Book traversal links for Rules for Regulating Buy-Now-Pay-Later (BNPL) Companies
Rules for Regulating Buy-Now-Pay-Later (BNPL) Companies
No: 450360390000 Date(g): 17/12/2023 | Date(h): 5/6/1445 Status: In-Force The Saudi Central Bank (SAMA) issued these Rules based on the powers vested in SAMA under the Finance Companies Control Law issued by Royal Decree No. M/51 dated 13/08/1433H.
Chapter I. Definitions and General Provisions
Article 1: Definitions
1- The terms and phrases mentioned in these Rules shall have the same meanings stated in the Finance Companies Control Law.
2- The following terms and phrases, wherever mentioned in this document, shall have the meanings assigned to them unless the context otherwise requires:
SAMA: The Saudi Central Bank.
Law: Finance Companies Control Law.
Rules: The Rules Governing BNPL Companies.
BNPL Activity: A type of financing that allows a consumer to purchase goods or services without a term cost payable by the consumer.
BNPL Company: A joint stock company licensed by SAMA to engage in BNPL activity.
Consumer: Beneficiary of the activity
Stores: Sales outlets and places where goods and services are provided.
Article 2: Scope of Application
These Rules apply to companies licensed by SAMA to engage in BNPL activity.
Article 3 :General Provisions
1. These Rules aim to: a. Establish licensing procedures and requirements for BNPL activity. b. Set the minimum standards and procedures necessary for carrying out BNPL activity. 2. BNPL activity shall not be carried out except after obtaining a license from SAMA in accordance with the provisions of the Law, the requirements set forth in these Rules, and any instructions issued by SAMA in this regard from time to time. 3. These Rules shall not prejudice the provisions of relevant regulations, including, but not limited to: a. The Finance Companies Control Law issued by Royal Decree No. M/51 dated 13/08/1433H. b. The Requirements for Appointments to Senior Positions in Financial Institutions Supervised by SAMA. c. The Cyber Security Framework issued by SAMA. d. The Business Continuity Management Framework issued by SAMA. e. The Financial Consumer Protection Principles and Rules issued by SAMA. f. Debt Collection Regulations and Procedures for Individual Customers issued by SAMA. Chapter II. Licensing Provisions
Article 4: License Requests
The license application for engaging in BNPL activity shall be submitted to SAMA along with the following items:
1. A completed license application in the form provided by SAMA. 2. A copy of the commercial register, memorandum of association, and articles of incorporation (if any). 3. A list of the founding members or shareholders of the company, including the number and percentage of shares of each member or shareholder in the company. 4. The Fit and Proper Form for founding members or shareholders, signed by each founding member or shareholder. 5. The Fit and Proper Form for Board members, signed by each candidate for Board membership. 6. Information about the BNPL company's owners and organizational structure, including all key departments and functions and their main tasks. 7. The feasibility study and business plan. 8. An irrevocable bank guarantee for an amount equivalent to the minimum capital, issued in favor of SAMA by a bank licensed to operate in Saudi Arabia and renewed automatically until the capital is paid in full, if the license application is submitted for a BNPL company under establishment. Such guarantee shall be released upon the request of the license applicant in any of the following cases: a. If the capital is paid in cash. b. If the license request is withdrawn. c. If the license request is rejected. 9. Any other documents or information required by SAMA. Article 5: Capital
Pursuant to the provisions of the Companies Law, the minimum capital for the BNPL company shall be SAR 5,000,000 (five million Saudi riyals), subject to increase or decrease by SAMA as it deems appropriate.
Article 6: Management Requirements
- All candidates for supervisory and executive positions in a BNPL company shall:
- Meet the professional eligibility requirements set by SAMA.
- Be permanent residents of the Kingdom of Saudi Arabia.
- Be theoretically and practically qualified and have sufficient experience in the field.
- Meet any other requirements set by SAMA.
Article 7: Licensing Procedures
- The applicant shall provide SAMA with any additional information or documents required by SAMA within 30 working days from the request date.
- In case of failure to meet the period requirement specified in paragraph (1) of this Article, SAMA may reject the license application.
- SAMA issues a written notice to the applicant after the completion of all the requirements set forth in the relevant rules and regulations.
- SAMA informs the applicant of the initial approval or justified rejection in writing within 60 working days from the date the applicant receives notification of application completeness. Such initial approval does not constitute a license or permit to carry out the activity.
