The Saudi Central Bank issued these rules based on the powers granted to it under its system issued by Royal Decree No. M/36 dated 11/04/1442 AH, and the Banking Control System issued by Royal Decree No. M/5 dated 22/02/1386 AH, and the Rules for Implementing the Provisions of the Banking Control System issued by Ministerial Decision No. 2149/3 dated 14/10/1406 AH.

These rules replace the previous instructions issued by the Saudi Central Bank regarding the role and participation of banks in an Initial Public Offering concerning Circular No. 38399/ M A Sh/ 588 dated 12/11/1426 AH, and No. M A Sh/ 337 dated 08/11/1425 AH, and No. 333/ M A/ 200 dated 22/08/1413 AH, and the General Rules for Regulating Subscription Operations in Saudi Joint Stock Companies, with an emphasis on the obligation to comply with these rules in accordance with the rules, instructions, and other regulatory requirements issued either by the Saudi Central Bank or other legislative bodies - whenever applicable.

1) The terms and phrases mentioned below - wherever they appear in these rules - shall have the meanings specified next to each of them, unless the context requires otherwise:

Central Bank: Saudi Central Bank

Rules: Rules governing the operations of receiving and financing banks in the initial public offering of securities.

Receiving Bank: The bank that receives subscription requests and amounts from individuals in the initial public offering process and processes them. In the case of multiple receiving banks in a single offering, the term receiving bank includes the primary receiving bank and the secondary receiving bank.

Financing Bank: The bank that provides credit facilities to its clients for the purpose of subscribing to securities in the initial public offering process.

Issuer: The person who issues or intends to issue securities.

Securities: A security is a document that shows the legal ownership by a person of a share in a joint-stock company, reflecting the person's ownership of it as having financial value.

Offering Period: Includes the period for registering subscription requests, the process of building the order book, payment of the subscription amount, and the final allocation of the offering shares.

Related Parties: The parties clarified in Article (2) Paragraph (6) of the first update of the related parties rules, communicated under Central Bank Circular No. 41045379 dated 01/07/1441 AH.

Exposures: The exposures clarified in Article (3, 1) Paragraph (4) of the large exposures rules for banks, communicated under Central Bank Circular No. 67/1651 dated 09/01/1441 AH.

Individuals: Natural persons who do not possess any legal status and are not wealthy individuals.

Wealthy Subscribers: Natural persons with high financial solvency, classified according to the limits and criteria of the bank, provided that their assets under the bank's management are not less than 5 million Riyals.

Legal Entities: A legal entity such as commercial institutions, companies, government and quasi-government sectors, financial institutions, or a group of individuals or entities or both, gathered for a specific purpose and forming a legal entity.

Government Offering: The initial public offering of securities for a company in which the Government of the Kingdom of Saudi Arabia, or any directly or indirectly affiliated entity, owns 51% or more.

2) These rules aim to assist the receiving banks or the financing banks in initial public offerings of securities in establishing the minimum policies and procedures to mitigate potential risks they may face. 
 

3) Scope These rules apply to all banks participating in the initial public offering of securities, whether the offering is inside or outside the Kingdom, in one of the following capacities or both:

• A) Financing Bank.

• B) Receiving Bank.

4) The bank must incorporate what is stated in these rules into its policies and procedures, and take the necessary steps to ensure compliance with them. The following governance procedures must be applied as a minimum:

• أ) The responsibility for establishing participation standards as a financing bank or receiving bank lies with the bank's Board of Directors or its authorized representative.

• ب) Demonstrating its ability to participate in the initial public offering process and fulfilling its role with caution and efficiency, by possessing the financial and operational capacity that includes the necessary resources, systems, and procedures to manage associated risks.

• ج) Establishing procedures for monitoring activities related to initial public offerings, and complying with the requirements set forth in these rules.

5) The bank may not deviate from its internal policies regarding financing programs or other programs except after obtaining the approval of the Board of Directors or its authorized representative.

6) The bank must ensure the effectiveness of all related systems before commencing the initial public offering process.

22) The bank must apply appropriate precautionary controls for cybersecurity to protect the informational assets and data of the bank and the subscribers from cyberattacks, while ensuring compliance with regulatory requirements related to cybersecurity.

23) The bank must ensure the application of security monitoring controls for all systems and applications used in the initial public offering process. Governance of monitoring and incident response procedures must be established according to the cybersecurity incident response policy, ensuring the readiness of incident response teams.

24) The bank must implement a comprehensive testing program to verify the effectiveness and resilience of the cybersecurity of the systems and applications used in the initial public offering process, which includes, but is not limited to, the following:

• A) Security vulnerability assessment and penetration testing.

• B) Security assessment of the breach situation.

25) The bank must ensure operational resilience by testing a range of potential failure scenarios and verifying compliance with regulatory requirements related to business continuity.

26) The bank must implement preventive measures to mitigate risks arising from reliance on third parties and service providers. Additionally, it must ensure the readiness of the third party to support the systems and applications used in the initial public offering process.

27) The bank shall establish documented procedures for the refund of any excess subscription amount, if any, after the allocation of the securities.

28) The bank must inform the subscriber of the mechanism for the refund process of the excess subscription and the timeline for that, ensuring that the excess amount is refunded to the subscriber's account electronically only.

29) In the event of cancellation or incomplete initial public offering, the bank shall refund the entire subscription amount to the subscriber's account electronically only, according to the timeline for that.

30) The bank must exercise due diligence when refunding the subscription amount, and it must - at a minimum - verify the identity of the subscriber before processing the refund.

31) The bank must provide the central bank with a report on the initial public offering data based on the criteria outlined below:

• أ) A report after the end of the offering period.

• ب) In the event that the initial public offering falls under the definition of a large-scale initial public offering or a government offering, reports must be submitted on a daily basis during the offering period.

32) Reports must be submitted to the central bank no later than one business day from the criteria mentioned above.

33) Reports must be submitted to the central bank via the following email: [email protected]

34) The central bank may apply Article (31-b) to subscriptions that do not fall under the definition of a large-scale initial public offering or a government offering at its discretion.

35) These rules shall come into effect as of this date.