Implementing Regulation of the Finance Companies Control Law

Rajab 1447H / December 2025G

The Saudi Central Bank has issued this Regulation in accordance with the powers vested in it under the Finance Companies Control Law issued by Royal Decree No. (51/M) dated 13/8/1433H.

---

Part One

Definitions and General Provisions

Article One:

For the purpose of applying the provisions of this Regulation, the terms and expressions mentioned below - wherever they appear in this Regulation - have the meanings specified in the Law, unless the context requires otherwise:

• The Law: The Finance Companies Control Law.
• Financing Laws: The Real Estate Financing Law, the Financial Leasing Law, and the Finance Companies Control Law.
• The Bank: The Saudi Central Bank.
• Micro Consumer Finance Company: A company licensed to engage in the activity of micro consumer finance and no other financing activities.
• Buy Now Pay Later (BNPL) Company: A company licensed to engage in the Buy Now Pay Later activity and no other financing activities.
• Debt Crowdfunding Company: A company licensed to engage in the debt crowdfunding activity and no other financing activities.
• Microfinance Company: A company licensed to engage in the microfinance activity and no other financing activities.
• Micro Consumer Finance Activity: Granting credit for consumption purposes in accordance with the controls stipulated in Article (Ninth) of this Regulation.
• Buy Now Pay Later Activity: Financing the beneficiary to purchase goods or services from merchants without cost, with the deferred amount payable by the beneficiary.
• Debt Crowdfunding Activity: Collecting funds from participants through a debt crowdfunding platform to grant credit contracts to beneficiaries.
• Microfinance Activity: Granting credit in accordance with the controls stipulated in Article (Ninth) of this Regulation.
• Financing Activity or Activities: One or more types of financing specified in Article Tenth of the Law or any other financing activity approved by the Bank in accordance with the same Article.
• Financing Contract: A contract under which credit is granted for the activities specified in the Law and this Regulation.

Regulated Amount: The total amount payable by the beneficiary, distributed over the term of the financing contract after deducting expenses, fees, and costs not mentioned, such as charges, commissions, and administrative service costs.

Cost of Deferment: The value of the deferment charged to the beneficiary under the financing contract, which can be expressed as a fixed or variable annual percentage of the financing amount provided to the beneficiary.

Total Cost of Financing: The costs the beneficiary is committed to paying during the financing amount in accordance with the provisions of the financing contract, including the cost of deferment, charges, commissions, administrative service costs, insurance, and any necessary expenses to obtain financing, excluding any expenses the beneficiary can avoid, such as costs or charges incurred by the beneficiary due to breach of any of its obligations under the financing contract.

Financing Amount: The maximum or total amounts available to the beneficiary under the financing contract.

Total Amount Payable by the Beneficiary: The financing amount plus the total cost of financing.

Annual Percentage Rate: The discount rate calculated in accordance with the provisions of Article Eighty-Five of this Regulation.

Board of Directors: The Board of Directors of the finance company.

Senior Management: The Managing Director, Chief Executive Officer, General Manager and their deputies, the Chief Financial Officer, heads of main departments, and persons responsible for risk management, internal audit, and compliance functions in the finance company.

Exposure: The value of the asset exposed to any credit risks, such as default risk or downgrade in credit rating.

Significant Exposure: Exposure to a single beneficiary amounting to (5%) or more of the paid-in capital and reserves of the finance company.

Controlling Interest: (5%) or more of the shares or stakes in a finance company or voting rights therein, whether owned directly or indirectly by one person or several persons acting in concert.

Article Two:

The Bank shall regulate the financing sector and supervise the activities of finance companies in accordance with the Law and this Regulation, including the following:

1. Licensing the practice of one or more financing activities, in accordance with the provisions of the financing laws and their regulations.
2. Taking necessary measures to preserve the integrity, stability, and fairness of transactions in the financing sector.
3. Taking necessary measures to promote legitimate and fair competition among finance companies.
4. Issuing the necessary rules and instructions to regulate the work of the financing sector.
5. Taking appropriate means to develop the financing sector, localize its jobs, and improve the efficiency of its workers, by regulating the obligations of finance companies regarding human resources training, skill enhancement, and knowledge development.