Article 8: Requirements for BNPL Company Incorporation and Business Activity Registration
- If a company is under establishment, the founding members shall satisfy the requirements necessary to engage in BNPL activity within six months from the date of initial approval, and provide SAMA with a copy of the commercial of failure to meet the requirements set out in this paragraph within the specified period, the approval shall be deemed expired. In addition, SAMA may extend the period for a maximum of another six months before the initial approval period expires.
- In case of an existing company, it shall provide SAMA with a copy of the commercial register containing its BNPL activity within six months from the date of initial approval. In case of failure to meet the requirements set out in this paragraph within the specified period, the approval shall be deemed expired. Moreover, SAMA may extend the period for a maximum of another six months before the initial approval period expires.
Article 9: License
- SAMA takes any necessary actions to verify that the BNPL company meets all SAMA’s requirements. Such actions include making licensing visits; meeting the company’s executives; and reviewing the company’s systems, procedures and records.
- SAMA issues a decision granting the applicant a license to engage in the activity after fulfilling all requirements and completing all procedures.
- The BNPL company shall not engage in any activity other than the activity for which the license has been issued unless it obtains a prior written non-objection from SAMA.
Article 10: License Term
The license shall be valid for five years and may be renewed by SAMA upon the BNPL company’s request. Such request must be submitted in writing, using the form designated by SAMA, at least three months before the expiry date of the license.
Article 11: Revocation of License
SAMA revokes the license upon the BNPL company’s request, taking into the account the rights of creditors and consumers as well as the soundness of the financial system.
Article 12: License Fees
SAMA charges fees as follows:
- SAR 5,000 (five thousand Saudi riyals) for license issuance.
- SAR 2,000 (two thousand Saudi riyals) for license renewal or amendment.
Chapter III: Internal Organization
Article 13: Internal Policies and Procedures
The BNPL company shall:
- Develop appropriate written organizational policies that address, at least, the internal organization guides, governance, stores acceptance and approval procedures, purchase approval and cancellation, credit, risk management, compliance, information confidentiality and security, consumer data protection, outsourcing, human resources, and anti-money laundering and counter-terrorist financing (AML/CTF).
- Ensure that technological and security equipment in place and related systems are adequate for its operational needs, nature of activity and risk status, in accordance with best practices and SAMA-issued instructions in this regard.
- Design information technology systems and their processes in a manner that ensures data availability, integration, integrity, and confidentiality. Such systems and processes shall be assessed by the BNPL company on a periodic basis in accordance with the generally accepted technical standards. They shall also be tested before they are used for the first time and after any changes applied to them.
- Retain all consumer documents, records and files in an orderly, clear and safe manner and ensure that all files are complete and updated periodically, for a period of at least 10 years from the date of the end of the relationship with the consumer.
- Have sufficient and qualified human resources in terms of knowledge and expertise to meet its operational needs and risk status.
Article 14: Requirements for Information Security and Combating Financial Crimes
- The BNPL company shall comply with the information security requirements set by SAMA and the relevant laws, regulations and instructions issued by SAMA.
The BNPL company shall comply with the legal requirements contained in the AML/CTF Laws, their Implementing Regulations, and the relevant rules and guidelines as specified by SAMA, in a manner that is consistent with the nature of the company’s activity and its size and the risks it may be exposed to. In addition, the company shall comply with the requirements and instructions issued by SAMA on financial crimes.
Article 16: Auditor
- The BNPL company shall appoint one or more certified external auditors, with the condition of obtaining a non-objection letter from SAMA. However, SAMA may appoint another auditor at the company’s expense where the size and nature of its business require so.
- SAMA may require external auditors to explain their report or disclose other facts of which they obtain knowledge during the audit process that could indicate a violation of the applicable laws, regulations or instructions or a violation of the BNPLby-laws.
Article 15: Outsourcing
The BNPL company shall comply with the Rules on Outsourcing for Finance Companies issued by SAMA.
Article 17: Consumer Protection and Data Confidentiality
- The BNPL company shall establish a function for handling complaints and set clear procedures for receiving, documenting, reviewing, and responding to complaints within the period set by SAMA. Such complaints must be kept in records that include all necessary details in relation to the complaint and the procedures taken.
- The BNPL company, including all of its employees, shall maintain the confidentiality of consumers’ data and transactions and shall not disclose them to other parties even after the end of service for employees or revocation of license, except in accordance with the relevant laws and instructions.
