The terms and phrases mentioned below - wherever they appear in these principles - shall have the meanings specified next to them, unless the context requires otherwise.

1- The Institution: The Saudi Arabian Monetary Authority.

2- The Bank: Local commercial banks and branches of foreign banks licensed to conduct banking operations in the Kingdom in accordance with the provisions of the Banking Control Law.

3- The Council: The Board of Directors of the local bank. The primary responsible person in the branch of the foreign bank shall assume the tasks and responsibilities assigned to the boards of directors of local banks wherever mentioned in these principles.

4- Senior Management: The executive management of the local bank (Chief Executive Officer, Managing Director, General Manager) and senior executives responsible for managing the bank's operations, proposing strategic decisions, and implementing them, as well as the branch manager for branches of foreign banks licensed to conduct banking operations in the Kingdom.

5- Compliance Function: An independent function at the first management level of senior management, which defines, evaluates, advises, monitors, and prepares reports on compliance risks in the bank, related to exposure to regulatory, administrative penalties, or financial losses, or that may harm the bank's reputation and lead to its loss due to failure to comply with regulations, instructions, and requirements for combating financial crimes, or with standards of conduct and sound professional practice. The tasks and responsibilities of this function are carried out by an independent compliance unit in banks.

6- Compliance Policy: The policy approved by the Board of Directors of the bank and the branch manager of the foreign bank, which defines and clarifies the overall responsibilities for compliance, the powers of the compliance unit, and the main principles, pillars, and methodology followed by the bank to manage compliance risks, including the elements outlined in principle (1).

7- Compliance Unit: A work unit at the level of a group, sector, or department according to the designation of work units at the first management level in local banks or a department or division or section, etc., at the first management level under the primary responsible person in branches of foreign banks, where the head and compliance staff perform compliance tasks and responsibilities only.

8- Head of Compliance: The Chief Executive of the compliance unit in local banks and the responsible person at the first management level directly reporting to the branch manager in branches of foreign banks, whose general responsibilities include coordinating the process of identifying compliance risks and providing advice to senior management, and overseeing the activities of compliance officers and staff.

9- Compliance Staff: All individuals performing compliance tasks and responsibilities from the members of the compliance unit.

10- Compliance Officer: An employee from other work units other than compliance unit staff, authorized by the head of compliance to undertake specific responsibilities and tasks related to the compliance function in their operational unit.

11- Compliance Risks: Risks that result in or lead to the imposition of penalties and regulatory actions against the bank or cause it to incur significant financial losses or harm its reputation due to its failure to comply with relevant regulations, instructions, and standards applicable to the bank, as well as the behavioral and ethical rules governing banking activities, all of which are referred to in compliance regulations, rules, and standards (collectively referred to as "risks arising from non-compliance").

12- Compliance Role: A description of the responsibilities of those who bear compliance responsibilities among the bank's employees.

13- The Regulations: The regulations and rules applicable to the banking sector and its members.

14- The Instructions: All that is issued by the institution in order to perform its role as a supervisory and regulatory authority and other relevant authorities, including regulations, rules, principles, frameworks, guidelines, and binding circulars.

15- Compliance Regulations, Rules, and Standards: The regulations and instructions applicable to the banking sector and its members.

16- Conflict of Interest: The situation or situations in which the head and compliance staff and compliance officers in other units have or may have a direct or indirect interest or relationship in a matter that is under consideration by that person for the purpose of making a decision regarding it, such that this interest or relationship prevents or leads to the belief that it has hindered them from expressing their opinion or making their decision independently and impartially, without regard to this interest or relationship.

17- The institution issued these principles under the powers granted to it and its supervisory and regulatory responsibility as follows:

A. The Law of the Saudi Arabian Monetary Authority, issued by Royal Decree No. (23) dated 23/05/1377 AH.

B. The Banking Control Law, issued by Royal Decree No. (M/5) dated 22/02/1386 AH.

C. The Anti-Money Laundering Law issued by Royal Decree No. (M/20) dated 05/02/1439 AH and its executive regulations issued under the decision of the Presidency of State Security No. (14525) dated 11/02/1439 AH.

D. The Anti-Terrorism Crimes and Financing Law issued by Royal Decree No. (M/21) dated 12/02/1439 AH and its executive regulations issued under the decision of the Council of Ministers No. (228) dated 02/05/1440 AH.

18 - The institution issued these principles as the first update to the compliance guide for banks operating in the Kingdom of Saudi Arabia, issued under Circular No. 56202 / M A T / 787 dated 19/12/1429 AH. This issuance is part of the institution's efforts aimed at continuously improving and addressing banking regulatory issues and enhancing sound practices in banking institutions, and the continuous affirmation that bank officials should be convinced that compliance policies and procedures are effective and implemented, and that senior management has appropriate corrective procedures to address any instances of non-compliance or deficiencies when detected.

19- Compliance with regulations and instructions begins at the top of the hierarchy, where the Chairman and members of the Council and senior management must be role models in managing work and compliance.