Article Three:

The provisions of this Regulation shall apply to every legal person licensed to practice one or more of the financing activities specified in Article Tenth of the Law or any other financing activity approved by the Bank in accordance with the same Article.

Part Two

Licensing of Finance Companies

Article Four:

No person shall practice any financing activity without obtaining a license from the Bank in accordance with the Law and this Regulation or other applicable laws.

Article Five:

The financing of goods originating from the enterprises or services of a natural or legal person to increase them is subject to the controls and instructions issued by the Bank.

Article Six:

A finance company shall not practice any activity other than those licensed to it under the financing laws and their regulations.

Article Seven:

The founders of a finance company, or their representatives, shall submit a license application to the Bank, specifying the financing activities for which licensing is sought, accompanied by the following:

1. The license application form prescribed by the Bank, completed.
2. The draft articles of association or bylaws of the finance company, as applicable.
3. A description of the organizational structure of the finance company, including all necessary departments, functions, and main responsibilities for each.
4. A list of the names of the founding members, including the number of shares or stakes for each founding member and their percentage.
5. The solvency requirements form for founding members, signed by each founding member.
6. The solvency requirements form for members of the Board of Directors or the manager or members of the board of managers of the company, or those in their stead, as applicable, signed by each candidate.
7. A feasibility study including the identification of the target market, services to be offered, the business model and strategy of the finance company, and a five-year business plan including at least the following:
   (a) The financing activities for which licensing is sought, the products, and the marketing plan.
   (b) Credit granting policies and procedures.
   (c) Pro forma financial statements, estimates of annual revenues and expenses, financial margins, and sustainable growth rates, taking into account the capital adequacy and liquidity requirements prescribed by the Bank. (d) Estimate of start-up costs and necessary financing. (e) Estimate of ongoing operational financing. (f) Branches the finance company intends to open. (g) Risk monitoring and management and compliance plan and programs. (h) Recruitment and training plan, including an estimate of the number of employees, the percentage of Saudis in each department and administrative level, and employee training and qualification programs.
8. An irrevocable bank guarantee in an amount equivalent to 20% of the minimum paid-in capital for the financing activity or activities for which licensing is sought, in accordance with the form determined by the Bank, issued in favor of the Bank by a local bank or branches of foreign banks, automatically renewed until the full capital is paid. This guarantee shall be released upon the request of the founders in the following cases:
   (a) Payment of the capital.
   (b) Withdrawal of the license application.
   (c) Rejection of the license application by the Bank.
   (d) The company obtaining preliminary approval from the Bank.
9. Draft agreements and contracts proposed with third parties, particularly agreements and contracts with related parties and external service providers.
10. Any other documents or information requested by the Bank.

Article Eight:

1. Subject to the provisions of the Companies Law, the minimum paid-in capital for a finance company shall be as follows:
   (a) SAR 200,000,000 (Two Hundred Million Riyals) for a finance company practicing real estate financing activity.
   (b) SAR 100,000,000 (One Hundred Million Riyals) for a finance company practicing one or more financing activities other than real estate financing.
   (c) SAR 50,000,000 (Fifty Million Riyals) for a finance company practicing the activity of financing small and medium enterprises and no other financing activities.
   (d) SAR 20,000,000 (Twenty Million Riyals) for a finance company practicing micro consumer finance activity and no other financing activities.
   (e) SAR 10,000,000 (Ten Million Riyals) for a finance company practicing micro consumer finance activity through fintech and no other financing activities.
   (f) SAR 10,000,000 (Ten Million Riyals) for a finance company practicing microfinance activity and no other financing activities.
   (g) SAR 5,000,000 (Five Million Riyals) for a finance company practicing debt crowdfunding activity and no other financing activities.
   (h) SAR 5,000,000 (Five Million Riyals) for a finance company practicing Buy Now Pay Later activity and no other financing activities.

2. In the event of combining the financing activities mentioned in paragraphs (c) to (h), the company must meet the minimum paid-in capital requirement for the highest-value activity.

3. The Bank may raise or lower the minimum paid-in capital in accordance with market conditions, or if it deems that the proposed business model, nature of activities, or proposed geographical scope of the activity requires it, taking into account the size and nature of the risks associated with the activity. The capital must be paid in full upon the establishment of the finance company.

