Payment Systems and Payment Services Providers Circulars
Circular No. Circular Title Issue Date (G) Issue Date (H) Status N/A The Primary User of the Electronic Services Portal (E-services Portal, E-SAMA) 24/11/2024 23/05/1446 In- Force 46025374 Rules for Electronic Wallets 29/10/2024 26/04/1446 In- Force 46023985 Confirmation of the Application of the Provisions of the System for the Use of Security Surveillance Cameras, its Implementing Regulations, the Document of Security Conditions and Requirements for the Installation of the Surveillance System 21/10/2024 18/04/1446 In- Force 46015180 Presenting and Promoting Products with a Trademark Different from the Original Identity and Trade Name of the Financial Institution 09/09/2024 06/03/1446 In- Force 46013826 Electronic Integration with (Elm) Company to Benefit from the Digital Document Service 04/09/2024 01/03/1446 In- Force 46005535 Confirmation that the King Salman Humanitarian Aid and Relief Center is the Only Entity Authorized to Receive Relief, Humanitarian and Charitable Donations and Deliver them to those in Need Abroad 30/07/2024 24/01/1446 In- Force 46004465 Safeguarding Safeguarded Funds 24/07/2024 18/01/1446 In- Force 46004436 Rules for Dealing with E-Commerce Payment Service and Support Providers 24/07/2024 18/01/1446 In- Force 45068000 Update of the Key Principles of Governance in Financial Institutions 07/05/2024 29/10/1445 In- Force 44094621 Dealing with the Licensed Real Estate Brokers in Accordance with the Relevant Laws and Regulations 10/07/2023 22/12/1444 In- Force 44094620 Emphasis on Implementing the Provisions of the Civil Defense Law and the Requirements of the Saudi Building Code, Especially Concerning Fire Protection Procedures and Preventive Measures 10/07/2023 22/12/1444 In- Force 44093096 Issuance of the Implementing Regulations of Payments and Payment Services Law 04/07/2023 16/12/1444 In- Force N/A Emphasis on the Prohibition of Initiating Any Remote Relationship Without Using Biometric Authentication 23/03/2023 02/09/1444 In- Force 44064343 Rules for Advertising Products and Services Provided by Financial Institutions 05/03/2023 13/08/1444 In- Force 44037856 Biometric Authentication for Remote Customer Relationship Initiation/Establishment 26/11/2022 03/05/1444 In- Force 44009296 Updating Financial Institution KPIs 01/09/2022 05/02/1444 In- Force 43103118 POS Payment Service of GCC Net 19/07/2022 20/12/1443 In- Force 43067037 Requirements for ATM Receipts Initiative 06/03/2022 03/08/1443 In- Force 43065348 Cyber Threat Intelligence Principles for Financial Sector 27/02/2022 26/07/1443 In- Force 43045328 Personal Data Protection Law and data governance policies, regulations and rules 23/12/2021 19/05/1443 In- Force 43029603 Promoting use of Legal Entity Identifier and Facilitating Obtaining it Through Financial Institutions 09/11/2021 04/04/1443 In- Force 43010538 Accepting the digital ID on Absher platform and Tawakklna application 09/09/2021 02/02/1443 In- Force 43008132 Ensure compliance with the requirements for working (remotely) in customer service occupations 02/09/2021 25/01/1443 In- Force 43002199 Ensure the availability of communication channels for customers with financial institutions 16/08/2021 08/01/1443 In- Force 42081293 Key Principles of Governance in Financial Institutions 30/06/2021 21/11/1442 In- Force 42080528 Rules for Dealing with E-Commerce Payment Service and Support Providers 27/06/2021 18/11/1442 Superseded 42080532 Including a Suspicious Commercial Concealment Index 27/06/2021 18/11/1442 N/A Prohibition on Using Social Media Applications for Exchanging Official Data or Documents 12/06/2021 3/11/1442 In- Force 42064776 Update the Requirements for Appointments to Senior Positions 24/04/2021 13/09/1442 In- Force 42047169 Instant Payments Launch (Fast) 17/02/2021 06/07/1442 42046077 POS Payment Service of GCC Net 15/02/2021 04/07/1442 In- Force 42045077 Financial Frauds Through Prior Authorization and Notification Features 13/02/2021 02/07/1442 In- Force 42031578 Verifying the Identity of Customers via a Reliable Source 27/12/2020 13/05/1442 In- Force 42027544 Updating Financial Institution KPIs. 13/12/2020 28/04/1442 Modified 42023876 Standardization of the elements of notifications sent to customers of financial institutions. 29/11/2020 14/04/1442 In- Force 42017708 Instructions for replacing the commercial registration number and licences for non-governmental establishments with the unified number starting with (7). 03/11/2020 18/03/1442 In- Force 42013854 Opening Daycare for Children of Female Workers at Financial Institutions 21/10/2020 05/03/1442 42010693 Follow up Circular- to Obtaining SAMA no Objection before Accepting Nomination or Assignment / or Re-Assignment or Appointment / or Reappointment of any of the Senior Positions in Financial Institutions 12/10/2020 25/02/1442 Modified 42009003 Preparations for Providing Electronic Payment Methods for the Grocery Sector 05/10/2020 18/02/1442 In- Force 42007290 Approval of the Unified Number Starting with (7), Issued by the National Information Center, to Serve as the Unified Number for Non-Governmental Establishments 28/09/2020 11/02/1442 In- Force 42006511 the emphasis on adherence to the Institution’s instructions related to advertising and marketing. 22/09/2020 05/02/1442 42006529 The standard form for responding to complaints received through the SAMA Cares platform. 22/09/2020 05/02/1442 In- Force 41071602 Readiness to Receive Requests for installing electronic payment methods for all retail sector activities 17/08/2020 28/12/1441 In- Force 41059555 Charging Fees on Mada Claims 06/06/2020 15/10/1441 41049697 Readiness Receive Requests to Provide Electronic Payment Methods for Personal Service Activities 11/03/2020 17/07/1441 371000100598 GCC POS Pricing Policy 18/06/2016 14/09/1437 361000085193 Rules, Procedures and Instructions Regulating Saudi Payment Systems 05/04/2015 16/06/1436 N/A Use the Local Tech Product Guide when Ordering Those Products 21/09/2023 07/03/1445 44871590 Schedule for Submitting Quarterly and Annual Financial reports to SAMA 24/10/2023 10/04/1445 In- Force 41061590 Upgrading Point-of-Sale Devices Operating in the Kingdom to "4G" Technology 21/06/2020 01/11/1441 In- Force 42050337 Emphasize the Mandatory Verification of the Customer and the Effectiveness of the Procedures Followed to Adhere with the "Know Your Customer (KYC)" Principle Before Initiating the Sale or Purchase of Point-of-Sale Devices 01/03/2021 18/07/1442 In- Force 43006158 Amendments on E-Wallets Recharge on MADA Cards 29/08/2021 21/01/1443 In- Force N/A Raising Awareness About the Crime of Foreign Bribery 09/11/2023 26/04/1445 Guidance N/A Enhance Electronic Payment ــــــــــــــــــ ــــــــــــــــــ In- Force 45048798 Remuneration for Members of Boards of Directors of Financial Institutions 04/02/2024 25/07/1445 In- Force 45040399 Enabling the Provision of Various Types of Electronic Payments for Charities and Non-Profit Organizations 06/01/2024 25/06/1445 In- Force N/A Compliance with the Updated Personal Data Protection System and its Implementing Regulations 18/09/2023 04/03/1445 In- Force N/A Criteria for Systemically Important Payment Systems in Kingdom