KYC.IO

Global Regulations and Requirements for KYC Onboarding
(powered by KYC-Chain)

KYC to onboard domestic persons

personal status cardnational identity cardfamily registration bookcertified family recorddiplomatic passportspecial passportbirth certificate

KYC to onboard international persons

personal status cardnational identity cardfamily registration bookcertified family recorddiplomatic passportspecial passportbirth certificate

corporate requirements

Residence BookFive Year Resident Bookpassport Diplomatic Card

National ID card name

Bitaqat Al-Hawia Al-Wataniya بطاقة الهوية الوطني

National ID Photo

back of national id photo back

Does the country have Esignature Laws?

Electronic Transactions Protection Law

E-sig law files

text.jsp

What year did the relevant AML laws and regulations become effective?

2003

Further details on AML regime

Saudi Arabia passed the Anti-Money Laundering Law and Supplementary Guidance, under Royal Decree referenced M/39 dated 25/6/1424H corresponding to (24 Aug 2003) ratifying the Council of Ministers Decision #167 dated 20/6/1424H (corresponding to 19 Aug 2003). This Law provides a statutory basis for criminalising money laundering and terrorist financing activities.

Who is the regulator for AML controls for Banking

Saudi Arabia Monetary Agency (SAMA):

Link to site

http://www.sama.gov.sa/en-us/pages/default.aspx

Other financial Services

Capital Market Authority (CMA):

Website of Regulator

http://www.cma.org.sa/en/Pages/home.aspx

Financial Sector regulator

N/A

Practical Guidance for AML

Saudi Arabia Monetary Agency (SAMA); a) for all banks, money exchangersc) for insurance companies:b) for financing companies and branches of foreign banks operating in the Kingdom of Saudi Arabia:

Practical guidance PDF's

Is there a requirement to verify the identity of customers retroactively?

Yes

Retroactive details

Yes The AML Law was ratified in 2003. It requires subject entities to update their customers’ profiles at least once every five years

Has the country been the subject of FATF mutal evaluation in the last 3 years?

No, the latest FATF review was conducted in 2010:

PDF of FATF review

Are there minimum transaction thresholds (Y/N)

More details on minimum transaction thresholds.

What are the requirements for customer identification information for individuals

Originals of either Personal Status Card; National Identity Card; Family Registration Book; Certified Family Record; Diplomatic passport; Special Passport; Hafithat Nofos; Certified Civil Record for Women; Certificate of Birth

Details to be Collected on Corporates

Residence Book (Iqama); Five Year Resident Book; GCC Passport or Diplomatic Card

What are the high level requirements around beneficial ownership (identification and verification)?

Legal entities should verify the beneficiaries owner of all accounts and relationships and should conduct due diligence on all final beneficial owners. Legal persons should establish the identity of all shareholders or beneficial owner who own 5% and more of the company's shares.

What circumstances are enhanced customer due diligence measures required?

Simplified due diligence procedures are allowed for customers that are not considered high risk.

How should FI's deal with Politically exposed persons

No specific guidance is provided however all PEPs are to be considered high risk and subject to enhanced due diligence measures. Opening an account for a PEP requires an approval of a general manager, managing director, or CEO.

What enhanced due diligence must be performed for correspondent banking relationships?

a) banks should not open a correspondent account for or deal with a shell bank; b) correspondent bank accounts shall not be opened before the approval of the compliance officer in addition to that of the chief executive officer/director; c) banks should immediately inform SAMA of opening correspondent bank account in Saudi Riyal; d) third parties are prohibited from operating correspondent bank accounts; e) local cash deposits should not be allowed. This arrangement, known as "Payable-Through Accounts" should not be accepted; f) the correspondent bank should not be under sanctions by the UN or Saudi Arabia; g) banks should also determine from any available information (e.g., the internet) whether the correspondent bank has been subject to any money laundering, terrorist financing investigations or regulatory action; h) banks should obtain certification of AML/CTF compliance for all correspondent relationships, which should include the following information: a. the location, major business activities, and management; b. that they are under jurisdiction of their central bank or a similar monitory authority and are committed to the FATF recommendations; c. that they are governed by and committed to AML/CTF and KYC policies and procedures; d. that they have procedures in place for reporting suspicious transactions; e. that they are not dealing with any shell bank; f. any other pertinent information that can reassure the bank that sufficient focus is being directed to combating money laundering and terrorist financing; and g. the certification should be either renewed or confirmed by the correspondent bank every three years; and i) banks and money exchangers should apply satisfactory due diligence on a continuous basis regarding the banking correspondence relationships, document the responsibilities of AML/CTF, which are the correspondent and receiving banks responsibilities and apply due diligence regarding all banking correspondence relationships, including correspondence relationships that already exist.

