Financial institutions shall provide effective channels that ensure confidentiality of information for all of their employees and stakeholders.

Financial institutions shall handle the reports received according to internal instructions that ensure objective and progressive processing of reports and formulation of a corrective action plan. Each report will be classified by type of processing, in line with the financial institution’s administrative structure.

A financial institution shall develop an internal policy for the approval and supervision on the mechanism for processing violation reports. It shall also assign the individuals authorized to handle these reports.

A financial institution shall establish the controls necessary to review and clearly understand the content of reports. It shall develop an automated system through which, at least, the following information can be viewed:

1.  The channel for receiving reports; - Total number of reports; 
2.  Total number of reports by subject; 
3.  Number of reports processed and reports in progress; and 
4.  Type of processing

Such automated system should be designed to generate any reports for any of the processing stages requested by SAMA.

The financial institution shall establish working procedures for the processing of reports, describing detailed steps of each procedure and specifying the inputs, outputs, models and automated systems used for each procedure as well as the individuals authorized. These working procedures should include at least the following stages:

1. Report reception; 
2. Initial assessment;
3. Identification of verification plan;
4. Documentation of rationale supporting the processing decision;
5. Decision taken for processing;
6. Follow-up on decision implementation; and
7. Record keeping.