Circular on the Update of the Oversight Framework for Payment Systems and Their Operators

Saudi Central Bank (SAMA)

Circular

Reference No.: 472047719 Date: 19/09/1447 AH / March 2026 CE Attachments: 9 pages

To: Respected Parties,

Assalamu Alaykum wa Rahmatullahi Wa Barakatuh,

Subject: Update of the Oversight Framework for Payment Systems and Their Operators.

Pursuant to the Saudi Central Bank's (SAMA) authorities under the Payments and Payment Services System issued by Royal Decree No. (M/67) dated 22/03/1443 AH, its Executive Regulations, and related laws and regulations.

We hereby inform you of the update to the Oversight Framework for Payment Systems and Their Operators, which replaces the previous Oversight Framework for Payment and Financial Settlement Systems issued by SAMA on 04/08/2021. It aims to define the scope of the framework and align it with the Payments System and its Executive Regulations, clarify the supervisory methodology including supervisory tools, self-assessment, and supervisory assessment, as well as define the obligations of payment systems and their operators in line with relevant regulatory frameworks and international standards.

For your information and action.

Yours sincerely, [Signature] Yazid bin Ahmed Al-Sheikh Deputy Governor for Supervision

Distribution Scope:

• Payment systems and payment system operators.

P.O. Box 2992, Riyadh 11169, Kingdom of Saudi Arabia. Tel: +966114633000

Oversight Framework for Payment Systems and Their Operators March 2026 CE / Ramadan 1447 AH

Contents:

Articles	Page
Article One: Definitions	3
Article Two: Introduction	5
Article Three: Objective	6
Article Four: Regulatory Framework	6
Article Five: Framework Objectives	7
Article Six: Scope of the Framework	7
Article Seven: Classification	7
Article Eight: Supervisory Methodology	7
Article Nine: Supervisory Activities	8
Article Ten: Obligations of Payment System Operators	9
Article Eleven: Applicable Financial Market Infrastructure Principles	9

Article One: Definitions

1. The terms and expressions used in this Oversight Framework carry the meanings specified in the Payments System and its Executive Regulations, unless the context otherwise requires.
2. For the purpose of applying the provisions of this Oversight Framework, the following terms and expressions - wherever used in the framework - carry the meanings set forth opposite each of them, unless the context otherwise requires.

Term	Definition
System	The Payments and Payment Services System issued by Royal Decree No. (M/67) dated 22/03/1443 AH.
Executive Regulations	The Executive Regulations of the Payments and Payment Services System issued by SAMA on 24/11/1444 AH.
Framework	The Oversight Framework for Payment Systems and Their Operators.
Kingdom	The Kingdom of Saudi Arabia.
SAMA	Saudi Central Bank (SAMA).
IOSCO	International Organization of Securities Commissions.
CPMI	Committee on Payments and Market Infrastructures.
Payment Systems (PS)	The set of instruments, procedures, and rules for processing and settling payment orders and related clearing operations within or outside the Kingdom.
Payment System Operator (PSO)	A legal entity licensed by SAMA as an operator of one or more payment systems.
Systemically Important Payment Systems (SIPS)	Payment systems classified as systemically important according to the criteria specified in the Executive Regulations.
Non-Classified Payment System (Non-SIPS)	A payment system not classified by SAMA as a systemically important payment system.
Bank for International Settlements (BIS)	An international organization responsible for issuing guidelines related to Financial Market Infrastructure (FMI) principles, in cooperation with relevant regulatory/supervisory authorities.
Financial Market Infrastructure (FMI)	Any system that enables the settlement of financial transactions among its participants, including, but not limited to, payment, clearing, and settlement systems.
Guideline on the Obligations of Payment Systems regarding Financial Market Infrastructure Principles	A document issued by SAMA clarifying the requirements for payment systems to comply with Financial Market Infrastructure (FMI) principles.

