## 1sauea2024003-print-pdf ## Source details **Canonical URL:** [1sauea2024003-print-pdf](https://www.imf.org/-/media/files/publications/cr/2024/english/1sauea2024003-print-pdf.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2024/english/1sauea2024003-print-pdf.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2024/english/1sauea2024003-print-pdf.pdf.json) --- ### Progress in regulatory and supervisory framework - Recent legislative updates: Saudi Central Bank Law (SCBL; 2020) and Anti-Money Laundering Law (2017). - Draft Banking Control Law (BCL): public consultation ended in early-2023; authorities intend to use the new draft BCL to further strengthen the framework. - SAMA’s Banking Policy Development Framework (2021) is reviewing and updating all regulations. - Recent circulars assessed as fit for purpose: financial fraud, disaster recovery, and Basel III disclosures. - Identified regulatory gaps needing new or updated rules: - overarching risk management framework; - country and transfer risk; - market risk; - interest rate risk in the banking book (IRRBB). ### Legal mandate, independence, and supervisory powers (findings) - SCBL Article 3 states SAMA’s objectives as: (i) maintaining monetary stability; (ii) supporting the stability of the financial sector and promoting trust therein; and (iii) supporting economic growth. - Primary legislative shortcomings: - SCBL does not specify that promoting safety and soundness of banks is the explicit primary mandate or that other objectives are subordinate. - BCL (1966) and implementing rules leave certain supervisory powers unclear or requiring prior Minister/Council approval for key actions (examples cited: issuing general rules, conducting inspections, taking specific corrective actions, imposing certain sanctions). - Powers SAMA lacks or where legal basis is unclear: - calibrate prudential requirements and supervisory reporting proportionate to bank risk profile and systemic relevance; - review, reject, and impose prudential conditions on transfers of significant ownership and controlling interest in banks; - take corrective actions and impose sanctions based on supervisory judgment ahead of legal or regulatory breach; - full access to boards, group boards, management, staff, and records (including parent and affiliated companies); - powers to limit consolidated group activities and locations (including closure of foreign offices). - Independence and accountability recommendations: - set qualifying criteria and grounds for removal for Governor and Vice Governors and disclose removal reasons; - make appointment/removal processes more transparent; - reduce requirements for prior approval from Minister or Council at several supervisory stages; - strengthen legal protection for SAMA, its staff, retired staff, and its agents (cover omissions and defence costs). ### Licensing, ownership transfer, and major acquisitions (findings & recommendations) - Current licensing: - BCL designates the Minister as licensing authority; SAMA receives and processes license applications but law is silent on who sets enforceable licensing criteria. - Current minimum initial capital amount in law: SAR 2.5 million (noted as inadequate for modern bank start-ups). - Over the past five years SAMA received 18 license applications: two conventional banks, six digital banks, and 10 foreign bank branches. As of December 31, 2023 SAMA has issued licenses for three digital banks. - Licensing process gaps: - Lack of binding timelines to commence operations after license approval. - Licensing processing lacks documented verification of: source of funds for initial capital; shareholder financial strength and capacity to support; identification and due diligence of ultimate beneficial owners (UBOs); assessment of group ownership impacts on supervision; assessment of board/senior management collective knowledge. - Newly established banks are not subject to an enhanced supervision cycle after licensing. - Transfer of significant ownership: - No statutory definitions of “significant ownership” or “controlling interest.” - Current semi-formal arrangements with CMA (MoU and exchange of letters) are not legally enforceable and do not cover all changes in significant/controlling beneficial ownership. - Recommendations: empower SAMA to review, reject and impose conditions on changes in significant ownership (including ability to reverse changes based on false information); require prompt notification of material shareholder changes; perform periodic fit-and-proper assessments of beneficial owners above a threshold. - Major acquisitions: - SAMA lacks internal guidelines for processing major