Article Nine:

1. The practice of micro consumer finance activity by a micro consumer finance company shall be subject to the following controls:
   (a) The purpose of financing must be the purchase of goods and services for consumption, including, but not limited to, purchasing furniture, consumer goods, household items, or financing education, etc.
   (b) The purpose of financing must not be related to the commercial or professional activities of the beneficiary.
   (c) Financing for the purchase of vehicles is excluded from the micro consumer finance activity.
   (d) The total amount of financing granted to a beneficiary by a micro consumer finance company shall not exceed SAR 60,000 (Sixty Thousand Riyals).
   (e) As an exception to the provision of paragraph (d) of this Article, the total amount of financing granted to a beneficiary by a micro consumer finance company practicing the activity exclusively through fintech shall not exceed SAR 30,000 (Thirty Thousand Riyals). (f) The Bank may adjust the amounts granted to beneficiaries for micro consumer finance in accordance with market conditions or the geographical scope of the micro consumer finance company.

2. The practice of microfinance activity by a microfinance company shall be subject to the following controls:
   (a) The financing must be for the activities and productive assets of beneficiaries who are small business owners, artisans, and those in their stead, whether natural persons or micro-enterprises.
   (b) The amount of financing granted to a beneficiary for microfinance shall not exceed SAR 20,000 (Twenty Thousand Riyals).
   The Bank may increase this amount upon request by the microfinance company in accordance with market conditions or the geographical scope of the microfinance company.

Article Ten:

A finance company licensed to practice debt crowdfunding activity or Buy Now Pay Later activity must comply with the requirements, controls, and rules issued by the Bank for these activities.

Article Eleven:

1. Each founding member must meet the legal and regulatory eligibility requirements and the solvency requirements approved by the Bank. In particular, the following conditions must be met by the founding member:
   (a) They must not have violated the provisions of the Banks Control Law, the Capital Market Law, the Cooperative Insurance Companies Control Law, or their regulations, or the financing laws or their regulations.
   (b) No final judgment must have been issued against them for opening any bankruptcy proceedings, in accordance with the provisions of the Bankruptcy Law.
   (c) They must not have been convicted of any crime involving dishonesty, unless their reputation has been restored and a period of not less than ten years has passed since the execution of the sentence imposed for this crime, and provided that a letter from the Bank is obtained stating no objection to this. (d) They must not have previously submitted a request to withdraw a license to practice a financing activity within the past two years. (e) They must not have had a license to practice a financing activity rejected by the Bank within the past five years. (f) They must have sufficient financial solvency, and must not have breached any financial obligation towards their creditors, nor show signs of inability to continue fulfilling their financial obligations towards their creditors.

2. If it appears that a founding member or a holder of a controlling interest fails to meet the legal or regulatory eligibility requirements or the solvency requirements approved by the Bank, the Bank may, at any time, prohibit them from exercising the right to vote on the finance company's decisions, or require them to obtain written no-objection from the Bank before exercising this right, to safeguard the performance of the finance company and apply governance principles and protect the interests of stakeholders in the finance company.

3. A letter from the Bank stating no objection must be obtained before acquiring a controlling interest in a finance company.

4. If the founding member or the person intending to acquire shares or stakes in a finance company is an entity, the provisions of this Article shall apply to anyone owning 5% or more of the capital or voting rights in that entity.

Article Twelve:

Each person on the Board of Directors, manager, or members of the board of managers of the company, or those in their stead, as applicable, must meet the professional eligibility requirements and the solvency requirements approved by the Bank. In particular, the following conditions must be met:

1. They must not have violated the provisions of the Capital Market Law and its regulations, or been convicted of violating the Banks Control Law, the Cooperative Insurance Companies Control Law, or the financing laws or their regulations.
2. They must not have been convicted of any crime involving dishonesty, unless their reputation has been restored and a period of not less than ten years has passed since the execution of the sentence imposed for this crime.
3. They must have sufficient financial solvency, and must not have any existing breach of a financial obligation towards their creditors.

