Saudi Arabia country pack.
Saudi Arabia pack covering SAMA's rules for banks, Islamic banks and finance companies (internal audit, Shariah governance, AML/CTF, counter-fraud, business continuity, outsourcing and corporate governance), NCA cloud cybersecurity controls, the Personal Data Protection Law, the CMA Corporate Governance Regulations for listed companies and ZATCA e-invoicing. It is built for internal audit, compliance, Shariah audit and privacy teams in Saudi financial institutions, listed companies and large enterprises.
Frameworks and regulations.
| Instrument | Applies to | Requirements | Status |
|---|---|---|---|
| SAMA Cyber Security Framework Saudi Central Bank (SAMA) · 1.0 (May 2017) | Banks, Islamic banks, Insurers, Finance companies and more | 36 | Source checked |
| NCA Essential Cybersecurity Controls National Cybersecurity Authority (Saudi Arabia) · ECC-2:2024 | Government bodies, State-owned enterprises, Critical infrastructure | 32 | Source checked |
| SAMA IT Governance Framework Saudi Central Bank (SAMA) · 1.0 (2021) | Banks, Islamic banks, Insurers, Finance companies and more | 21 | Source checked |
| Principles of Internal Auditing for Local Banks Operating in Saudi Arabia Saudi Central Bank (SAMA) · No. 43037826, 1 December 2021 (26/4/1443H); effective 1 January 2022 | Banks, Islamic banks | 30 | Source checked |
| Shariah Governance Framework for Local Banks Operating in Saudi Arabia Saudi Central Bank (SAMA) · No. 41042498, 12 February 2020 (18/6/1441H); Arts. 7 and 17 enforced from 1 January 2023 | Banks, Islamic banks | 21 | Source checked |
| The Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) Guide Saudi Central Bank (SAMA) · No. 18318/486, 17 November 2019 (20/3/1441H) | Banks, Islamic banks, Finance companies, Exchange houses | 22 | Source checked |
| Counter-Fraud Framework Saudi Central Bank (SAMA) · No. 000044021528, 11 October 2022 (16/3/1444H); full compliance required by 29 June 2023 | Banks, Islamic banks | 29 | Source checked |
| Business Continuity Management Framework Saudi Central Bank (SAMA) · No. 381000058504, 27 February 2017 (1/6/1438H) | Banks, Islamic banks | 17 | Source checked |
| Rules on Outsourcing Saudi Central Bank (SAMA) · No. 41027017, 15 December 2019 (18/4/1441H) | Banks, Islamic banks | 18 | Source checked |
| Key Principles of Governance in Financial Institutions Saudi Central Bank (SAMA) · Circular No. 42081293, 30 June 2021 (21/11/1442H), mandatory from 1 January 2022; amended by Circular No. 45068000, 7 May 2024 (29/10/1445H) | Banks, Islamic banks, Finance companies, Payment providers | 19 | Source checked |
| Finance Companies Control Law; Internal Audit Principles and Compliance Principles for Finance Companies and Real Estate Refinance Companies Saudi Central Bank (SAMA) · Law: Royal Decree M/51 of 13/8/1433H, amended by Royal Decree M/272 of 4/12/1445H (10 June 2024). Internal Audit Principles No. 46020559 and Compliance Principles No. 46020562, both 1 October 2024; effective 180 days after publication | Finance companies | 22 | Source checked |
| Cloud Cybersecurity Controls (CCC-2:2024) National Cybersecurity Authority (NCA) · CCC-2:2024 (2024); replaces CCC-1:2020 | Government bodies, State-owned enterprises, Critical infrastructure, Large enterprises | 28 | Source checked |
| Personal Data Protection Law and its Implementing Regulations Saudi Data and Artificial Intelligence Authority (SDAIA) · Royal Decree M/19 of 9/2/1443H, amended by Royal Decree M/148 of 5/9/1444H; Law and Implementing Regulations in force 14 September 2023 (29/2/1445H), fully enforced from 14 September 2024 | Large enterprises, Banks, Islamic banks, Finance companies and more | 17 | Being confirmed |
| Corporate Governance Regulations Capital Market Authority (CMA) · CMA Board Resolution 8-16-2017 (16/5/1438H, 13 February 2017), as amended by Resolution 8-5-2023 (25/6/1444H, 18 January 2023); Arts. 73–75 mandatory and amendments to Arts. 24(4), 52(b)(3), 54(b) and 87(11) effective 1 January 2024 | Listed companies | 24 | Source checked |
| E-Invoicing Regulation (FATOORA) Zakat, Tax and Customs Authority (ZATCA) · E-invoicing resolution published 4 December 2020; E-Invoicing Regulation published 28 May 2021; Phase 1 from 4 December 2021; Phase 2 integration in waves from 1 January 2023 (Wave 25 deadline 1 February 2027) | Large enterprises, Banks, Finance companies, Listed companies and more | 11 | Source checked |
Checklists in the pack.
