Implementing Regulation of the Finance Companies Control Law

Saudi Central Bank
SAMA
Saudi Central Bank

Ref: 472038006
Date: 02/07/1447
Attachments: 37 files

Circular

Recipients
Gentlemen,
Peace, mercy, and blessings of God be upon you.

Subject: Amendment of the Implementing Regulation of the Finance Companies Control Law, and cancellation of the rules governing the microfinance activity, and cancellation of the rules regulating microfinance consumer finance companies.

Based on the authorities vested in the Saudi Central Bank under its system issued by Royal Decree No. (36/M) dated 11/04/1442H, and the authorities vested in His Excellency the Governor of the Saudi Central Bank under the Finance Companies Control Law issued by Royal Decree No. (51/M) dated 13/08/1433H.

We inform you of the issuance of His Excellency the Governor's decision approving the amendments to the Implementing Regulation of the Finance Companies Control Law in the attached wording, cancelling the rules governing the microfinance activity under Decision No. (80/M Fin) dated 16/01/1441H, and cancelling the rules regulating microfinance consumer finance companies under Decision No. (82/M Fin) dated 13/04/1441H, and extending the finance companies' deadline by (90) days from its date to rectify their status accordingly.

For information and action.

Accept my regards,

Yazid bin Ahmed Al Sheikh
Deputy Governor for Supervision

Distribution List:

• Finance companies operating in the Kingdom.
• Digital brokerage companies licensed by the Saudi Central Bank.
• Debt collection establishments for financing trades licensed by the Saudi Central Bank.

P.O. Box 2992 Riyadh 11169, Kingdom of Saudi Arabia Tel: +966 11 463 3000 +971 11 463 3000 - Phone: Kingdom of Saudi Arabia Riyadh 11169 P.O. Box 2992

---

Implementing Regulation of the Finance Companies Control Law Rajab 1447H / December 2025G

The Saudi Central Bank issued this Regulation in accordance with the authorities vested in it under the Finance Companies Control Law issued by Royal Decree No. (51/M) dated 13/08/1433H.

---

Chapter One
Definitions and General Provisions

Article One:
For the purpose of applying the provisions of this Regulation, the following words and expressions - wherever they appear in this Regulation - have the meanings set out in the System, unless the context requires otherwise:

The System: The Finance Companies Control Law.
Financing Systems: The Real Estate Financing System, the Financial Leasing System, and the Finance Companies Control Law.
The Bank: The Saudi Central Bank.
Microfinance Consumer Finance Company: A company licensed to practice the microfinance consumer financing activity exclusively and no other financing activities.
Deferred Payment Company: A company licensed to practice the deferred payment activity exclusively and no other financing activities.
Debt-based Crowdfunding Company: A company licensed to practice the debt-based crowdfunding activity exclusively and no other financing activities.
Microfinance Company: A company licensed to practice the microfinance activity exclusively and no other financing activities.
Microfinance Consumer Financing Activity: Granting credit for consumption purposes in accordance with the controls stipulated in Article (Ninth) of this Regulation.
Deferred Payment Activity: Financing the beneficiary to purchase goods or services from merchants without cost, with the deferred amount due from the beneficiary.
Debt-based Crowdfunding Activity: Collecting funds from participants through a debt-based crowdfunding platform to grant credit contracts to beneficiary establishments.
Microfinance Activity: Granting credit in accordance with the controls stipulated in Article (Ninth) of this Regulation.
Financing Activity or Activities: One or more types of financing stipulated in Article Tenth of the System or any other financing activity approved by the Bank under the same Article.
Financing Contract: A contract under which credit is granted for the activities stipulated in the System and this Regulation.

Regulation: The total amount due for payment by the beneficiary distributed over the duration of the financing contract after deducting expenses, fees, and costs not mentioned, such as charges, commissions, and administrative service costs.

Cost of Time: The value of the time charge imposed on the beneficiary under the financing contract, which can be expressed as a fixed or variable annual percentage of the financing amount provided to the beneficiary.

Total Cost of Financing: What the beneficiary is committed to pay during the financing amount in accordance with the provisions of the financing contract, including the cost of time, charges, commissions, administrative service costs, insurance, and any necessary expenses to obtain financing, excluding any expenses that the beneficiary can avoid, such as costs or charges due from the beneficiary resulting from breach of any of its obligations under the financing contract.

