and Overview of the Application Process
These Licensing Guidelines and minimum criteria set out the Saudi Central Bank's (SAMA's) Licensing process for banks. The guidelines and criteria apply to applicants seeking a license to carry on banking business in the Kingdom of Saudi Arabia (KSA) under the Banking Control Law “BCL”. They outline the general guidelines, the minimum criteria to be addressed by applicants and the application procedures and the necessary information and documents to be submitted with an application.
These guidelines and minimum licensing criteria are issued in accordance with the authority vested in SAMA under the Charter of Saudi Arabian Monetary Agency -issued via Royal Decree No. 23 dated 23/5/1377 H, and the Banking Control Law - issued via Royal Decree No. M/5 dated 22/2/1386 H.
The application process involves the following steps:
• Preliminary consultation between SAMA and the prospective applicant to discuss the applicant’s plans to carry on banking business in the Kingdom of Saudi Arabia.
• Submission of an application and relevant information, as detailed in the Licensing criteria and the application form; and
• SAMA’s review of the application.
• The form can be found under the link below:
sama.gov.sa/en-us/applylicense/pages/banksforms.aspx
All applications will be processed within reasonable time, having regard to the particular circumstances of each application, including the completeness of information and documents submitted to SAMA by the applicant. Some common factors that can delay the Licensing process include:
• An initial submission that contains incomplete or inadequate documentation;
• Situations where as per SAMA’s assessment, the applicant is unable or unwilling to comply with SAMA requirements;
• Delays in responding to SAMA’s requirements and requests and;
• Delays as a result of new developments since the application was first lodged by the applicant.
All prospective applicants are encouraged to contact SAMA as early as possible during their planning process to discuss their intent (or likely intent) to apply for a banking license.
2. General Licensing Guidelines for Banks
1. Overview
1. These guidelines are for the applicants seeking to conduct banking business in Kingdom of Saudi Arabia. The requirements set down the minimum criteria to be met by the applicants and the necessary information and documents to be submitted with the application.
2. Article 3 of the Banking control law allows Joint Stock Companies to carry on banking business in Kingdom of Saudi Arabia.
3. Applicants seeking a license to carry on banking business in Kingdom of Saudi Arabia should apply in writing to SAMA.
4. Foreign banks may apply to establish branches to carry on banking business in Kingdom of Saudi Arabia. For Foreign branches, references to ‘Applicant’ means the parent entity. If any of the founders of a locally incorporated bank is a foreign bank, the foreign partner would also be subject to the requirements for the licensing of a foreign bank branch.
5. Except as explicitly stated in SAMA’s Prudential Standards, foreign bank branches are subject to the same legislative and prudential requirements as locally incorporated Banks. Although the prime responsibility for oversight of the Kingdom of Saudi Arabian operations of a foreign bank branch rests with local management and its head office as well as with the foreign bank branch’s home supervisor(s), the foreign bank branch is nonetheless required to submit its local operations to SAMA’s prudential supervision and other statutory laws.
2. Use of Restricted Words and Expressions
6. Applicants should note that The Banking Control Law prohibits the use of the word “Bank, or its synonyms, or any similar term in any language on papers or printed matter, or in commercial address, or name or in advertisements”
3. Minimum Licensing Criteria for Banks
7. SAMA will only process a license for suitable applicants with the capacity and commitment to conduct banking business with integrity, prudence and competence on a continuing basis.
8. These licensing criteria are applicable to all applicants, including foreign bank applicants intending to establish a foreign bank branch. These requirements represent minimum criteria that an applicant will need to meet. These licensing criteria should not be taken as exhaustive as SAMA may consider processing an application on other prudential grounds.
9. SAMA expects all applicants to be aware and able to comply with the BCL, its prudential requirements, and other relevant laws and regulations from the commencement of their banking operations. It should be noted that more prudential requirements may be set on a case-by-case basis, for example, for newly licensed banks in their formative years.
A. Capital
10. SAMA will also assess the adequacy of capital for an applicant on a case-by-case basis depending on the scale, nature and complexity of the operations as proposed in the business plan. Foreign Bank branches are not required to maintain capital in Kingdom of Saudi Arabia although capital requirements may be set on a case-by-case basis, for example, those intending to conduct high risk businesses and/or wanting to specialize in particular business lines that require specific level of capacity or competence.
11. Applicants must satisfy SAMA that they are able to comply with SAMA’s capital adequacy requirements from the commencement of their banking operations. All locally incorporated banks are required to maintain, at all times, a minimum capital ratio (CAR) as set by SAMA. Newly established banks may be subject to a higher minimum capital ratio in their formative years, depending on the risk profile of their proposed operations.