acquisition proposals; current guidance dates to 2011. - Explicit criteria to consider when processing major acquisitions: (i) SAMA’s ability to supervise and require corrective measures across the banking group; (ii) quality of host-country supervision and SAMA’s consolidated supervision capability; (iii) assessment of risks from the acquired entity and bank’s ability to mitigate them. - Laws/regulations should empower SAMA to prohibit major acquisitions/investments in countries where information flows needed for consolidated supervision are prohibited. ### Domestic coordination and cross-border cooperation - Domestic coordination: - NFSC (founded 2015) chaired by Minister of Finance; includes SAMA Governor as Secretariat; meets quarterly with ministerial and technical subcommittees. - MoU-based arrangements exist with CMA and one host supervisor; MoUs with Insurance Authority and remaining host supervisors are recommended. - Cross-border cooperation: - SAMA participates occasionally in supervisory colleges for two banks; has MoUs/information-sharing arrangements with only one of 24 relevant home/host jurisdictions. - No systematic, ongoing, proactive sharing of material supervisory information with most home/host supervisors; information exchange is typically request-initiated. - SAMA has yet to establish cross-border crisis management or resolution arrangements with relevant home/host supervisors and resolution authorities. - Banking international footprint and ownership: - There are 23 foreign banks from 18 jurisdictions licensed to have a branch presence (of which 16 from as many jurisdictions are currently operating). - Saudi banks operate branches or subsidiaries in eight jurisdictions. - Three foreign banks hold majority or controlling shareholding in three Saudi banks. - Saudi banks’ foreign footprint: 18 subsidiaries, four associates and eight branches in foreign jurisdictions. - Of the eleven Saudi banks, one is a subsidiary of a foreign bank; in two other local banks, foreign banks licensed elsewhere have controlling interest; these three banks account for about 16 percent market share of KSA banking system assets. - Recommendations: - Establish full MoUs with: Insurance Authority; the remaining seven host supervisors; all relevant home supervisors and stakeholders relevant for resolution. - Make information exchange systematic, ongoing and proactive; develop joint communication strategies with home/host supervisors. - Conclude cross-border crisis cooperation and group resolution planning frameworks; operationalize SIFIL implementing regulations. ### Supervisory approach, risk-based supervision, and scope - SAMA’s supervisory model: - Employs an established Risk-Based Supervision (RBS) framework embedded in supervisory activities. - RAM (Risk Assessment Model) assesses nine risk categories: credit, liquidity, market, operational, banking book interest rates (IRRBB), technology, legal, strategic, and AML/CFT. - RAM combines inherent risk, controls and oversight assessments, capital and earnings ratings, and an impact rating based on DSIB criteria: Size; Interconnectedness; Substitutability; Complexity. - Direction of risk assessed for a 12-month outlook. - Scope and limitations: - Supervisory focus and monitoring largely concentrated on domestic consolidated levels; solo bank monitoring is limited in practice. - Prudential requirements are mostly set to apply at solo and consolidated levels, but monitoring is often only at domestic consolidated or global consolidated levels. - Specific monitoring gaps: - related parties and large exposures monitoring is at the domestic level and excludes exposures in overseas branches and subsidiaries; - liquidity monitoring is undertaken at the global consolidated and domestic consolidated levels, but not consistently at the solo level. - Onsite inspections are thorough and compliance-focused but have a narrower qualitative assessment of risk culture; since 2019 SAMA “has not conducted full-scope inspection in any bank”; full-scope inspections for high-stance banks are “not routine.” - Recommendations to improve supervisory approach: - Produce and maintain distinct, ongoing solo-bank (standalone) risk profiles in addition to consolidated group assessments. - Incorporate reputation risk, contagion risk, and group risks into core risk ratings and the RAM. - Assess banks’ and banking groups’ resolvability and incorporate resolvability risks into risk profiles. - Engage systematically with boards, board committees, and independent board members (require meetings and challenge strategy). - Periodically undertake formal assessment of: (i) quality, effectiveness and