Financing Amount: The maximum or total amounts available to the beneficiary under the financing contract.

Total Amount Due for Payment by the Beneficiary: The financing amount added to the total cost of financing.

Annual Percentage Rate: The discount rate calculated in accordance with the provisions of Article Eighty-Five of this Regulation.

Board of Directors: The board of directors of the finance company.

Senior Management: The Managing Director, Chief Executive Officer, General Manager and their deputies, the Chief Financial Officer, heads of main departments, and persons responsible for risk management, internal audit, and compliance functions in the finance company.

Exposure: The value of the asset exposed to any credit risks, such as default risk or downgrade of credit rating.

Large Exposure: Exposure to a single beneficiary of (5%) or more of the paid-up capital and reserves of the finance company.

Material Share: (5%) or more of the shares or stakes of the finance company or voting rights therein, whether owned directly or indirectly by one person or several persons acting in concert.

Article Two:
The Bank shall regulate the financing sector and supervise the affairs of finance companies in accordance with the System and this Regulation, including the following:

1. Licensing the practice of one or more financing activities, in accordance with the provisions of the financing systems and their regulations.
2. Taking the necessary measures to preserve the safety, stability, and fairness of transactions in the financing sector.
3. Taking the necessary measures to gather legitimate and fair competition among finance companies.
4. Issuing the necessary rules and instructions to regulate the work of the financing sector.
5. Taking appropriate means to develop the financing sector, and working to localize its jobs, and improve the efficiency of its workers, by regulating the obligations of finance companies regarding human resources training, improving their skills, and developing the knowledge of their employees.

Article Three:
The provisions of this Regulation shall apply to every legal person licensed to practice one or more of the activities stipulated in Article Tenth of the System or any other financing activity approved by the Bank under the same Article.

Chapter Two
Licensing of Finance Companies

Article Four:
No person shall practice any financing activity except after obtaining a license from the Bank in accordance with the System and this Regulation or other applicable systems.

Article Five:
The financing of a natural or legal person for identical goods or services shall be subject to the controls and instructions issued by the Bank.

Article Six:
A finance company shall not practice any activity other than those licensed to it under the financing systems and their regulations.

Article Seven:
The founders of a finance company, or their representatives, shall submit a license application to the Bank, specifying the financing activities for which licensing is sought, accompanied by the following:

1. The license application form prescribed by the Bank, completed.

2. The draft articles of association or bylaws of the finance company, as applicable.

3. A description of the organizational structure of the finance company, including all necessary departments, functions, and the main tasks of each.

4. A list of the names of the founding members, including the number of shares or stakes for each founding member and their percentage.

5. The solvency requirements form for founding members, signed by each founding member.

6. The solvency requirements form for members of the Board of Directors or the manager or members of the board of managers of the company or those in their stead, as applicable, signed by each candidate.

7. A feasibility study including the identification of the target market, services to be offered, the finance company's business model and strategy, and a five-year business plan including at least the following:
   (a) The financing activities for which licensing is sought, the products, and the marketing plan.
   (b) Credit granting policies and procedures.
   (c) Pro forma financial statements, estimates of annual revenues and expenses, financial margins, and targeted growth rates, taking into account the capital adequacy and liquidity requirements prescribed by the Bank.
   (d) Estimate of start-up costs and necessary financing.
   (e) Estimate of ongoing operational financing.
   (f) Branches the finance company intends to open.
   (g) Risk and compliance monitoring and management plan and programs.
   (h) Recruitment and training plan, including an estimate of the number of employees, the percentage of Saudis among them in each department and administrative level, and employee training and qualification programs.

8. An irrevocable bank guarantee in an amount equal to 20% of the minimum capital for the financing activity or activities for which licensing is sought, in accordance with the form determined by the Bank, issued in favor of the Bank by a local bank or a branch of a foreign bank, automatically renewed until the capital is fully paid, and released upon request by the founders in the following cases:
   (a) Payment of the capital.
   (b) Withdrawal of the license application.
   (c) Rejection of the license application by the Bank.
   (d) The company obtaining preliminary approval from the Bank.

9. Draft agreements and contracts proposed with third parties, particularly agreements and contracts with related parties and external service providers.