Article Thirteen:

Each candidate for a position in Senior Management must meet the professional eligibility requirements and the solvency requirements approved by the Bank. In particular, the following conditions must be met by the Senior Management candidate:

1. They must be resident in the Kingdom during the period of holding the position.
2. They must be theoretically and practically qualified, and have appropriate experience in the same field of not less than five years, with the Bank having the right to assess this.
3. As an exception to the provisions of paragraph (2) of this Article: The experience period in micro consumer finance companies, microfinance companies, Buy Now Pay Later companies, and debt crowdfunding companies shall be two years. The Bank has the right to assess whether the candidate meets this duration.
4. They must not have been dismissed or removed from a position for disciplinary reasons within the previous three years, with the Central Bank having the right to approve the candidate based on available data.
5. They must not have violated the provisions of the Capital Market Law and its regulations, or been convicted of violating the Banks Control Law, the Cooperative Insurance Companies Control Law, or the financing laws or their regulations.
6. No final judgment must have been issued against them for opening any bankruptcy proceedings, in accordance with the provisions of the Bankruptcy Law.
7. They must not have been convicted of any crime involving dishonesty, unless their reputation has been restored and a period of not less than ten years has passed since the execution of the sentence imposed for this crime, and provided that a letter from the Bank is obtained stating no objection to this.
8. They must have sufficient financial solvency, and must not have any existing breach of a financial obligation towards their creditors.

Article Fourteen:

1. The license application must meet all requirements prescribed in the Law and this Regulation. The founding members of the finance company must provide the Bank with any additional information or documents requested within (30) thirty working days from the date of the request.
2. The Bank may reject the license application in the event of non-compliance with the time limit mentioned in paragraph (1) of this Article.
3. The Bank shall notify the license applicant in writing of the completion of their application after meeting all requirements prescribed in the Law and this Regulation.
4. The Bank shall notify the license applicant in writing of preliminary approval or reasoned rejection within (60) sixty working days from the date of notifying the license applicant of the completion of their application. The Bank's preliminary approval does not prevent licensing or authorize the practice of financing activities.

Article Fifteen:

1. The founding members must complete the establishment of the finance company within six months from the date of the Bank's preliminary approval and provide the Bank with a copy of the company's commercial registration and its articles of association or founding contract, as applicable, including the activities mentioned in the Bank's preliminary approval. The validity of the Bank's preliminary approval expires by operation of law after six months from the date of that approval, and this period may be extended for a maximum of six months upon obtaining a letter from the Bank stating no objection before the specified period expires.
2. The founding members must complete the company's readiness within twelve months from the date of issuance or amendment of the commercial registration. After this period expires, the Bank may close the license application or reject it.

Article Sixteen:

1. The Bank shall issue a decision granting the license to the company after completing its establishment procedures and submitting license applications proving the full payment of capital and any additional initial financing specified in the business plan, and taking all necessary steps to begin practicing the financing activities for which licensing is sought, such as providing human resources, technical systems, and necessary equipment.
2. The Bank may take necessary measures to verify that the company meets the requirements mentioned in paragraph (1) of this Article and related laws, regulations, rules, and instructions, such as conducting licensing, supervisory, or inspection visits to the company's premises and those of its officials, and reviewing its systems, procedures, and records. The company must address observations noted during visits and commit to implementing recommendations and instructions issued by the Bank.

Article Seventeen:

The Bank shall specify in the license the financing activity or activities licensed to the finance company to practice, and may restrict the license with special conditions specifying the geographical area in which the finance company is licensed to operate or the beneficiaries licensed to deal with, or other conditions.

Article Eighteen:

The license shall be valid for five years, and the Bank may renew it upon request by the finance company in accordance with the requirements specified in this Regulation. The company shall submit the renewal request to the Bank at least six months before the expiration of the license term, in accordance with the form prescribed by the Bank, accompanied by the following:

1. The finance company's strategy and updated five-year business plan, including at least the following:
   (a) Marketing plan, taking into account current products and products to be developed.
   (b) Credit granting policies and procedures.
   (c) Pro forma financial statements, estimates of annual revenues and expenses, financial margins, and targeted growth rates compared to the finance company's performance during the previous five years, taking into account any changes to the company's strategy and business plan. (d) Estimates of expected capital adequacy and liquidity levels, compared to those during the previous five years, taking into account any changes to the company's strategy and business plan. (e) Estimate of ongoing operational financing. (f) Branches the finance company intends to open. (g) Report on risks the finance company was exposed to during the previous five years, how they were handled and managed, including compliance risks and cases of violation of laws, regulations, or instructions, and the company's plan and future programs for risk and compliance management. (h) Current number of employees, and the percentage of Saudi employees in each department and administrative level. (i) Recruitment and training plan, including employee training and qualification programs.
2. The financial consideration required for license renewal.
3. Any other documents or information requested by the Bank.

