SAMA CSF implementation
Cybersecurity expectations across SAMA-supervised institutions.
SAMA CSF implementationCompliance service
Implement SAMA payment systems requirements.
Limaz maps applicable payment-system expectations to real systems and owners, implements the control and process changes, and builds the evidence model for SAMA-supervised payment operations.
What Limaz delivers
- Readiness and gap assessment against applicable payment-system expectations
- Control applicability, ownership, and target-state mapping
- Risk-prioritized implementation and remediation roadmap
- Hands-on process and technical control implementation
- Evidence model, validation, and progress reporting
What the framework covers
The Saudi Central Bank oversees payment systems and their operators under the Oversight Framework of the Payment Systems and Their Operators, issued in March 2026 to replace the 2021 Oversight Framework for Payments and Financial Settlement Systems. Organisations that were scoped against the old text should re-check their position against the new one.
Payment-system expectations concern how a payment service is operated and controlled: authorization and settlement flows, availability and resilience, change and incident handling, third-party and outsourcing arrangements, customer protection, and the records that evidence all of it.
Implementation is engineering work, not a document exercise. It needs a target control set, named owners, changes in systems and processes, and current evidence a reviewer can follow.
How Limaz implements payment systems requirements
01
Scope the requirement
Establish which expectations apply to your licence and payment activities, and which systems carry them.
02
Map the payment flows
Trace authorization, clearing, settlement, reconciliation, and exception paths across the systems that actually carry them.
03
Design the target
Control architecture, decision rights, resilience objectives, and what must change in process and technology.
04
Sequence the work
An implementation backlog with owners, dependencies, priorities, and acceptance criteria.
05
Connect evidence
Logs, approvals, test results, and reconciliation artefacts tied to owners so reviews do not start from zero.
06
Validate and remediate
Prove operation under real conditions, then close residual risk as measurable work.
Common implementation gaps
- Settlement and reconciliation breaks are handled by people, not by a controlled process.
- Resilience objectives are stated but never tested end to end.
- Third-party and processor dependencies sit outside the control model.
- Incident handling is defined for technology but not for payment impact.
- Fraud decisioning runs separately from the payment control set.
- Evidence is assembled for a review, then decays.
Where Naiza and Limaz solutions fit
Payment operations generate exactly the decisions Naiza is built for: screening, transaction monitoring, and review workflow at the point money moves. Naiza covers that slice.
The surrounding governance, resilience, and evidence work is implementation, and Limaz delivers it through cybersecurity and regulatory engineering. Do not treat either as a substitute for the other.
Related Limaz pages
SAMA IT governance framework
Decision rights and oversight for technology in supervised institutions.
SAMA IT governance frameworkNaiza by Limaz
Fraud and AML decisioning where money actually moves.
Naiza by LimazFinancial crime technology
The implementation program around screening, monitoring, and decisioning.
Financial crime technologyQuestions
The Saudi Central Bank oversees payment systems and their operators through its Oversight Framework of the Payment Systems and Their Operators, issued in March 2026 to replace the earlier Oversight Framework for Payments and Financial Settlement Systems.
Applicability depends on SAMA supervision, licence category, and the payment activities actually performed. A fintech is not automatically in or out of scope.
SAMA CSF sets cybersecurity expectations across supervised institutions. Payment-system expectations concern the operation, resilience, and control of payment services themselves. Many providers must address both, and the evidence model should be built once rather than twice.
No. Fraud and AML decisioning is one control area inside a broader operating model. A detection platform does not satisfy governance, resilience, or oversight expectations on its own.
Last reviewed: Sep 12, 2026
Official sources
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll review the scope and suggest the next step.