Financial Market Infrastructure Disclosure Framework (CPSS-IOSCO Disclosure Framework)	A document issued by CPMI and IOSCO specifying the standard disclosure requirements for Financial Market Infrastructures, including payment systems.
Financial Market Infrastructure Principles (PFMIs)	The principles issued by CPMI and IOSCO in April 2012, along with all subsequent amendments and publications.
Participant	Any person holding an account in a payment system through which they can issue or receive payment orders.
Customer	Any person receiving payment services or using a payment system.
Self-Assessment	An evaluation process conducted by a payment system operator to determine its compliance with Financial Market Infrastructure (FMI) principles.
Supervisory Assessment	An independent evaluation conducted by SAMA to measure the compliance of payment systems with relevant regulatory frameworks and international principles.

Article Two: Introduction SAMA is the competent authority for the regulation, oversight, and supervision of payment systems and their operators in the Kingdom pursuant to the provisions of the System and its Executive Regulations.

Oversight of payment systems is a core function and responsibility of SAMA, aimed at enhancing safety and efficiency by monitoring existing and planned systems and their operators, evaluating them against safety and efficiency objectives, and implementing necessary changes¹.

Furthermore, SAMA's supervisory functions include establishing controls and standards in accordance with the Financial Market Infrastructure Principles (PFMIs) issued by CPMI and IOSCO, to promote the application of best practices, assess risks, and ensure compliance with regulations that maintain the stability, safety, and efficiency of payment systems and their operators. This is essential to ensuring the smooth functioning of financial markets, thereby preserving and achieving trust and reliability for all participants and customers.

¹ "Central Bank Oversight of Payment and Settlement Systems, www.bis.org/cpmi/publ/d18.pdf".

Article Three: Objective This document aims to define and describe the Oversight Framework for payment systems and their operators, through which SAMA exercises its supervisory responsibilities. It also clarifies the regulatory framework, objectives, and obligations of payment systems, as well as outlining the supervisory methodology applied to oversee payment systems and their operators.

Article Four: Regulatory Framework SAMA exercises its supervisory functions under the Saudi Central Bank System issued by Royal Decree No. (M/67) dated 22/03/1443 AH, based on Paragraph (7) of Article (Four), which stipulates SAMA's commitment to "establishing, developing, and operating national payment system infrastructures, settlements, and clearing; issuing rules, instructions, and licenses; and supervising and overseeing payment systems, settlements, and clearing within its jurisdiction."

Furthermore, SAMA's regulation and oversight of payment systems and their operators rely on several related laws, regulations, and circulars, including but not limited to:

• Article Three of the Payments and Payment Services System issued by Royal Decree No. (M/67) dated 22/03/1443 AH: "The System applies to payment systems and their operators, as well as payment services and their providers."
• Paragraph (6) of Article Seven of the same System: "SAMA is responsible for regulating, overseeing, and supervising payment systems and their operators, as well as payment services and their providers, in accordance with the provisions of the System and regulations. It shall specifically: ... 6. Establish classifications and controls for payment systems according to their degree of importance, including classifying any payment system as a 'systemically important payment system'."
• Paragraph (1) of Article Three of the Executive Regulations of the Payments and Payment Services System issued on 24/11/1444 AH: "SAMA executes its functions and authorities under the provisions of the System, all related regulations, and policies, taking into account international standards and best practices."
• Paragraph (3) of the aforementioned Article: "SAMA is responsible for supervising payment systems, specifically including..."
• Guideline on the Obligations of Payment Systems regarding Financial Market Infrastructure Principles, March 2024.
• SAMA Circular No. (141000117728) dated 08/10/1434 AH, titled "Application of Financial Market Infrastructure Principles (PFMIs)".

Article Five: Framework Objectives The framework aims to achieve the following supervisory objectives:

• Contributing to enhancing the safety and efficiency of payment systems.
• Contributing to ensuring that payment system operators develop effective procedures to mitigate disruption risks.
• Contributing to managing systemically important risks within payment systems.

Article Six: Scope of the Framework The scope of the framework, as stipulated in the Executive Regulations, includes:

• National Payment System, defined in Article One of the Executive Regulations as: "A payment system owned or operated directly or indirectly by SAMA."
• Payment systems operated within the Kingdom, whether domestic or cross-border, pursuant to Paragraph (3) of Article (One Hundred and Two) of the Executive Regulations.
• Other payment systems requiring cooperative oversight between SAMA and other competent authorities.

