Instructions for Practicing Aggregation Activity

Instructions for Practicing Aggregation Activity May 2023 (Shawwal 1444H) The Saudi Central Bank (SAMA) issued these Instructions based on the powers vested in SAMA under the Finance Companies Control Law issued by Royal Decree No. M/51 dated 13/08/1433H Important note:
To keep abreast of the latest updates and amendments of SAMA’s instructions, SAMA always advises you to use the documents published on its website: www.sama.gov.sa

Table of Contents
Section Page No.
Section I. Definitions and General Provisions 3

1. Definitions 3
2. General Provisions 3
   Section II. Regulatory and Technical Instructions 4
3. Technological Equipment 4
4. Requirements for the Accuracy of Information Provided 4
5. Requirements for the Retention of Information Provided 5
6. Conflict of Interest 5
7. Disclosure 5
8. Obligations of the Entity 6
   Section III. Contract Requirements Between Parties 7
9. Contract Signed Between Entity and Consumer 7
10. Contract Signed Between Entity and Financier 8
    Section IV. Concluding Provisions 9

Section I
Definitions and General Provisions

1. Definitions:
   1.1 The terms and phrases mentioned herein shall have the same meanings stated
   in the Rules of Licensing Finance Support Activities.
   1.2 The following terms and phrases, wherever used herein, shall have the
   corresponding meanings unless the context requires otherwise:
   1.2.1 SAMA: The Saudi Central Bank.
   1.2.2 Instructions: The Instructions for Practicing Aggregation Activity.
   1.2.3 Activity: Aggregation activity.
   1.2.4 Financier: Banks, finance companies, and entities licensed to engage in
   finance activities under the laws applicable in Saudi Arabia.
   1.2.5 Consumer: A person to whom services are offered by the entity.
   1.2.6 Entity: An entity licensed by SAMA to practice aggregation activity.
   1.2.7 Platform: Any electronic means used to carry out the activity, including
   websites and applications.
   1.2.8 Documented Channels: An approved, recorded and verifiable contact
   method that can be retrieved electronically, such as text messages and emails.
2. General Provisions:
   2.1 These Instructions aim to set the minimum standards and procedures
   necessary for carrying out the activity.
   2.2 These Instructions shall apply to entities licensed by SAMA to engage in the
   activity.
   2.3 The activity shall not be carried out except after obtaining a license from SAMA
   in accordance with the Rules of Licensing Finance Support Activities and the relevant laws.
   2.4 These Instructions shall not prejudice the provisions contained in relevant laws
   and instructions, including, but not limited to, the following:
   2.4.1 The Finance Companies Control Law issued by Royal Decree No. M/51
   dated 13/08/1433H and its Implementing Regulations.
   2.4.2 The Rules of Licensing Finance Support Activities issued by SAMA.
   2.4.3 The Cyber Security Framework issued by SAMA.

2.4.4 The Business Continuity Management Framework issued by SAMA.
2.4.5 The Financial Consumer Protection Principles and Rules issued by SAMA.
Section II
Regulatory and Technical Instructions
3. Technological Equipment:
The entity shall ensure that its technological equipment and related systems are sufficient for its operational needs and the nature of the activity and in line with the best practices and SAMA’s instructions issued in this regard. In addition, as a minimum, the entity shall maintain, develop and operate the platform to carry out the activity according to SAMA’s instructions and shall develop standard technical interfaces to communicate with financiers, exchange information, and receive and process finance offers and applications.
4. Requirements for the Accuracy of Information Provided:
4.1 The entity shall, using reliable and independent sources, verify the identity of
the consumer and ensure the validity of the information and documents provided online before sending them to the financier. Such procedure shall be documented in accordance with the instructions issued by SAMA.
4.2 The entity shall establish the necessary internal procedures to ensure the
validity and accuracy of finance offers before presenting them to the consumer.
4.3 The entity shall create an electronic record for each consumer and comply
with the Electronic Transactions Law and its Implementing Regulations. The entity shall also establish the necessary procedures and measures to ensure that the information provided is correct and up-to-date, including, at a minimum:
4.3.1 Sending an authentication code to verify the consumer’s phone
number.
4.3.2 Developing the procedures necessary to ensure the provision of up￾to-date information, such as the national address.

5. Requirements for the Retention of Information Provided:
   Taking into account the laws and instructions related to data and information protection issued by the competent authorities, the entity shall, at a minimum:
   5.1 Develop the necessary procedures and controls to maintain the
   confidentiality of all data and information obtained through the platform, and not disclose such data and information to any external party unless SAMA’s prior approval is obtained and in a manner consistent with the relevant regulations.
   5.2 Ensure the security, integrity and availability of the information provided
   through the platform, including, but not limited to, the information provided for the consumer and the information collected and stored by the entity or the other party it contracted with as a service provider. The entity shall particularly protect the consumer’s personal information from loss and unauthorized access, including use, modification and disclosure.
   5.3 Keep all consumer documents, records and files in an orderly, clear and safe
   manner and ensure that all files are complete and updated regularly, for a period of at least 10 years from the date of the end of the relationship with the consumer.

6. Conflict of Interest:
   The entity shall develop an appropriate written organizational policy that addresses potential conflicts of interest. Such policy must include adequate measures to be taken to avoid and address any conflict of interest to ensure fair treatment of all consumers and financiers.

