8
Named authorities
9
Sectors covered
1
FIU / SAFIU
1
Prohibited sector
02The regulatory landscape
02
No single regulator owns your file
Saudi Arabia runs no single financial-crime regulator. You are judged against the authority that licences your activity, plus the national reporting channel behind all of them. Know which body owns your file, and on what basis, before you build.
- Some activities are licensed and prudentially supervised.
- Others are only registered and AML-supervised as designated non-financial businesses and professions (DNFBPs).
- One is prohibited outright.
VASP & crypto
SAMACMA The Saudi Central Bank (SAMA) and the Capital Market Authority (CMA) co-own the virtual-asset perimeter: SAMA on payments and stability, the CMA on securities and token activity. A virtual-asset operator must be ready to stand in front of either.
Payments & MSB
SAMA SAMA licenses payment institutions and money-service businesses. This is full licensing and ongoing supervision, not a register entry, and licensees appear in the public licensed payment service providers register.
Banks & FIs
SAMA SAMA is the prudential and conduct authority for banks and finance companies, and maintains the public licensed banks register. The financial-crime programme is inspected as part of that ongoing supervision.
Funds & CSP
CMAMoCSAFIU A split basis. The CMA licenses and supervises capital markets, investment funds, fund administration and authorised persons, listed in the public authorised persons register. Corporate, company-service and trust-service activity carries no dedicated licence: it registers with the Ministry of Commerce (MoC) and is AML-supervised as a DNFBP, reporting to SAFIU.
Gold & DPMS
MoCMIM Precious-metals and precious-stones dealers are registered as businesses and AML-supervised as DNFBPs by the MoC, not licensed the way a bank is. The Ministry of Industry and Mineral Resources (MIM) owns the upstream mining and mineral supply chain that sits alongside.
Gaming
CST There is no gaming regulator and no licence to hold. Gambling is prohibited under Sharia as maisir, enforced through the judiciary, the Public Prosecution and the security authorities, with online access blocked at the network level by the Communications, Space and Technology Commission (CST, formerly CITC).
Real estate & DNFBP
REGAMoCSAFIU The Real Estate General Authority (REGA) supervises the real-estate sector and brokerage, with a public real-estate broker inquiry register. The activity also sits inside the DNFBP AML perimeter, with the MoC as general DNFBP supervisor and reporting into SAFIU.
Defence & dual-use
GAMI The General Authority for Military Industries (GAMI) is the authority for the military-industries and defence sector. The exposure here is sanctions, export control and integrity due diligence as much as classic AML supervision.
Art & high-value
MoCSAFIU No dedicated regulator. Art dealers, auction houses and high-value-goods dealers are AML-supervised as DNFBPs by the MoC and report to SAFIU. The absence of a bespoke supervisor does not reduce the obligation.
Every regulator above is drawn from the verified Saudi regulator matrix. The framework requires the programme behind each authorisation to be designed, staffed and evidenced now, and tested at the next review. Any specific rulebook instrument, circular, threshold or penalty is verified with the named authority before it is stated as fact.
03Who operates here, and what they must build
The authority differs by sector, and so does the basis: some operators are licensed, some are only registered and AML-supervised as DNFBPs. The obligation is the same shape either way. Whoever holds your file expects a programme that is designed, staffed, documented, tested and actually operating. That means:
01A risk assessment that reflects the real book. Business-wide and customer risk, mapped to the products, channels, geographies and counterparties you actually serve in and through the Kingdom, not a template.
02Controls that run. Customer due diligence and enhanced due diligence, sanctions and PEP screening, transaction monitoring, and, for value transfers, the FATF Travel Rule. Calibrated, tuned and evidenced.
03A named, accountable officer and a working reporting line. A compliance officer and MLRO function with the seniority and independence the supervisor expects, and a live channel into SAFIU for suspicious-transaction reporting.
04Governance and assurance. Board and senior-management oversight, record-keeping, staff training, and independent testing that proves the programme works.
Passing a licensing or registration review is one moment. Standing up to supervision, an inspection or an enforcement finding is the harder, longer test. We build for the second one.
04By sector here
How we serve every sector here
Nine sectors, one standard, even weight, no flagship. We serve all nine to the same senior standard. Choose the activity that matches your licence or registration. If a sector is not the right fit, we say so before you engage.
VASP & cryptoSAMA and the CMA co-own the virtual-asset perimeter. We build the AML, sanctions and Travel Rule programme a virtual-asset operator needs to stand in front of either.
Payments & MSBSAMA licenses payment institutions and money-service businesses and maintains the public licensed-provider register. We build the monitoring, screening and reporting behind that licence.
Banks & FIsSAMA is the prudential and conduct supervisor for banks and finance companies. We build, remediate and run the financial-crime programme a bank is inspected against.
Funds & CSPThe CMA licenses funds, fund administration and authorised persons. CSPs register with the MoC and are AML-supervised as DNFBPs, reporting to SAFIU. We build for both bases.
Gold & DPMSDealers are AML-supervised as DNFBPs by the MoC, with the upstream mineral supply chain under MIM. We build the source-of-funds, screening and reporting controls the sector requires.
GamingGambling is prohibited in the Kingdom under Sharia and online access is blocked by the CST. There is no regulator and no licence to build behind. We say so plainly, and we advise operators to keep this activity out of the Saudi perimeter.
Real estate & DNFBPREGA supervises the sector and brokerage, with the MoC as general DNFBP AML supervisor and SAFIU as the reporting channel. We build the CDD, source-of-funds and reporting function.
Defence & dual-useGAMI is the authority for the military-industries sector. We build the sanctions, export-control and integrity due-diligence programme this activity demands.
Art & high-valueDealers and auction houses are AML-supervised as DNFBPs by the MoC and report to SAFIU. We build the provenance, source-of-funds and screening controls.
05The five service lines, in this market
01
Licensing and new-regime programme build. The AML, CFT and sanctions programme that sits behind a SAMA or CMA licence, a REGA-supervised brokerage or an MoC DNFBP registration, built to the standard the supervisor inspects to, ready before the first review.
02
Remediation. Post-finding or post-enforcement rebuild of a Saudi programme, on a fixed scope, with the evidence a supervisor will ask for and a defensible closure trail.
03
Outsourced and bridge MLRO plus managed FIU function. A senior compliance officer and MLRO function with a working suspicious-transaction reporting line into SAFIU while you recruit, scale, or stabilise after a departure.
04
Independent AML audit. The independent review a Saudi supervisor expects, run by a practitioner who did not build the thing being reviewed.
05
Sanctions, export-control and integrity due diligence. Counterparty, corridor, beneficial-owner and Travel Rule work, including GAMI-facing controls for defence and dual-use exposure.
06The operator-side value
The reviewer, not the seller
We sell no software and take no commissions. Nothing we recommend earns us a fee elsewhere. That is what independent means. Our only interest is that your programme holds.
Senior-only
Practitioner-led work, CAMS and ICA credentialed. The people who scope your engagement are the people who do it. No junior handover.
Fixed scope, fixed fee
No hourly billing. A costed plan within 48 hours of a first conversation. We hand it over working: the programme runs when we leave, staffed and evidenced, ready for the supervisor.
Briefing seriesCurrent and datedA standing series on frontier and Gulf financial-crime supervision.Insights →
Local partnersLocal legal standingLicensed local law-firm and compliance partners in our markets.Partners →
Tell us which Saudi authority owns your file. We will build what sits behind it.
Send us the activity and the licence or registration. You get a costed, fixed-scope plan within 48 hours, from the senior team that will run the work.