Article Nineteen:

A finance company shall not cease practicing its activity for a period exceeding three consecutive months, except with the Bank's prior written approval, and in accordance with the controls issued by the Bank on this matter.

Article Twenty:

A finance company may request to amend the license by adding or deleting some financing activities, or amending any condition or restriction therein. The request must be based on reasonable grounds for the amendment and accompanied by any documents, information, or studies requested by the Bank. In the event that the amendment results in adding a new activity or modifying the licensed activity, the company must meet the specific requirements for it in accordance with the Law, this Regulation, and related rules.

Article Twenty-One:

1. The Bank may revoke the license in the following cases:
   (a) Upon request by the finance company, taking into account the rights of creditors and beneficiaries and the integrity of the financial system.
   (b) If it is established that the finance company provided the Bank with false information or omitted to disclose material information it was required to disclose for licensing purposes.

2. Revocation of the license results in the classification of the finance company.

Article Twenty-Two:

1. The license shall terminate in the following cases:
   (a) Expiration of the license term without renewal.
   (b) Appointment of a conservator for the finance company.
   (c) Expiration of the term of the finance company, if any.
   (d) Issuance of a judgment declaring the bankruptcy of the finance company.

2. Termination of the license results in the finance company ceasing to practice any of the financing activities.

3. The finance company must comply with instructions issued by the Bank upon the occurrence of any of the license termination cases mentioned in paragraph (1) of this Article.

Article Twenty-Three:

The finance company must completely stop its financing activities in the event of suspension of its license in accordance with the provisions of Article Twenty-Nine of the Law, and it shall not practice any of those activities except after obtaining a letter from the Bank stating no objection to this.

Article Twenty-Four:

1. The Bank shall collect a financial consideration as follows:
   (a) SAR 200,000 (Two Hundred Thousand Riyals) for issuing the license.
   (b) SAR 100,000 (One Hundred Thousand Riyals) for renewing the license.
   (c) SAR 50,000 (Fifty Thousand Riyals) for amending the license.

2. As an exception to the provisions of paragraph (1) of this Article, the Bank shall collect a financial consideration as follows:
   (a) The financial consideration for issuing, amending, or renewing a license to practice micro consumer finance activity shall be SAR 20,000 (Twenty Thousand Riyals).
   (b) The financial consideration for issuing, amending, or renewing a license to practice micro consumer finance activity through fintech shall be SAR 10,000 (Ten Thousand Riyals).
   (c) The financial consideration for issuing, amending, or renewing a license to practice microfinance activity shall be SAR 10,000 (Ten Thousand Riyals).
   (d) The financial consideration for issuing a license to practice debt crowdfunding activity and Buy Now Pay Later activity shall be SAR 5,000 (Five Thousand Riyals), and the financial consideration for renewing or amending the license shall be SAR 20,000 (Twenty Thousand Riyals).

Article Twenty-Five:

1. The finance company must obtain a letter from the Bank stating no objection before launching any new financing products or amending any existing financing products directed at individuals or beneficiaries of microfinance.
2. The Bank may stop any of the financing products provided by the finance company if the integrity of the financing sector requires it.

Part Three

Capital Adequacy and Liquidity

Article Twenty-Six:

The finance company must comply with the capital adequacy and liquidity levels required in accordance with the tables, requirements, and standards approved by the Bank.

Article Twenty-Seven:

The finance company must comply with the following:

1. Providing the Bank with prudential data at specified times in accordance with the forms, controls, and instructions determined by the Bank.
2. Providing the Bank with any reports, data, or information requested in accordance with the forms and instructions and at the time determined by the Bank.

Article Twenty-Eight:

The finance company must obtain a letter from the Bank stating no objection before listing its shares in the capital market.

