Key takeaways

• On January 26, Saudi Arabia announced a new Draft Banking Law, proposing significant revisions to the existing Banking Control Law. The law would apply to all banks and financial institutions that provide banking services to clients in the Kingdom (including those based outside of the country).
• This is the first time the Banking Control Law has been revised since it was first issued 50 years ago. The Saudi Arabian Monetary Authority (SAMA), which issued the original and revised law, has underscored that these changes represent a major shift in the Kingdom’s regulation of banking and other related services.  
• The proposed changes are open for public consultation until February 24. Banks and other financial institutions should closely review the revised regulations against the original law and evaluate the strategic implications for their operations in the Kingdom. A link to the English-translated version of the revised law can be found here.
• While the current draft gives strong indication of the expected changes, key details on how banks and institutions must ensure compliance will be outlined in the coming Implementing Regulations. A date for issuing these regulations has not yet been set. As required, the Saudi Council of Ministers approved the draft law before publication two weeks ago, but it does not need to review the Implementing Regulations. This gives SAMA a lot of flexibility to further develop the banking sector’s regulatory environment as it sees fit.  

Key provisions

Although we anticipate further significant changes with the Implementing Regulations, some of the key aspects of the recently published draft law are: 

• Its redefinition of what banking is in the Kingdom. One of the law’s first sections expands the Kingdom’s definition of banking to include, among other things: receiving and accepting deposits; opening and operating checking, savings, or other bank accounts; issuing credit or credit facilities; paying and receiving checks or other forms of written payment; issuing bonds and loan guarantees; trading in local and foreign currencies; issuing remittances; offering banking-related financial products, such as bonds (including sharia-compliant bonds, called Sukuk) and financial derivatives. Companies are strongly encouraged to review the exact wording of these new definitions (outlined in Article 4 of the law linked above) as they depart considerably from the Kingdom’s previous, more limited definition of banking. 
• Its provision of key new licensing authorities to SAMA. While banks and institutions had previously been required to obtain licenses from the Council of Ministers to start their operations in the Kingdom, this authority has now been transferred to SAMA. SAMA can now issue, revoke, suspend, renew, or modify the conditions of licenses issued to relevant entities. This will reduce licensing delays and reaffirms SAMA’s role as the primary authority regulating banking in the Kingdom. Notably, foreign banks or institutions that issue credit or credit facilities “for the purposes of supporting financing projects and commercial businesses in Saudi Arabia,” or those that offer banking services to authorities within the Saudi government, are not required to obtain licenses from SAMA. However, they must still abide by all the law’s other regulations.  
• Its creation of a new fund to support local depositors in the event of bank default or closure. This new fund, called the Deposits Protection Fund (DPF), will collect payments (via routine installments) from licensed banks and institutions in the Kingdom and use those funds to repay local depositors if a certain bank defaults on its guarantees. The DPF will be a branch within SAMA and will be supervised by key SAMA departments. The Implementing Regulations will outline the official definitions for which types of banks or institutions will be required to pay into this fund, the exact coverage limit and cadence for mandatory installment dues, and the DPF’s authorities to penalize late or non-payment. Additionally, banks and institutions are required to notify their depositors on the limits and conditions under which they can protect individual deposits and ensure immediate notification to depositors if their deposits are in any way at risk.  
• Its provision to centralize the regulation of information technology (IT), data, and cybersecurity infrastructure at licensed banks and institutions with SAMA. This regulatory authority had previously been distributed across various Saudi data and technology authorities, such as the Ministry of Communication and Information Technology (MCIT), the National Data Management Office (NDMO), and the National Cybersecurity Authority (NCA). However, SAMA now has authority to adapt existing and future national regulations relevant to the development and operation of IT, data, or cybersecurity infrastructure to the banking sector. Banks and institutions should still monitor regulatory frameworks issued by these other authorities, as they will serve as a basis for SAMA’s regulations. Companies should also position themselves as partners to SAMA as it undertakes these new regulatory responsibilities. 
• Its provision that institutions provide access to their clients’ data to third-party fintech providers for certain purposes. Per Article 16 of the draft law, SAMA has the authority to compel financial institutions to share client data with licensed fintech providers in order to promote open banking. If SAMA requests that an institution share this information, that institution must also gain approval from its clients directly before sharing their data with a fintech provider. Since the original law did not refer to fintech, this new provision is the first official designation of fintech as an activity within the Saudi banking sector – and a key step in SAMA’s efforts to promote fintech and innovation and banking. We expect SAMA to issue further fintech-related regulations, whether under the Implementing Regulations or other initiatives, over the next few years.
• Its requirement that all bank employees, regardless of their seniority, notify SAMA of any suspected violations of the law. This provision applies to all members of a given bank or institution’s board of directors, its CEO, senior executives, junior staff, and internal and third-party auditors. Bank employees must notify SAMA officials not only of any suspected violations to the law but also of any perceived risks to a licensed bank’s reputation in the Kingdom, or abroad, as well as any threats to its ability to uphold guarantees to its clients. Banks and institutions should prepare their staff immediately to comply with these key new requirements, and closely review the Implementing Regulations for further details on this.
• Its stipulation of a range of other new regulations for banks and institutions. This includes revised penalties for violations to the law, which could include up to five years imprisonment and fines up to 5 million riyals (Articles 50-53); new governance rules for how SAMA can enforce compliance on relevant institutions, which include extensive requirements for institutions to obtain written approval from SAMA before they undergo a range of business activities (Articles 13-20); and a slew of new regulations for how banks and institutions must conduct their core operations, including requirements that banks maintain no less than 11 percent of their deposit liabilities in SAMA accounts and that institutions maintain a minimum 15 percent of liquidity in their reserves (Article 32). The law also provides key new guidelines for ensuring banking confidentiality, consumer privacy, and data security within the sector (Articles 43-49).