of Saudi Arabia 22/01/2015 02/04/1436 In- Force N/A QR Code Technology 21/09/2021 14/2/1443 In- Force N/A Compliance with Policies, Frameworks, Standards, and Regulations Related to Cybersecurity 09/11/2021 04/04/1443 N/A Emphasize Prompt Communication with SMS Service Providers 02/06/2022 03/11/1443 N/A Key Elements of SMS Notifications for Newly Updated Mada Transactions 14/10/2021 08/03/1443 In- Force N/A Approval of the Companies' Memorandum of Association and its Amendments 28/12/2021 24/05/1443 In- Force N/A The Unified Pricing Model for Point-of-Sale and E-Commerce Services 13/06/2022 14/11/1443 N/A Challenges of the Payroll Management System on the Mudad Platform 10/05/2022 09/10/1443 N/A Data Cybersecurity Controls 31/01/2023 10/07/1444 In- Force N/A Lists of Deregistered Commercial Records 28/11/2021 23/04/1443 N/A The Procedures for Enforcing Judicial Decisions Issued Against Customers of Payment Service Companies 24/03/2022 20/08/1443 N/A Regulation of the Special Integrated Logistics Zone 21/11/2021 16/04/1443 N/A Mechanism for Reporting Judicial Decisions Issued Against Certain Financial Institutions 15/05/2022 14/10/1443 Miscellaneous Regulations (PSP)
Rules, Procedures and Instructions Regulating Saudi Payment Systems
No: 361000085193 Date(g): 5/4/2015 | Date(h): 16/6/1436 Translated Document
Based on the regulations and instructions that authorized SAMA to supervise banks, and money exchange operators, and to issue mandatory rules, procedures, and instructions for them.
You will find Attached a copy of the Governor's decision No. 361000082764 dated 11/06/1436H regarding the rules, procedures, and regulatory instructions for payment systems in the Kingdom of Saudi Arabia. Banks, and licensed money exchange operators are required to continue adhering to and implementing these rules, procedures, and regulatory instructions, as well as any amendments that may be introduced by SAMA in the future. It should be noted that SAMA will monitor the implementation and application of these rules, procedures, and instructions in accordance with the provisions of the Banking Control Law and its Implementation Rules. SAMA will also take legal action against any breach or violation in this regard.
Enhancement of Electronic Payments
Based on the strategies of SAMA regarding payment systems and the Financial Sector Development Program aimed at enhancing electronic payments and reducing cash transactions, and in continuation of the efforts of the National Anti-Commercial Concealment Program by gradually mandating the retail sector to provide electronic payment methods.
The program, in cooperation with SAMA, the Ministry of Municipal and Rural Affairs, and the Ministry of Commerce, has mandated all grocery stores and supply outlets in the Kingdom to provide electronic payment methods starting from 17th of Ramadan 1441H, corresponding to 10th of May 2020G. To ensure the success of the efforts to implement this decision and to guarantee full readiness to meet the expected demand, all banks and payment service providers must comply with the following requirements:
- Readiness to respond to requests for opening bank accounts and electronic wallets for merchants operating in the grocery and supply sector.
- Readiness to receive requests for the provision of electronic payment methods authorized by SAMA (such as Point of Sale devices "POS" or Quick Response "QR" codes) and to respond to these requests through all available channels, including branches, the official website, the unified customer service number, and others, to facilitate this requirement for merchants operating in this sector, while adhering to the regulatory and operational rules for these services.
- Compliance when providing the payment method using the Merchant Category Code designated for this activity, which is: 5411.
- Internal circular of this decision to bank employees and payment service providers to ensure their adequate understanding when receiving requests and inquiries regarding this matter.
Decision No. (361000082764) dated (11/6/1436 H)
The Governor of the Saudi Central Bank*, based on the powers vested in him by law, and after reviewing the relevant regulations and instructions, including:
1- The Saudi Arabian Monetary Authority Law issued by Royal Decree No. 23 dated 23/05/1377 H, particularly Article (1) paragraph (c) and Article (3) paragraph (d), which empower the Central Bank* to monitor commercial banks and currency exchange operators and to issue specific instructions whenever deemed necessary.
2- The Banking Control Law issued by Royal Decree No. M/5 dated 22/02/1386 H, particularly Article (16) paragraph (3).
4- The Anti-Money Laundering Law issued by Royal Decree No. M/31 dated 11/05/1433 H and its Implementing Regulations , particularly Article (7), which authorizes regulatory authorities to issue instructions related to the Know Your Customer principle and instructions concerning Prudential measures and internal controls to detect any crimes stated in this law, and to ensure financial institutions to comply with the requirements issued by it and to develop, implement, and update effective written controls to prevent these institutions from being exploited in money laundering operations and to help detect suspicious transactions.
5- The Council of Ministers Decision No. 59 dated 28/03/1420 H, which empowered the Central Bank* to license the issuance of electronic bank cards and the like and to supervise them according to the instructions, standards, and conditions that it adopts.
It is decided as follows:
First: To incorporate the rules, agreements, standards, instructions, and guidelines listed below under the title (Rules, Procedures, and Regulatory Instructions Related to Payment Systems), which include:
- Operating rules for the Saudi Payment Network.
- Regulatory Rules for Prepaid Payment Services in the Kingdom of Saudi Arabia.
- Rules and instructions for operating the Saudi Fast Payment System (SARIE).
- Agreement for providing (SADAD) payment system services with the bank.
- Agreement for providing (SADAD) payment system services with the biller.
- Automated Teller Machine Service Level Agreement.
- Standards and procedures for the Saudi Payment Network.
- Instructions for Cheque Clearing Rooms.
- Guide to cheque specifications, contents, and printing procedures.
- Guide for the Direct Debit Service of the Saudi Fast Payment System (SARIE).
Second: All relevant authorities must continue to adhere to and implement the above, as well as any amendments that may arise from the Central Bank*, noting that the implementation and application of these rules, procedures, and instructions will be monitored in accordance with the provisions of the Banking Control Law and its Implementation Rules.
* The "Saudi Arabian Monetary Agency" was replaced By the "Saudi Central Bank" in accordance with The Saudi Central Bank Law No. (M/36), dated 11/04/1442H, corresponding to 26/11/2020G.
Criteria for Systemically Important Payment Systems in Kingdom of Saudi Arabia
As the sole owner, operator, and regulatory authority for payment systems in the Kingdom, the Saudi Central Bank is responsible for ensuring the security and safety of these systems.