B. Bank Ownership
12. As per to the BCL, the founders and members of the Board of Directors of an applicant are required to demonstrate to SAMA that they are ’fit and proper’, are persons of good reputation, are well established and are of financially sound standing and substance. In the case of foreign bank branch applicants, this requirement applies both to the foreign bank itself and to the significant shareholders of the foreign bank. SAMA requires all significant shareholders to be able to demonstrate that their involvement in the bank represents a long-term commitment and that they have the capacity to contribute additional capital, if required.
C. Corporate Governance
13. Applicants must satisfy the requirements set out in SAMA’s Principles of Corporate Governance for Banks Operating in Saudi Arabia with regard to the composition and functioning of the Board. Applicants must also satisfy SAMA that they have policies and related procedures in place to ensure that persons who hold the key positions within the proposed bank are fit and proper, in accordance with SAMA’s Requirements for Appointments to Senior Positions in Financial Institutions Supervised by the Saudi Central Bank (SAMA).
14. SAMA may consult other regulators (domestic and overseas) regarding the suitability of individuals who will manage the affairs of the proposed bank. Where necessary, applicants will be expected to provide SAMA with consent to seek details in this regard.
D. Risk Management and Controls
15. Applicants must satisfy SAMA that their proposed (or existing) risk management and control policies are adequate and appropriate for monitoring and limiting risk exposures in relation to domestic and, where relevant, international operations from the commencement of the bank’s operations. This includes, but is not limited to, the development, implementation and maintenance of adequate and appropriate policies and procedures for monitoring and managing Credit, Market, Liquidity, Compliance, AML/CTF risks and Operational Risks.
16. Applicants must demonstrate that their proposed arrangements for reporting to SAMA are adequate and are in line with SAMA prudential standards and Article 15 of the Banking Control Law. Foreign bank branch applicants must demonstrate that the arrangements for reporting to SAMA and the parent foreign bank or head office are adequate and in compliance with applicable laws and regulations.
17. In assessing whether the proposed policies and procedures for managing and controlling risks are adequate and appropriate for the applicant’s operations, SAMA will take into account the size, nature and complexity of the operations.
E. Compliance & Anti Money Laundering and Combating Terrorism Financing (AML/CTF)
18. Applicants must satisfy SAMA that their proposed compliance and AML & CTF processes, people and systems are adequate and appropriate for ensuring compliance with:
(a) Rules Governing Anti-Money Laundering & Combating Terrorist Financing and;
(b) SAMA’s Compliance Manuel for Banks Working in SAUDI ARABIA and;
(c) Other Kingdom of Saudi Arabia regulatory and legal requirements.
19. In assessing whether the proposed compliance and AML/CTF processes, people and systems are adequate and appropriate for the applicant’s operations, SAMA will have regard to the size, nature and complexity of those operations.
F. Information Technology (IT), Accounting Systems and Outsourcing
20. All Banks are required to submit prudential returns to SAMA. Required reporting forms and the frequency for Banks depend on the type of bank.
21. Applicants must satisfy SAMA that their proposed information technology and accounting systems will be adequate for maintaining up-to-date records of all transactions and commitments undertaken by an applicant, so as to keep management and SAMA continuously and accurately informed of the bank’s condition and the risks to which it is exposed.
22. Applicants are required to demonstrate to SAMA that their proposed IT and accounting systems will be capable of producing all required statutory and prudential information in an accurate and timely manner from the commencement of their banking operations.
23. In assessing the overall adequacy of the proposed information and accounting systems, SAMA will have regard to the integrity and security of the systems and arrangements for Business Continuity Management (BCM) and Disaster Recovery Planning (DRP) as per SAMA’s SAMA Cyber Security Framework and BCM framework.
24. Any planned outsourcing of material processes, people and systems must satisfy SAMA’s outsourcing requirements set out in SAMA’s Instructions for Outsourcing.
G. External and Internal Audit Arrangements
25. Applicants must demonstrate to SAMA that arrangements have been established with external auditors in accordance with the requirements of the BCL and other relevant laws and regulations.
26. Applicants are required to satisfy SAMA on the adequacy of proposed internal audit arrangements and requirements as set out in SAMA’s Principles of Corporate Governance for Banks Operating in Saudi Arabia.
H. Supervision by Home Supervisor (Foreign Bank Branch Application)
27. Foreign bank branch applicants must have received a written consent from their home supervisor for the establishment of a banking operation in Kingdom of Saudi Arabia. Only applicants that are licensed banks in their home country and are listed in their domestic stock exchange will have their applications processed for granting of a license to operate as a foreign bank branch.