20- Good compliance from senior management requires a continuous affirmation that a culture based on high standards of integrity and professional ethics must prevail. Compliance should be an integral part of the bank's culture and should not be limited to the compliance unit staff only, as the responsibility for compliance lies with every individual working in the bank, and this responsibility should be an integral part of the bank's operations and all operational activities, achieving high standards in executing its work through its continuous endeavor to adhere to the spirit and text of the law. It should be taken into account that the results of the bank's actions related to shareholders, clients, employees, and its market environment may lead to significant negative reactions affecting its reputation and causing harm, even if there is no actual violation of the regulations.

21- The standards of trust and integrity are the core values and the highest rank in the relationship between the bank and its clients, and the most important pillars upon which the bank builds its reputation with its clients and the entities it deals with. Reputation protection should be a constant characteristic in the minds of managers and employees in all their activities. They must exhibit a high level of trust, integrity, and professionalism when performing their assigned tasks, and their actions must always comply with the text and spirit of the regulations and instructions governing the banking sector and its personnel.

22- These principles establish a framework for compliance governance in the bank consisting of the Council and its responsibility to approve the compliance policy and oversee the management of non-compliance risks, senior management and its responsibility to manage non-compliance risks, and the compliance unit and its responsibility for the overall coordination of compliance and supporting senior management.

23- These principles initially define the responsibilities placed on the Council and senior management regarding compliance as a primary importance, followed by the principles that should support the compliance unit within the bank.

24- Compliance systems, rules, and standards include issues such as: adherence to appropriate market practice standards, managing conflicts of interest, treating clients fairly, ensuring the suitability of advice provided to clients, and covering specific areas such as: anti-money laundering, combating the financing of terrorism, preventing the proliferation of weapons, the Know Your Customer principle, combating financial fraud, combating corruption, and addressing reports of violations.

25- Compliance systems, rules, and standards are based on multiple sources, including the regulations and instructions applicable to the banking sector under the supervision of the institution, the regulations and instructions overseen by other official authorities with jurisdiction, or in other countries where banks conduct their operations, prevailing banking customs, business practice rules supported by sector institutions, internal conduct rules applicable to bank employees, standards of integrity and ethical conduct, and relevant requirements issued by international organizations and groups specialized in formulating policies governing the supervision of banking and financial institutions, such as the Basel Committee on Banking Supervision and others.

26- Compliance principles require that the compliance unit be independent and adequately supported with resources, that its responsibilities be clearly defined, and that its activities be subject to independent and periodic review by the internal audit unit. This will be elaborated in principles (5) to (8) below in more detail, all reflecting the effectiveness of the compliance unit's work.

27- The compliance unit and function in banks are among the most important foundations and success factors, as they play a crucial role in maintaining the bank's reputation and credibility and protecting the interests of shareholders and depositors, and providing protection from penalties. This is achieved through its contributions as follows: .

• ● Mitigating non-compliance risks, particularly systemic risks, reputational risks, and financial penalty risks.

• ● Strengthening the relationship with regulatory and supervisory authorities and considering their communicated observations to periodically identify and address deficiencies before they escalate.

• ● Contributing to establishing principles of sound management and governance in banks.

• ● Ensuring compliance with what is issued by supervisory and regulatory authorities in particular and competent authorities in general from regulations and instructions.

• ● Creating appropriate mechanisms and frameworks to combat money laundering, financing of terrorism, preventing the proliferation of weapons, financial fraud, and corruption, and providing insights and advice to address and correct deficiencies and violations.

• ● Taking necessary actions to address reports received from bank personnel and stakeholders regarding violations consistent with the reporting policy for violations at financial institutions issued by the institution to ensure objective and escalating treatment and to formulate a corrective action plan.

• ● Upholding values and professional practices in banking work.

• ● Raising awareness among bank employees and clarifying the positives and negatives regarding their compliance and the risks of non-compliance with the regulations and instructions issued by the relevant regulatory and supervisory authorities.

28- The bank must organize its compliance unit in such a way that prioritizes managing non-compliance risks in a manner consistent with its risk unit strategy.

29- It should be recognized that the extent of the compliance framework and the diversity and complexity of compliance rules and their sources place the responsibility for managing non-compliance risks and verifying compliance levels and establishing necessary controls to ensure compliance, whether at the level of work procedures or technical systems and data protection, on senior management and all operational units (groups and business sectors) through doing what is necessary for review and ensuring effective and continuous application, while the role of the compliance unit is limited to identifying, communicating, and explaining the regulations and instructions to business sectors immediately upon receiving them from the supervisory and regulatory authorities and other competent entities and obtaining confirmation from them, ensuring their inclusion in policies and procedures, and conducting continuous monitoring to identify, discover, and assess non-compliance risks periodically and report violations of compliance systems, rules, and standards and raise reports regarding non-compliance risks and violations.

