Glossary
Short definitions of the terms that come up in Saudi regulation and compliance work, each linked to a guide that goes deeper.
Manipulating people, rather than systems, into revealing information or taking an action, such as sharing a one-time password or approving a transfer. A common form is a caller posing as a bank or a government body. Institutions counter it with customer awareness, extra verification for unusual requests, and monitoring that spots a customer acting under pressure.
Saudi fraud law and SAMA's Counter-Fraud FrameworkA message or website that imitates a trusted organization to steal login details, card details or one-time passwords. It arrives by email, text message or social media, and often leads to account takeover. Defences combine email and domain protection, multi-factor authentication, and awareness for staff and customers.
Security engineeringA fraudster gains control of a genuine customer's account, usually with stolen login details, a hijacked session or a swapped SIM card, then changes the contact details and moves money out. Detection looks at the device, location and behaviour behind a login or payment, not only the password.
NaizaAn account, or the person behind it, used to receive stolen or illicit money and pass it on. Mules connect fraud to money laundering: the account that receives a scam victim's transfer is the first step in laundering it. Typical signs are many incoming transfers from unrelated senders followed by immediate outgoing payments.
Saudi AML law for fintechsMaking the proceeds of crime look legitimate. It is usually described in three stages: placement, when illicit funds enter the financial system; layering, when they are moved through transfers and accounts to hide where they came from; and integration, when they return to the economy as apparently clean money. In Saudi Arabia it is a crime under the Anti-Money Laundering Law.
Saudi AML law for fintechsIdentifying and verifying a customer before and throughout the relationship: who they are, who owns or controls them, and what activity to expect from them. For individuals in Saudi Arabia, identity is commonly verified through the national digital identity. KYC is the starting point of customer due diligence.
NaizaCustomer due diligence (CDD) is the set of checks an institution applies to every customer: verifying identity, identifying the beneficial owner, understanding the purpose of the relationship and monitoring it over time. Enhanced due diligence (EDD) adds stronger checks for higher-risk customers, such as establishing the source of funds and obtaining senior management approval.
Saudi AML law for fintechsSomeone who holds, or has held, a prominent public function, together with their family members and close associates. Institutions can serve PEPs, but their position raises the risk of corruption, so they receive enhanced due diligence.
NaizaChecking customers, beneficial owners and counterparties against the sanctions lists that apply, at onboarding, whenever the lists change, and before payments. Good screening handles transliteration: an Arabic name can be written many ways in Latin script, and weak matching either misses real matches or floods analysts with false ones.
NaizaA report a financial institution files when it suspects, or has reasonable grounds to suspect, that funds are linked to crime. In Saudi Arabia, reports go to the General Directorate of Financial Intelligence, and the customer must not be told that a report has been made.
Saudi AML law for fintechsReviewing customer transactions, in real time or after the fact, to find activity that does not fit the customer's profile or that matches known fraud and laundering patterns. Alerts go to analysts, who investigate, record a decision and report where required.
Fraud and AML systemsThe natural person who ultimately owns or controls a customer, or on whose behalf a transaction is carried out. For a company, identifying the beneficial owner means looking through each layer of ownership to the real people behind it.
Saudi AML law for fintechsUnder Saudi Arabia's Personal Data Protection Law (PDPL), personal data is any data that identifies a person directly or indirectly. Sensitive data is a narrower category with stricter rules. It includes health, genetic, biometric, credit and location data, among others.
PDPL complianceThe controller decides why and how personal data is processed and carries primary responsibility under the PDPL. The processor handles the data on the controller's behalf, under a contract. A bank is the controller of its customers' data, and its cloud provider is a processor.
PDPL complianceAn assessment of the risks a processing activity poses to people's privacy, carried out before the processing starts. The PDPL Implementing Regulations require one when processing involves, among other cases, sensitive data, data combined from different sources, continuous monitoring, new technologies or decisions made entirely by automated means.
The PDPL Implementing RegulationsThe person responsible for overseeing an organization's compliance with the PDPL. One must be appointed by public entities that process data at large scale, and by organizations whose core activities involve regular, systematic monitoring of people or processing sensitive data. The role can be held by an employee or an external contractor.
PDPL complianceSorting an organization's data into levels by sensitivity. National guidance in Saudi Arabia uses four levels: top secret, secret, restricted and public. Each level carries handling rules that set who can access the data, where it can be stored and how it must be protected, which lets privacy and security controls match the data's sensitivity.
Data classificationProtecting networks, systems, applications and data from attack, damage and unauthorized access. In Saudi Arabia, the National Cybersecurity Authority sets national requirements such as the Essential Cybersecurity Controls, and sector regulators add their own, such as SAMA's Cyber Security Framework for financial institutions.
Compliance and assuranceAssets, systems and networks whose disruption would seriously harm national security, the economy or public services. Private organizations that own, operate or host critical national infrastructure must comply with NCA's Essential Cybersecurity Controls.
NCA ECC implementationA score for how firmly a control is established, from ad hoc to measured and continuously improved. SAMA's Cyber Security Framework uses six levels, from 0 (non-existent) to 5 (adaptive), and expects member organizations to operate at level 3, structured and formalized, or higher.
The SAMA CSF self-assessmentControls for the accounts that can change systems or reach sensitive data, such as administrator and service accounts. PAM limits who holds these privileges, grants them only when needed, records privileged sessions and rotates the credentials.
Identity and access managementAn authorized, simulated attack on systems or applications to find weaknesses before attackers do. Findings are ranked by severity, fixed and then retested. NCA's Essential Cybersecurity Controls include penetration testing among their requirements.
Security engineeringHow an organization sets direction and policy (governance), identifies and treats its risks (risk), and proves it meets laws, regulations and standards (compliance). A GRC programme links every requirement to a control, an owner and evidence.
Cybersecurity risk and GRCRisk that comes from the vendors, outsourcing partners and cloud providers that hold your data or run your services. SAMA CSF and NCA ECC both require security terms in contracts, assessment before onboarding and periodic review afterwards.
Cybersecurity risk and GRCTell us which system, control, or requirement you are working on. We’ll come back with a clear next step.