28. Foreign bank branch applicants must satisfy SAMA that they are subject to adequate prudential supervision in their home country. In considering the standard of supervision exercised by the home supervisor, SAMA will have regard to the Core Principles of Banking Supervision (Core Principles) promulgated by the Basel Committee on Banking Supervision (BCBS). This includes whether the home supervisor supervises the foreign bank applicant on a consolidated basis in accordance with the principles contained in the Basel rules, and is prepared to co-operate with SAMA in the supervision of the bank branch in Kingdom of Saudi Arabia.
4. Application Process Guidelines
1. Pre-Application Consultations
29. Prospective applicants for a license to carry on banking business in Kingdom of Saudi Arabia are encouraged to contact SAMA to discuss their plans prior to submitting a formal application. Consultations with prospective applicants before they submit an application will help them to:
I. Understand SAMA’s licensing procedures.
II. Understand SAMA’s expectations of banks, and in particular any concerns that SAMA might have early on, and which will help the prospective applicant make an informed decision about whether to spend time and other resources on an application that may not progress further.
30. To start the pre-application process, prospective applicants should contact SAMA to arrange an initial meeting.
2. Information Required to Be Submitted with the Application
31. After the pre-application consultations, prospective applicants should be ready to submit their formal application for SAMA to assess. Prospective applicants can find the application form they need to complete on SAMA’s website. All the supporting information and other requirements to be submitted by an applicant to carry out banking business in the Kingdom of Saudi Arabia, either to operate as a locally incorporated bank or as a foreign bank branch, is set out in the Application Form.
32. SAMA may seek such additional information from an applicant, as is necessary, to assess the application.
3. Submission of Application
33. Two copies of the final application (one hard copy and one soft copy (via e-mail)), each to be signed by two authorized Directors of the applicant (preferably the Chairman of the Board of Directors and the Chief Executive Officer (CEO), including all the required information and supporting documents as set out in the Application Form, should be submitted to SAMA. These should be sent to the physical and e-mail addresses shown in the front page of the Application Form. If there are any changes to the information provided before a decision on the application has been made, the applicant should notify SAMA in writing as soon as possible.
4. Processing and Notification
34. All applications will be processed within reasonable time, having regard to the particular circumstances of each application, including the completeness of information and documents submitted to SAMA by the applicant. For applicant’s application to be assessed as complete, it would need to have provided SAMA with a fully and correctly completed Application Form with all its supporting requirements. The information provided must also be of sufficient quality and detail to allow SAMA to complete its assessment.
35. Applicants should expect to receive written acknowledgement (by e-mail) of receipt of their application from SAMA along with confirmation of their case officer/s name within fifteen (15) business days.
36. SAMA will endeavor to assess an application and reach a decision within a reasonable time. Throughout the processing and assessment of the application, SAMA may have queries or require further information from the applicants. Applicants can help to make the process as efficient as possible by responding promptly and comprehensively to any SAMA queries.
Additional Licensing Guidelines and Criteria for Digital-Only Banks in Saudi Arabia Feb 2020
Date(g): 24/2/2020 | Date(h): 1/7/1441 Status: In-Force Introduction
These Additional Licensing Guidelines and Criteria for Digital-Only Banks in Saudi Arabia are issued in accordance with the authority vested in SAMA under the Charter of Saudi Arabian Monetary Authority –issued via Royal Decree No. 23 dated 23/5/1377 H, and the Banking Control Law – issued via Royal Decree No. M/5 dated 22/2/1386 H.
Purpose and Scope
1. This document sets out the licensing criteria for Digital-only Banks. For purposes of implementing the provisions in this document, a Digital-only Bank is defined as a bank that conducts a banking business mainly through digital channels (e.g. the web and mobile applications).
2. These guidelines are applicable to Digital-only Bank license applications in Saudi Arabia. They must be considered as additional requirements to be met along with the Banking Licensing Guidelines and Minimum Criteria.
Licensing Conditions
To apply for a Digital-only Bank license in Saudi Arabia, the following conditions must be met:
1. The Digital-only Bank should be set up as a locally incorporated joint-stock company.
2. A promoter should have:
a. experience and knowledge in the financial industry;
b. appropriate technology-related experience and knowledge; and
c. financial capacity to support setting up the Digital-only Bank.
3. An applicant must possess a team with adequate expertise to discuss relevant aspects of the application.
Business Plan
An applicant is required to present a clearly articulated business plan, covering as a minimum:
1) the IT infrastructure plan and innovative technologies that will be rolled out;
2) the financial projections;
3) the targeted segment (with the underlying study and analysis); and
4) the proposed products and services in line with the targeted segments.
Capital and Liquidity Requirements
An applicant is required to submit an Internal Capital Adequacy Assessment Plan (ICAAP) and an Internal Liquidity Adequacy Assessment Plan (ILAAP) along with the application.