This responsibility entails a key task: identifying payment systems that are essential to the financial system, facilitating the functioning of the financial infrastructure, and addressing economic needs.
<<Systemically Important Payment Systems>> are defined as those whose disruption could hinder participants or lead to systemic failure of the financial infrastructure in the Kingdom.
As part of its supervisory duties, the Central Bank has established a set of criteria for classifying those systems that are considered important to the financial system.
The Central Bank has decided to classify any system that meets any of the following criteria as important to the financial system:
- Any system that handles payments between banks or with customers that may pose risks to financial stability.
- A payment system that is primary in terms of the total volume and value of daily payments.
- Any system used for settlements within other financial infrastructures that are important to the financial system.
- Any central payment infrastructure system that is trusted by clients based on the number and type of participants, its market depth, and the absence of alternatives
In this regard, the Central Bank has classified the following systems as important to the financial system in the Kingdom:
- The Saudi Fast Payment System (SADAD): A real-time gross settlement system for payments.
- The Saudi Payment Network: A system for ATM services and electronic payments via Point of Sale terminals.
- SADAD Payment System: An electronic bill presentation and payment system.
Compliance with Policies, Frameworks, Standards, and Regulations Related to Cybersecurity
Given the increasing cyber attacks and threats faced by the financial sector in the Kingdom, SAMA emphasizes the commitment to adhere to the policies, frameworks, standards, and regulations related to cybersecurity issued by SAMA, the National Cybersecurity Authority, and related instructions.
SAMA emphasizes the necessity of taking the required measures to implement the basic cybersecurity controls and the cybersecurity controls for sensitive systems, and to prioritize cybersecurity in spending from the approved budgets to enhance its cybersecurity readiness.
Challenges of the Payroll Management System on the Mudad Platform
Referring to the receipt of a letter from His Excellency the Minister of Human Resources and Social Development addressing the challenges facing the "Payroll Management" system on the (Mudad) platform regarding the integration with partner financial institutions, as well as the technical malfunctions affecting the compliance of establishments with the 'Wage Protection' program, and the delays in employees receiving their entitlements as a result.
Therefore, SAMA emphasizes the importance of adhering to the terms outlined in the "Service Level Agreement" between the company and the (Mudad) platform, and taking the necessary measures to resolve the technical issues as per the signed terms, which will help prevent establishments from failing to comply with timely wage payments.
Use the Local Tech Product Guide when Ordering Those Products
Referring to the receipt by the Central Bank of a letter from His Excellency the Governor of the Communications, Space, and Technology Authority, No. (374/1445/H T) dated 05/02/1445 H, which references Article (2) of the Law of Telecommunications and Information Technology, and the launch of the Authority's guide to local technical products on its website. This guide serves as a reference list of technical products developed by leading local companies to serve various business sectors, including banking, insurance, and finance.
For your information and awareness, with a confirmation of compliance with the relevant instructions issued by SAMA, particularly those concerning the rules on outsourcing.
Schedule for Submitting Quarterly and Annual Financial reports to SAMA
Based on the powers vested to SAMA under The Law of Payments and Payment Services issued by Royal Decree No. M/26 dated 22/03/1443 H, and its Implementing Regulations issued on 24/11/1444 H—which stipulates in paragraph Two of "Article 120" that "A Licensee is obliged to submit to SAMA quarterly financial reports (to be reviewed by an external auditor), which include any information that SAMA deems necessary." Furthermore, paragraph Three of the same article states that "A Licensee is obliged to submit to SAMA annual financial statements (reviewed and audited by an external auditor) in a way determined by SAMA."
Accordingly, SAMA emphasizes to payment service providers the necessity of complying with the following requirements to provide SAMA with:
First: Submission of quarterly financial reports, including those for the (first, second, and third quarters) audited by an external auditor, along with the auditor's report, within 45 days following the end of the quarter. Second: Submission of the annual financial statements audited by an external auditor, along with the auditor's report, within 90 days from the end of the fiscal year (December 31). Upgrading Point-of-Sale Devices Operating in the Kingdom to "4G" Technology
Based on the powers vested to the Central Bank under its law issued by Royal Decree No. (23) dated 23/05/1377 H*, and The Banking Control Law issued by Royal Decree No. (M/5) dated 22/02/1386 H, and the Minister Council Decision No. (226) dated 02/05/1440 H, which confirms that SAMA is the legally designated authority responsible for operating payment systems and financial settlement services in the Kingdom, monitoring and supervising them, and has the authority to issue rules, regulations, and licenses according to the standards applied by SAMA in this regard. In reference to the decision by the Communications and Information Technology Commission to update the technical specifications for terminal devices connected to mobile networks, mandating that these devices support at least 4G networks to be approved and allowed for clearance by the General Authority for Customs, and the shift by telecommunications service providers in the Kingdom are moving to discontinue 2G and 3G networks, replacing them with the more advanced 4G and 5G networks, it is noted that this decision will have a direct impact on point-of-sale devices operating in the Kingdom.
I would like to inform you that, in coordination with the Communications and Information Technology Commission, it has been decided to start shutting down the third-generation network by the end of 2022 and to deactivate the second-generation network during the fourth quarter of 2024. Accordingly, SAMA and the Saudi Payments Company have developed an action plan to replace the current point-of-sale devices in the Saudi market with modern devices that comply with the aforementioned decisions of the Communications and Information Technology Commission, as follows:
- All point-of-sale device suppliers are required to provide devices that support the 4G network starting from June 2020 until the end of this year. These devices must be submitted to the Saudi Payments Company’s authorization center for technical approval and to ensure compatibility with the payment network (Mada).
Approval of the installation of point-of-sale devices that support the 4G network as a minimum requirement for new installations requests starting from January 2021. This also includes devices being replaced due to technical malfunctions.
I would also like to inform you that banks and companies hosting electronic payment services must implement the aforementioned replacement plan starting from January 2021 for all currently operating point-of-sale devices in the Kingdom. This entails replacing at least 4% devices monthly from the total number of point-of-sale devices for each entity. The replacement plan, along with progress percentages and remaining quantities, should be shared with SAMA and the Saudi Payments Company on a monthly basis starting from the end of January 2021.
* The Saudi Central Bank Law issued by Royal Decree No.(M/36), dated 11/04/1442H replace the Saudi Arabian Monetary Agency Law issued by Royal Decree No. (23), dated 23/05/1377H.
Raising Awareness About the Crime of Foreign Bribery
We refer to the receipt by the central bank of a letter from His Excellency the President of the Oversight and Anti-Corruption Authority, No. (15929/45), dated 01/04/1445H, which mentions the amendment of paragraph (7) of Article (8) of the Anti-Bribery Law to include the criminalization of bribing foreign public officials in relation to international business transactions. The letter also notes the Authority's work on an awareness booklet regarding issues related to the Crime of Foreign Bribery.
