Two teams, two views
Fraud and AML run separate tools on the same customer. Alerts arrive without context, and investigators rebuild the timeline by hand.
Solutions
Connect fraud signals, AML screening, and investigations.
Connect fraud, AML, identity, monitoring, and review in one accountable decision flow.
What gets built
- Decisioning flows for fraud and AML events
- Screening, monitoring, and case operations
- Identity and document checks in onboarding and ongoing use
- Rules, evidence, and investigator workflows
- Integration into payments, lending, and account journeys
Where Naiza fits
When the need is a fraud and AML decisioning platform, Naiza by Limaz is the product. Detailed product capabilities live on naiza.ai.
Limaz also delivers the control design, evidence, integration, and counter-fraud program work around the platform.
Why fraud and AML belong in one decision flow
Fraud and money laundering move through the same accounts, devices and payment rails. An account that receives stolen funds and passes them on is a fraud signal and a money-laundering signal at the same moment. When the fraud team and the anti-money laundering (AML) team see it in separate systems, each team sees half of the story.
Saudi regulation already links the two. The Saudi Central Bank (SAMA) Counter-Fraud Framework requires customer due diligence to align with the institution's AML and counter-terrorist financing (CTF) policies. The Anti-Money Laundering Law requires ongoing monitoring of transactions against what the institution knows about the customer, and much of that knowledge sits in onboarding, device and behaviour data the fraud team already holds.
One decision flow means one event model, one customer view and one evidence record. A payment is scored for fraud and its counterparty is screened in the same flow. An investigator opens one timeline. When SAMA or an auditor asks why a transaction went through, the answer is a single record with the signals, the rule, the reviewer and the outcome.
Limaz builds these systems on Naiza, the Arab world's first unified fraud and AML platform, and engineers the integrations, rules, review workflows and evidence around it for Saudi banks, finance companies, payment firms and fintechs.
What we build
- Sanctions and PEP screening
- Customer and counterparty screening at onboarding, on payments and across the whole portfolio, against 1,100+ global sanctions, PEP and watchlist sources, with Arabic and Latin name matching. Possible and confirmed matches go to named reviewers, and every screening keeps its record.
- Transaction monitoring
- Payment, transfer and withdrawal events scored in real time or monitored in the background. Scenarios cover the typologies your risk assessment names, and each threshold has a written rationale.
- Identity and KYC
- Identity and document verification at onboarding and through the relationship, device and behavioural signals, and customer risk profiles that set the level of due diligence each customer receives.
- Rules and risk scoring
- Expression-based rules in priority order, cumulative risk scores and explicit ALLOW, REVIEW and BLOCK outcomes. Rules change without a software release, and every new rule is tested and observed before it enforces.
- Case management and investigation
- Review queues, roles and escalation paths. Each case shows the customer's events, devices, decisions and screening results in one timeline, with investigator notes and outcome labels linked to your case IDs.
- Reporting and management information
- Alert volumes, outcomes, fraud typologies and losses by product for senior management, and a complete case file your AML officer uses to report a suspicious transaction to the General Directorate of Financial Intelligence (SAFIU).
Regulatory expectations in Saudi Arabia
The Anti-Money Laundering Law, issued by Royal Decree No. M/20 in 1439H (2017), sets the core duties for financial institutions. They must identify, assess and document their money-laundering risks and keep that assessment current. They must apply customer due diligence, with enhanced measures for higher risk, and use appropriate systems to identify politically exposed persons (PEPs). They must monitor transactions on an ongoing basis, keep records for at least ten years from the transaction or account closure, and run internal policies, procedures and controls. Suspicious transactions go promptly and directly to SAFIU, and tipping off the customer is prohibited.
Enforcement is concrete. A supervisory authority can fine an institution up to SAR 5 million per violation. Money laundering carries two to ten years in prison, a fine of up to SAR 5 million, or both. The Council of Ministers approved amendments to the law in April 2026, including confiscation of an offender's funds that are disproportionate to lawful income.
The Law of Combating Terrorism Crimes and its Financing (Royal Decree No. M/21, 12/2/1439H) sets matching duties for terrorist financing: a documented risk assessment, due diligence proportionate to risk, records kept for at least ten years, scrutiny of complex and unusually large transactions, and prompt, direct reporting to SAFIU. Terrorist financing carries five to fifteen years in prison. The Council of Ministers approved amendments to this law in June 2026.
SAMA's Counter-Fraud Framework, issued in October 2022, applies to the member organisations SAMA notifies. It is built on four domains: Governance, Prevent, Detect and Respond. It requires a Counter-Fraud Department, an approved strategy for sourcing or developing counter-fraud systems, documented scenarios and thresholds, timely new rules for emerging typologies, and a recorded outcome for every alert and referral. Institutions notify SAMA of new fraud typologies and significant fraud, and multi-factor authentication should not rely solely on one-time passwords sent by SMS.
SAMA also publishes sector AML and CTF rules in its rulebook, including the Rules Governing Anti-Money Laundering and Combating Terrorist Financing for banks, money exchangers and foreign bank branches, and an AML/CTF Guide. Limaz maps each of these obligations to a control, a system and an owner.
