National Cybersecurity Authority (NCA)
Issues the Essential Cybersecurity Controls that sit alongside SAMA’s own cyber framework. Two overlapping control sets, one audit season — map them once.
ACTIVITIES THIS REGULATOR SUPERVISES
WHY THERE IS NO ACTIVITY LIST
HOW IT GOT HERE
HOW TO ENGAGE
3 ROUTESLicensing enquiries go through the regulator’s e-services portal, not a general inbox. Pre-application questions are handled by the relevant supervision department.
Licence application
The standing route into a regulated activity. Submitted through the portal with a full application pack; expect at least two rounds of clarification before a decision.
WHAT YOU WILL BE ASKED FOR
- Incorporated entity with the activity in its commercial registration
- Committed capital evidenced, not merely pledged
- Named compliance officer and governance structure
- Full policy pack — AML/CFT, risk, outsourcing, continuity, consumer protection
- Technology and information security assessment
VIA THE REGULATOR’S E-SERVICES PORTAL · TYPICAL TIMEFRAME 6–12 MONTHS TO DECISION
Regulatory sandbox admission
A permitted period of live testing with real customers under agreed caps. For some activities it is the only available entry; for others it is optional and slower than applying directly.
WHAT YOU WILL BE ASKED FOR
- A defined test scope with customer and volume caps
- Stated exit criteria agreed up front
- Reporting cadence you can actually meet
- A plan for the capital step-up at exit
SANDBOX APPLICATION WINDOW — TWO COHORTS A YEAR · TYPICAL TIMEFRAME 2–4 MONTHS TO A DECISION
Public consultation response
Draft rules are published for comment before they take effect. This is the one point where the rule is still movable — and the one most operators skip.
WHAT YOU WILL BE ASKED FOR
- A written response against the specific clauses
- Evidence from your own operating data where you can share it
- Submission before the deadline; late responses are not read
CONSULTATION PAPERS ARE PUBLISHED WITH A FIXED WINDOW · TYPICAL TIMEFRAME BY PUBLISHED DEADLINE