New SAMA Governor appointment

One final piece of note is that the former Governor of SAMA – H.E. Fahd Al-Mubarak – was honorably relieved of his duties on February 2. The timing of his departure, shortly after the publication of the revised law, underscores its importance as one of the former Governor’s key accomplishments, as well as the general spirit of change unfolding within the Saudi banking sector. H.E. Al-Mubarak will assume the role of an Advisor to the Royal Court, with the rank of minister. 

His replacement is H.E. Ayman Al-Sayari, who will also have the rank of minister as the new Governor. H.E. Al-Sayari is a long-time senior SAMA official, having most recently served as SAMA’s Deputy Governor for Investment and Research. Multinational corporations should expect a general continuation of SAMA policy, with the obvious exception of the revised law, under H.E. Al-Sayari. They should also expect a stronger focus on expanding banking-related innovation and fintech, in line with the Kingdom’s broader priorities for modernizing the banking sector.

Considerations for businesses 

• The draft revisions to the Banking Control Law is a major change in the Saudi regulation of banking and other financial services. Banks and institutions, including those already licensed by SAMA and those interested in entering the Saudi market, should closely review the revised law and respond to its public consultation with recommended changes or considerations they would like to raise with SAMA. Responses delivered in a thorough, precise, and well-structured manner will win most favor with SAMA officials, who have a reputation within the government for their exactitude. 
• Companies should also begin to engage with relevant stakeholders – which principally include SAMA officials as well as officials at the Ministry of Investment (MISA) and Ministry of Finance (MoF). Chairmen or key Board members of banks or institutions should arrange formal congratulatory meetings with the new Governor H.E. Al-Sayari. Senior executives should also engage more routinely with SAMA counterparts to underscore their commitment to growing the Saudi banking sector and promoting productive dialogues with Saudi authorities about the Kingdom’s regulatory priorities. 

____________________________________________________________________________

About ASG

Albright Stonebridge Group (ASG), part of Dentons Global Advisors, is the premier global strategy and commercial diplomacy firm. We help clients understand and successfully navigate the intersection of public, private, and social sectors in international markets. ASG’s worldwide team has served clients in more than 120 countries.

ASG's Middle East & North Africa practice has extensive experience helping clients navigate Saudi Arabia and beyond. For questions or to arrange a follow-up conversation please contact Louise Rosenberg.