Therefore, and in line with the instructions issued by SAMA, including those outlined in The principles of conduct and work ethics in financial institutions, and given the awareness-raising potential of the aforementioned booklet regarding the seriousness of the crime of foreign bribery and ways to detect it, along with contact information for reporting such crimes, SAMA urges all financial institutions to review this booklet and benefit from its contents. Additionally, we would like to inform you of the Authority's readiness to hold remote workshops to raise awareness about the content of the aforementioned booklet.
Enabling the Provision of Various Types of Electronic Payments for Charities and Non-Profit Organizations
Further to the instructions of SAMA issued by Circular No. (371000119129) dated 18/11/1437H, which included a request to suspend from providing mobile (GPRS) point-of-sale devices to charities and non-profit organizations and to replace them with point-of-sale devices connected exclusively to the fix (landline) telephone, and to Circular No. (41061590) dated 01/11/1441H, regarding upgrading point-of-sale devices operating in the Kingdom to "4G" technology.
I inform you that in coordination with the relevant authorities, it was decided to provide electronic payment solutions authorized by SAMA, including mobile point of sale (GPRS) devices, provided that associations or institutions obtain the approval of the National Center for the Development of the Non-Profit Sector to benefit from the service.
Quick Response Code Technology (QR CODE)
Based on the powers vested to SAMA under the Saudi Central Bank Law issued by Royal Decree No. (M/36) dated 11/04/1442 H, and referring to Cabinet Decision No. 226 dated 02/05/1440 H, which affirms that SAMA is the legally authorized entity to operate payment and financial settlement systems and their services in the Kingdom and to oversee them.
We would like to inform you that the team at Saudi Payments has been working on a project to develop the payment environment using Quick Response Code (QR Code) technology. This project aims to enhance operations in accordance with the principle of interoperability of payment systems among participants in this vital sector, including banks and licensed fintech companies in the Kingdom, while striving to offer multiple payment options in line with the ongoing developments in the payments sector in the Kingdom.
Accordingly, SAMA would like to emphasize that all entities that launched the service previously must comply with the implementation of the technical and commercial requirements and standards related to the payment environment associated with this project. They are also required to carry out the necessary testing procedures by completing the technical authorization process with Saudi Payments before the end of 2021. For communication with the relevant team at the Saudi Payments Authorization Center, please contact them via email.
Exchange of Data and Official Documents
Based on SAMA's commitment to safeguarding the data of financial institutions and their customers, given its significant impact on the trust of stakeholders and the stability of transactions, and referring to the instructions issued by SAMA in this regard.
We would like to inform you that all financial institutions must refrain from using social media applications to exchange any official data or documents, whether directly or indirectly. Such data or document exchanges should be conducted through secure and approved official channels. This is due to the potential negative impacts and risks associated with using social media and instant messaging applications for data or document exchange on the activities of entities and the interests of individuals.
Emphasis Prompt Communication with SMS Service Providers
Referring to the receipt by SAMA of a letter from His Excellency the Governor of the Communications and Information Technology Commission regarding the establishment of governance for the registration of sender names in bulk SMS messages (Tag Names) through the organization of a unified electronic portal for SMS service providers, which enables the Commission to protect the public interest from the misuse of SMS.
Accordingly, SAMA emphasizes the importance of cooperation and prompt communication with the contracted SMS service providers to complete the registration process in the system within the transitional period specified by the commission.
Emphasis on the Prohibition of Initiating Any Remote Relationship Without Using Biometric Authentication
Further to the instructions issued by SAMA as communicated in Circular No. (44037856) dated 03/05/1444 H, regarding the approval of using biometric authentication for remote customer relationship initiation/establishment, and completing the integration procedures with the approved service provider by a maximum deadline of 31/01/2023.
Accordingly, SAMA emphasizes the commitment to refrain from initiating any "remote" relationships through various channels without using biometric authentication with a high level of verification or higher. Please note that SAMA will take regulatory actions in case of non-compliance.
For your information and action accordingly as of this date. If there are any inquiries regarding this matter, please contact SAMA via email.
Approval of the Companies' Memorandum of Association and its Amendments
Referring to the receipt by SAMA of the Ministry of Commerce's telegram No. (33380/41) dated 04/03/1443H regarding the approval of companies' memorandum of association and its amendments, in which the ministry seeks to facilitate and streamline the procedures for establishing companies and any amendments thereto in accordance with the provisions of The Companies Law.
Accordingly, we would like to inform you that the Ministry of Commerce will approve the memorandums of association and their Amendments, clarifying the responsibility of the partners for what is presented and required from them. The contents of these memorandums are the responsibility of the partners in accordance with the provisions of The Companies Law. It is important to emphasize that this does not affect the obligations of the financial institution under the relevant regulations issued by SAMA.
The Key Elements of SMS Notifications for Newly Updated Mada Transactions
Further to SAMA Circular No. (42023876) on 14/04/1442 H regarding the standardization of notification elements sent to financial institution customers, aimed at enhancing customer awareness through notification messages for transactions on their accounts, memberships, and electronic wallets.
And due to the existence of some newly introduced transactions related to Mada transactions, the key elements of SMS notifications for those transactions are attached. Financial institutions are required to comply with sending the relevant notifications accordingly, no later than the end of the first quarter of 2022.
For your information and act accordingly, and provide SAMA with the implementation plan before the end of the working day of November 4, 2021.
The Unified Pricing Model for Point-of-Sale and E-Commerce Services
Referring to SAMA circular communicated via email sent on April 19, 2020, regarding the unified pricing model for POS (Point of Sale) and e-commerce services for transactions made through MADA cards at remittance centers, currency exchange offices, and transfers conducted through electronic wallets.
Accordingly, we hope that you can inform us about the extent of compliance with the above-mentioned circular and the application of the unified pricing model for the Point of Sale (POS) and E-commerce services by banks and payment service providers for transactions carried out through MADA cards at all exchange centers (money transfer/currency exchange), remittance centers, and international transfers conducted through electronic wallets, and provide us with this information no later than Wednesday, June 15, 2022 through the email (PaymentSystemsoversight@sama.gov.sa).
In case of any inquiries, please contact us at the designated email address.
Data Cybersecurity Controls
Referring to the Cyber Security Framework issued by SAMA, which mandates financial institutions to establish a mechanism for implementing the relevant regulatory guidelines and standards criteria issued by national and international entities, and to comply with their application according to the following scope guidelines:
We would like to inform you that the National Cybersecurity Authority has issued Data Cybersecurity Controls (1:2022-DCC), which extend and complement the fundamental cybersecurity controls. Financial institutions are required to comply with the provisions outlined in these controls as follows:
First: Implement measures to ensure ongoing and continuous compliance with these controls. Second: Conduct a self-assessment of the current status of the financial institution using the assessment and compliance tool. Third: Complete implementation of the controls by no later than the end of September 2023. SAMA also emphasizes the necessity of adhering to the aforementioned instructions according to the specified timeline, along with the urgent need to assess and manage cybersecurity risks to address potential threats. For any inquiries, please contact the General Department of Cyber Risk Supervision at the email address.
