Two instruments, two jobs
Two instruments shape how fraud is handled in the Saudi financial sector:
- the Law of Combating Financial Fraud and Breach of Trust, a criminal law issued in 1442H (2021). It has eleven articles, defines the offences and sets the penalties. The Public Prosecution investigates cases and brings them before the competent court;
- the SAMA Counter-Fraud Framework, issued by the Saudi Central Bank (SAMA). It sets principles and control requirements that regulated institutions must implement to govern, prevent, detect and respond to fraud.
The law deals with the fraudster. The framework deals with the institution. A bank or fintech needs to understand both: the law defines what its counter-fraud programme is protecting against, and the framework defines what that programme must contain.
What the law says
| Offence | Maximum penalty |
|---|---|
| Financial fraud: taking another person's money through deception, lying or misleading means | Up to 7 years' imprisonment, a fine of up to SAR 5 million, or both |
| Breach of trust: misappropriating money held through employment, deposit, partnership, agency, pledge or a similar trust, or disposing of it in bad faith | Up to 5 years' imprisonment, a fine of up to SAR 3 million, or both |
| Either offence committed by an organized gang, or repeated | Not less than half and up to double the maximum |
| Attempt | Up to half the maximum |
| Incitement, assistance or agreement | Up to the maximum if the crime is committed, up to half if it is not |
Courts also confiscate the tools used and the proceeds of the crime. Where the same act is a crime under another law, the harsher penalty applies.
Two points matter for institutions. First, breach of trust covers insiders: an employee who misappropriates money they control because of their role commits a crime under this law, so insider fraud controls are part of the picture. Second, the penalties for organized and repeat offences are severe, which reflects how fraud now works: networks of mule accounts, recruited intermediaries and repeated campaigns.
What SAMA's Counter-Fraud Framework requires
The framework applies to the member organizations SAMA notifies, and is designed to be implemented alongside the SAMA Cyber Security Framework. Its stated objectives are a common approach to fraud risk across member organizations, an appropriate maturity level of fraud controls, and proper management of fraud risk across the institution.
It covers four areas:
- Governance: a counter-fraud programme owned by senior management, with responsibilities across the three lines of defence;
- Prevention: controls that stop fraud before money moves;
- Detection: monitoring that finds fraud across products and channels;
- Response: investigation, recovery, reporting and learning from each case.
SAMA assesses counter-fraud maturity and control effectiveness periodically, using a maturity model in which level 3, structured and formalized, is the baseline.
What that means in practice
| Area | What a working programme has |
|---|---|
| Governance | A board-approved counter-fraud strategy and policy, a counter-fraud function with clear authority, fraud risk appetite, and regular reporting to senior management |
| Prevention | A fraud risk assessment per product and channel, strong customer authentication, identity checks at onboarding, staff vetting and segregation of duties, and customer awareness |
| Detection | Monitoring of every product and channel, real-time scoring where money moves instantly, rules and behavioural models working together, and case management with an audit trail |
| Response | Investigation procedures, fund recovery and account blocking, reporting to SAMA and the authorities, and root-cause fixes fed back into prevention and detection |
The fraud types to design for
- Account takeover: stolen or phished credentials, SIM swap and session hijacking.
- Social engineering and impersonation: victims tricked into authorizing payments themselves, often by callers posing as banks or government bodies.
- Application fraud: forged documents and false information at onboarding.
- Synthetic and borrowed identities: accounts opened to receive and move stolen money.
- Card and payment fraud: unauthorized purchases, withdrawals and transfers.
- Insider fraud: the breach-of-trust offence, from staff with access to funds or systems.
Each one leaves different signals: device and location changes, unusual beneficiaries, first-time high-value transfers, rapid in-and-out movement, or staff activity outside normal patterns. A detection model that sees only transactions misses most of them.
Why detection must happen in real time
Instant payments settle in seconds. Once money leaves the institution and passes through two or three mule accounts, recovery is unlikely. Detection that runs overnight is investigation, not prevention. The decision to approve, step up authentication, hold or decline has to be made while the transaction is in flight.
Fraud and AML belong in one decision flow
Fraud and money laundering share the same customers, devices, accounts and transactions. Mule accounts are both: they receive stolen funds and launder them. Running fraud detection and AML monitoring on separate systems doubles the data work and leaves gaps between them.
Naiza, built by Limaz, makes fraud and AML decisions in real time on one flow, and our fraud and AML systems service integrates it with core banking, payments and case management. For the AML side of the same programme, read our guide to the Saudi AML Law for fintechs.
Limaz designs and implements counter-fraud programmes for Saudi banks, finance companies and fintechs, from fraud risk assessment to live detection. See our fraud and AML systems service.