SAMA’s Open Banking Framework in 2026:Why Saudi Financial Institutions Must Strengthen Fraud and AML Controls
Saudi Arabia’s financial sector is entering a new phase of digital transformation. Under Vision 2030, SAMA’s Open Banking Program enables customers to securely share their financial data with authorized third-party providers, creating opportunities for banks, fintech companies, payment providers, and other financial institutions. On March 26, 2026, SAMA announced the commencement of licensing fintech companies to provide open banking services following the successful completion of its regulatory sandbox phase. SAMA stated that the initiative aims to support financial innovation, improve the efficiency and flexibility of financial services, and strengthen financial inclusion within a secure regulatory framework. [Source]
However, greater digital connectivity also requires financial institutions to address the risks associated with digital financial services. FATF guidance highlights that digital identity and technology can improve customer identification and transaction monitoring, while also creating risks that regulated entities need to understand and mitigate. For Saudi financial institutions, this reinforces the importance of combining digital innovation with effective AML/CFT, identity verification, and financial crime risk controls. [Source]
Open Banking Is Raising the Bar for AML and Fraud Prevention
SAMA’s Open Banking Framework establishes a comprehensive set of use cases, business rules, and technical standards for banks and fintech companies. The framework includes customer experience guidelines, API specifications, implementation requirements, and operational guidelines. SAMA also operates an Open Banking Lab that enables participants to develop, test, and certify their services against the framework. [Source]
For compliance teams, this digital environment increases the importance of effective and continuous customer due diligence. SAMA’s AML requirements state that financial institutions should continuously apply due diligence measures based on customer and business-relationship risk, verify transactions throughout the relationship, reassess customer risk based on activities and transactions, and apply enhanced measures to higher-risk customers. SAMA’s rules also require financial institutions to identify and assess customer risks as part of their KYC processes. Sources: SAMA Rulebook – Due Diligence Measures SAMA Rulebook – Application of KYC Principle and AML/CFT Requirements
Beneficial ownership is another important priority for Saudi financial institutions. SAMA’s AML requirements state that financial institutions must identify the natural person who owns or controls 25% or more of a legal person’s shares and take sufficient and reasonable measures to verify that person’s identity. Where no such controlling ownership exists or there is doubt regarding the beneficial owner, institutions must apply additional measures to identify the person exercising control.
In 2026, SAMA also issued a circular concerning technical integration with the Ministry of Commerce’s Wathq service for verifying the identity of Ultimate Beneficial Owners (UBOs). SAMA’s Rulebook lists this circular as in force from March 9, 2026, demonstrating the continued development of beneficial ownership verification mechanisms in the Kingdom. [Source]
What Saudi Financial Institutions Should Prioritize
To strengthen AML compliance in Saudi Arabia, institutions participating in the digital financial ecosystem should focus on:
Real-time identity verification: Use reliable digital identity processes to strengthen customer identification and verification.
Continuous transaction monitoring: Monitor customer activity and reassess risk throughout the business relationship.
Automated sanctions and PEP screening: Maintain appropriate processes and tools to identify PEPs and apply enhanced due diligence where required.
Beneficial ownership verification: Identify and verify individuals who ultimately own or control legal entities.
Integrated fraud and AML controls: Connect identity, customer, transaction, and risk information to improve financial crime detection.
Audit-ready compliance: Maintain appropriate records demonstrating the customer due diligence and risk-management measures applied.
SAMA’s continued development of the Open Banking ecosystem, including the transition from regulatory sandbox testing to licensing and its focus on operational and regulatory priorities, makes effective compliance increasingly important for Saudi banks and fintech companies. [Source]
Saudi Arabia’s Open Banking transformation is creating significant opportunities for financial innovation, but it also requires financial institutions to maintain strong financial crime prevention capabilities. Combining secure digital identity verification, continuous customer due diligence, transaction monitoring, sanctions and PEP screening, beneficial ownership verification, and appropriate fraud controls can help institutions manage evolving financial crime risks while supporting digital financial innovation.
FACEKI AML Service, based in Riyadh, Saudi Arabia, provides AML screening and compliance technology designed for the Saudi market, including AML/PEP screening, sanctions screening, ongoing monitoring, and audit-ready reporting. FACEKI states that its solution is designed to align with SAMA, CMA, and Insurance Authority (IA) regulations in KSA. [Source]