Lists of Deregistered Commercial Records
Referring to SAMA's role in supervising and overseeing the payments sector, and its contribution to maintaining the integrity of the financial sector while ensuring that financial institutions adhere to Know Your Customer (KYC) principles, and referencing Article 12-2 (A-3) of the Payment Services Providers Regulations, which grants payment service providers the authority to refuse payment orders in specific circumstances, including when the payment transaction constitutes a violation of any obligations of the payment service provider under the applicable laws and regulations..
We would like to emphasize the importance of payment companies' role in verifying the regulatory status of the clients to whom they provide payment services by validating the authenticity of official identification documents. This should be incorporated into the service provision policies and agreements, reflecting the commitment of payment companies to the relevant regulatory requirements. This includes, but is not limited to, requiring the contracting party to inform the payment company of any changes in their regulatory status.
Accordingly, we attach the lists of entities with cancelled commercial registrations for the purpose of reassessing the appropriate actions regarding them and taking the necessary steps.
For your information and action accordingly, we also hope to receive confirmation of the receipt of all segmented lists via four separate emails.
Regulation of the Special Integrated Logistics Zone
Referring to SAMA's role in supervising and overseeing the payments sector, and its contribution to maintaining the integrity of the financial sector by supporting and developing all services provided to clients of payment service companies, as well as referencing the regulation concerning the Special Integrated Logistics Zone issued under Royal Decree No. (A/17) dated 01/02/1440 H and the implementing regulations issued by the General Authority of Civil Aviation for companies operating in that area in this regard.
SAMA emphasizes that all companies operating in the payments sector, when providing payment services to any entities licensed under the regulation of the Special Integrated Logistics Zone, must consider the nature of those entities and update their policies and service agreements accordingly. It is also required to verify the identity of these entities through the following requirements:
- A copy of the Commercial register issued by the General Authority of Civil Aviation (GACA).
- A copy of the company’s memorandum of association and appendixes.
- Copies of the IDs of individuals authorized to open and manage the accounts.
The Procedures for Enforcing Judicial Decisions Issued Against Customers of Payment Service Companies
Based on the powers vested in SAMA to supervise and oversee financial institutions under the Saudi Central Bank Law issued by Royal Decree No. (M/36) dated 11/04/1442 H, and referring to Articles (21) and (46) of the Enforcement Law issued by Royal Decree No. (M/53) dated 13/08/1433 H, as well as other relevant regulations.
SAMA emphasizes that payment service companies must comply with the implementation of judicial decisions issued against clients, as communicated to them through the banks they deal with from each company. SAMA also reiterates the following instructions:
- The company, upon receiving a ban order, is obliged to suspend the customer's electronic wallet and prevent them from managing it or conducting any debit transactions. The company must also not allow the customer to establish any new relationships.
- The ban orders apply in the case of a customer being a natural person (citizen or resident) or a juristic person (institution or company).
- The ban shall be imposed in respect of the customer’s funds and in his/her personal capacity only, and shall not include the fact that the customer is a guardian, curator, legal agent or a person authorized to manage accounts not opened in his/her name.
- The company is obligated to verify that the type and number of the customer's identification, or their personal information or commercial registration record, matches the data recorded with the company in relation to the judicial order issued against them.
- The company is obligated to allow customers access to amounts excluded from attachment, (salaries and related allowances, bonuses, etc. are excluded from attachment at a rate of 67% of the total salary, and 75% of the total pension).
- The company is obligated to maintain the confidentiality of data and information, and not to acquire, publish, or allow access to such data and information by any person for any reason. The only exception is if the inquirer is the customer themselves or their legal representative, provided that the validity of the representation is verified.
- The company is obligated to cancel all actions related to the ban order upon receiving a request to lift the transaction ban.
Accordingly, SAMA emphasizes on payment service companies the importance of taking the necessary measures and means to implement the above, as well as providing the human and technical resources to execute judicial decisions during official working hours.
Mechanism for Reporting Judicial Decisions Issued Against Certain Financial Institutions
Referring to the Royal Order No. 14388 dated 25/03/1439 H, which mandates the adoption of the following electronic means for judicial notifications (text messages sent via verified mobile phones, email, and notifications through any registered accounts in governmental automated systems) and after notifying through these means to the intended recipient, and referring to what is stated in paragraph (14) of Article 34 of the Implementing Regulations of the Enforcement Law, which states that " No process shall be served to the defendant’s place of residence before sunrise nor after sunset. The circuit may, where necessary, give a permission to serve the process at any time. If the process is served by electronic means, this may be carried out at any time".
Based on the above, SAMA emphasizes to financial institutions the importance of utilizing the 'Electronic Authorization' service provided by the Ministry of Commerce. This service allows financial institutions to add an authorized representative to receive judicial notifications issued against them, in addition to the ability to access all judicial orders issued for or against the financial institution through the 'Najiz Portal.' This will enable financial institutions to resolve claims within the notification period stipulated in Article 34 of the Enforcement Law, thereby avoiding the initiation of enforcement actions by the competent court against the financial institution as outlined in Article 46 of the same law (attached is the guide for electronic authorization).
Approval of the Unified Number Starting with (7), Issued by the National Information Center, to Serve as the Unified Number for Non-Governmental Establishments
Referring to Cabinet Resolution No. (225) dated 06/05/1439H, which approved the numbering system starting with the digit (7) issued by the National Information Center as the unified identification number for non-governmental establishments, and to the letter from His Excellency the Chairman of the Saudi Data and Artificial Intelligence Authority No. (702) dated 20/12/1441H, which refers to the letter from His Excellency the Minister of Commerce No. (29238) dated 09/11/1441H. The letter confirmed that the Ministry of Commerce has completed issuing the unified number for establishments for all commercial registers in conjunction with issuing commercial registers for businesses in the first phase. The second phase, which involves the complete replacement of commercial register numbers with the unified number for establishments, began on 17/02/1442H, corresponding to 04/10/2020G.
Please note that the unified number is the digital identity of the establishment for identification throughout its lifecycle. It is issued by the Ministry of Commerce for commercial registers and by the Ministry of Human Resources and Social Development for non-commercial registers. The number consists of ten digits starting from the left with the digit seven (7XXXXXXXXX), followed by the remaining digits. For existing establishments, the unified number is automatically and freely generated above the commercial register. New establishments will be assigned a unified national number and will not be given any other number.
In light of the above and to ensure compliance by financial institutions without disrupting their operations with various entities, and given that inquiries and requests addressed to financial institutions regarding their operations, contracts, and clients from non-governmental establishments will be based on the unified establishment number as of the aforementioned date, the Central Bank requests the following actions to be observed and adhered to:
- Verify the presence of the unified establishment number starting with the digit (7) in the commercial records of financial institutions under the supervision and regulation of the Central Bank. If it is not available, it must be obtained through the Ministry of Commerce's official website.
- Do not open accounts, enter into contracts, or establish relationships with new non-governmental establishments (such as companies, institutions, and others) that are established and registered from the date mentioned above unless based on official documents issued with their unified national number.