30- The compliance principles apply to all commercial banks operating in the Kingdom and their branches and locations in foreign countries where they conduct banking operations unless they conflict with the regulations and instructions of those countries, representing the minimum necessary to achieve effective compliance in general and the compliance unit and its function in particular, and the institution expects adherence to higher sound practices.

31- These principles should be read and applied alongside a number of related instructions for the unit's operations, including but not limited to the following:

• ● The main principles of governance in banks and financial institutions operating in the Kingdom of Saudi Arabia.

• ● Principles of conduct and work ethics in financial institutions.

• ● Anti-Money Laundering and Combating the Financing of Terrorism Guide.

• ● Banking account rules.

• ● Regulatory rules for the operation of self-supervisory units and committees.

• ● Anti-Financial Fraud Guide.

• ● Internal control guidelines.

• ● Framework for Sharia governance for local banks and financial institutions operating in the Kingdom.

• ● Reporting policy for violations at financial institutions.

• ● Instructions issued regarding risk management.

• ● Requirements for appointment to leadership positions in financial institutions subject to the institution's supervision.

• ● Instructions for outsourcing tasks to third parties.

36- The responsibility for the effective management of non-compliance risks rests with the senior management of the bank. Principles (3 and 4) outline the key elements of this principle. 
 

The senior management of the bank is responsible for preparing, updating, and obtaining the Council's approval for the compliance policy, publishing it, ensuring adherence to it, and reporting on the management of compliance risk to the Council.

Responsibility for Preparing, Updating, and Communicating the Compliance Policy

37- The senior management of the bank is responsible for preparing and updating the compliance policy for managing compliance matters, obtaining the Council's approval in local banks, and the branch manager's responsibility for foreign bank branches, and communicating it to all sectors of the bank, ensuring it includes the following:

• (1) Principles of compliance that must be adhered to by the business units and their personnel.

• (2) Explanation of the main procedures through which compliance risks are identified and managed at all levels of the bank's system.

• (3) Enhancing clarity and transparency by distinguishing between the general standards applicable to all employees and the specific standards and procedures that apply only to certain groups of employees.

Responsibility for Adhering to the Compliance Policy, Taking Corrective Actions, and Applying Sanctions

38- The senior management has the duty to ensure adherence to the compliance policy and to ensure that appropriate corrective and disciplinary action is taken in the event of a violation of the compliance policy.

Oversight and Reporting

39- The senior management, with the assistance of the compliance unit, is responsible for the following:

• ● Identifying the main compliance risks facing the bank and developing plans to manage and assess them at least once a year. These plans must address any shortcomings in the policy, procedures, or implementation related to the effectiveness of the existing compliance risk management, in addition to determining the need for any additional policies or procedures to address new compliance risks identified by the annual compliance risk assessment.

• ● Providing written reports to the Council or its delegated committee, highlighting the bank's management of compliance risks at least once a year, to support Council members in making informed decisions based on accurate information regarding the effectiveness of the bank's compliance risk management.

• ● Immediately notifying the Council or its delegated committee in writing of any significant failures, deficiencies, or violations of compliance (for example: instances of non-compliance that may pose significant risks resulting in legal or regulatory penalties, substantial financial loss, or damage to reputation and loss thereof).

The senior management is responsible, under the compliance policy approved by the Council, for establishing and developing a permanent and effective compliance unit within the bank, as follows:

Establishing, supporting, and developing the compliance unit

40- As a fundamental requirement of compliance, senior management in local banks, under the compliance policy approved by the Council, must establish, support, and develop an independent, permanent, and effective compliance unit that undertakes compliance tasks and enjoys sufficient powers and responsibilities to monitor compliance, with a unit or an independent compliance officer functionally at the first management level reporting to the chief officer for branches of foreign banks. The role of the compliance unit must be clarified to all employees, encouraging them to consult it on compliance matters.

Reliance on the compliance unit.

41- Senior management must take the necessary measures to ensure that the bank relies on a permanent and effective compliance unit that adheres to and performs the tasks assigned to it according to the principles of the compliance unit's tasks mentioned later.

Coordination and harmony with other operational units

42- Achieving compliance requires senior management to create an atmosphere of trust and harmony in the relationship between the compliance unit and other operational units and the role it plays, and to take the necessary measures and coordination to facilitate that.

Appointment of the compliance officer and officials and employees of the compliance units

43- The selection and nomination of the compliance officer and officials of the operational units in the compliance unit are subject to the appointment requirements for leadership positions issued by the institution and any guidelines that the institution may issue in this regard. The responsibility for selecting employees of the operational units in the compliance unit lies with the compliance officer in accordance with the internal employment and appointment requirements approved in the bank.

The main principles from Principle No. (5) to Principle No. (8) describe and include details of the correct practices, requirements, and applications necessary for this unit. However, the methods by which these principles are implemented depend on various factors such as the size of the bank, the nature and complexity of the bank's operations, its geographical scope, and the regulatory framework and instructions under which it operates.