The oversight scope covers both systemically important payment systems (SIPS) and non-classified payment systems (Non-SIPS), to ensure compliance with SAMA's issued laws and policies regarding payment systems, such as the Real-Time Gross Settlement (RTGS) system.

Article Seven: Classification SAMA classifies a payment system as either a systemically important payment system (SIPS) or potentially becoming one, based on specific criteria. A payment system is classified as a SIPS when the criteria stipulated in Article (One Hundred and One) of the Executive Regulations are met. If these criteria are not met, it is considered a non-classified payment system.

Article Eight: Supervisory Methodology Based on SAMA's membership in the Committee on Payments and Market Infrastructures (CPMI) and its participation in developing internationally recognized Financial Market Infrastructure Principles (PFMIs), SAMA strives to fulfill its supervisory responsibilities according to a principles-based approach as follows:

• Oversight in accordance with requirements stipulated in regulatory frameworks.
• Oversight in accordance with Financial Market Infrastructure Principles (PFMIs).

Article Nine: Supervisory Activities SAMA oversees payment systems and their operators through the following activities:

1) Continuous Monitoring Through collecting, analyzing, and reviewing data related to each payment system, to monitor performance levels, risks, compliance, and ensure safety, efficiency, and stability.

2) Assessment SAMA conducts an independent supervisory assessment to measure the compliance of payment systems with relevant regulatory frameworks, including:

a) Self-Assessment: Pursuant to Paragraph (1) of Article (One Hundred and Six) of the Executive Regulations, which states: "A systemically important payment system operator must conduct a self-assessment to test its compliance with Financial Market Infrastructure (FMI) principles at least once annually, or upon any fundamental change in operating systems, or upon request by SAMA." And Paragraph (4) of the same Article states: "A non-classified payment system operator must conduct a self-assessment to test its compliance with FMI principles periodically, as agreed with SAMA under its license, or as determined by SAMA."

Payment system operators must also comply with Appendix (A) of the Financial Market Infrastructure Principles document: Disclosure Framework and Assessment Methodology, for the self-assessment of each applicable principle.

Furthermore, the systemically important payment system operator is responsible for disclosing its self-assessment summary after obtaining a no-objection letter from SAMA, pursuant to Paragraph (3) of Article (One Hundred and Six) of the Executive Regulations, which states: "A systemically important payment system operator must publicly disclose its answers to the self-assessment summary of Financial Market Infrastructure (FMI) principles, in line with the Disclosure Framework issued by CPMI and IOSCO (CPMI-IOSCO Disclosure Framework for Financial Market Infrastructures), after obtaining a no-objection letter from SAMA."

b) Supervisory Assessment SAMA conducts periodic and independent supervisory assessments to measure the compliance of payment systems with applicable regulatory requirements, as well as their compliance with Financial Market Infrastructure (FMI) principles. SAMA may also request the payment system operator to conduct an independent assessment of its operated system by a third party, if necessary.

3) Implementing Changes A core supervisory function, implemented through issuing policies, rules, and instructions, and applying international best practices.

Article Ten: Obligations of Payment System Operators The primary responsibility for ensuring the safety and efficiency of payment systems lies with the payment system operator, who must comply with the requirements stipulated in the following regulatory framework:

1. The Payments and Payment Services System issued by Royal Decree No. (M/67) dated 22/03/1443 AH.
2. The Executive Regulations of the Payments and Payment Services System issued on 24/11/1444 AH.
3. The Guideline on the Obligations of Payment Systems regarding Financial Market Infrastructure Principles, issued in March 2024.
4. All related regulatory documents issued by SAMA.
5. Financial Market Infrastructure Principles (PFMIs) for Central Banks, issued in August 2015.
6. The Financial Market Infrastructure Disclosure Framework, issued in 2012 by CPMI and IOSCO, which is binding for payment systems and other financial market infrastructures.

Article Eleven: Applicable Financial Market Infrastructure Principles (18) out of (24) Financial Market Infrastructure principles apply to payment systems operated by SAMA, in accordance with Bank for International Settlements (BIS) guidelines on "Application of the Financial Market Infrastructure Principles to Central Bank Financial Market Infrastructures", issued in August 2015.

The Executive Regulations also address these principles in Chapter Two of Part Nine, titled "Requirements for Financial Market Infrastructure Principles".