10. Any other documents or information requested by the Bank.

Article Eight:

1. Subject to the provisions of the Companies System, the minimum paid-up capital for a finance company shall be as follows:
   (a) (200,000,000) Two hundred million riyals for a finance company practicing the real estate financing activity.
   (b) (100,000,000) One hundred million riyals for a finance company practicing one or more financing activities other than real estate financing.
   (c) (50,000,000) Fifty million riyals for a finance company practicing the financing of small and medium-sized enterprises activity exclusively and no other financing activities.
   (d) (20,000,000) Twenty million riyals for a finance company practicing the microfinance consumer financing activity exclusively and no other financing activities.
   (e) (10,000,000) Ten million riyals for a finance company practicing the microfinance consumer financing activity through fintech exclusively and no other financing activities.
   (f) (10,000,000) Ten million riyals for a finance company practicing the microfinance activity exclusively and no other financing activities.
   (g) (5,000,000) Five million riyals for a finance company practicing the debt-based crowdfunding activity exclusively and no other financing activities.
   (h) (5,000,000) Five million riyals for a finance company practicing the deferred payment activity exclusively and no other financing activities.

2. In the event of combining the financing activities stipulated in paragraphs (c) to (h), the company shall meet the minimum capital requirement for the highest-value activity.

3. The Bank may raise or lower the minimum capital requirement in accordance with market conditions, or if it deems that the proposed business model of a finance company, the nature of its activities, or the proposed geographical scope of the activity so requires, taking into account the size and nature of the risks associated with the activity. The capital must be paid in full upon the establishment of the finance company.

Article Nine:

1. The practice of a microfinance consumer finance company's activity shall be in accordance with the following controls:
   (a) The purpose of financing shall be to purchase goods and services for consumption, including, but not limited to, purchasing furniture, consumer goods, or household items, or financing education, etc.
   (b) The purpose of financing shall not be related to the beneficiary's commercial or professional activities.
   (c) Financing for the purchase of vehicles is excluded from the microfinance consumer financing activity.
   (d) The total amount of financing granted to a beneficiary by a microfinance consumer finance company shall not exceed (60,000) sixty thousand riyals.
   (e) As an exception to the provision of paragraph (d) of this Article, the total amount of financing granted to a beneficiary by a microfinance consumer finance company practicing the activity through fintech only shall not exceed (30,000) thirty thousand riyals. (f) The Bank may adjust the amounts granted to the beneficiary for microfinance consumer financing in accordance with market conditions or the geographical scope of the microfinance consumer finance company.

2. The practice of a microfinance company's activity shall be in accordance with the following controls:
   (a) The financing shall be for the productive activities and assets of the beneficiaries, which are small business owners, artisans, and those in their stead among natural persons or micro-enterprises.
   (b) The amount of financing granted to a beneficiary for microfinance shall not exceed (200,000) two hundred thousand riyals.
   The Bank may increase this amount upon request by the microfinance company in accordance with market conditions or the geographical scope of the microfinance company.

Article Ten:
A finance company licensed to practice the debt-based crowdfunding activity or the deferred payment activity shall comply with the requirements, controls, and rules issued by the Bank for these activities.

Article Eleven:

1. Each founding member must meet the Shariah and regulatory eligibility requirements, and the solvency requirements approved by the Bank. In particular, the following conditions are required of the founding member:
   (a) He must not have violated the provisions of the Banking Control System, the Capital Market System, the Cooperative Insurance Control System, or their regulations, or the financing systems or their regulations.
   (b) No final judgment must have been issued against him opening any bankruptcy proceedings, in accordance with the provisions of the Bankruptcy System.
   (c) He must not have been convicted of any crime involving moral turpitude, unless his reputation is restored and a period of not less than ten years has passed since the execution of the sentence imposed for this crime, and subject to obtaining a letter from the Bank stating no objection thereto. (d) He must not have previously submitted a request to withdraw a license to practice a financing activity within the past two years. (e) He must not have previously had a license to practice a financing activity rejected by the Bank within the past five years. (f) He must have sufficient financial solvency, and must not have breached any financial obligation towards his creditors, or any indication must not appear suggesting his inability to continue fulfilling his financial obligations towards his creditors.

2. In the event that anything appears that violates the founding member or material shareholder's compliance with the Shariah or regulatory eligibility requirements or the solvency requirements approved by the Bank, the Bank may, at any time, temporarily deprive him of the right to vote on the finance company's decisions, or require his written non-objection before exercising this right, to preserve the sound performance of the finance company and apply governance principles and protect the interests of stakeholders in the finance company.