Article Twenty-Nine:

The finance company must obtain a letter from the Bank stating no objection before approving any distribution of profits or any other distributions, or recommending or announcing them, after ensuring that the following conditions are met:

1. The distribution does not lead to a decrease in capital adequacy and liquidity levels below the prescribed levels.
2. The total distributions in the financial year do not exceed the profits realized during the previous financial year.
3. Any other conditions approved by the Bank.

Part Four

Ownership and Assets

Article Thirty:

Subject to what is mentioned in Article (Eleven) of the Law, a finance company shall not practice any activity other than financing, or own an enterprise practicing any activity other than financing, whether directly or indirectly, except after meeting the conditions or controls set by the Bank.

Article Thirty-One:

1. A finance company shall not acquire assets other than those necessary for managing its business except after obtaining a letter from the Bank stating no objection.
2. A finance company shall not carry out any partial or complete liquidation of its activity or the company itself without obtaining a letter from the Bank stating no objection.

Part Five

Corporate Governance

Article Thirty-Two:

The finance company must comply with the corporate governance rules approved by the Bank.

Article Thirty-Three:

The finance company must develop internal corporate governance rules, put in place a special bylaw for them, and have them approved by the Board of Directors, manager, or members of the board of managers, or those in their stead, as applicable, and provide the Bank with a copy thereof. This bylaw must include at least the following:

1. A description of the organizational structure, including all departments and functions, and the tasks and responsibilities of each.
2. Controls for independence and segregation of duties.
3. Competencies of the Board of Directors, managers, or members of the board of managers, or those in their stead, and the committees, their formation, and responsibilities for each.
4. Compensation and bonus policies.
5. Controls for working in cases of conflict of interest.
6. Guarantees of integrity and transparency.
7. Guarantees of compliance with related laws, regulations, and instructions.
8. Means of maintaining information confidentiality.
9. Guarantees of fair dealing.
10. Controls for protecting the company's assets.

Article Thirty-Four:

The Board of Directors in a joint stock finance company shall form a specialized committee to expand the scope of its work in areas requiring specific expertise. The Board of Directors shall enumerate its authorities and monitor its performance, including at least an audit committee and another for risk and credit management.

Part Six

Internal Organization

Article Thirty-Five:

The finance company must put in place appropriate written regulatory policies, including work manuals and operational procedures, and update them periodically. These must be communicated to relevant employees in an appropriate manner and at a time that allows them to comply with them. Regulatory policies must include at least the rules governing the following:

1. Organizational and operational structure, method of exercising competencies, and determination of responsibilities.
2. Credit granting and operational processes.
3. Financial and accounting management.
4. Marketing and sales.
5. Information technology.
6. Customer service and collection.
7. Risk identification, management, monitoring, and disclosure.
8. Internal control system.
9. Internal audit.
10. Compliance with related laws, regulations, and instructions.
11. Assignment of tasks to external service providers.
12. Salaries, bonuses, and barriers, including salaries of Senior Management and employees, their incentives, and bonuses for members of the Board of Directors, manager, members of the board of managers, or those in their stead, as applicable, and committees.

Article Thirty-Six:

A finance company shall not combine an executive function, such as financing or hedging, with a supervisory function, such as internal audit, risk, or accounting. Duties must be segregated to ensure the implementation of standard procedures, policies, and technical standards to safeguard the company's assets and funds and prevent fraud and embezzlement.

---

Article 37:

1. The technical equipment in a finance company and the associated systems must be sufficient for the company's operational needs, the nature of its activity, and its risk profile, in accordance with recognized technical standards and consistent with what the Bank issues in this regard.

2. Information technology systems and related procedures must be designed to ensure the availability, integrity, and confidentiality of information. The finance company must evaluate this periodically in accordance with recognized technical standards, and it must be selected before first use and after any changes are made to it.

3. The finance company must put in place a plan ensuring business continuity in emergency situations, including alternative solutions to resume its activity within a suitable period.

Article 38:
The finance company must preserve all working documents, records, and files in an organized, transparent, and secure manner, in compliance with relevant systems and instructions. It must verify the completeness of files and update them periodically for a period of at least ten years from the date the relationship with the client ends, which includes all transactions related to clients.

