SAMA Updates Payment Oversight Framework: Riyadh Strengthens Digital Transaction Rules
Riyadh, Saudi Arabia’s central bank issued updated payment system regulations on March 8, 2026, replacing its 2021 framework. The Saudi Central Bank (SAMA) released circular 472047719 aligning oversight protocols with the Law of Payments and Payment Services enacted under Royal Decree M/26. The update affects all payment system operators in the Kingdom.
Overview
SAMA published its revised Oversight Framework on Payment Systems and Their Operators through its Riyadh headquarters, superseding the August 4, 2021 “Oversight Framework for Payments and Financial Settlement Systems.” The framework emerged from a December 2025 public consultation process and establishes comprehensive regulatory parameters for the Kingdom’s expanding digital payments infrastructure.
The update systematizes SAMA’s regulatory approach through defined oversight boundaries, supervisory methodologies, and operator obligations calibrated to international payment standards. The framework applies to all entities operating payment systems within Saudi jurisdiction and implements requirements under the Payments Law implementing regulations.
Legal Architecture and Scope Definition
The framework establishes regulatory boundaries synchronized with Saudi Arabia’s payments legislation. SAMA’s documentation specifies the alignment process:
“The updated framework aims to define the scope of the oversight framework and align it with the provisions of the Law of Payments and Payment Services and its Implementing Regulations.”
The framework replaces the prior 2021 version with expanded coverage addressing payment system categories, operator classifications, and oversight thresholds. SAMA structured the update to eliminate regulatory gaps between the 2021 framework and subsequent payments legislation enacted through Royal Decree M/26.
Significance: The synchronization creates unified compliance requirements for payment operators and establishes clear jurisdictional parameters for SAMA’s oversight authority across digital payment channels.
Supervisory Methods and Assessment Tools
SAMA detailed its oversight methodology incorporating dual assessment mechanisms. The framework specifies:
“It also clarifies the oversight methodology, including oversight tools, self-assessment, and oversight assessment.”
The methodology requires payment system operators to conduct periodic self-assessments against SAMA-established criteria. SAMA retains authority to perform independent evaluations using standardized metrics. The framework establishes reporting frequencies, assessment templates, and remediation protocols for identified deficiencies.
SAMA’s oversight tools include transaction monitoring systems, operator interviews, documentation reviews, and on-site inspections. The framework categorizes payment systems by risk level, determining assessment intensity and frequency.
Significance: The dual assessment structure distributes compliance responsibility between operators and regulators while providing SAMA with verification mechanisms to ensure accuracy in operator self-reporting.
Operator Requirements and International Standards
The framework mandates specific operational obligations for payment system operators. SAMA’s documentation states:
“In addition, it sets out the obligations of payment systems and their operators, in line with the relevant regulatory frameworks and international standards.”
Operators must implement security protocols, maintain system reliability thresholds, establish business continuity procedures, and report incidents within specified timeframes. The framework references alignment with the Committee on Payments and Market Infrastructures (CPMI) Principles for Financial Market Infrastructures (PFMIs), incorporating standards for governance, risk management, and settlement finality.
Technical requirements address cybersecurity controls, data protection measures, and operational resilience benchmarks. Operators face mandatory compliance timelines following framework publication in SAMA’s official Rulebook portal.
Significance: The international standards alignment positions Saudi payment infrastructure within global best practices frameworks, facilitating cross-border payment interoperability and reducing compliance friction for multinational operators.
What’s Next / Outlook
Payment system operators must demonstrate compliance through SAMA’s Rulebook platform following the March 8 effective date. SAMA will enforce requirements through its supervisory assessment protocols detailed in the framework. Operators face potential sanctions for non-compliance under the Payments Law enforcement provisions.
The framework establishes the regulatory foundation for licensing decisions under the broader payments legislation. SAMA’s oversight approach may influence regulatory updates in neighboring Gulf Cooperation Council markets including the United Arab Emirates and Bahrain.
Conclusion
SAMA’s updated framework establishes standardized oversight for Saudi Arabia’s payment system operators through defined legal alignment, supervisory methodologies, and international compliance standards. The March 8 update replaced the 2021 framework with expanded requirements synchronized to the Kingdom’s Payments Law. The framework positions Riyadh as a regulated hub for digital payment innovation through structured compliance obligations and assessment mechanisms. Operators face immediate implementation requirements under SAMA’s enforcement authority.
Sources: Saudi Gazette, SAMA Rulebook, SAMA Rulebook, SAMA, Zawya