3. A letter from the Bank stating no objection must be obtained before acquiring a material share in a finance company.

4. If the founding member or the person intending to acquire shares or stakes in a finance company is an entity, the provisions of this Article shall apply to anyone who owns (5%) or more of the capital or voting rights in that entity.

Article Twelve:
Each person on the company's Board of Directors, manager, or members of the board of managers, or those in their stead, as applicable, must meet the professional eligibility requirements and the solvency requirements approved by the Bank. In particular, the following conditions are required:

1. He must not have violated the provisions of the Capital Market System and its regulations, or been convicted of violating the Banking Control System, the Cooperative Insurance Control System, or the financing systems or their regulations.
2. He must not have been convicted of any crime involving moral turpitude, unless his reputation is restored and a period of not less than ten years has passed since the execution of the sentence imposed for this crime.
3. He must have sufficient financial solvency, and must not have any existing breach of a financial obligation towards his creditors.

Article Thirteen:
Each candidate for appointment to senior management must meet the professional eligibility requirements and the solvency requirements approved by the Bank. In particular, the following conditions are required of the candidate for appointment to senior management:

1. He must be resident in the Kingdom during the period of holding the position.
2. He must be theoretically and practically qualified, and have appropriate experience in the same field of not less than five years. The Bank has the right to assess whether the candidate meets this duration.
3. As an exception to the provisions of paragraph (2) of this Article: the experience duration in microfinance investment companies, microfinance, deferred payment, and debt-based crowdfunding shall be sixty [months/years - text implies duration context, literal translation 'sixty' follows]. The Bank has the right to assess whether the candidate meets this duration.
4. He must not have been dismissed or removed from a position for disciplinary reasons within the previous three years, and the Saudi Central Bank has the right to approve the candidate based on available data.
5. He must not have violated the provisions of the Capital Market System and its regulations, or been convicted of violating the Banking Control System, the Cooperative Insurance Control System, or the financing systems or their regulations.
6. No final judgment must have been issued against him opening any bankruptcy proceedings, in accordance with the provisions of the Bankruptcy System.
7. He must not have been convicted of any crime involving moral turpitude, unless his reputation is restored and a period of not less than ten years has passed since the execution of the sentence imposed for this crime, and subject to obtaining a letter from the Bank stating no objection thereto.
8. He must have sufficient financial solvency, and must not have any existing breach of a financial obligation towards his creditors.

Article Fourteen:

1. The license application must meet all the requirements stipulated in the System and this Regulation, and the founding members of the finance company must provide the Bank with any additional information or documents requested within (30) thirty working days from the date of the request.
2. The Bank may reject the license application in the event of non-compliance with the time period mentioned in paragraph (1) of this Article.
3. The Bank shall notify the license applicant in writing of the completion of his application after meeting all the requirements stipulated in the System and this Regulation.
4. The Bank shall notify the license applicant in writing of the preliminary approval or reasoned rejection within (60) sixty working days from the date of notifying the license applicant of the completion of his application. The Bank's preliminary approval does not constitute a license or permission to practice the financing activity.

Article Fifteen:

1. The founding members must complete the establishment of the finance company within six months from the date of the Bank's preliminary approval and provide the Bank with a copy of the company's commercial registration and its articles of association or articles of incorporation, as applicable, including the activities stipulated in the Bank's preliminary approval. The validity of the Bank's preliminary approval expires by operation of law upon the expiration of one month from the date of that approval, and the period may be extended for another six months maximum after obtaining a letter from the Bank stating no objection thereto - before the specified period expires.
2. The founding members must complete the company's readiness within twelve months from the date of issuing or amending the commercial registration, and the Bank may, after the expiration of this period, close the license application or reject it.

Article Sixteen:

1. The Bank shall issue a decision granting the license to the company after completing its establishment procedures and submitting license applications proving the full payment of the capital and any additional initial financing stated in the business plan, and taking all necessary steps to begin practicing the financing activities for which licensing is sought, such as providing human resources, technical systems, and necessary equipment.
2. The Bank shall take the necessary measures to verify that the company meets the requirements mentioned in paragraph (1) of this Article and the related laws, regulations, rules, and instructions, such as conducting a licensing, supervisory, or inspection visit to the company's premises and the residences of its officials, and reviewing its systems, procedures, and records. The company must address the observations noted during the visits and commit to implementing the recommendations and instructions directed by the Bank.