Article 39:
The finance company must have sufficient and qualified human resources in terms of knowledge and experience to meet operational needs, business activities, and risk profiles. The financial rewards and incentives provided by the finance company to its employees must be fair and balanced with the company's strategy, and must not give rise to conflicts of interest.

Article 40:

1. The ratio of human resource localization must not be less than (50%) when the finance company begins its activities, at all administrative levels.
2. The localization of human resources must be increased annually by at least (5%) of the total of these resources until the ratio reaches (70%), and the Bank may set a minimum for the annual increase in the localization ratio thereafter.
3. The appointment of non-Saudis in a finance company is restricted to positions requiring expertise not available in the Saudi labor market. In all cases, the finance company must obtain a letter from the Bank confirming no objection before appointing any non-Saudi employee in supervisory departments, after the finance company provides proof establishing the unavailability of Saudis to fill the position and submits a plan for replacing the position with a qualified Saudi for the necessary duration.

Chapter Seven
Outsourcing Tasks to External Service Providers

Article 41:

1. The Board of Directors, Managers, Board of Directors members, or those in their stead – as applicable – shall issue a written policy governing the outsourcing of tasks to external service providers and review it annually. This policy must include, in particular:
   (a) The competencies of the Board of Directors, Managers, Board of Directors members, or those in their stead – as applicable – and senior management, and their responsibilities.
   (b) Criteria for qualifying the external service provider.
   (c) Criteria for identifying risks and how to hedge against them.
   (d) Rules for continuous monitoring and supervision of operations outsourced to external service providers.
   (e) Criteria for identifying conflicts of interest and rules and procedures ensuring that the interests of the finance company are not compromised or overridden by the interest of another party.
   (f) Procedures for protecting information and maintaining its confidentiality and privacy.

2. The Bank, the external auditor, and the finance company have the right to obtain or access any information or documents related to the work of the external service provider at its premises.

3. The finance company must verify the external service provider's compliance with relevant systems, regulations, and instructions. The finance company is not exempt from liability in the event that the external service provider fails to comply with the prevailing systems, regulations, and instructions in any of the operations and tasks assigned to it.

4. The finance company must comply with the rules on outsourcing issued by the Bank.

Chapter Eight
Risk Management

Article 42:
The finance company must do the following:

1. Develop a clear written business strategy and a written risk management policy approved by the Board of Directors, Managers, Board of Directors members, or those in their stead – as applicable – and update them annually. The risk management policy must consider the identification, classification, and analysis of all types of related risks and the manner of dealing with them, taking into account all business activities, including operations and tasks outsourced to external services. It must include, at a minimum, the analysis of the following risks:
   (a) Credit risks.
   (b) Market risks.
   (c) Forward interest rate risks.
   (d) Asset-liability mismatch risks.
   (e) Foreign exchange rate risks.
   (f) Liquidity risks.
   (g) Operational risks.
   (h) Risks in other countries where the finance company operates.
   (i) Legal risks.
   (j) Reputational risks.
   (k) Technical risks.

2. Develop appropriate procedures for identifying, assessing, managing, monitoring, and reporting on risks, and place them within a comprehensive risk management framework that ensures the following:
   (a) Early and comprehensive identification of risks.
   (b) Assessment of relationships between risks.
   (c) Periodic coordination with the Board of Directors, Managers, Board of Directors members, or those in their stead – as applicable – and the Risk and Credit Management Committee of the joint-stock finance company, senior management, responsible employees, and internal audit management if necessary.

3. Establish a risk management department that reports directly to the Risk and Credit Management Committee of the joint-stock finance company. The Risk and Credit Management Committee must submit its views on risk management reports to the Board of Directors.

Article 43:
The risk management department prepares a quarterly risk report for discussion by the Risk and Credit Management Committee and the Board of Directors, Managers, Board of Directors members, or those in their stead – as applicable – based on senior management review. This report must include, at a minimum:

1. A comprehensive review of risk developments and the performance of financial positions exposed to market price risks, as well as situations where permitted limits are exceeded.
2. Changes occurring in the assumptions and factors on which risk assessment procedures were based.
3. The performance of the financing portfolio according to activity, risk type, size, and collateral type.
4. The extent of granted limits, external credit lines, and significant exposures stipulated in Article 59 of this Regulation, and other significant exposures, such as variable financings, and comments on them.
5. An analysis of situations where the finance company exceeded permitted limits, stating the reasons, the size and development of new business, and risk allocations in the company.
6. Any major financing decisions that do not align with the finance company's strategies or policies.