Article 18: Saudization of Human Resources
- At least 50% of human resources employees must be Saudi nationals when the BNPL company starts operations. The percentage applies to all departments and organizational levels.
- The percentage must be increased annually by 5% at least until it reaches 75%. Furthermore, SAMA determines the minimum annual increase required for Saudization.
- Recruitment of non-Saudis in the BNPL company shall be limited to positions that require expertise not available in the Saudi labor market. In all cases, the company shall obtain a non-objection letter from SAMA before appointing any non-Saudi employee in control departments, provided that the company shall prove that there are no Saudi nationals available to fill the position.
Chapter IV: Activity Provisions
Article 19: Company Obligations
The BNPL company shall:
- Comply with the Responsible Lending Principles for Retail Consumers issued by SAMA.
- Verify and document the credit record of the consumer, with their consent, to confirm their solvency, repayment capacity and credit conduct.
- Register the consumer’s credit information, with their consent, at one or more
- of the companies licensed to collect credit information according to the relevant laws, regulations and instructions. Such information must be updated throughout the period of dealing with the consumer.
- Set appropriate approvals and acknowledgments and allow consumers to read and agree to them before dealing with them, provided that such approvals and acknowledgments are shown as a pop-up window.
- Adopt a clear, transparent and documented scientific method, criteria and procedures to evaluate the creditworthiness of the consumer and their repayment capacity, in accordance with best practices in this field.
- Identify the consumer, verify their identity through a reliable and independent source, and document this in accordance with the regulations and instructions issued by SAMA.
- Obligate contracted stores not pass or charge any additional fees to the consumer. The company shall also monitor the compliance, and provide them periodically with the required guidelines.
- Maintain provisions for potential losses, defaults and risks in line with the International Accounting Standards and relevant SAMA-issued guidelines.
Article 20: Activity Limits
The BNPL company shall not:
- Charge fees on the consumer, including fees owed to the company, contracted stores, or a third party. This excludes any delay penalties or debt collection fees imposed in accordance with the Debt Collection Regulations and Procedures for Individual Customers.
- Launch any new products without obtaining prior written non-objection from SAMA.
- Transact with a consumer under the age of (18) Hijri years.
- Transact with a foreign consumer who is not a resident of Saudi Arabia, except after obtaining a written non-objection from SAMA.
- Purchase goods or services in a currency other than the Saudi riyal, except after obtaining a written non-objection from SAMA.
Article 21: Consumer Due Diligence (CDD)
1. The BNPL company shall develop a CDD program and comply with the AML/CTF regulations and instructions. The CDD program must include policies and procedures for the following, as a minimum: a. Know Your Customer (KYC). b. Information security. c. Data privacy and confidentiality. 2. The company shall comply with the Electronic Transactions Law and its Implementing Regulations and establish the necessary procedures and measures to ensure that the information provided is correct and up-to-date, including, at a minimum: a. verification of consumers’ phone numbers through authentication tokens. b. Verification of consumers’ national addresses are correct. Article 22: Credit Limits
- Without prejudice to the deductible ratios specified in the Responsible Lending Principles for Retail Consumers, the total outstanding financing for each consumer natural person must not exceed an amount of SAR 5,000 (five thousand Saudi riyals), subject to increase or decrease by SAMA as it deems appropriate.
- The number of installments granted to the consumer must not exceed a maximum of 12 installments.
- Collection methods must be applied through electronic channels. Cash request is prohibited.
- The total outstanding finance made through the company must not exceed 20 times the capital and reserves, except after obtaining a non-objection letter from SAMA. Additionally, SAMA may raise or lower the maximum limit of the total financing to the extent it deems appropriate.
- The company shall not obtain financial facilities from non-licensed financiers, except after obtaining a non-objection letter from SAMA.
Article 23: Advertisement Requirements
1. Subject to the Rules for Advertising Products and Services Provided by Financial Institutions issued by SAMA, the BNPL company shall ensure to: a. Include the company’s name, logo, any unique slogans, and contact information in their advertisements. b. Avoid publishing advertisements that contain a false offer, statement or claim or those that are expressed in a way that could directly or indirectly lead to deceiving or misleading the consumer. c. Avoid publishing excessively persuasive advertising that encourages taking on credit for unnecessary consumption purposes instead of actual needs. 2. SAMA obliges the company that fails to comply with the clauses stipulated in paragraph 1 of this Article to withdraw the advertisement within one business of SAMA’s notice. Article 24: Conflict of Interest
The BNPL company shall develop an appropriate written organizational policy that addresses potential conflicts of interest. Such policy must include adequate measures put in place to avoid and address any conflict of interest, ensuring fair treatment of all consumers and stores.