Article Seventeen:
The Bank shall specify in the license the financing activity or activities licensed to the finance company to practice, and may restrict the license with special conditions that determine the geographical area licensed to the finance company to operate in, or the beneficiaries licensed to it to deal with, or other such conditions.

Article Eighteen:
The license shall be valid for five years, and the Bank may renew it upon request by the finance company in accordance with the requirements stipulated in this Regulation. The company shall submit the renewal request to the Bank at least six months before the expiration of the license validity period, in the form prescribed by the Bank, accompanied by the following:

1. The finance company's strategy and updated five-year business plan including at least the following:
   (a) The marketing plan, taking into account current products and products to be developed.
   (b) Credit granting policies and procedures.
   (c) Pro forma financial statements, estimates of annual revenues and expenses, financial margins, and targeted growth rates compared to the finance company's performance during the previous five years, taking into account any changes to the company's strategy and business plan. (d) Estimate of expected capital adequacy and liquidity levels, and comparing them with their counterparts during the previous five years, taking into account any changes to the company's strategy and business plan. (e) Estimate of ongoing operational financing. (f) Branches the finance company intends to open. (g) Report on the risks the finance company was exposed to during the previous five years, and how they were handled and managed, including non-compliance risks and cases of violation of systems, regulations, or instructions, and the company's plan and future programs for risk and compliance management. (h) The current number of employees, and the percentage of Saudi employees in each department and administrative level. (i) Recruitment and training plan, including employee training and qualification programs.

2. The financial consideration necessary to renew the license.

3. Any other documents or information requested by the Bank.

Article Nineteen:
A finance company shall not cease practicing its activity for a period exceeding three consecutive months, except with the Bank's prior written approval, and in accordance with the controls issued by the Bank on this matter.

Article Twenty:
A finance company may request to amend the license by adding or deleting some financing activities, or amending any condition or restriction contained therein. The request must be based on reasonable justifications for the amendment and accompanied by any documents, information, or studies requested by the Bank. In the event that the amendment results in adding a new activity or modifying the licensed activity, the specific requirements for it must be met in accordance with the System, this Regulation, and related rules.

Article Twenty-One:

1. The Bank may cancel the license in the following cases:
   (a) Upon request by the finance company, taking into account the rights of creditors and beneficiaries and the safety of the financial system.
   (b) If it is established that the finance company provided the Bank with false information or omitted disclosure of material information it was required to disclose for licensing purposes.
2. Cancellation of the license results in the classification of the finance company.

Article Twenty-Two:

1. The license shall terminate in the following cases:
   (a) Expiration of the license period without renewal.
   (b) Appointment of a liquidator for the finance company.
   (c) Expiration of the finance company's term, if any.
   (d) Issuance of a judgment declaring the bankruptcy of the finance company.
2. Termination of the license results in the finance company ceasing to practice any of the financing activities.
3. The finance company must comply with the instructions issued by the Bank upon the occurrence of any of the license termination cases mentioned in paragraph (1) of this Article.

Article Twenty-Three:
The finance company must completely stop its financing activities in the event of suspension of its license in accordance with the provisions of Article Twenty-Nine of the System, and it shall not practice any of those activities except after obtaining a letter from the Bank stating no objection thereto.

Article Twenty-Four:

1. The Bank shall collect a financial consideration as follows:
   (a) Two hundred thousand riyals for issuing the license.
   (b) One hundred thousand riyals for renewing the license.
   (c) Fifty thousand riyals for amending the license.
2. As an exception to the provisions of paragraph (1) of this Article, the Bank shall collect a financial consideration as follows:
   (a) The financial consideration for issuing the license to practice the microfinance consumer financing activity or amending or renewing it shall be (20,000) twenty thousand riyals.
   (b) The financial consideration for issuing the license to practice the microfinance consumer financing activity through fintech or amending or renewing it shall be (10,000) ten thousand riyals.
   (c) The financial consideration for issuing the license to practice the microfinance activity or amending or renewing it shall be (10,000) ten thousand riyals.
   (d) The financial consideration for issuing the license to practice the debt-based crowdfunding activity and the deferred payment activity shall be (5,000) five thousand riyals, and the financial consideration for renewing or amending the license shall be (2,000) two thousand riyals.

