Section II: Regulatory and Technical Instructions
3. Technological Equipment
The entity shall ensure that its technological equipment and related systems are sufficient for its operational needs and the nature of the activity and in line with the best practices and SAMA’s instructions issued in this regard. In addition, as a minimum, the entity shall maintain, develop and operate the platform to carry out the activity according to SAMA’s instructions and shall develop standard technical interfaces to communicate with financiers, exchange information, and receive and process finance offers and applications.
4. Requirements for the Accuracy of Information Provided
4.1 The entity shall, using reliable and independent sources, verify the identity of the consumer and ensure the validity of the information and documents provided online before sending them to the financier. Such procedure shall be documented in accordance with the instructions issued by SAMA.
4.2 The entity shall establish the necessary internal procedures to ensure the validity and accuracy of finance offers before presenting them to the consumer.
4.3 The entity shall create an electronic record for each consumer and comply with the Electronic Transactions Law and its Implementing Regulations. The entity shall also establish the necessary procedures and measures to ensure that the information provided is correct and up-to-date, including, at a minimum:
4.3.1 Sending an authentication code to verify the consumer’s phone number.
4.3.2 Developing the procedures necessary to ensure the provision of up-to-date information, such as the national address.
5. Requirements for the Retention of Information Provided
Taking into account the laws and instructions related to data and information protection issued by the competent authorities, the entity shall, at a minimum:
5.1 Develop the necessary procedures and controls to maintain the confidentiality of all data and information obtained through the platform, and not disclose such data and information to any external party unless SAMA’s prior approval is obtained and in a manner consistent with the relevant regulations.
5.2 Ensure the security, integrity and availability of the information provided through the platform, including, but not limited to, the information provided for the consumer and the information collected and stored by the entity or the other party it contracted with as a service provider. The entity shall particularly protect the consumer’s personal information from loss and unauthorized access, including use, modification and disclosure.
5.3 Keep all consumer documents, records and files in an orderly, clear and safe manner and ensure that all files are complete and updated regularly, for a period of at least 10 years from the date of the end of the relationship with the consumer.
6. Conflict of Interest
The entity shall develop an appropriate written organizational policy that addresses potential conflicts of interest. Such policy must include adequate measures to be taken to avoid and address any conflict of interest to ensure fair treatment of all consumers and financiers.
7. Disclosure
The entity shall:
7.1 Clarify and post on its platform all terms and conditions of the platform, security instructions, payment methods, information confidentiality, any other instructions related to the use of the platform, and all data that must be disclosed under the relevant laws and instructions.
7.2 Disclose all fees and commissions charged for the entity’s services.
7.3 Post on its platform the entity’s licensing information.
8. Obligations of the Entity
8.1 The entity shall strengthen the platform’s cybersecurity and promptly deal with any cases of breach. In case of a breach, the entity shall immediately notify SAMA.
8.2 The entity shall ensure that the electronic linkage between the entity and the financier serves the provision of aggregation activity only and is not used for any other purposes, unless approved by SAMA.
8.3 The entity shall have on its platform a feature that allows consumers to communicate directly with the entity to submit feedback and complaints. This feature must also allow for documentation and preservation of any communication occurring through it.
8.4 The entity shall set appropriate approvals and acknowledgments and allow consumers to read and agree to them before using the platform, provided that such approvals and acknowledgments are shown as a Pop-Up Window.
8.5 The entity shall inform, through the documented channels, the consumer of the reason if the finance application is not accepted or of the need to submit additional documents if required.
8.6 The entity shall consider the needs and desires of consumers and provide them with information in a clear, transparent and not misleading manner.
8.7 The entity shall provide visual and print messages and materials to raise awareness of and educate consumers about major risks, thus helping them make informed and effective decisions before obtaining finance from the financier.
8.8 The entity shall not receive or deliver funds on behalf of the financier unless SAMA’s approval is obtained.
8.9 The entity shall make a list of the financiers it deals with so that the consumer can choose from them.
8.10 The entity shall not participate in any marketing campaigns for any financier and shall not prefer a financier to another.
8.11 The entity shall obtain the consumer’s consent before examining their credit record held with one or more credit bureaus and before sharing the consumer’s credit information with the financier, in a manner consistent with the relevant laws and instructions.
8.12 The entity shall offer the consumer the available financing options, provided that such options are consistent with the credit policies or standards communicated by the financier. If the financier’s credit policies or standards do not apply to the consumer, the entity shall explain the reasons to the consumer through the platform.
8.13 In the event that finance is approved, the entity shall send a message to the consumer through the documented channels. The message must state the basic information of the finance product in a clear, accurate, understandable and not misleading manner, accompanied by the phone numbers of the complaint centers/customer service at the entity and the financier.
8.14 The entity shall periodically update the information on services and products provided by the financier for the consumer. Such information must be clear, concise, understandable, accurate and not misleading and must include, at a minimum, the following:
8.14.1 Key conditions and features.
8.14.2 Clarification of the rights and responsibilities of each party.
8.14.3 Details of the prices and commissions charged by the financier.
8.14.4 Details of fines, risks and the mechanism for terminating the relationship, along with the consequences thereof.
8.14.5 Details about the alternative products and services offered by other financiers.