The legal base
Saudi Arabia's Anti-Money Laundering Law was issued by Royal Decree No. M/20 dated 5/2/1439H (2017), with its Implementing Regulations, replacing the earlier law, and has been amended since. Three bodies matter most to a fintech:
- the Saudi Central Bank (SAMA), which supervises banks, finance companies and payment service providers, and issues AML and counter-terrorist financing rules for them;
- the General Directorate of Financial Intelligence, the Kingdom's financial intelligence unit, which receives suspicious transaction reports;
- the Public Prosecution, which investigates and prosecutes money laundering.
The law defines a financial institution as anyone who carries out financial activities or operations for or on behalf of a customer. Digital lenders, buy-now-pay-later providers, wallets, payment companies and remittance services all meet that definition. Being a startup does not change it.
The obligations, in plain terms
| Obligation | What it means for a fintech |
|---|---|
| Risk assessment | Identify and document the money laundering and terrorist financing risks of your customers, products, channels and geographies, and update it when they change |
| Customer due diligence | Identify and verify every customer, and any beneficial owner, before establishing the relationship, and understand the purpose of the relationship |
| Enhanced due diligence | Apply stronger checks to higher-risk customers, including politically exposed persons: source of funds, senior management approval and closer monitoring |
| Ongoing monitoring | Check that transactions stay consistent with what you know about the customer, and keep customer information current |
| Sanctions screening | Screen customers, beneficial owners and counterparties against the sanctions lists that apply in the Kingdom, and act immediately on a confirmed match |
| Suspicious transaction reporting | Report to the General Directorate of Financial Intelligence immediately when you suspect, or have reasonable grounds to suspect, that funds are linked to crime |
| No tipping off | Never tell the customer, or anyone outside the reporting chain, that a report has been made or is being considered |
| Record keeping | Keep transaction records and due diligence documents for at least ten years |
| Internal controls | Policies approved by the board, a compliance officer, staff training and independent testing of the programme |
Building it in a fintech
1. Start with the risk assessment
Everything else is calibrated from it. A BNPL product with small tickets and merchant settlement carries different risks from a wallet with peer-to-peer transfers or a cash-loan product. Score each product, channel and customer segment, and let the scores decide the depth of onboarding and monitoring.
2. Tier your onboarding
Use national digital identity verification, such as Nafath, for Saudi nationals and residents, and set three tiers:
- standard due diligence for most customers;
- enhanced due diligence triggered automatically by risk factors, such as a PEP match, high expected volumes or a high-risk geography;
- declined onboarding for profiles outside your risk appetite.
The triggers must be wired into the onboarding flow. A policy that says "apply EDD to high-risk customers" without an automatic trigger is not a control.
3. Screen at onboarding and on every list update
Screen at onboarding, again when sanctions lists change, and on payments to new counterparties. Match quality matters as much as list coverage: Arabic names have many valid transliterations, and weak matching produces either missed hits or alert floods.
4. Monitor with scenarios that fit your products
Rules copied from a bank rarely fit a fintech. Design scenarios around how your products can be abused, for example:
- rapid funding and withdrawal through a wallet;
- many small transfers that add up to a large amount;
- early loan settlement with funds from third parties;
- accounts that receive from many senders and pay out at once, the pattern of mule accounts;
- activity that does not match the customer's stated income or profile.
At fintech volumes, monitoring must be automated. Review alert outcomes every month and tune the scenarios that produce noise.
5. Run cases with an audit trail
Every alert needs an owner, a decision, a rationale and a timestamp. Investigators should see the customer's full profile, history and related accounts in one place.
6. Make the reporting decision defensible
Document why each case was or was not reported. When you report, report immediately, and protect the information from anyone who could tip off the customer.
7. Keep records you can retrieve
Ten years of records is only useful if you can find them. Store due diligence documents, screening results, alerts, decisions and reports so an examiner's request can be answered in hours, not weeks.
8. Govern it
Appoint a compliance officer with direct access to the board, report AML metrics to senior management, train every customer-facing and operations employee, and have the programme tested independently.
Where fraud and AML meet
Money mules connect fraud to money laundering: the account that receives a scam victim's money is the first step in laundering it. Running fraud detection and AML monitoring on the same data and the same decision flow catches what each would miss alone. Our guide to Saudi fraud law and SAMA's Counter-Fraud Framework covers the fraud side.
Naiza, built by Limaz, screens against more than 1,100 global sanctions, PEP and watchlist sources in a single call, covering millions of individual and entity profiles. Every screening returns a clear result with scored matches and a full audit trail, and Naiza runs fraud detection on the same platform.
Where fintech AML programmes slip
- A risk assessment written for the licence application and never updated.
- Enhanced due diligence described in policy but not triggered in the onboarding flow.
- Monitoring rules borrowed from a bank that do not reflect the fintech's products.
- Alert backlogs that grow faster than the team can review them.
- Reporting decisions with no documented rationale.
- Records spread across vendors and tools that cannot be retrieved quickly.
Limaz builds AML and fraud programmes for Saudi fintechs, finance companies and banks, from risk assessment to live screening and monitoring. See our fraud and AML systems service.