Saudi Arabia's AML/CFT regime has matured faster in the last five years than most observers expected. The FATF mutual evaluation in 2018 was the inflection point — what followed was a methodical strengthening of supervisory expectations, increased coordination between SAMA, the CMA, and the Saudi Arabia Financial Intelligence Unit (SAFIU), and a clear willingness to enforce penalties when programmes underperform.
The Legal Frame
The Anti-Money Laundering Law and its implementing regulations, together with the Combatting Terrorism Crimes and Financing Law, provide the statutory base. SAMA, the CMA, and the Insurance Authority each issue sector-specific rulebooks that operationalise the law for their licensees. SAFIU, hosted within the Presidency of State Security, receives and analyses suspicious activity reports.
What SAMA and the CMA Actually Inspect
Inspection focus has shifted over the past three cycles. Customer due diligence quality, beneficial ownership identification, sanctions screening effectiveness, and the timeliness and quality of SAR filings now take priority over policy and procedure completeness. A polished policy stack that does not match operational reality fails inspection in a way it would not have done five years ago.
Beneficial Ownership in Practice
Identifying the natural person ultimately owning or controlling a customer entity is harder in the Gulf than in many other markets — layered family ownership structures, trusts, and offshore vehicles are common. The regulator's expectation is not perfection but documented effort and risk-based escalation. Firms that rely on data vendor returns without challenging anomalous structures are routinely found wanting.
Sanctions Screening
Saudi Arabia maintains its own sanctions list in addition to applying the UN consolidated list. Domestic screening is non-negotiable, and the regulator expects screening against the local list alongside UN, OFAC, EU, and UK references for any institution with international counterparty exposure. Coverage gaps in screening tools are a regular finding.
SAR Quality, Not Volume
SAFIU has been explicit that quality matters more than volume. Firms generating large numbers of low-quality SARs to demonstrate vigilance are not credited for it. A well-evidenced narrative, with supporting transaction context and counterparty information, lands better than a checkbox filing.
Recent Enforcement Themes
The pattern in published enforcement over the last 18 months: late SAR filings, weak EDD on politically exposed persons, and inadequate transaction monitoring tuning for risk-relevant products. Penalties at the high end have run into single-digit millions of riyals for major institutions, alongside individual accountability for senior compliance officers.
How Arabia Markets Helps
We work with financial institutions newly licensed in the Kingdom to build AML/CFT programmes that match SAMA and CMA supervisory expectations from day one, rather than rebuilding after the first inspection cycle.