2018-03-29
The Saudi Central Bank (SAMA) issued these instructions to clarify banking secrecy obligations for licensed banks, financial institutions, and money exchange companies operating in the Kingdom. The directive mandates that direct requests for customer data from government and non-government entities must be routed through SAMA unless they fall within five enumerated exceptions, including financial investigations, active court lawsuits, internal entity accounts, and recent ATM or building CCTV footage. It further requires designated headquarters departments to process these requests, mandates annual internal audit reporting on compliance, and establishes unauthorized direct disclosure as a criminal offense under the Banking Control System.