SAMA will assess the adequacy of capital of applicants on a case-by-case basis considering the scale, nature and complexity of the operations as proposed in the Business Plan, ICAAP and ILAAP of the applicants.
Physical Presence
An applicant must maintain a physical presence for its Digital-only Bank in Saudi Arabia to be its principal place of business (i.e. head office). A Digital-only Bank is not expected to establish physical branches; however, on exceptional basis, SAMA may require a Digital-only Bank to establish costumer service centers in order to facilitate customer interaction, enquiries or complaints.
Governance
Digital-only Banks are required to follow the same SAMA’s Principles of Corporate Governance for Banks Operating in Saudi Arabia as with conventional banks.
Risk Management and Control
Digital-only Banks are required to satisfy SAMA that their proposed risk management and control policies are adequate and appropriate for monitoring and limiting risk exposures as per section D of the SAMA Banking Licensing Guidelines and Minimum Criteria.
Compliance & Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT)
In addition to demonstrating compliance with the requirements set out in Section E of the SAMA Banking Licensing Guidelines and Minimum Criteria, applicants should demonstrate the compliance of the AML/CTF regulations in the fully digitalized environment.
Technology and Cybersecurity Risks
1. Applicant should consider Information systems security, resilience and availability, being key components of a Digital-only Bank. The selection of appropriate technologies and security arrangements should be aligned to the proposed banking products and services.
2. SAMA requires compliance with all relevant requirements, such as (but not limited to) SAMA’s Cybersecurity Framework and BCM Framework. In addition, SAMA requires applicants to consider other relevant regulations, (e.g. from National Cybersecurity Authority) when designing and implementing the Technology and Cybersecurity framework of the proposed Digital-Only Bank.
Independent Assessment
SAMA may require the applicant to appoint a qualified and experienced third-party entity (“assessor”) to perform assessments on the specific technical areas such as the technology/cybersecurity and AML/CFT arrangements at the expense of the applicant. Such assessment will be performed over following phases:
a) The design phase – After submission of the application to SAMA, the assessor should perform an assessment of the adequacy of the governance, proposed processes and systems of the proposed design. SAMA requires the applicant to submit a report on the proposed design phase assessment along with a plan on the closure of observations/issues (if any). The applicant should remediate all key observations / issues to the satisfaction of SAMA.
b) The implementation phase – Prior to commencement of operations, the assessor should perform a detailed assessment of the implementation of paragraph (a) above. SAMA requires the applicant to submit a report on the implementation phase assessment in accordance with the approved design along with a plan on the closure of observations/issues (if any). The applicant must remediate all key observations / issues to the satisfaction of SAMA prior to obtaining SAMA's approval to go-live.
Outsourcing
Any planned outsourcing of material processes, people and systems must satisfy SAMA’s outsourcing requirements as set out in SAMA’s Rules of Outsourcing.
Exit Plan
An applicant is required to provide an exit plan in case of difficulties in achieving the targeted business objectives.
The exit plan should be clearly articulated to provide SAMA with the steps that will be taken to manage customer funds and ongoing businesses. This could include, for example, the migration of bank accounts and associated funds to another bank, ensuring continued services to the existing customers, and management of other assets and liabilities.
Prudential and Supervisory Requirements
1. Digital-only Banks will be subject to the same set of prudential requirements as with other banks.
2. In addition, due to the nature of business operations, all (or most) of the data are expected to be in an electronic format. The design of technology solutions in a Digital-only Bank should allow for easy and quick access to complete and accurate information needed for SAMA to perform its supervisory duties.
Consumer Protection
1. SAMA’s Banking Consumer Protection Principles are also applicable to Digital-only Banks.
2. An applicant should demonstrate that the necessary arrangements and channels are in place to adequately support customers during the banking life cycle.
Application Forms
All prospective applicants are encouraged to fulfill all requirements outlined in the Licensing guidelines and other Statutory Regulations and Prudential Standards before filling out the application forms, and to arrange an initial meeting with SAMA. The forms can be found under the links below:
Application Process
The applicant shall submit an application to SAMA using the License Request Form, complete all information including prerequisite documents and files in a hard-copy and soft-copy, then submit it via the following addresses:
- Saudi Central Bank (SAMA)- General Department of Banking Control - Banking Licensing Division P.O. Box 2992, Riyadh 11169, Saudi Arabia.
- Email: (BankingLicenseApp@SAMA.GOV.SA).
If any changes occur to the given information by license applicant prior to SAMA's decision on the application, the license applicant shall notify SAMA as soon as possible.
Prohibited Activities
Withdrawal of a License