Article Twenty-Five:

1. The finance company must obtain a letter from the Bank stating no objection before launching any new financing products or modifying any existing financing products directed to individuals or beneficiaries of microfinance.
2. The Bank may stop any of the financing products provided by the finance company if the safety of the financing sector so requires.

Chapter Three
Capital Adequacy and Liquidity

Article Twenty-Six:
The finance company must comply with the required capital adequacy and liquidity levels in accordance with the paragraphs, requirements, and standards approved by the Bank.

Article Twenty-Seven:
The finance company must comply with the following:

1. Providing the Bank with prudential data at specified times in accordance with the forms, controls, and instructions determined by the Bank.
2. Providing the Bank with any reports, data, or information requested in accordance with the forms and instructions and at the time determined by the Bank.

Article Twenty-Eight:
The finance company must obtain a letter from the Bank stating no objection before listing its shares in the capital market.

Article Twenty-Nine:
The finance company must obtain a letter from the Bank stating no objection before approving any distribution of dividends or any other distributions or recommending or announcing them, after ensuring compliance with the following conditions:

1. The distribution must not lead to a decrease in the capital adequacy and liquidity levels below the prescribed levels.
2. The total distributions in the financial year must not exceed the profits realized during the previous financial year.
3. Any other conditions approved by the Bank.

Chapter Four
Ownership and Assets

Article Thirty:
Subject to what is stipulated in Article (Eleven) of the System, a finance company shall not practice any activity other than financing, or own an establishment that practices any activity other than financing, whether directly or indirectly, except after meeting the conditions or controls set by the Bank.

Article Thirty-One:

1. A finance company shall not acquire assets other than those necessary for managing its business except after obtaining a letter from the Bank stating no objection thereto.
2. A finance company shall not carry out any partial or complete liquidation of its activity or the company itself without obtaining a letter from the Bank stating no objection thereto.

Chapter Five
Corporate Governance

Article Thirty-Two:
The finance company must comply with the corporate governance rules approved by the Bank.

Article Thirty-Three:
The finance company must develop internal corporate governance rules and put in place a special bylaw for them and approve it by the Board of Directors, manager, or members of the board of managers, or those in their stead, as applicable, and provide the Bank with a copy thereof. That bylaw must include at least the following:

1. A description of the organizational structure including all departments and functions and the tasks and responsibilities of each.
2. Controls for independence and segregation of duties.
3. Competencies of the Board of Directors, managers, or members of the board of managers, or those in their stead, and the committees, their formation, and the responsibilities of each.
4. Compensation and bonus policies.
5. Controls for working in the event of a conflict of interest.
6. Guarantees of integrity and transparency.
7. Guarantees of compliance with related systems and regulations.
8. Means of maintaining information confidentiality.
9. Guarantees of fairness in transactions.
10. Controls for protecting the company's assets.

Article 34:
The Board of Directors of a joint-stock finance company shall form a specialized committee to expand its scope of work in areas requiring specific expertise. The Board of Directors shall define its powers and monitor its performance, which must include, at a minimum, an audit committee and a risk and credit management committee.

Chapter Six
Internal Regulation

Article 35:
A finance company must establish appropriate written regulatory policies, including work guides and operational procedures, and update them periodically. It must communicate these to relevant employees in a suitable manner and at a time that allows them to comply. Regulatory policies must include, at a minimum, rules governing the following:

1. Organizational and operational structure, methods of exercising authority, and determination of responsibilities.
2. Granting credit and operational processes.
3. Financial and accounting management.
4. Marketing and sales.
5. Information technology.
6. Customer service and collection.
7. Risk management, including identification, treatment, monitoring, and disclosure.
8. Internal control system.
9. Internal audit.
10. Compliance with relevant systems, regulations, and instructions.
11. Outsourcing tasks to external service providers.
12. Salaries, bonuses, and incentives, including those for senior management, employees, Board of Directors members, the Manager, members of the Board of Managers, or equivalent persons, and commissions.

Article 36:
A finance company shall not combine an executive function, such as financing or hedging, with a supervisory function, such as internal audit, risk, or accounting. Tasks must be segregated to ensure the application of recognized technical procedures, policies, and standards to protect the company's assets and funds and prevent fraud and embezzlement.

