Approve an effective compliance policy and oversee it, which includes at a minimum:

1. 1. Establishing a permanent and effective compliance unit and updating its organization from time to time.
2. 
   2. Promoting a culture of compliance, employee responsibilities, and penalties for neglect and the levels that must be achieved.
3. 
   3. Supporting and promoting values of integrity and honesty throughout the bank.
4. 
   4. Comprehensive and total commitment in all of the bank's policies to comply with regulations and instructions.
5. 
   5. The necessary requirements for managing non-compliance risk matters.
6. 
   6. Supervising the implementation of the policy, including ensuring that compliance-related issues are addressed by senior management quickly and effectively with the help of the compliance unit.
7. 
   7. Committing to providing adequate resources to the compliance unit on a continuous basis.
8. 
   8. Granting the compliance unit the necessary independency as per Principle (5).
9. 
   9. Precisely defining the responsibilities of the compliance unit.
10. 
    10. Having the internal audit unit review the activities of the compliance unit and compliance risks periodically.
11. 
    11. Continuously overseeing efforts towards implementing the compliance policy, the performance level achieved through periodic reports, assessing the compliance unit's activities, identifying weaknesses, and efforts in training and awareness.

The senior management of the bank is responsible for preparing and updating the compliance policy for managing compliance matters and obtaining board approval for local banks, and the branch head for foreign bank branches, and communicating it to all bank sectors. The policy should include:

1. The compliance principles that work units and their personnel must adhere to.
    
2. An explanation of the key procedures for identifying and managing compliance risks throughout all levels of the bank's system.
    
3. Enhancement of clarity and transparency by distinguishing between general standards applicable to all employees and specific standards and procedures that apply only to certain employee groups.
    

The senior management, with the assistance of the compliance unit, are responsible for:

• Identifying the principal non-compliance risks facing the bank, developing plans to manage and assess these risks at least annually. These plans should address any deficiencies in the policy, procedures, or implementation related to the effectiveness of the existing non-compliance risk management, as well as determine the need for any additional policies or procedures to address new non-compliance risks identified in the annual non-compliance risk assessment.
   
• Providing written reports to the board or its delegated committee, highlighting the bank's management of non-compliance risks at least once annually, to support board members in making informed decisions based on accurate information regarding the effectiveness of the bank’s non-compliance risk management.
   
• Reporting in writing to the board or its delegated committee immediately about any significant failures, deficiencies, or violations of non-compliance (e.g., non-compliance situations that may result in significant risks leading to legal or regulatory penalties, severe financial losses, or damage to the bank’s reputation).

The concept of independence includes four interrelated elements that must be applied as follows:

1. Element One: The Compliance Unit Must Have an Official Status in the Bank.
   
   Element Two: In local banks, the compliance unit should be headed by an executive at the first managerial level. In branches of foreign banks, the unit should be led by a senior executive at the first managerial level who reports directly to the head of the branch. This position should include the overall responsibility for coordinating the management of compliance risks within the bank.
    
2. Element Three: The personnel of the compliance unit, particularly the head of compliance, should not be placed in a position that could lead to potential conflicts of interest between their compliance responsibilities and any other responsibilities associated with their role.
    
3. Element Four: All personnel within the compliance unit should have the right and authority to access and review all relevant information, records, and files, and communicate with bank employees as necessary to perform their duties.
    

The organizational document for the Compliance Unit, related to the compliance policy, must include at a minimum the following requirements:

1. ‎ The role and responsibilities of the Compliance Unit.  
    
2. Procedures necessary to ensure the independency of the Compliance Unit.
    
3. The relationship of the Compliance Unit with other risk units within the bank, and its relationship with the internal audit unit.
    
4. The method for distributing compliance responsibilities in exceptional cases where, due to technical or specialized reasons, or where there is not a significant relationship with non-compliance risks, some compliance responsibilities may be assigned to employees in other operational units such as human resources, administrative affairs, branches, etc., and must be according to specific procedures outlining the role and authority of those units and designated officials.
    
5. The Compliance Unit has the right to access the necessary information, records, and data to perform its responsibilities, and the requirement for bank employees to cooperate in providing this information.
    
6. The Compliance Unit has the right to conduct necessary investigations by itself or through delegated external experts for potential policy violations or shortcomings in compliance policy implementation, and its authority to appoint or request external experts if needed.
    
7. The Compliance Unit has the right to freely report investigation results to senior management and, when necessary, to the board or its authorized committee.
    
8. The official obligations of the Compliance Unit regarding reporting to senior management.
    
9. The Compliance Unit has the right to direct access to the board or its authorized committee.

The Chief Compliance Officer should have the authority to hold regular meetings with senior management and heads of different business units to discuss compliance with regulations and instructions relevant to the operations and activities of each group, department, or sector. These meetings should be officially documented. It is preferable that senior management and heads of business units attend these meetings personally rather than sending representatives, as their active participation demonstrates:

• Leadership by example.
   
• Understanding of their responsibilities regarding compliance.
   
• Continuous reinforcement of compliance.
   
• Support for the compliance process.
   

To effectively manage compliance responsibilities as outlined in the compliance documentation and at all administrative levels within the bank where non-compliance risks may exist, the Compliance Unit must have the following principal rights and capabilities, without waiting for orders or instructions:

1. The right to communicate with any employee and access any necessary information, records, and files needed to fulfill its responsibilities.
    
2. The ability to carry out its responsibilities independently across all business units where non-compliance risks are present, including the right to investigate any potential violations of compliance policies and to seek assistance from internal specialists (e.g., legal affairs or internal audit) or engage external experts if necessary.
    
3. The freedom to report any potential violations or transgressions uncovered during its investigations to senior management, without fear of retaliation or dissatisfaction from business units or other employees.
    
4. Although the Compliance Unit should report administratively to the CEO/Managing Director/General Manager, it must also have the right to communicate directly with the board or its delegated committee, bypassing usual administrative reporting lines if necessary.
    
5. The Chief Compliance Officer should meet with the board or its delegated committee at least once a year to help assess the board's evaluation of the bank's ability to manage non-compliance risks effectively.
    
6. The Chief Compliance Officer must promptly and directly notify SAMA/General Directorate of Bank Supervision upon identifying strong indicators of significant or serious compliance failures or violations that impact the reputation of the banking sector and must ensure that SAMA is informed.

• Provide advice on regulations and the drafting of instructions for the Compliance Unit, and to prepare necessary guidelines for employees. The Compliance Unit will focus on monitoring compliance, instructions, policies, and procedures, and prepare and submit reports to senior management.

• Investigate deficiencies and violations related to the implementation of relevant regulations and instructions concerning the tasks and operations of all units within the Compliance Unit.

• Provide legal opinions on the results of investigations conducted by the Compliance Unit from time to time.

• Raising employee awareness about compliance issues and potential violations, recognizing that they are the first line of defense, and serving as an internal contact point for compliance-related questions from bank employees.

• Developing written guidance for employees that addresses the appropriate application of relevant regulations, compliance rules, and standards through policies and procedures. This includes preparing other guidance documents such as compliance manuals, internal codes of conduct, and practical guides.

• Ensuring that the annual training and awareness program for all employees includes a plan that meets the bank’s ongoing needs and can be promptly adjusted in response to new issues, observations, significant changes, or updates in regulations, or high employee turnover. Training should be provided through available methods within or outside the bank, particularly for new employees, to familiarize them with compliance requirements related to their banking operations before starting their duties, and for those who interact directly with the public, to periodically remind them of requirements such as sales and marketing instructions, anti-money laundering and counter-terrorism financing, due diligence, reporting suspicious transactions, and internal violations.