Rules for Regulating Buy-Now-Pay-Later (BNPL) Companies

Classification:
Public - عام
Rules for Regulating Buy-Now-Pay-Later
(BNPL) Companies
November 2023 (JUMADA’ I 1445H)
The Saudi Central Bank (SAMA) issued these Rules based on the powers vested in SAMA under the Finance Companies Control Law issued by Royal Decree No. M/51 dated 13/08/1433H. Important note:
For the updated and amended Rules, SAMA strictly advises you to use the documents published on its website: www.sama.gov.sa

Classification:
Public - عام
Table of Contents
Chapter Page No.
Chapter I. Definitions and General Provisions 3
Chapter II. Licensing Provisions 4
Chapter III. Internal Organization 7
Chapter IV. Activity Provisions 9
Chapter V. Supervision and Compliance 13
Chapter VI. Concluding Provisions 14

Classification:
Public - عام
Chapter I. Definitions and General Provisions
Article 1: Definitions

1. The terms and phrases mentioned in these Rules shall have the same meanings
   stated in the Finance Companies Control Law.
2. The following terms and phrases, wherever mentioned in this document, shall
   have the meanings assigned to them unless the context otherwise requires:
   SAMA: The Saudi Central Bank.
   Law: Finance Companies Control Law.
   Rules: The Rules Governing BNPL Companies.
   BNPL Activity: A type of financing that allows a consumer to purchase goods or services without a term cost payable by the consumer. BNPL Company: A joint stock company licensed by SAMA to engage in BNPL activity. Consumer: Beneficiary of the activity. Stores: Sales outlets and places where goods and services are provided.
   Article 2: Scope of Application
   These Rules apply to companies licensed by SAMA to engage in BNPL activity.
   Article 3: General Provisions
3. These Rules aim to:
   a. Establish licensing procedures and requirements for BNPL activity. b. Set the minimum standards and procedures necessary for carrying out BNPL activity.
4. BNPL activity shall not be carried out except after obtaining a license from
   SAMA in accordance with the provisions of the Law, the requirements set forth in these Rules, and any instructions issued by SAMA in this regard from time to time.
5. These Rules shall not prejudice the provisions of relevant regulations, including,
   but not limited to:
   a. The Finance Companies Control Law issued by Royal Decree No. M/51 dated 13/08/1433H. b. The Requirements for Appointments to Senior Positions in Financial Institutions Supervised by SAMA.

Classification:
Public - عام
c. The Cyber Security Framework issued by SAMA.
d. The Business Continuity Management Framework issued by SAMA. e. The Financial Consumer Protection Principles and Rules issued by SAMA. f. Debt Collection Regulations and Procedures for Individual Customers issued by SAMA.
Chapter II. Licensing Provisions
Article 4: License Requests
The license application for engaging in BNPL activity shall be submitted to SAMA along with the following items:

1. A completed license application in the form provided by SAMA.
2. A copy of the commercial register, memorandum of association, and articles of
   incorporation (if any).
3. A list of the founding members or shareholders of the company, including the
   number and percentage of shares of each member or shareholder in the company.
4. The Fit and Proper Form for founding members or shareholders, signed by each
   founding member or shareholder.
5. The Fit and Proper Form for Bord members, signed by each candidate for Bord
   membership.
6. Information about the BNPL company’s owners and organizational structure,
   including all key departments and functions and their main tasks.
7. The feasibility study and business plan.
8. An irrevocable bank guarantee for an amount equivalent to the minimum
   capital, issued in favor of SAMA by a bank licensed to operate in Saudi Arabia and renewed automatically until the capital is paid in full, if the license application is submitted for a BNPL company under establishment. Such guarantee shall be released upon the request of the license applicant in any of the following cases:
   a. If the capital is paid in cash. b. If the license request is withdrawn.
   c. If the license request is rejected.
9. Any other documents or information required by SAMA.

