The Convergence of SAMA Cyber-Governance and NCA Controls: Securing KSA Financial Systems Against Cyber-Enabled Financial Crime
Saudi Arabia’s financial sector is becoming increasingly dependent on digital banking, electronic payments, fintech platforms, and interconnected financial services. This digital transformation also increases the importance of protecting sensitive financial information and transaction systems from evolving cyber threats. SAMA’s Cyber Security Framework requires regulated financial institutions to establish appropriate cybersecurity governance, preventive and detective controls, and mechanisms for managing cyber risks. The framework specifically emphasizes protecting the confidentiality, integrity, and availability of information assets and online services. SAMA – Cyber Security Framework [Source]
The National Cybersecurity Authority (NCA) also plays an important role in strengthening Saudi Arabia’s national cybersecurity posture through its Essential Cybersecurity Controls (ECC 2-2024). The controls are designed to strengthen cybersecurity and protect information and technology assets against internal and external threats. For entities within the ECC scope, the framework provides requirements covering areas such as cybersecurity governance, risk management, asset protection, identity and access management, and cybersecurity incident management. Financial institutions should therefore understand how applicable NCA requirements interact with sector-specific SAMA controls. NCA – Essential Cybersecurity Controls (ECC 2-2024) [Source]
Core Pillars of Integrated Cyber-AML Governance
A strong cyber-AML strategy should connect cybersecurity intelligence with financial crime monitoring rather than treating the two functions as completely separate disciplines. SAMA’s Cyber Security Framework recognizes the need for preventive and detective controls, while its Financial Sector Cyber Threat Intelligence Principles emphasize collecting, analyzing, and sharing cyber-threat information to help financial institutions anticipate attacks and protect critical information assets. This creates an opportunity for institutions to use relevant cyber-risk indicators alongside transaction and customer-risk information when investigating suspicious activity. SAMA – Financial Sector Cyber Threat Intelligence Principles
Data Protection and Cloud Governance: SAMA’s framework includes specific cloud-security requirements, including data-location considerations. In principle, cloud services used by regulated entities should be located in Saudi Arabia, while use of services outside the Kingdom requires explicit SAMA approval. Institutions should therefore assess data residency, segregation, security controls, and third-party risks when deploying AML and cybersecurity technologies.
Identity and Session Risk: Combining authentication, access, device, and transaction-related indicators can help institutions identify unusual activity and strengthen protection against unauthorized access. SAMA’s cybersecurity requirements for electronic banking services include controls such as multi-factor authentication and measures designed to protect customer information and transactions.
Forensic and Security Logging: Maintaining reliable security and activity records is essential for investigation, incident response, and regulatory oversight. Institutions should ensure that relevant system events, access activities, security incidents, and compliance decisions are appropriately logged, protected, and available for investigation. SAMA – Cloud Computing Controls
For Saudi financial institutions, cybersecurity and financial crime risk are increasingly interconnected. A resilient compliance architecture should combine strong cybersecurity governance, threat intelligence, identity controls, transaction monitoring, and effective investigation processes. By integrating these capabilities, financial institutions can improve their ability to protect sensitive systems, detect emerging threats, and maintain regulatory readiness across the Kingdom’s evolving digital financial ecosystem. SAMA – Cyber Security Framework
