The concept of independence includes four interrelated elements that must be applied as follows:

1. Element One: The Compliance Unit Must Have an Official Status in the Bank.
   
   Element Two: In local banks, the compliance unit should be headed by an executive at the first managerial level. In branches of foreign banks, the unit should be led by a senior executive at the first managerial level who reports directly to the head of the branch. This position should include the overall responsibility for coordinating the management of compliance risks within the bank.
    
2. Element Three: The personnel of the compliance unit, particularly the head of compliance, should not be placed in a position that could lead to potential conflicts of interest between their compliance responsibilities and any other responsibilities associated with their role.
    
3. Element Four: All personnel within the compliance unit should have the right and authority to access and review all relevant information, records, and files, and communicate with bank employees as necessary to perform their duties.
    

The organizational document for the Compliance Unit, related to the compliance policy, must include at a minimum the following requirements:

1. ‎ The role and responsibilities of the Compliance Unit.  
    
2. Procedures necessary to ensure the independency of the Compliance Unit.
    
3. The relationship of the Compliance Unit with other risk units within the bank, and its relationship with the internal audit unit.
    
4. The method for distributing compliance responsibilities in exceptional cases where, due to technical or specialized reasons, or where there is not a significant relationship with non-compliance risks, some compliance responsibilities may be assigned to employees in other operational units such as human resources, administrative affairs, branches, etc., and must be according to specific procedures outlining the role and authority of those units and designated officials.
    
5. The Compliance Unit has the right to access the necessary information, records, and data to perform its responsibilities, and the requirement for bank employees to cooperate in providing this information.
    
6. The Compliance Unit has the right to conduct necessary investigations by itself or through delegated external experts for potential policy violations or shortcomings in compliance policy implementation, and its authority to appoint or request external experts if needed.
    
7. The Compliance Unit has the right to freely report investigation results to senior management and, when necessary, to the board or its authorized committee.
    
8. The official obligations of the Compliance Unit regarding reporting to senior management.
    
9. The Compliance Unit has the right to direct access to the board or its authorized committee.

The Chief Compliance Officer should have the authority to hold regular meetings with senior management and heads of different business units to discuss compliance with regulations and instructions relevant to the operations and activities of each group, department, or sector. These meetings should be officially documented. It is preferable that senior management and heads of business units attend these meetings personally rather than sending representatives, as their active participation demonstrates:

• Leadership by example.
   
• Understanding of their responsibilities regarding compliance.
   
• Continuous reinforcement of compliance.
   
• Support for the compliance process.
   

To effectively manage compliance responsibilities as outlined in the compliance documentation and at all administrative levels within the bank where non-compliance risks may exist, the Compliance Unit must have the following principal rights and capabilities, without waiting for orders or instructions:

1. The right to communicate with any employee and access any necessary information, records, and files needed to fulfill its responsibilities.
    
2. The ability to carry out its responsibilities independently across all business units where non-compliance risks are present, including the right to investigate any potential violations of compliance policies and to seek assistance from internal specialists (e.g., legal affairs or internal audit) or engage external experts if necessary.
    
3. The freedom to report any potential violations or transgressions uncovered during its investigations to senior management, without fear of retaliation or dissatisfaction from business units or other employees.
    
4. Although the Compliance Unit should report administratively to the CEO/Managing Director/General Manager, it must also have the right to communicate directly with the board or its delegated committee, bypassing usual administrative reporting lines if necessary.
    
5. The Chief Compliance Officer should meet with the board or its delegated committee at least once a year to help assess the board's evaluation of the bank's ability to manage non-compliance risks effectively.
    
6. The Chief Compliance Officer must promptly and directly notify SAMA/General Directorate of Bank Supervision upon identifying strong indicators of significant or serious compliance failures or violations that impact the reputation of the banking sector and must ensure that SAMA is informed.