Skip to main content
Custom print
Download Original PDF

Article 28

Date(g): 13/6/2023 | Date(h): 24/11/1444 Status: In-Force

Translated Document

Effective from Jun 13 2023 - Jun 12 2023
To view other versions open the versions tab on the right

 1.The licensee shall establish policies, procedures, controls, and laws for the management of risks, compliance and business continuity, so that they are comprehensive and proportionate to the nature, volume and complexity of the activities and services provided thereby. Policies, procedures, laws and controls shall also take into account the types of activities of the licensee, the nature, volume and complexity of its business, the difficulties and levels of risks associated with operational processes.
 2.The licensee shall ensure that the policies, procedures, laws and controls for risk management, compliance and business continuity are updated and reviewed at least once a year and shall submit a copy to SAMA when any fundamental amendments are made. SAMA may request that additional information be provided thereto or that any necessary changes be made.
 3.

The licensee’s risk management and compliance systems and controls shall include the following matters:

 

A.The procedures necessary to identify, manage, monitor and report any risks to which the licensee may be exposed.
B.Necessary internal control mechanisms that include administrative procedures, risk management and appropriate accounting procedures.
C.Appropriate mechanisms to verify compliance with all relevant requirements under the Law and Regulations, and all relevant laws, regulations, decisions, instructions and circulars.
D.Fraud detection policies and procedures and measures for dealing with fraud cases.
E.Policies and procedures for notifying SAMA and relevant authorities of fraudulent incidents.
 4.

Taking into account Paragraph [3] hereinabove, the licensee’s risk management and compliance policies and controls shall include the following measures:

A.Establish a risk management function, an internal audit and audit function and a compliance function, while providing the officers responsible for the same with independence and sufficient resources to perform their duties.
B.Establish an integrated control framework between the functions of internal audit, risk management, compliance and the external auditor.