Products and services subject to these Rules that require SAMA's approval
1. New services and products that the company has not previously provided, i.e. a product or service that the company offers in the Kingdom for the first time regardless of whether it was previously provided by the company or the parent company outside the Kingdom, provided that these services are within the scope of payment services stipulated in the Payment Services Providers Regulations.
2. Products/services previously approved that have undergone substantial changes in their structure, characteristics and risk profile. The Chief Risk Officer (or any other senior risk officer designated by the Company) and the Compliance Officer are responsible for assessing whether the change to the existing product/service is considered substantial. The purpose is to determine if that product/service is new. Changes to the principal terms and conditions relating to payment, other significant rights and obligations of counterparties and customers, the intended uses and target markets of the product, and the nature of the assets upon which the product is based must be taken into account when determining whether the change or modification to the product is considered substantial.
Procedures for submitting an approval request to SAMA
1. To obtain SAMA's approval, the company must send a request that contains all the required documents to the following e-mail: PRDPayments@SAMA.GOV.SA
2. The company must provide any missing information/documents and address comments within (10) working days from the date of receiving SAMA's notification. This period may be extended for a similar period once SAMA accepts the justifications submitted by the company.
3. If the company fails to provide the missing information/documents or address comments within the period specified in provision (2) above, SAMA has the right to close the request, and the company will have to resubmit the request.
4. The company must not market or offer the product/service until after obtaining SAMA's approval and receiving the product/service code.
Documents required for approval requests
1. Business plan for the product or service attached with detailed document (s) that include:
a. The strategy, including mission, objectives, unique benefits, target segments, and market research.
b. A detailed description of the product and service.
c. The operating model.
d. Feasibility study.
e. A separate and comprehensive assessment of AML/CFT risks and the company's controls to mitigate such risks.
f. A separate and comprehensive assessment of cyber security risks and the company's controls to mitigate such risks.
g. A separate and comprehensive assessment of technical risks and the company's controls to mitigate such risks, including those that may affect business continuity.
h. A separate and comprehensive assessment of financial fraud risks and the company's controls to mitigate such risks.
2. Acknowledgment and undertaking from the CEO, Compliance Manager, Risk Manager, and Information Security Manager to confirm that the product/service to be provided developed in accordance with all relevant rules and instructions and with the policies adopted by the company (Appendix A).