Chapter V: Internal Organization
No: 43083271 Date(g): 26/4/2022 | Date(h): 25/9/1443 Status: In-Force Article 23
The Company shall establish appropriate written organizational policies, approved by the board, that include work manuals and workflow procedures. Such policies must be kept up to date on a regular basis and must be communicated to the relevant staff in an appropriate and timely manner that allows them to comply with such policies. The organizational policies must include at least the following:
1. Organizational and operational structure, ways of exercising duties, identification of responsibilities, and authority matrix.
2. Credit granting, operational processes, and purchase of loan portfolios.
3. Policy for acceptance of real estate financiers.
4. Treasury operations, including debt management operations.
5. Balance sheet management processes, including policies for management of balance sheet size.
6. Collateral management.
7. Business continuity and disaster recovery.
8. Information systems risk management.
9. Information technology systems protocols for each functional system, data processing protocols, and data privacy and security.
10. Document retention management.
11. Loan portfolio servicing management.
12. Term cost risk management.
13. Capital management.
14. Investment portfolio management.
15. Securitization and sukuk management program.
16. Liquidity management.
17. Financial management and accounting.
18. Risk management, assessment, treatment, control and disclosure.
19. Internal audit.
20. Compliance with relevant laws, regulations and instructions.
21. Outsourcing.
22. Salaries, bonuses and incentives, including the salaries and incentives of the members of senior management and staff and the incentives of the members of board and its committees.
Article 24
The Company shall not combine an executive function with a supervisory function. Functions must be separated in order to ensure the application of the recognized procedures, policies and technical standards to protect the Company’s assets and funds and prevent fraud and embezzlement.
Article 25
1. The technological equipment and its relevant systems in the Company must be sufficient and consistent with the Company’s operational needs, nature of activity, and risk profile according to the generally accepted technical standards.
2. Information technology systems and their processes shall be designed in a manner that ensures data availability, integration, integrity, and confidentiality. Such systems and processes shall be assessed by the Company on a regular basis in accordance with the generally accepted technical standards. They shall also be tested before they are used for the first time and after any changes are applied to them.
3. The Company shall establish a business continuity plan for emergencies that includes alternative solutions to restore its operations in a timely manner.
Article 26
The Company shall have sufficient and qualified human resources in terms of knowledge and expertise consistent with the Company’s operational needs, business activities, and risk profile. Bonuses and incentives of staff shall be fair and in line with the Company’s risk management strategy, and shall not create a conflict of interest.
Article 27
1. At least 50% of all employees must be Saudi nationals when the Company starts operations. The percentage applies to all departments and organizational levels.
2. The percentage of Saudi nationals of total human resources shall be annually increased by 5% of all employees until it reaches 75%. Furthermore, SAMA may determine the minimum annual increase required thereafter.
3. Recruitment of non-Saudis in the Company shall be limited to positions that require expertise not available in the Saudi labor market.
4. Priority for appointment to senior positions shall be given to Saudi candidates. If the Company nominates a non-Saudi candidate to be appointed or interim appointed to a senior position, the Company shall provide justifications for the nomination, demonstrate the non availability of a qualified Saudi candidate for the position, develop and include an approved plan for replacement in the written no-objection request submitted to SAMA. The plan shall include the procedures, programs and courses the Company uses and conducts to train and qualify Saudi candidates for such positions as well as the time period required.
2173