Article 37:

1. The technical equipment in a finance company and its associated systems must be sufficient for the company's operational needs, the nature of its activity, and its risk profile, in accordance with recognized technical standards and consistent with what the Bank issues in this regard.
2. Information technology systems and related procedures must be designed to ensure the availability, integrity, and confidentiality of information. The finance company must evaluate this periodically according to recognized technical standards, and such evaluation must be conducted before initial use and after any changes.
3. A finance company must establish a plan ensuring business continuity in emergency situations, including alternative solutions to resume its activity within a suitable period.

Article 38:
A finance company must keep all work documents, records, and files in an organized, transparent, and secure manner, in compliance with relevant systems and instructions. It must verify the completeness of files and update them periodically for at least ten years from the date the relationship with the client ends, including all transactions related to clients.

Article 39:
A finance company must have sufficient and qualified human resources in terms of knowledge and experience to meet operational needs, business activities, and risk profiles. Financial bonuses and incentives provided by the finance company to its employees must be fair and balanced with the company's strategy and must not create conflicts of interest.

Article 40:

1. The human resource localization rate must not be less than 50% when a finance company begins its activities, at all administrative levels.
2. Human resource localization must increase annually by at least 5% of the total workforce until reaching a rate of 70%. The Bank may set a minimum annual increase in the localization rate thereafter.
3. The appointment of non-Saudis in a finance company is restricted to positions requiring expertise not available in the Saudi labor market. In all cases, the finance company must obtain a letter from the Bank confirming no objection prior to appointing any non-Saudi employee in supervisory departments, after submitting proof that no Saudis are available for the position and a plan for replacing the position with a qualified Saudi for the necessary duration.

Chapter Seven
Outsourcing to External Service Providers

Article 41:

1. The Board of Directors, the Manager, the Board of Managers, or equivalent persons must issue a written policy regulating the outsourcing of tasks to external service providers and update it annually. This policy must include, in particular:
   (a) The authorities and responsibilities of the Board of Directors, the Manager, the Board of Managers, or equivalent persons, and senior management.
   (b) Criteria for qualifying external service providers.
   (c) Criteria for identifying risks and how to hedge against them.
   (d) Rules for continuous monitoring and supervision of operations outsourced to external service providers.
   (e) Criteria for identifying conflicts of interest and rules and procedures ensuring that the interests of the finance company are not compromised or overridden by the interests of another party.
   (f) Procedures for protecting information and maintaining its confidentiality and privacy.
2. The Bank, the external auditor, and the finance company have the right to obtain or access any information or documents related to the work of an external service provider at its premises.
3. A finance company must verify that the external service provider complies with relevant systems, regulations, and instructions. The finance company is not relieved of liability if the external service provider fails to comply with applicable systems, regulations, and instructions in any of the outsourced operations and tasks.
4. A finance company must comply with the outsourcing rules issued by the Bank.

Chapter Eight
Risk Management

Article 42:
A finance company must do the following:

1. Establish a clear written business strategy and a written risk management policy approved by the Board of Directors, the Manager, the Board of Managers, or equivalent persons, and updated annually. The risk management policy must consider the identification, classification, and analysis of all types of related risks and how to deal with them, taking into account all business activities, including operations and tasks outsourced to external services. It must include, at a minimum, an analysis of the following risks:
   (a) Credit risk.
   (b) Market risk.
   (c) Term cost price risk.
   (d) Asset-liability mismatch risk.
   (e) Foreign exchange rate risk.
   (f) Liquidity risk.
   (g) Operational risk.
   (h) Risk of other countries in which the finance company operates.
   (i) Legal risk.
   (j) Reputational risk.
   (k) Technical risk.
2. Establish appropriate procedures for identifying, assessing, managing, monitoring, and reporting on risks, and place them within a comprehensive risk management framework that ensures:
   (a) Early and comprehensive identification of risks.
   (b) Assessment of relationships between risks.
   (c) Periodic coordination with the Board of Directors, the Manager, the Board of Managers, or equivalent persons, the risk and credit management committee in the joint-stock finance company, senior management, responsible employees, and the internal audit department if necessary.
3. Establish a risk management department that reports directly to the risk and credit management committee in the joint-stock finance company. In this case, the risk and credit management committee must submit its views on the risk management department's reports to the Board of Directors.