Classification:
Public - عام
Article 5: Capital
Pursuant to the provisions of the Companies Law, the minimum capital for the BNPL company shall be SAR 5,000,000 (five million Saudi riyals), subject to increase or decrease by SAMA as it deems appropriate.
Article 6: Management Requirements
All candidates for supervisory and executive positions in a BNPL company shall:

1. Meet the professional eligibility requirements set by SAMA.
2. Be permanent residents of the Kingdom of Saudi Arabia.
3. Be theoretically and practically qualified and have sufficient experience in the
   field.
4. Meet any other requirements set by SAMA.
   Article 7: Licensing Procedures
5. The applicant shall provide SAMA with any additional information or
   documents required by SAMA within 30 working days from the request date.
6. In case of failure to meet the period requirement specified in paragraph (1) of
   this Article, SAMA may reject the license application.
7. SAMA issues a written notice to the applicant after the completion of all the
   requirements set forth in the relevant rules and regulations.
8. SAMA informs the applicant of the initial approval or justified rejection in
   writing within 60 working days from the date the applicant receives notification of application completeness. Such initial approval does not constitute a license or permit to carry out the activity.
   Article 8: Requirements for BNPL Company Incorporation and Business
   Activity Registration
9. If a company is under establishment, the founding members shall satisfy the
   requirements necessary to engage in BNPL activity within six months from the date of initial approval, and provide SAMA with a copy of the commercial register containing the company’s activity and articles of incorporation. In case of failure to meet the requirements set out in this paragraph within the specified period, the approval shall be deemed expired. In addition, SAMA may extend the period for a maximum of another six months before the initial approval period expires.

Classification:
Public - عام
2. In case of an existing company, it shall provide SAMA with a copy of the
commercial register containing its BNPL activity within six months from the date of initial approval. In case of failure to meet the requirements set out in this paragraph within the specified period, the approval shall be deemed expired. Moreover, SAMA may extend the period for a maximum of another six months before the initial approval period expires.
Article 9: License

1. SAMA takes any necessary actions to verify that the BNPL company meets all
   SAMA’s requirements. Such actions include making licensing visits; meeting the company’s executives; and reviewing the company’s systems, procedures and records.
2. SAMA issues a decision granting the applicant a license to engage in the activity
   after fulfilling all requirements and completing all procedures.
3. The BNPL company shall not engage in any activity other than the activity for
   which the license has been issued unless it obtains a prior written non-objection from SAMA.
   Article 10: License Term
   The license shall be valid for five years and may be renewed by SAMA upon the BNPL company’s request. Such request must be submitted in writing, using the form designated by SAMA, at least three months before the expiry date of the license.
   Article 11: Revocation of License
   SAMA revokes the license upon the BNPL company’s request, taking into account the rights of creditors and consumers as well as the soundness of the financial system.
   Article 12: License Fees
   SAMA charges fees as follows:
4. SAR 5,000 (five thousand Saudi riyals) for license issuance.
5. SAR 2,000 (two thousand Saudi riyals) for license renewal or amendment.

Classification:
Public - عام
Chapter III: Internal Organization
Article 13: Internal Policies and Procedures
The BNPL company shall:

1. Develop appropriate written organizational policies that address, at least, the
   internal organization guides, governance, stores acceptance and approval procedures, purchase approval and cancellation, credit, risk management, compliance, information confidentiality and security, consumer data protection, outsourcing, human resources, and anti-money laundering and counter-terrorist financing (AML/CTF).
2. Ensure that technological and security equipment in place and related systems
   are adequate for its operational needs, nature of activity and risk status, in accordance with best practices and SAMA-issued instructions in this regard.
3. Design information technology systems and their processes in a manner that
   ensures data availability, integration, integrity, and confidentiality. Such systems and processes shall be assessed by the BNPL company on a periodic basis in accordance with the generally accepted technical standards. They shall also be tested before they are used for the first time and after any changes applied to them.
4. Retain all consumer documents, records and files in an orderly, clear and safe
   manner and ensure that all files are complete and updated periodically, for a period of at least 10 years from the date of the end of the relationship with the consumer.
5. Have sufficient and qualified human resources in terms of knowledge and
   expertise to meet its operational needs and risk status.
   Article 14: Requirements for Information Security and Combating
   Financial Crimes
6. The BNPL company shall comply with the information security requirements set
   by SAMA and the relevant laws, regulations and instructions issued by SAMA.
7. The BNPL company shall comply with the legal requirements contained in the
   AML/CTF Laws, their Implementing Regulations, and the relevant rules and guidelines as specified by SAMA, in a manner that is consistent with the nature of the company’s activity and its size and the risks it may be exposed to. In