Article 44:
The finance company must provide the Bank with the report referred to in Article 43 of this Regulation after it has been discussed by the Risk and Credit Management Committee and the Board of Directors of the joint-stock finance company or its manager or Board of Directors members, or those in their stead – as applicable – and approved, including the decisions taken regarding it.

Chapter Nine

Compliance

Article 45:

1. The finance company must comply with prevailing systems, regulations, and instructions, and take the necessary measures and controls to ensure compliance with their provisions without violation.

2. The finance company must comply with the compliance principles for finance companies and mortgage refinance companies issued by the Bank.

Article 46:

The finance company must do the following:

1. Establish an independent department or position responsible for compliance duties, and appoint a Compliance Officer who reports directly to the Audit Committee of the joint-stock finance company or Board of Directors members, or those in their stead, in non-joint-stock finance companies. The Audit Committee must submit its views on compliance reports to the Board of Directors in joint-stock companies.

2. Prepare a written compliance policy to be approved by the Board of Directors, Managers, Board of Directors members, or those in their stead – as applicable – which includes the authorities, obligations, and responsibilities of the compliance department, compliance programs, and related procedures. The Audit Committee in the joint-stock finance company or Managers, Board of Directors members, or those in their stead in non-joint-stock finance companies must verify the application of this policy, evaluate its effectiveness, update it, and propose necessary amendments annually.

3. Take the necessary measures to ensure the implementation of the compliance policy referred to in paragraph (2) of this Article.

Article 47:

1. The Compliance Officer is appointed by decision of the Board of Directors, Managers, Board of Directors members, or those in their stead – as applicable – based on the recommendation of the Audit Committee of the joint-stock finance company and after obtaining a letter from the Bank confirming no objection to this.

2. The Compliance Officer enjoys independence in performing assigned duties. He/She is not permitted to perform any other duties.

Article 48:

The Compliance Officer must submit a report on compliance to the Audit Committee of the joint-stock finance company at least quarterly for review, discussion, documentation of implemented measures and resulting decisions, and submission to the Board of Directors, Managers, Board of Directors members, or those in their stead – as applicable – for review and approval. The report must include the main risks related to non-compliance facing the finance company, analyze existing operations and procedures, evaluate their effectiveness, and propose any amendments or changes.

Article 49:

The number of employees and resources in the compliance department must be sufficient and commensurate with the finance company's business model and size. Compliance staff must report only to the Compliance Officer in the performance of their duties.

Article 50:

The compliance department is responsible for verifying the finance company's compliance with prevailing systems, regulations, and instructions, and performing the necessary tasks for this, including the following:

1. Identifying all non-compliance risks, dealing with them, and monitoring their developments.

2. Analyzing any policies, procedures, operations, and descriptions found, and describing procedures for dealing with related non-compliance risks.

3. Following a risk-based program and including the results reached in the report referred to in Article 48 of this Regulation.

4. Collecting compliance-related complaints and preparing written guidelines for employees whenever necessary.

5. Preparing internal policies and procedures to combat financial crimes, such as money laundering and terrorism financing crimes.

6. Monitoring compliance with systems, regulations, and rules on combating money laundering and terrorism financing.

7. Raising awareness of compliance issues and training employees on their topics through periodic programs.

8. Immediately reporting to the Bank and the Audit Committee of the joint-stock finance company or Managers, Board of Directors members, or those in their stead – as applicable – in the event of discovering any violations or infractions.

Article 51:

1. The finance company must comply with the regulatory requirements contained in the Anti-Money Laundering System, the System for Combating Terrorism and its Financing Crimes, and their executive regulations, as well as related rules and guidelines, commensurate with the nature of the company's activity and the level of risks it may be exposed to. It must also comply with the requirements and instructions issued by the Bank related to financial crimes and financial fraud.

2. The finance company must comply with the requirements set by the Bank regarding cyber risks and related systems, regulations, and instructions.