Chapter III: Internal Organization
Article 16: Internal Policies and Procedures
The Debt-Based Crowdfunding Company shall:
1- Develop written appropriate organizational policies approved by the board. Such policies must include, at least, the internal organization, governance, credit, risk management, compliance, a guide to deal with actual or potential conflicts of interest, confidentiality and security of information, outsourcing, and human resources.
2- Ensure that its technical equipment and related systems are adequate for its operational needs, nature of activity and risk situation and in accordance with best practices and SAMA’s instructions in this regard.
3- Design its information technology systems and related processes in a way that ensures the data availability, integration, safety and confidentiality and preserve the security of such systems and data. The Debt-Based Crowdfunding Company shall assess these systems and processes on a regular basis in accordance with the generally recognized technical standards.
4- Establish business continuity plans for emergencies, including alternative solutions to restore its operations within an appropriate time.
5- Keep all documents, records and files of the Participants and Institutional Beneficiaries in an orderly and safe manner and ensure that all files are complete and updated regularly for a period of at least 10 years from the date of the end of the relationship.
6- Have sufficient and qualified human resources in terms of knowledge and expertise to meet its operational needs, business activities and risk situation.
7- Develop a recruitment plan for vacant positions.
8- Develop a plan for cessation of business to be updated periodically to consider any changes to the Company’s business model or in the risks to which the Company is exposed.
Article 17: Requirements for Information Security and Combating Financial Crimes
1- The Debt-Based Crowdfunding Company shall comply with the information security requirements and the relevant laws, regulations and instructions issued by SAMA.
2- The Debt-Based Crowdfunding Company shall comply with the legal requirements contained in the Anti-Money Laundering Law, Combating Terrorism Crimes and their Financing Law, their Implementing Regulations, and the relevant rules and guidelines as specified by SAMA, in a manner that is consistent with the nature and size of the Company’s activity and risks it may be exposed to. The Debt-Based Crowdfunding Company shall also comply with the requirements and instructions issued by SAMA on financial crimes and fraud.
Article 18: Outsourcing
The Debt-Based Crowdfunding Company shall comply with the Rules on Outsourcing issued by SAMA for finance companies.
Article 19: Risk Management
The Debt-Based Crowdfunding Company shall:
1- Establish a written policy including a clear business strategy for risk management, approved and annually updated by its board of directors. The risk management policy shall take into account all relevant types of risks and how to deal with them. Such policy shall cover the analysis of at least the following risks:
a. Credit risk.
b. Market risk.
c. Operational risk.
d. Legal risk.
e. Reputational risk.
f. Technological risk.
g. Fraud risk.
h. Information security risk.
i. Cybersecurity risk.
j. Money laundering and terrorist financing risk.
k. Outsourcing risk.
l. Debt-Based Crowdfunding Platform operational cessation risk.
m. Participant protection-related risk, including the Institutional Beneficiary’s default risk.
2- Develop appropriate procedures to identify, assess, manage, monitor, communicate, and report risks. These procedures must be included in a comprehensive risk management framework that ensures:
a. Early and comprehensive identification of risks.
b. Assessment of correlations between risks.
c. Immediate coordination with the board of directors, senior management and responsible staff, when needed.
d. Immediate communication of identified risks to stakeholders.
Please review Circular No. (44028131) dated 02/04/1444H regarding Quarterly Risk Report Preparation and Submission to the Central Bank, Including Audited Annual and Quarterly Financial Statements, Prudential Data, and Publication on the Company's Website.
Article 20: Auditor
1- The Debt-Based Crowdfunding Company shall appoint one or more certified external auditors. A written non-objection letter for such appointment shall be obtained from SAMA. SAMA may appoint another auditor at the Company's expenses whenever its business' size and nature require so.
2- SAMA may require the external auditor to explain their report or disclose other facts from which they obtain knowledge in the course of an audit that could indicate a violation of the applicable laws, regulations, or instructions or a violation of the by-laws of the Company.
Article 21: Saudization of Human Resources
1- At least 50% of all employees of the Debt-Based Crowdfunding Company shall be Saudi nationals, including different departments and administrative levels, when the Company starts its operations.
2- The percentage of Saudization must be increased annually by at least 5% until it reaches 75%. Afterward, SAMA may determine the minimum required annual increase.
Article 22: Participants and Institutional Beneficiaries’ Protection and Data Confidentiality
1- The Debt-Based Crowdfunding Company shall establish a function for handling complaints and set clear procedures for receiving, documenting, reviewing, and responding to the complaints of Participants and Institutional Beneficiaries within the period specified by SAMA. Such complaints shall be kept in special records that also include all necessary details in relation to the complaint and the procedures taken.
2- All employees of the Debt-Based Crowdfunding Company shall maintain the confidentiality of data and transactions related to the Participants and Institutional Beneficiaries and shall not disclose them to other parties even after the end of service for employees or revocation of license, except in accordance with the relevant laws, regulations and instructions.
3- The Debt-Based Crowdfunding Company shall take all necessary measures to ensure the confidentiality of information and transactions related to Participants and Institutional Beneficiaries.