Are relationships with banks who might be considered a 'shell' and without substance permitted?

Yes

In what circumstances is additional due diligence required for non face-to-face transactions and/or relationships?

It is forbidden to open accounts or establish relationships for other than face-to-face customers. All account holders are subject to interview and identity verification.

To whom are SAR's made? (suspicious activity reports)

Financial Intelligence Unit – Ministry of Interior:

Link to website of SAR reporting

: https://www.moi.gov.sa/wps/portal/Home/sectors/safiu/contents/!ut/p/z1/tZLPT8IwHMX_FS4eSb9bu607VoLrhIDTDFkvpPsB1rAyWAX9790WPXhgSKK9Nf28l76XhwRaIqHlUW2kUTstt809Ee4KQkK4RexJ4M S3wKJosvDtsQWWh547wI-CEectYDEXWOjZcwgdKwhtJH6jHwWME28KQKeBAyHj8aMfYQwM9-rHLloggUSmTWVeULJWWupMye1A6WNRm68cN3D24VBUu4NRejOo3- qqyEyRD8xB6lpmLVC37lWmcpRgnFNcUCA5SVNsgyS-u3bSIvcySbFLO7Itajwzv_4O3FPJV3iM4dBoxcd0tfZJQ_xs1Zg9A4YwwvOvcieUwslvSm4i56uaOaCGf5DM59cZXZ_aZ7N_tXrfi9YM7KdNsW7Qct_WFlVxnFJcTlcgnooy9VsNpQp_Th9Alhvgzw!/dz/d5/L2dBISEvZ0FBIS9nQSEh/

Other Suspicious or unusual transactions obligations.

Are there any de-minimis thresholds below which transactions do not need to be reported?

No thresholds are set.

Are there any penalties for non compliance with reporting requirements e.g. tipping off?

Yes, though not specified.

Are there any requirements (legal or regulatory) to use automated Suspicious Transaction monitoring technology?

Yes. The Law mentions that the appropriateness and sophistication of the automated monitoring system will depend on the relevance of the parameters to the nature of business undertaken by each bank or money exchanger.

Is there a requirement to obtain authority to proceed with a current/ongoing transaction that is identified as suspicious?

Yes

Does the local legislation allow transactions to be monitored outside the jurisdiction?

No specific guidance is mentioned in the Law.

Is there a legal requirement for a bank’s external auditor/other external organisation to report on the bank’s AML systems and controls?

External auditors do not report on AML systems and controls. However, SAMA performs regular reviews and solicits external assistance. Subject entities are not required to engage independent parties to report on their AML compliance.

If an external report on the bank’s AML systems and controls is required: a) how frequently must the report be provided?

N/A

To whom should the report on AML systems be submitted?

N/A

Is an AML system part of the financial statement audit?

What are the requirements for the content of this external report on a bank’s AML systems and controls? Does it require: a) sample testing of KYC files? b) sample testing of SAR reports? c) examination of risk assessments?

Data Protection Laws And Personal Data

Data Protection for Corporate Data

Data protection for "sensitive Data" and additional protections.

Do any restrictions on the transfer of credit reports exist?

Regulator Acronym

SAMA, CMA

Year of last FATF mutual evaluation

2012

Field 67

identification&verification

National ID card details

Issued at 15 for males, compulsory at 17. Non-compulsory for females but issued at 18.

Compulsory?

National ID source

http://www.storagenewsletter.com/rubriques/business-others/lasercard-orders-saudi-arabia-id-card/

Passport Photo

practical Guidance yes / no

Is there a risk based approach

Legal Requirement

Requirement to proceed

Yes

requirement to use automated suspicious transaction tools

Yes

Who are SARS made to?

FIU-MI

shell banks

Yes

EDD for correspondent banking

Yes

If the AML laws and/or regulations became effective in the last 2 years, what were the requirements of the previous AML regime?

N/A

Non financial sector (e.g. casinos, high value goods etc.)

N/A

Does the country have a risk based approach?

Yes, related guidance is provided in the AML law and supplementary guidance

Where copies of identification documentation are provided, what are the requirements around independent verification or authentication?

Copies of Commercial registration; entity's license; Articles of Association and appendices ID of the owner of the licensed business; List of the owners of the business entity; List of persons authorized by the owner to operate the accounts.

Is there case law, other constitutional law or any other laws or regulations that may impact upon the transfer of information to this jurisdiction?

List of case law, constitutional law or any other laws or regulations that may impact upon the transfer of information.

No clear requirements in Saudi Laws