Delivery
Each engagement follows six stages, from obligations to a team that runs the system on its own.
Map risks and obligations
We start from your money-laundering and fraud risk assessments, products and channels, and map each legal and SAMA obligation to a control, a system and an owner.
Design the decision flow
One event model across onboarding, logins, payments and withdrawals. We decide which events need an answer before the customer continues, which run in the background, and who reviews what.
Integrate Naiza
We connect your channels, core systems and payment flows to Naiza through its API, Web SDK and signed webhooks, starting with test keys and moving to production in stages.
Build rules and screening
Scenarios, thresholds and screening sensitivity come from your risk assessment, each with a written rationale. New rules run in observation first and enforce once the results are clear.
Stand up review and cases
Queues, roles, escalation paths, investigator procedures and the hand-off from a confirmed case to your AML officer's suspicious transaction report.
Tune and hand over
Labelled outcomes drive false-positive reduction. We set up management reporting on alerts, typologies and losses, then hand over runbooks your team owns.
Common gaps
These are the gaps we close most often in Saudi fraud and AML programmes.
Thresholds without a rationale
Scenarios were set years ago and nobody can explain them to an examiner. The Counter-Fraud Framework expects the rationale to be documented.
Arabic names missed
Screening that ignores transliteration misses real matches and floods analysts with false ones. Arabic and Latin name matching fixes both.
Screening only at onboarding
Customers are checked once and never again. Continuous re-screening surfaces a new listing on the customer it affects.
Alerts closed without outcomes
Reviews end with no recorded reason, so there is no evidence for SAMA and nothing to tune the rules with.
SMS-only authentication
The Counter-Fraud Framework states that multi-factor authentication should not rely solely on SMS one-time passwords. Device and behavioural signals add the missing layer.
What your team has at go-live
- A fraud and AML decision flow across onboarding, logins, payments and withdrawals, running on Naiza.
- Screening at onboarding, on payments and across the portfolio, with Arabic and Latin name matching.
- Rules and thresholds with a written rationale for each, ready for an examiner.
- Review queues, roles and escalation paths, with every outcome recorded against its case ID.
- Customer data, events and screening records stored and processed inside the Kingdom.
- Management reporting on alert volumes, typologies and losses by product.
- Runbooks and an obligation map linking each AML Law, CTF Law and SAMA requirement to its control and owner.
Further reading
Saudi financial fraud law and SAMA's Counter-Fraud Framework: what institutions must do
The law punishes fraud after it happens. SAMA's Counter-Fraud Framework requires institutions to prevent and detect it first. Here is how the two fit together, and what a working programme looks like.
Saudi AML law for fintechs: building the programme SAMA expects
A fintech that moves, holds or lends money in the Kingdom is a financial institution under the AML Law. This is how to turn the law's obligations into a programme that works at fintech speed.
Questions
Limaz designs and implements fraud, AML, identity, monitoring, and decision workflows so Saudi and Gulf financial institutions can decide, review, and evidence those decisions.
Use Naiza when you need a fraud and AML decisioning product. Use a Limaz solution when you also need the operating model, integrations, controls, and evidence around that product.
Financial institutions and designated non-financial businesses and professions operating in Saudi Arabia must comply. For banks, finance companies, payment firms and money exchangers, the law requires a documented money-laundering risk assessment, customer due diligence, PEP identification, ongoing transaction monitoring, records kept for at least ten years, internal controls, and prompt, direct reporting of suspicious transactions to the General Directorate of Financial Intelligence (SAFIU).
Money laundering carries imprisonment of two to ten years, a fine of up to SAR 5 million or both, under the Anti-Money Laundering Law. A supervisory authority can also fine a financial institution up to SAR 5 million per violation. Amendments approved in April 2026 added confiscation of an offender's funds that are disproportionate to lawful income.
It is the Saudi Central Bank's framework for managing fraud risk, issued in October 2022 and applied to the member organisations SAMA notifies. It has four domains: Governance, Prevent, Detect and Respond. It requires a Counter-Fraud Department, counter-fraud systems that work as intended, documented scenarios and thresholds, investigation of every alert with a recorded outcome, and notification to SAMA of new fraud typologies and significant fraud.
Fraud detection protects the customer and the institution from losses, often in real time, by stopping account takeover, payment fraud and abusive signups. AML transaction monitoring looks for money laundering and terrorist financing and leads to a suspicious transaction report to SAFIU. Both use the same customers, devices and payments, which is why Limaz builds them on one decision flow in Naiza.
At least ten years. The Anti-Money Laundering Law requires financial institutions to keep records for no less than ten years from the date the transaction concluded or the account closed. The Law of Combating Terrorism Crimes and its Financing sets the same ten-year minimum. Records must let the institution reconstruct each transaction and show the due diligence and decisions behind it.
To the General Directorate of Financial Intelligence (SAFIU), the national central agency that receives suspicious transaction reports. Under both the Anti-Money Laundering Law and the Law of Combating Terrorism Crimes and its Financing, financial institutions report promptly and directly once they have reasonable grounds to suspect. Tipping off the customer, or anyone else, that a report is being or has been filed is prohibited.
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll come back with a clear next step.