- Third-Party and Cloud Outsourcing Review
- SAMA CSF Maturity Self-Assessment
- NCA ECC-2:2024 Compliance Review
- SAMA Internal Audit Function Review
- SAMA Counter-Fraud Maturity Self-Assessment
- PDPL Compliance Review
- SAMA Shariah Governance and Compliance Audit
- CMA Corporate Governance and Audit Committee Review
Regulators.
- SAMA Saudi Central Bank
- NCA National Cybersecurity Authority
- SDAIA Saudi Data and Artificial Intelligence Authority
- CMA Capital Market Authority
- ZATCA Zakat, Tax and Customs Authority
Who it is for
Banks, Islamic banks, Finance companies, Exchange houses, Payment providers, Listed companies, State-owned enterprises, Government bodies, Critical infrastructure, Large enterprises.
Regulatory calendar.
20 recurring deliverables, each with the regulator, the instrument and the deadline rule. Some examples:
| Deliverable | Regulator | How often | Deadline |
|---|---|---|---|
| Quarterly internal audit report to the audit committee | SAMA | Every quarter | Every quarter, covering control assessments, findings, actions and overdue items with reasons |
| Annual internal audit report to the audit committee | SAMA | Every year | By the end of the quarter after financial year-end, or the date in the approved annual plan |
| Review the audit universe and approve the risk-based annual audit plan | SAMA | Every year | At least once a year; plan approved by the audit committee before the plan year |
| External quality assessment of internal audit | SAMA | Every 5 years | At least once every five years; results to the audit committee and board |
| SAMA non-objection before appointing, renewing or changing the head of internal audit | SAMA | When it happens | Before the appointment or extension takes effect; notify SAMA when the head leaves |
| Internal Shariah audit reported to the audit committee and Shariah committee | SAMA | Every year | At least once a year, based on the bank's risk profile |
Reporting conventions.
- Reports in Arabic and English
- Hijri (Umm al-Qura) dates next to Gregorian dates
- Arabic-Indic digits in Arabic reports
- Amounts in SAR
SAMA issues its instruments in Arabic with English translations; the SAMA Rulebook warns that translations are under review and the Arabic text governs. SAMA documents carry both Hijri (Umm al-Qura) and Gregorian dates, so reports, plans and committee packs should show both. Use Arabic-Indic digits in Arabic output and Latin digits in English output, with amounts in SAR. VAT records and invoices must be kept in Arabic and held in the Kingdom (ZATCA). Regulator deadlines are often in business days (for example 5 or 30 business days), so the calendar needs a Saudi working-week and public-holiday setting.
Kept current.
Content version 2026.10, reviewed 27 October 2026. Descriptions are AuditHD's own; each framework links to the official text. License this pack on its own or with other countries; International standards are always included.
See it with your own checklists.
Open the live demo now, or book a walkthrough and we will load one of your frameworks or work programmes.