7. Disclosure:
   The entity shall:
   7.1 Clarify and post on its platform all terms and conditions of the platform,
   security instructions, payment methods, information confidentiality, any other instructions related to the use of the platform, and all data that must be disclosed under the relevant laws and instructions.
   7.2 Disclose all fees and commissions charged for the entity’s services.
   7.3 Post on its platform the entity’s licensing information.

8. Obligations of the Entity:
   8.1 The entity shall strengthen the platform’s cybersecurity and promptly deal
   with any cases of breach. In case of a breach, the entity shall immediately notify SAMA.
   8.2 The entity shall ensure that the electronic linkage between the entity and the
   financier serves the provision of aggregation activity only and is not used for any other purposes, unless approved by SAMA.
   8.3 The entity shall have on its platform a feature that allows consumers to
   communicate directly with the entity to submit feedback and complaints. This feature must also allow for documentation and preservation of any communication occurring through it.
   8.4 The entity shall set appropriate approvals and acknowledgments and allow
   consumers to read and agree to them before using the platform, provided that such approvals and acknowledgments are shown as a Pop-Up Window.
   8.5 The entity shall inform, through the documented channels, the consumer of
   the reason if the finance application is not accepted or of the need to submit additional documents if required.
   8.6 The entity shall consider the needs and desires of consumers and provide
   them with information in a clear, transparent and not misleading manner.
   8.7 The entity shall provide visual and print messages and materials to raise
   awareness of and educate consumers about major risks, thus helping them make informed and effective decisions before obtaining finance from the financier.
   8.8 The entity shall not receive or deliver funds on behalf of the financier unless
   SAMA’s approval is obtained.
   8.9 The entity shall make a list of the financiers it deals with so that the consumer
   can choose from them.
   8.10 The entity shall not participate in any marketing campaigns for any financier
   and shall not prefer a financier to another.
   8.11 The entity shall obtain the consumer’s consent before examining their credit
   record held with one or more credit bureaus and before sharing the consumer’s credit information with the financier, in a manner consistent with the relevant laws and instructions.
   8.12 The entity shall offer the consumer the available financing options, provided
   that such options are consistent with the credit policies or standards

communicated by the financier. If the financier’s credit policies or standards do not apply to the consumer, the entity shall explain the reasons to the consumer through the platform.
8.13 In the event that finance is approved, the entity shall send a message to the
consumer through the documented channels. The message must state the basic information of the finance product in a clear, accurate, understandable and not misleading manner, accompanied by the phone numbers of the complaint centers/customer service at the entity and the financier.
8.14 The entity shall periodically update the information on services and products
provided by the financier for the consumer. Such information must be clear, concise, understandable, accurate and not misleading and must include, at a minimum, the following:
8.14.1 Key conditions and features.
8.14.2 Clarification of the rights and responsibilities of each party.
8.14.3 Details of the prices and commissions charged by the financier.
8.14.4 Details of fines, risks and the mechanism for terminating the
relationship, along with the consequences thereof.
8.14.5 Details about the alternative products and services offered by other
financiers.
Section III
Contract Requirements Between Parties
9. Contract Signed Between Entity and Consumer:
The entity shall draw up a contract between the entity and the consumer in accordance with the relevant legal requirements. Each party shall receive a copy of the contract that must clarify, at least, the following:
9.1 Contract parties.
9.2 Contract scope.
9.3 Contract term.
9.4 Desired type of finance, its duration, specifications — if any — and
requirements.
9.5 Rights and obligations of the contract parties.
9.6 Pricing and fee structure.
9.7 Withdrawal procedures and conditions.

9.8 Dispute resolution mechanism.
9.9 Contract termination and expiration.
9.10 Any other data or information required by SAMA.
10. Contract Signed Between Entity and Financier:
The entity shall draw up a paper or electronic contract between the entity and the financier in accordance with the relevant legal requirements. Each party shall receive a copy of the contract that must clarify, at least, the following:
10.1 Contract parties.
10.2 Financier’s licensing number and date.
10.3 Contract scope.
10.4 Contract term, provided that the contract term is consistent with the validity
of relevant licenses of both parties.
10.5 Rights and obligations of the contract parties.
10.6 Pricing and fee structure.
10.7 Mechanisms for exchanging data and information of finance offers and for
updating them periodically.
10.8 Withdrawal procedures and conditions.
10.9 Service levels, performance requirements, and mechanisms of reporting and
escalation.
10.10 The financier’s obligation to notify the entity through the platform when
the finance contract is issued.
10.11 Dispute resolution mechanism.
10.12 Information confidentiality, privacy and security.
10.13 Commitment of the parties to fulfill the obligations stipulated in the
relevant laws, regulations, rules, guidelines and instructions. The financier is not exempted from meeting its obligations.
10.14 Prohibition of subcontracting.
10.15 Consequences of contract renewal and renegotiation.
10.16 Contract termination and expiration.
10.17 Any other data or information required by SAMA.

Section IV
Concluding Provisions
11. Non-compliance with these Instructions shall be deemed a violation of the
Finance Companies Control Law.
12. SAMA may exempt the entity from applying any of the requirements contained
in these Instructions.
13. These Instructions shall be published on the official website of SAMA and shall
enter into force on the date of their approval.

P.O. Box 2992, Riyadh 11169,
Kingdom of Saudi Arabia
Tel.: +966 11 463 3000, www.sama.gov.sa