Article 25: Disclosure
The BNPL company, through the means by which it carries out its activities, shall ensure, as a minimum, to:
- Clarify and disclose all terms and conditions, security instructions, payment methods, information confidentiality and any other statements that must be disclosed according to relevant laws and instructions.
- License Disclosure Instructions issued by SAMA.
Article 26: Finance (Terms and Conditions) Contract Requirements
The BNPL company shall draw up a finance (terms and conditions) contract with the consumer before any dealings, provided that it is presented clearly, easy to understand, and not misleading. The contract shall also be consistent with the relevant regulatory requirements and contain, as a minimum:
- The information of the company and consumer (parties).
- Finance term.
- Type of goods or services, including their specifications and requirements (if any).
- Involved parties’ rights and obligations
- The amount, number and term of installments payable by the consumer, and the company’s commitment to notify the consumer of the monthly installment due date in advance.
- Consequences of a delayed payment of installments.
- Purchase order cancellation method, and refund procedures, conditions and process time.
- Procedures for early payment and for compensating the company (when necessary) and how to determine such compensation.
- Procedures for dealing with defaulting consumers.
- Consumer’s permission to enter their information in the credit record.
- Dispute resolution mechanism.
- Any other data or information required by SAMA.
Article 27: Contract Requirements Between the Company and Stores
A contract must be drawn up in paper or electronic form between the company and stores in accordance with the relevant legal requirements. Each party shall receive a copy of the contract that must clarify, at least, the following:
- Contract parties and their information.
- Contract term, provided that the contract term is consistent with the validity of relevant permits or licenses of both parties.
- Contract parties’ rights and obligations.
- Pricing structure.
- Withdrawal procedures and conditions.
- Information confidentiality, privacy and security.
- Customer protection provisions.
- Compliance of the parties with the provisions of relevant laws, regulations, rules, guidelines and instructions.
- Provisions of contract renewal and renegotiation.
- Contract termination and expiration.
- Reporting and escalation procedures and dispute resolution mechanism.
- Any other data or information required by SAMA.
Chapter V: Supervision and Compliance
Article 28: SAMA Supervision
1. The BNPL company shall: a. Provide SAMA with any required reports, data and information in accordance with the forms, guidelines, and times determined by SAMA. b. Adopt the International Accounting Standards in preparing its accounts and financial statements. c. Provide SAMA, upon its request, with all information and documents related to the company, its activities, partners and employees. d. Report to SAMA immediately paid-up capital. e. Develop a recruitment plan for vacant positions. f. Enable SAMA’s specialized staff and appointed auditors to access relevant facilities, documents and data (including digital data) upon request. 2. The company and its staff shall not conceal or attempt to conceal any information or irregularities or refrain from answering any inquiries made by SAMA. 3. The company shall obtain SAMA’s written non-objection before disposal of financing assets or rights arising therefrom. 4. SAMA takes necessary actions to ensure the compliance of the company with relevant laws, regulations, rules and instructions. Such actions may include making supervisory or inspection visits to the company’s head office, meeting its staff and reviewing its systems, procedures and records. The company shall adhere to the recommendations and instructions directed by SAMA to address the observations made during visits. 5. The company shall bear any expenses that may arise from SAMA’s appointment of a third party to implement any of the procedures undertaken in line with the provisions of this Article. Article 29: Compliance
- The BNPL company shall establish internal controls and procedures to ensure compliance with the provisions of the Law and these Rules and relevant laws, regulations and rules.
- The company shall retain sufficient records to confirm compliance with the provisions of the Law and these Rules and relevant laws, regulations and instructions and shall take the necessary procedures to prevent any violation of their provisions.
- The company shall not disclose any information to third parties, unless it obtains non-objection and such disclosure does not violate the provisions of relevant laws.
- The company shall obtain a non-objection letter from SAMA before undergoing partial or complete liquidation.
Chapter VI: Concluding Provisions
Article 30: Non-Compliance
Non-compliance with these Rules shall be deemed a violation of the Law.
Article 31: Enforcement
The Rules shall come into force 30 days after the date of its publication on SAMA’s official website.