- Obtain the unified establishment number starting with the digit (7) for existing accounts, relationships, and contracts that currently have valid commercial records and licenses. This number will replace the commercial registration number (for non-governmental establishments requiring a commercial register) and the activity license (for non-governmental establishments requiring only a license). The update must occur on the date previously specified by the financial institution or upon the expiration of the records and licenses—whichever comes first during the update process—according to the regulations and instructions concerning the updating of customer information and data.
Rules for Electronic Wallets
No: 46025374 Date(g): 29/10/2024 | Date(h): 26/4/1446 Status: In-Force Translated Document
Based on the powers granted to SAMA under the Law of Payments and Payment Services issued by Royal Decree No. (M/26) dated 22/03/1443H and its Implementing Regulations issued on 24/11/1444H, and stemming from SAMA's supervisory and regulatory role over the Payments Sector in the Kingdom.
We inform you of the issuance of the Rules for Electronic Wallets as per the attached format, and SAMA emphasizes that Electronic Money Companies must comply with all provisions contained therein. These rules shall take effect ninety calendar days from the date of their publication on the official website of SAMA.
Article 1
(1) The terms and expressions mentioned in these rules shall have the meanings specified for them in the Law of Payments and Payment Services and its Implementing Regulations.
(2) For the purpose of applying the provisions of these rules, the following words and expressions shall have the meanings indicated opposite each of them wherever they appear in these rules, unless the context requires otherwise:
SAMA: Saudi Central Bank
The Rules: Rules for Electronic Wallets
The Company: An entity licensed as a large electronic money company or a small electronic money company.
Electronic Wallet: A service provided by the electronic money company to a payments services user for the purpose of issuing, storing, and managing electronic money.
Freelancer Certificate Holder: A person who provides their services on a personal basis (per hour, day, or task) instead of working for an employer on a regular salary basis.
Minor: Any male or female under the age of eighteen (Hijri calendar).
The Guardian: The individual responsible for managing the affairs of a minor and representing them, as defined by the Family Law.
The Custodian: The individual responsible for managing the affairs of a minor and representing them, as defined by the Family Law.
The Caretaker: A person designated by a custody decree, authorizing them to receive funds allocated for the ward from governmental or private entities, such as allowances or rewards.
Public Benefit Committees: Committees licensed by local government authorities serving the public, such as Patients Friends Committees, persons with disabilities and the blinds, and awards for academic excellence.
Endowment (Waqf): An endowment registered by the General Authority for Awqaf, including public, private (family), and joint endowments as defined by the competent.
Article 2
These rules aim to define the requirements related to opening, maintaining, and managing electronic wallets, which must be adhered to by the company to protect participants in the sector and contribute to enhancing the safety and stability of the sector.
Article 3
These rules apply to the company when providing electronic wallet services in the Kingdom.
Article 4
The company must comply with the following when opening an electronic wallet:
(1) Review and classify the electronic wallet, and take the actions stipulated in these rules in accordance with the time periods specified for each. (2) Classify the company's customers and ensure that no customer holds electronic money or performs payment transactions exceeding the financial limits set by SAMA within the calendar month, in accordance with the provisions of the Implementing Regulations of Payments and Payment Services Law
(3) Retain copies of documents, records, files, and data related to all amounts and dues, according to the required statutory period.
(4) Maintain detailed records of all electronic wallets, which must include, at a minimum, the following data:
(a) The full name of the customer as recorded in the identification document.
(b) The customer's identification number.
(c) The customer's national address, place of residence, and approved contact information.
(d) Any other data related to the customer, if available or necessary.
(5) The company must maintain personal and financial data in electronic records in accordance with the technical specifications determined by SAMA, ensuring ease of access and compliance with the provisions of relevant regulations.
(6) The role of the Compliance Department at all stages and during the mentioned periods shall be supervisory to ensure compliance with the requirements of the Rules for Electronic Wallets.
Article 5
(1) The company must not overlook the professional aspects of the employee, refined through experience and training, which can assist in identifying and assessing the customer's risk level.
(2) The company must ensure that the national ID and/or residency and/or commercial registration and/or freelancer certificate is linked to only one electronic wallet.
(3) The company must verify that the ownership of the phone number registered in the electronic wallet belongs to the same user (i.e., matching name and customer data) through a trusted entity.
(4) The company must apply the verification controls for fintech customers issued by SAMA, as well as related instructions on combating financial fraud, including those related to electronic wallets.
(5) The company must use an automated monitoring system to detect and mitigate internal and external fraud operations, ensuring its comprehensiveness for financial and non-financial operations, and the system's ability to take immediate actions in the event of any financial fraud against the company.
(6) The company must periodically evaluate fraud prevention assumptions and establish measurement indicators to ensure their effectiveness, assess fraud risks, and implement necessary precautionary controls to mitigate them.
(7) The Compliance Department must have timely access to customer identification data, other due diligence information on customers, transaction records, and other relevant data.
Article 6
(1) Specific requirements for opening electronic wallets for individuals:
(a) Electronic wallets are opened for citizens based on the national ID card or the family record for minors, and the customer's national address or the national address of the guardian, custodian, or caretaker.
(b) Electronic wallets are opened for resident customers present in the Kingdom based on a copy of the residency ID document, their national address in the Kingdom or the national address of the guardian, custodian, or caretaker, and their address in their home country.
(2) Electronic wallets for minors are opened according to the following requirements::
(a) The electronic wallet must be created by the guardian, custodian, or caretaker, using the national ID or residency ID of the minor, and must not exceed one electronic wallet
(b) The validity of the relationship between the guardian, custodian, or caretaker and the minor must be verified, and a copy of the guardianship decree issued by the competent court for the custodian, or a guardianship decree if the guardian is not the father, or a copy of the custody decree for the caretaker must be provided and verified.
(c) This type of electronic wallet must not include the authority for cash withdrawal, transfers to anyone other than the guardian, custodian, or caretaker, receiving transfers from others, international transfers, or adding funds by any means unless the guardian, custodian, or caretaker approves adding such authorities.
(d) SAMA sets the provisions for funding the electronic wallet of the minor, the maximum monthly payment transaction limit, and the overall monetary value holding limits within the calendar month.
(e) Obtain the family record data where the minor is listed and the national ID data of the guardian, custodian, or caretaker, and verify their validity.
(f) If the minor reaches the age of 18 (Hijri calendar) and is incapacitated or equivalent, the company must obtain a copy of the legal document proving the minor's condition and a copy of the decree of continued guardianship for the guardian or the custodianship decree for the custodian.
Article 7
Electronic wallets are opened for legal entities and licensed individuals to practice a profession or activity based on an official document, as follows:
(1) Licensed institutions:
(a) A copy of the commercial registration of the institution or a copy of the activity license if required solely for the institution's activity without the need for a commercial registration.
(b) Identify and verify the identity of the institution's owners as per the name listed in the commercial registration or license, ensuring the validity of their identity and its data.
