A Licensee must notify SAMA as soon as possible, and within ten calendar days in any event, if it becomes aware that any of the following events have occurred or are likely to occur:
(a)
Any event that prevents access to or disrupts the operations of one or more of its Relevant Payment Services offered by it or Payment Systems operated by it;
(b)
Any breach of its obligations under the Implementing Regulation or other applicable laws, regulations and decisions;
(c)
Any legal proceeding against it or any criminal proceeding against any member of its Senior Positions, either in the Kingdom or outside;
(d)
The commencement of any bankruptcy, winding up or other liquidation proceedings, or the appointment of any receiver, administrator or provisional liquidator under the law of any country;
(e)
Any disciplinary measure or sanction taken against it or imposed on it by a regulatory body other than SAMA, whether in the Kingdom or outside;
(f)
Any change in supervisory or regulatory requirements to which it is subject beyond those of SAMA, whether in the Kingdom or outside;
(g)
Fraud; and
(h)
Any other event specified by SAMA.
Unless any other applicable laws, regulations or rules specify a shorter timeframe, in which case the notification must be made within that shorter timeframe.
(2)
Notwithstanding the specific notification obligations set out in Paragraph (1) of this Article, a Licensee must notify SAMA immediately upon identification of any ‘Medium’ or higher classified cyber incident or any operational incident that may affect Clients in compliance with related instructions.