Article 43:
The risk management department must prepare quarterly risk reports for discussion by the risk and credit management committee and the Board of Directors, the Manager, the Board of Managers, or equivalent persons, based on senior management review. This report must include, at a minimum:

1. A comprehensive review of risk developments and the performance of financial positions exposed to market price risks, as well as situations where limits are exceeded.
2. Changes in assumptions and factors underlying risk assessment procedures.
3. Financing portfolio performance by activity, risk type, size, and collateral type.
4. The extent of granted limits, external credit lines, and large exposures specified in Article 59 of this Regulation, and other significant exposures, such as variable financings, and comments on them.
5. An analysis of situations where the finance company exceeded permitted limits, stating reasons, the size and development of new business, and the company's risk provisions.
6. Any major financing decisions not implemented in accordance with the finance company's strategy or policies.

Article 44:
A finance company must provide the Bank with the report referred to in Article 43 of this Regulation after it has been discussed by the risk and credit management committee and the Board of Directors, the Manager, the Board of Managers, or equivalent persons in the joint-stock finance company, and approved, including decisions taken regarding it.

Chapter Nine
Compliance

Article 45:

1. A finance company must comply with applicable systems, regulations, and instructions, and take necessary measures and controls to ensure compliance without violating their provisions.
2. A finance company must comply with the compliance principles for finance companies and real estate refinance companies issued by the Bank.

Article 46:
A finance company must do the following:

1. Establish an independent department or position responsible for compliance tasks, and appoint a compliance officer who reports directly to the audit committee in the joint-stock finance company, or the Board of Managers, or equivalent persons in a non-joint-stock finance company. The audit committee must submit its views on compliance reports to the Board of Directors in joint-stock companies.
2. Prepare a written compliance policy approved by the Board of Directors, the Manager, the Board of Managers, or equivalent persons, which includes the authorities, obligations, and responsibilities of the compliance department, compliance programs, and related procedures. The audit committee in the joint-stock finance company, or the Manager, or the Board of Managers, or equivalent persons in a non-joint-stock finance company, must verify the implementation of this policy, evaluate its effectiveness, update it, and propose necessary amendments annually.
3. Take necessary measures to ensure the implementation of the compliance policy referred to in paragraph (2) of this Article.

Article 47:

1. The compliance officer is appointed by decision of the Board of Directors, the Manager, the Board of Managers, or equivalent persons, based on the recommendation of the audit committee in the joint-stock finance company, and after obtaining a letter from the Bank confirming no objection.
2. The compliance officer enjoys independence in performing assigned tasks and shall not perform any other tasks.

Article 48:
The compliance officer must submit a quarterly report on compliance to the audit committee in the joint-stock finance company for review, discussion, documentation of implemented measures and resulting decisions, and submission to the Board of Directors, the Manager, the Board of Managers, or equivalent persons for review and approval. The report must include main risks related to non-compliance facing the finance company, analyze existing operations and procedures, evaluate their effectiveness, and propose any amendments or changes.

Article 49:
The number of employees and resources in the compliance department must be sufficient and proportional to the finance company's business model and size. Compliance staff must report only to the compliance officer in performing their tasks.

Article 50:
The compliance department is responsible for verifying the finance company's compliance with applicable systems, regulations, and instructions, and performing necessary tasks, including:

1. Identifying all non-compliance risks, dealing with them, and monitoring their developments.
2. Analyzing policies, procedures, operations, and descriptions found, and describing procedures to deal with related non-compliance risks.
3. Following a risk-based synchronization program and including results in the report referred to in Article 48 of this Regulation.
4. Collecting compliance-related complaints and preparing written guidelines for employees as needed.
5. Preparing internal policies and procedures to combat financial crimes, such as money laundering and terrorist financing.
6. Monitoring compliance with systems, regulations, and rules combating money laundering and terrorist financing.
7. Raising awareness of compliance issues and training employees on their topics through periodic programs.
8. Promptly reporting to the Bank and the audit committee in the joint-stock finance company, or the Manager, or the Board of Managers, or equivalent persons, upon discovering any violations or breaches.

Article 51:

1. A finance company must comply with the regulatory requirements in the Anti-Money Laundering System, the Anti-Terrorism and Terrorist Financing System, their executive regulations, and related rules and guidelines, consistent with the nature of the company's activity and the level of risk it may face. It must also comply with requirements and instructions issued by the Bank related to financial crimes and financial needs.
2. A finance company must comply with requirements set by the Bank regarding cyber risks and related systems, regulations, and instructions.