(c) Identify and verify copies of the identities of individuals authorized to manage and operate the electronic wallets.
(d) In case the institution's owner is an endowment (Waqf), the following must also be fulfilled in addition to the above requirements:
(a) A copy of the valid endowment (Waqf) registration certificate issued by the General Authority for Endowments, including at a minimum the following: Name of the endowment, Endowment deed number and date, Names of the trustees and their ID numbers.
(b) Copies of the IDs of the trustees listed in the registration certificate.
(2) Institutions engaged in e-commerce activities:
(a) The name of the electronic wallet must match the name recorded in the commercial registration, and the purpose of opening the electronic wallet must be specified as (e-commerce).
(b) Verify the electronic platform of the commercial institution through entities licensed by the Ministry of Commerce to certify electronic stores.
(c) Obtain the national address of the institution or its owner.
(3) Freelancer Certificate Holders:
(a) A copy of the freelancer certificate issued by the Ministry of Human Resources and Social Development.
(b) A copy of the national ID of the freelancer certificate holder.
(c) Obtain the national address of the freelancer certificate holder.
(d) The electronic wallet must not be shared or have authorized users.
(e) The validity of the electronic wallet is linked to the expiration date of the freelancer certificate.
(4) Resident Companies:
(a) A copy of the commercial registration.
(b) A copy of the articles of incorporation or the company's bylaws.
(c) A copy of the ID of the responsible manager.
(d) Identify and verify the identities of the board members, if any.
(e) A notarized power of attorney issued by a notary public or an authorized certifier from the person(s) who, under the articles of incorporation, bylaws, partners' resolution, or a board resolution, have the authority to delegate natural persons to sign and operate electronic wallets.
(f) Copies of the IDs of the individuals authorized to sign and operate electronic wallets.
(g) Identify and verify the identities of the company's owners listed in the articles of incorporation or bylaws, as per the latest amendments.
(h) If all or any of the company's owners are endowments (Waqf) as specified in the articles of incorporation or bylaws, the following requirements must also be fulfilled in addition to the above:
(a) A copy of the valid endowment (Waqf) registration certificate issued by the General Authority for Endowments, including at a minimum: Name of the endowment, Endowment deed number and date, Names of the trustees and their ID numbers. (b) Copies of the IDs of the trustees listed in the registration certificate for each endowment.
Article 8
(1) Electronic wallets are opened for committees, endowments (Waqf), and clubs as follows:
(a) Public Benefit Committees:
(1) A copy of the committee's license issued by the official authority according to its jurisdiction, such as the Ministry of Education, the regional Emirate, or others, when opening electronic wallets.
(2) Copies of the IDs of the council or trustees' members and the committee's bylaws.
(3) Approval from the Compliance Department Manager to open the electronic wallet.
(4) A joint signature by the committee's chairman or secretary and the financial officer for opening the electronic wallet.
(5) It is permissible to open an electronic wallet if the wallets are intended for public benefit activities, whether annual or seasonal, such as festivals, celebrations, or similar events, funded from sources outside the state budget, after obtaining the following:
(a) An official request from the official authority organizing the activity to open and manage the electronic wallet.
(b) A joint signature from the individual authorized to manage the activity and the financial officer, along with copies of their IDs.
(c) Copies of the IDs of the activity committee members.
(d) Specify a defined duration for using the electronic wallet, after which it must be closed once the purpose for which it was opened is fulfilled.
(e) Approval from the Compliance Department Manager to open the electronic wallet.
(6) This type of electronic wallet is not permitted to transfer funds outside the Kingdom.
(b) Endowments (Awqaf):
(a) Endowments overseen by the General Authority for Awqaf:
(1) A letter from the General Authority for Awqaf requesting the opening of the electronic wallet under the name "Revenues and Expenses," specifying the individuals authorized to manage the electronic wallet, with dual authorization powers, along with a statement of their financial powers or their delegation to others.
(2) Copies of the IDs of the individuals authorized to operate the electronic wallet.
(b) Endowments not overseen by the General Authority for Awqaf:
(1) A copy of the valid endowment registration certificate issued by the General Authority for Awqaf, including at a minimum, Name of the endowment, Endowment deed number and date, Names of the trustees and their ID numbers.
(2) A copy of the legal deed of the endowment.
(3) A letter from the authorized person, as per the endowment deed, specifying the individuals authorized to operate the electronic wallet.
(4) Copies of the IDs of the individuals authorized to operate the electronic wallet.
(5) Copies of the IDs of the trustees listed in the endowment registration certificate.
(6) Transfers from the endowment's electronic wallets to outside the Kingdom are not permitted, except for purposes related to managing the endowment's activities, such as consulting service payments, participation in external seminars and conferences, or similar purposes, provided that official approval is obtained from the General Authority for Awqaf.
(c) Clubs:
(a) Electronic wallets for clubs licensed by the Ministry of Sports are opened upon submission of the following documents:
(1) Approval from the Ministry of Finance to open the electronic wallet.
(2) A copy of the license issued by the Ministry of Sports.
(3) A copy of the board formation resolution.
(4) Authorization from the board of directors for the individuals authorized (joint signature) to open and manage the electronic wallet.
(5) Copies of the IDs of the authorized individuals and the board members.
(b) Electronic wallets for cultural and literary clubs under the supervision of the Ministry of Culture are opened upon submission of the following documents:
(1) Approval from the Ministry of Finance to open the electronic wallet.
(2) A copy of the license issued by the Ministry of Culture.
(3) A copy of the board formation resolution.
(4) Authorization from the board of directors for the individuals authorized (joint signature) to open and manage the electronic wallet.
(5) Copies of the IDs of the authorized individuals and the board members.
Article 9
The electronic wallet is closed by the authorized person, as follows:
(1) The customer may submit a request to the company if they wish to close their wallet, and the company must accept the customer 's request to close their wallet and notify them, provided that the electronic wallet is not frozen, restricted, or contains any remaining balance.
(2) The company must allow their Saudi customers and GCC citizens residing in Saudi Arabia to close their wallets without updating their information, provided that the electronic wallet is not frozen, restricted, or contains any remaining balance.
(3) The company must not allow a foreign resident in the Kingdom to close their wallet after the expiration of their residency permit or ID without providing a renewed copy or a final exit visa, provided that the electronic wallet is not frozen, restricted, or contains any remaining balance.
(4) The company may close the electronic wallet after thirty calendar days from notifying the client if a year has passed without any balance in the client's electronic wallet or any financial transactions, unless the wallet is frozen.
Article 10
(1) The data of electronic wallets is updated as follows:
(a) The company must request an update of the data under which the electronic wallets were opened at least once every three years from the date the electronic wallet was opened or upon any changes to it. The company must include this in its internal policies and procedures.
(b) The company must notify its customers of the impending expiration of the documents under which the electronic wallet was opened at least 90 calendar days before the expiration of those documents.
(c) The company must, 90 calendar days before a minor customer reaches 15 Hijri years of age, request the guardian, custodian, or caretaker to update the customer's wallet data, obtain the customer's information, and verify its accuracy.
