RULE CHANGES
10 changes across SAMA, the CMA, SDAIA and ZATCA, newest first. Status is read against the effective date as of 30 October 2026 — confirm anything consequential with the issuer.
UPCOMING SAMA · CONSULTATION 07/2026 · SANDBOX & EXIT
Sandbox exit capital moves from a flat floor to a sliding scale indexed to trailing twelve-month processed volume. Teams that grew fast inside the sandbox face a materially larger step-up than the entry number suggested.
IN FORCE SAMA · DRAFT STANDARD 02/2026 · EKYC & IDENTITY
Onboarding flows relying only on passive liveness detection will fail the revised standard. Active challenge-response or certified equivalent becomes the floor. Vendors must re-certify; the obligation stays with the regulated entity, not the vendor.
IN FORCE ZATCA · ZATCA WAVE NOTICE · E-INVOICING (FATOORA)
A further revenue band was brought into Phase 2 integration with the Fatoora platform. Payment and lending platforms issuing invoices on behalf of merchants inherit the requirement through the merchant relationship.
IN FORCE SDAIA · SDAIA IMPLEMENTING REGS · DATA PROTECTION (PDPL)
Transfer of personal data outside the Kingdom for processing requires a documented adequacy or safeguard basis and a risk assessment on file. Affects anyone running core systems on non-resident cloud regions.
IN FORCE SAMA · SAMA LICENSING FRAMEWORK · OPEN BANKING
SAMA closed the open banking sandbox phase and opened a standing licensing route for third-party providers covering account information and payment initiation. Lean Technologies took the first Major Payment Institution licence on the same announcement.
IN FORCE SAMA · CIRCULAR 04/2026 · OPEN BANKING
Providers may now initiate recurring mandates without a separate authorisation, provided consent is re-confirmed every twelve months. Existing single-mandate authorisations remain valid until renewal.
IN FORCE SAMA · CIRCULAR 41/2025 · BNPL & CONSUMER FINANCE
Any credit limit increase requires a documented affordability assessment on file. The assessment must be re-run if more than ninety days have passed since the last one.
IN FORCE SAMA · REPORTING NOTICE 09/2025 · PAYMENTS
Prudential, conduct, AML and operational returns merged into one consolidated submission on a single calendar. Net reduction in filings; net increase in the penalty for a late one.
IN FORCE SAMA · CIRCULAR 18/2025 · PAYMENTS
Domestic transfer settlement moved to a shorter window. Providers running end-of-day batch reconciliation had to re-architect toward intraday.
IN FORCE CMA · CMA RESOLUTION 2-2025 · CROWDFUNDING & CAPITAL MARKETS
Disclosure obligations that applied at primary issuance now follow the instrument into secondary transfer between investors on the same platform.
TEN CATEGORIES
CAT-01 · SAMA
Payment institutions, acquiring, and money transfer.
CAT-02 · SAMA
Account information and payment initiation services.
CAT-03 · SAMA
Deferred payment providers and affordability rules.
CAT-04 · SAMA
Onboarding, liveness, and verification standards.
CAT-05 · SAMA
Entry criteria, testing scope, and exit conditions.
CAT-06 · CMA
Debt and equity crowdfunding, robo-advisory, and CMA permits.
CAT-07 · SDAIA
Personal data handling, consent, transfer, and breach duties.
CAT-08 · NCA / SAMA
NCA essential controls and SAMA cyber framework overlap.
CAT-09 · ZATCA
ZATCA integration phases, wave assignments, and technical specs.
CAT-10 · INSURANCE AUTHORITY
Broking, aggregation, and embedded insurance rules.
CHECK AT THE SOURCE