Classification:
Public - عام addition, the company shall comply with the requirements and instructions issued by SAMA on financial crimes.
Article 15: Outsourcing
The BNPL company shall comply with the Rules on Outsourcing for Finance Companies issued by SAMA.
Article 16: Auditor

1. The BNPL company shall appoint one or more certified external auditors, with
   the condition of obtaining a non-objection letter from SAMA. However, SAMA may appoint another auditor at the company’s expense where the size and nature of its business require so.
2. SAMA may require external auditors to explain their report or disclose other
   facts of which they obtain knowledge during the audit process that could indicate a violation of the applicable laws, regulations or instructions or a violation of the BNPL company’s by-laws.
   Article 17: Consumer Protection and Data Confidentiality
3. The BNPL company shall establish a function for handling complaints and set
   clear procedures for receiving, documenting, reviewing, and responding to complaints within the period set by SAMA. Such complaints must be kept in records that include all necessary details in relation to the complaint and the procedures taken.
4. The BNPL company, including all of its employees, shall maintain the
   confidentiality of consumers’ data and transactions and shall not disclose them to other parties even after the end of service for employees or revocation of license, except in accordance with the relevant laws and instructions.
   Article 18: Saudization of Human Resources
5. At least 50% of human resources employees must be Saudi nationals when the
   BNPL company starts operations. The percentage applies to all departments and organizational levels.
6. The percentage must be increased annually by 5% at least until it reaches 75%.
   Furthermore, SAMA determines the minimum annual increase required for Saudization.

Classification:
Public - عام
3. Recruitment of non-Saudis in the BNPL company shall be limited to positions
that require expertise not available in the Saudi labor market. In all cases, the company shall obtain a non-objection letter from SAMA before appointing any non-Saudi employee in control departments, provided that the company shall prove that there are no Saudi nationals available to fill the position.
Chapter IV: Activity Provisions
Article 19: Company Obligations
The BNPL company shall:

1. Comply with the Responsible Lending Principles for Retail Consumers issued by
   SAMA.
2. Verify and document the credit record of the consumer, with their consent, to
   confirm their solvency, repayment capacity and credit conduct.
3. Register the consumer’s credit information, with their consent, at one or more
   of the companies licensed to collect credit information according to the relevant laws, regulations and instructions. Such information must be updated throughout the period of dealing with the consumer.
4. Set appropriate approvals and acknowledgments and allow consumers to read
   and agree to them before dealing with them, provided that such approvals and acknowledgments are shown as a pop-up window.
5. Adopt a clear, transparent and documented scientific method, criteria and
   procedures to evaluate the creditworthiness of the consumer and their repayment capacity, in accordance with best practices in this field.
6. Identify the consumer, verify their identity through a reliable and independent
   source, and document this in accordance with the regulations and instructions issued by SAMA.
7. Obligate contracted stores not pass or charge any additional fees to the
   consumer. The company shall also monitor the stores’ practices to ensure their compliance, and provide them periodically with the required guidelines.
8. Maintain provisions for potential losses, defaults and risks in line withthe
   International Accounting Standards and relevant SAMA-issued guidelines.