(d) The company must, 90 calendar days before a minor customer reaches 18 Hijri years of age, notify the guardian, custodian, or caretaker of the need to update the customer's wallet data, complete and verify the customer's information, and sign a new wallet agreement with the customer upon reaching 18 Hijri years of age.
(2) Updating the customer's identity:
Identities and official documents are updated according to the durations, as follows:
(a) Identities and documents with a validity period of less than five years must be updated at the end of their specified validity period, such as commercial registrations or licenses.
(b) Identities and documents with a validity period of more than five years must be updated every five years or upon the expiration of the identity or official documents, whichever comes first.
(c) Electronic wallets opened based on approvals or official letters, such as wallets opened for embassies, international organizations or their representatives, or based on licenses and open-ended registrations like public benefit committees and endowments, must be updated no later than every five years.
(3) Remote identity data update:
(a) The company may update the identity data of its customers remotely at its discretion.
(b) The company must verify the validity of identity documents using documents, data, or information from a reliable and independent source and document this process.
(4) Updating customer data:
In addition to the requirements for updating the customer's identity outlined in Paragraph (2) of this Article, the company must update the customer data associated with the electronic wallet at least every three years. Customer data must also be updated in the following cases:
(a) When the customer's information becomes outdated, the specified period mentioned in Paragraph (2) of this Article elapses, or there is a change in the customer's information.
(b) When there is a change in the customer's behavior in conducting transactions on the electronic wallet.
(c) When the company undertakes due diligence measures related to money laundering and terrorism financing risks.
Article 11
(1) The company must comply with orders to disclose data of electronic wallets and execute actions on them (such as freezing and mandatory deductions) issued against customers, communicated through the central bank or via banks dealing with the company, based on requests from authorized entities in accordance with the law.
(2) Upon receiving a prohibition order issued by authorized entities, the company must prevent the customer from managing the electronic wallet, conducting debit transactions, and opening new electronic wallets. The prohibition should be limited to the customer's funds and personal status and should not extend to cases where the individual is a guardian, custodian, caretaker, agent, or authorized representative managing an electronic wallet not registered in their name.
(3) When implementing a freeze, the company must adhere to legal provisions related to the freezing of wages or salaries (ensuring that the freeze does not exceed one-third of the net wage or monthly salary of an employee, except in cases of alimony debts, and one-quarter of a retiree's pension, except in cases of alimony debts) while complying with any instructions related to amounts exempt from the freeze.
(4) Prohibition measures will be lifted upon receiving an order to remove the prohibition issued by authorized entities in accordance with the law.
(5) The company must take the necessary actions and measures and provide adequate human and technical resources to implement the provisions stated above.
(6) The company must verify the type and number of the customer's identity against which requests from authorized entities are issued and ensure they match the data registered in the company's systems.
(7) The company must maintain the confidentiality of data and information and not disclose, publish, or allow access to such data and information to any person for any reason, except when the request is made by the customer themselves or their legal representative after verifying its validity, without prejudice to the applicable laws and regulations.
Article 12
(۱) The company may accept a payment services order from a user under a one-time payment contract, taking into account the provisions of The Guidance of Anti Money Laundering and Combating Terrorist Financing
(2) When executing a payment services order under a one-time payment contract, the company must collect the identity information of the citizen or resident present in the Kingdom, or the passport and visa information (visit/tourism) or resident with a temporary residence permit and record its number.
Article 13
(1) An electronic wallet is considered inactive if it falls under one of the following categories:
(a) Dormant Electronic Wallet: An electronic wallet on which the customer has not performed any transaction for twelve calendar months (one year).
(b) Unclaimed Electronic Wallet: An electronic wallet on which the customer has not performed any transaction for twenty-four calendar months (two years).
(c) Abandoned Electronic Wallet: An electronic wallet on which the customer has not performed any transaction for sixty calendar months (five years).
(2) Inactive electronic wallets are managed as follows:
(a) Inactive electronic wallets are subject to the supervision of senior management to ensure dual oversight in accordance with policies established for this purpose.
(b) The company must contact the customer in accordance with the policy set by the company for this purpose.
(c) If electronic wallets become unclaimed, the funds in them must be transferred to a dedicated aggregate account for such wallets.
(d) Abandoned electronic wallets are placed under the supervision and oversight of the Chief Executive Officer and the Compliance Department.
Article 14
Without prejudice to the provisions of Article (11) of these rules, the company must consider the following when dealing with inactive electronic wallets:
(1) Continue calculating commissions and profits for electronic wallets as agreed upon in the framework agreement.
(2) Review and classify electronic wallets and take the actions specified in the related instructions.
(3) Submit an annual report to SAMA, including a list of inactive electronic wallets, with details of these wallets and any additional information requested by SAMA.
(4) Retain copies of documents and records for all amounts and entitlements according to the statutory period.
(5) Maintain detailed records of electronic wallets containing the necessary customer data as specified in these rules and related instructions.
(6) Retain personal and financial data in electronic records in accordance with the technical specifications determined by SAMA.
(7) The Compliance Department must have a supervisory role throughout all stages and periods mentioned to ensure compliance with electronic wallet instructions.
(8) Establish policies and procedures for handling inactive electronic wallets, including a communication mechanism with the owners of these wallets.
(9) Without prejudice to Clause (c) of Paragraph (2) of Article (13), the balance of the electronic wallet must remain as a financial obligation on the company’s financial position, and any action on the electronic wallet is prohibited.
(10) Verify the absence of debit obligations on the electronic wallet, and if present, they must be settled before transferring the wallet to the aggregate account.
Article 15
These rules shall come into effect 90 calendar days from the date of their publication on SAMA's website.
Safeguarding Safeguarded Funds
Based on the powers of the Saudi Central Bank under the Law of Payments and Payment Services issued by Royal Decree No. (M/26) dated 22/03/1443H, and its Implementing Regulations issued on 24/11/1444H and communicated through Circular No. (44093096) dated 16/12/1444H.
Therefore, SAMA emphasizes the importance for all payment service providers to comply with the provisions of the Implementing Regulations of Payments and Payment Services Law regarding the Safeguarding Safeguarded Funds, as stated in (Article 93) of the Implementing Regulations, with compliance to the following:
First: The submission of the non-objection request should be accompanied by the policies and controls related to the management and operation of the safeguarded funds account by payment service providers, Including the determination of powers and the authorized persons, ensuring that the following are taken into consideration:
- Enhancing the principle of multiple controls based on risk assessment, including activating the role of supervisory functions within the company.
- The authority to manage the account should be limited to senior positions that are authorized for this purpose.
Second: The payment service provider must perform and document a reconciliation process to verify that the total balances of electronic wallets or the total value of executed payment transactions match the total of the safeguarded funds account.
- Enhancing the principle of multiple controls based on risk assessment, including activating the role of supervisory functions within the company.
The Primary User of the Electronic Services Portal (E-services Portal, E-SAMA)
This section is currently available only in Arabic, please click here to read the Arabic version.