Why fintechs experience SAMA CSF differently
The SAMA Cyber Security Framework (SAMA CSF) was first issued in May 2017. It applies to the member organizations the Saudi Central Bank (SAMA) supervises: banks, insurers, finance companies, payment service providers and the rest of the regulated financial sector. It is principle-based. It states what must be true, not which product to buy.
At a bank, most of the framework lands on teams and committees that already exist. A fintech starts somewhere else: a small team, cloud-first infrastructure, heavy use of third parties, and a product that changes every sprint. The control expectations are the same. The route to them is not.
The framework has four domains and 32 subdomains. SAMA expects member organizations to operate at maturity level 3, structured and formalized, or higher. Level 3 means a control is defined, approved, applied consistently and backed by evidence. A policy on its own scores level 1 or 2.
The four domains in fintech terms
| Domain | Subdomains | What it means for a fintech |
|---|---|---|
| Cyber Security Leadership and Governance | 7 | A committee that meets, a strategy and policies the board approved, named roles, awareness and training |
| Cyber Security Risk Management and Compliance | 5 | A risk register tied to real assets, a map of SAMA requirements, reviews and audits on a schedule |
| Cyber Security Operations and Technology | 17 | Asset inventory, identity and access, application security, change management, cryptography, payment and e-banking security, monitoring, incident, threat and vulnerability management |
| Third Party Cyber Security | 3 | Security clauses in vendor contracts, outsourcing governance, cloud computing controls |
Operations and technology holds more than half the subdomains. For a cloud-native fintech, the third-party domain carries far more risk than its three subdomains suggest.
Months 1 to 3: the foundations everything depends on
- Governance that actually meets. Form the cyber security committee, approve its charter and minute its first meetings. Reviewers look for decisions taken, not only a charter on file.
- An asset inventory you trust. Every cloud account, database, SaaS tool, API and service, each with an owner. Without it, access reviews, scanning and data classification all have gaps you cannot see.
- Identity and access management. Single sign-on for staff tools, multi-factor authentication everywhere, privileged access separated and logged, and joiner, mover and leaver steps tied to HR. This is the work behind our identity and access management service.
- A risk register and a SAMA requirements map. Link each SAMA CSF subdomain to an owner, the control that answers it, and the place its evidence lives.
Months 4 to 6: the engineering controls
- Secure development. Code review, dependency and secret scanning, and security testing before release. Change management that covers infrastructure as code, not only application releases.
- Logging and monitoring. Central logs from cloud, identity, endpoints and the core platform, with alert rules that have an owner.
- Vulnerability management. Scheduled scans, remediation deadlines by severity, and exceptions that expire.
- Cryptography. A key management standard, encryption at rest and in transit, and a record of where keys are held.
- Incident management. A tested response plan that includes the SAMA notification steps, and at least one tabletop exercise on record.
Months 7 to 9: third parties and cloud
A fintech runs on cloud providers, identity verification vendors, payment processors and SaaS tools. SAMA CSF expects:
- security requirements in every contract, including breach notification and the right to audit;
- due diligence before onboarding a vendor and periodic reassessment after;
- governance over outsourcing that follows SAMA's outsourcing rules;
- cloud controls that cover data location, access, encryption and an exit plan, with SAMA approval in place before production data moves where the rules require it.
Keep one vendor register with criticality, data access, contract clauses and the date of the last review. It answers most third-party questions from a single page.
Months 10 to 12: prove level 3
By now the controls exist. The last quarter is about proof:
- run the self-assessment against all 32 subdomains and score each one honestly;
- collect evidence that shows operation over time: tickets, logs, review records and KPI results;
- close the gaps, or formally accept them with compensating controls where a control cannot be implemented;
- plan the move to level 4, where controls are measured and managed.
Our guide to the SAMA CSF self-assessment covers the scoring step by step.
The evidence that counts
| Evidence type | Examples |
|---|---|
| Approved documents | Strategy, policies, standards and the committee charter, signed and versioned |
| Governance records | Committee minutes, decisions, risk acceptance approvals |
| Proof of operation | Access review records, change tickets, scan reports, incident tickets |
| Measurement | KPIs with actual results across several months |
| Third parties | Vendor assessments, contract clauses, cloud approvals |
A control with no evidence of operation scores as if it does not exist.
Where fintechs usually fall short
- Policies copied from templates that describe teams and tools the company does not have.
- Shared credentials for production access, with no session logging.
- Cloud services in use before the vendor review or the SAMA approval completed.
- Awareness training delivered once at onboarding and never again.
- An incident response plan that has never been tested.
How this connects to fraud and AML
SAMA CSF protects the systems. SAMA's Counter-Fraud Framework, designed to be implemented alongside it, protects the money moving through them. A fintech that builds both on the same asset inventory, identity model and logging saves months of duplicated work. We cover the fraud side in our guide to Saudi fraud law and SAMA's Counter-Fraud Framework, and Naiza runs the real-time fraud and AML decisions.
Limaz implements SAMA CSF for banks, finance companies and fintechs, from gap assessment to evidence. See our SAMA CSF implementation service.