Classification:
Public - عام
Article 20: Activity Limits
The BNPL company shall not:

1. Charge fees on the consumer, including fees owed to the company, contracted
   stores, or a third party. This excludes any delay penalties or debt collection fees imposed in accordance with the Debt Collection Regulations and Procedures for Individual Customers 1 .
2. Launch any new products without obtaining prior written non-objection from
   SAMA.
3. Transact with a consumer under the age of (18) Hijri years.
4. Transact with a foreign consumer who is not a resident of Saudi Arabia, except
   after obtaining a written non-objection from SAMA.
5. Purchase goods or services in a currency other than the Saudi riyal, except after
   obtaining a written non-objection from SAMA.
   Article 21: Consumer Due Diligence (CDD)
6. The BNPL company shall develop a CDD program and comply with the AML/CTF
   regulations and instructions. The CDD program must include policies and procedures for the following, as a minimum:
   a. Know Your Customer (KYC). b. Information security.
   c. Data privacy and confidentiality.
7. The company shall comply with the Electronic Transactions Law and its
   Implementing Regulations and establish the necessary procedures and measures to ensure that the information provided is correct and up-to-date, including, at a minimum:
   a. Verification of consumers’ phone numbers through authentication tokens. b. Verification of consumers’ national addresses are correct.
   Article 22: Credit Limits
8. Without prejudice to the deductible ratios specified in the Responsible Lending
   Principles for Retail Consumers, the total outstanding financing for each consumer natural person must not exceed an amount of SAR 10,000 (ten SAMA issued a decision on 02/14/1446H to suspend the application of administrative fees that the Company may apply within 1% of the finance amount, or SAR 50, whichever is less.

Classification:
Public - عام thousand Saudi riyals), subject to increase or decrease by SAMA as it deems appropriate.
2. The number of installments granted to the consumer must not exceed a
maximum of 12 installments.
3. Collection methods must be applied through electronic channels. Cash request
is prohibited.
4. The total outstanding finance made through the company must not exceed 20
times the capital and reserves, except after obtaining a non-objection letter from SAMA. Additionally, SAMA may raise or lower the maximum limit of the total financing to the extent it deems appropriate.
5. The company shall not obtain financial facilities from non-licensed financiers,
except after obtaining a non-objection letter from SAMA.
Article 23: Advertisement Requirements

1. Subject to the Rules for Advertising Products and Services Provided by Financial
   Institutions issued by SAMA, the BNPL company shall ensure to:
   a. Include the company’s name, logo, any unique slogans, and contact information in their advertisements. b. Avoid publishing advertisements that contain a false offer, statement or claim or those that are expressed in a way that could directly or indirectly lead to deceiving or misleading the consumer.
   c. Avoid publishing excessively persuasive advertising that encourages taking
   on credit for unnecessary consumption purposes instead of actual needs.
2. SAMA obliges the company that fails to comply with the clauses stipulated in
   paragraph 1 of this Article to withdraw the advertisement within one business day of SAMA’s notice.
   Article 24: Conflict of Interest
   The BNPL company shall develop an appropriate written organizational policy that addresses potential conflicts of interest. Such policy must include adequate measures put in place to avoid and address any conflict of interest, ensuring fair treatment of all consumers and stores.
   Article 25:Disclosure

Classification:
Public - عام
The BNPL company, through the means by which it carries out its activities, shall ensure, as a minimum, to:

1. Clarify and disclose all terms and conditions, security instructions, payment
   methods, information confidentiality and any other statements that must be disclosed according to relevant laws and instructions.
2. Disclose the company’s licensing information in accordance with the License
   Disclosure Instructions issued by SAMA.
   Article 26: Finance (Terms and Conditions) Contract Requirements
   The BNPL company shall draw up a finance (terms and conditions) contract with the consumer before any dealings, provided that it is presented clearly, easy to understand, and not misleading. The contract shall also be consistent with the relevant regulatory requirements and contain, as a minimum:
3. The information of the company and consumer (parties).
4. Finance term.
5. Type of goods or services, including their specifications and requirements (if
   any).
6. Involved parties’ rights and obligations
7. The amount, number and term of installments payable by the consumer, and
   the company’s commitment to notify the consumer of the monthly installment due date in advance.
8. Consequences of a delayed payment of installments.
9. Purchase order cancellation method, and refund procedures, conditions and
   process time.
10. Procedures for early payment and for compensating the company (when
    necessary) and how to determine such compensation.
11. Procedures for dealing with defaulting consumers.
    10.Consumer’s permission to enter their information in the credit record. 11.Dispute resolution mechanism. 12.Any other data or information required by SAMA.
    Article 27: Contract Requirements Between the Company and Stores
    A contract must be drawn up in paper or electronic form between the company and stores in accordance with the relevant legal requirements. Each party shall receive a copy of the contract that must clarify, at least, the following:

Classification:
Public - عام

1. Contract parties and their information.
2. Contract term, provided that the contract term is consistent with the validity of
   relevant permits or licenses of both parties.
3. Contract parties’ rights and obligations.
4. Pricing structure.
5. Withdrawal procedures and conditions.
6. Information confidentiality, privacy and security.
7. Customer protection provisions.
8. Compliance of the parties with the provisions of relevant laws, regulations,
   rules, guidelines and instructions.
9. Provisions of contract renewal and renegotiation.
10. Contract termination and expiration.
11. Reporting and escalation procedures and dispute resolution mechanism.
12. Any other data or information required by SAMA.
    Chapter V: Supervision and Compliance
    Article 28: SAMA Supervision
13. The BNPL company shall:
    a. Provide SAMA with any required reports, data and information in accordance with the forms, guidelines, and times determined by SAMA. b. Adopt the International Accounting Standards in preparing its accounts and financial statements.
    c. Provide SAMA, upon its request, with all information and documents related
    to the company, its activities, partners and employees. d. Report to SAMA immediately any losses exceeding 15% of the company’s paid-up capital. e. Develop a recruitment plan for vacant positions. f. Enable SAMA’s specialized staff and appointed auditors to access relevant facilities, documents and data (including digital data) upon request.
14. The company and its staff shall not conceal or attempt to conceal any
    information or irregularities or refrain from answering any inquiries made by SAMA.
15. The company shall obtain SAMA’s written non-objection before disposal of
    financing assets or rights arising therefrom.

Classification:
Public - عام
4. SAMA takes necessary actions to ensure the compliance of the company with
relevant laws, regulations, rules and instructions. Such actions may include making supervisory or inspection visits to the company’s head office, meeting its staff and reviewing its systems, procedures and records. The company shall adhere to the recommendations and instructions directed by SAMA to address the observations made during visits.
5. The company shall bear any expenses that may arise from SAMA’s appointment
of a third party to implement any of the procedures undertaken in line with the provisions of this Article.
Article 29: Compliance

1. The BNPL company shall establish internal controls and procedures to ensure
   compliance with the provisions of the Law and these Rules and relevant laws, regulations and rules.
2. The company shall retain sufficient records to confirm compliance with the
   provisions of the Law and these Rules and relevant laws, regulations and instructions and shall take the necessary procedures to prevent any violation of their provisions.
3. The company shall not disclose any information to third parties, unless it
   obtains SAMA’s written non-objection and such disclosure does not violate the provisions of relevant laws.
4. The company shall obtain a non-objection letter from SAMA before undergoing
   partial or complete liquidation.
   Chapter VI: Concluding Provisions
   Article 30: Non-Compliance
   Non-compliance with these Rules shall be deemed a violation of the Law.
   Article 31: Enforcement
   The Rules shall come into force 30 days after the date of its publication on SAMA’s official website.

P.O. Box 2992, Riyadh 11169,
Kingdom of Saudi Arabia
Tel.: +966 11 463 3000, www.sama.gov.sa
Classification:
Public - عام