integration of on-site and off-site functions; (ii) independent review of adequacy and effectiveness of supervisory tools and their use. - Institute full-scope inspections across banks at defined periodicity (example proposed: once every three to five years). ### Consolidated supervision and group-wide risks - Rationale: - All 11 local banks in KSA are part of banking groups; group entities include 69 subsidiaries and 24 associates, encompassing banking, insurance, securities/financial entities and 72 non-financial entities. - Group entities account (per SAMA data) for “3 to 22 percent of the net profits, 1 to 7 percent of total assets, and 3 to 18 percent of capital” of their respective consolidated banks; in 9 of 11 banks at least one of these three parameters is about 10 percent or more. - Identified gaps: - Consolidated supervision framework and tools need to be more comprehensive. - Insufficient assessment of reputation and contagion risks arising from group and wider group entities. - Insufficient application, monitoring and enforcement of prudential requirements at global consolidated level. - Supervisory reports at global consolidated level are not always obtained to determine banking group risk profiles. - Offsite and onsite examinations of local bank foreign operations lack a policy on scope and frequency; additional reporting is often required but not standardized. - Need to consider host supervision quality when determining risk profile and supervisory approach for foreign operations. - SAMA needs powers to limit range of activities of consolidated group and locations in which activities can be conducted (including closure of foreign offices), if necessary. - Recommended actions: - Assess risks from banking group entities (including parent/controlling entity and wider group) and incorporate in banking group risk profile and supervisory rating. - Apply, monitor and enforce prudential requirements at the level of global consolidation. - Establish policy on scope and frequency of examinations of foreign operations and require additional reporting as necessary. - Obtain supervisory reports at the global consolidated level. - Obtain powers to limit consolidated group activities/locations when necessary. ### Prudential framework, capital, liquidity, and risk metrics (key statistics preserved) - Industry average capital adequacy ratio: 20.1 percent (as of end-2023). - Liquidity Coverage Ratio (LCR): 180.3 percent (at end-June 2023). - Net Stable Funding Ratio (NSFR): 115.8 percent (at end-June 2023). - Non-performing loans (NPLs): 1.5 percent (at end-2023). - Banking sector ROA: 2.2 percent (as at end-2023). - Banking sector ROE: 12.8 percent (as at end-2023). - Total bank credit growth: average annual rate of 14 percent between end-2020 and end-2023. - Retail real estate loans more than tripled from 2019 to 2023; credit growth in this segment peaked at 59 percent in 2020 and decelerated to 10 percent in 2023. - PIF has invested 77 percent of its assets under management domestically (noted in national statistics PIF investments are classified as private). ### Credit risk, provisioning, large exposures, and related-party rules - Credit risk framework: - Rules on Credit Risk Management (2013) and Loan Classification, Provisioning and Credit Review (2004) apply; IFRS 9 adopted January 1, 2018. - SAMA requested banks in 2023 to maintain a NPL coverage ratio above 150 percent; some banks complied by increasing provisioning. - Forbearance and provisioning gaps: - Current definition of forbearance (rescheduled loans) is less comprehensive than Basel 2017 definition—recommend update within next two years. - FSC should systematically review provisioning levels considering macro indicators and system trends. - Large Exposures (LEX) and concentration: - LEX Rules issued August 2019; a large exposure is defined at 10 percent or more of Tier 1 capital. - Individual exposure limits (as percent of Tier 1 capital): 5 percent for individuals and sole proprietorships; 25 percent for commercial undertakings majority owned by Saudi government; 25 percent for exposures to banks unless the counterparty is a DSIB when the limit is reduced to 15 percent; 15 percent for all other exposures. - Aggregate large exposures capped at 600 percent of Tier 1 capital. - SAMA may allow temporary breaches up to 35 percent of Tier 1 capital in exceptional circumstances (assessors recommend strict temporariness). - Reporting gap: current reporting often confined to “domestic” consolidation and excludes overseas branches/subsidiaries—recommend reporting at solo and consolidated levels. - Observed high concentrations: for eight domestic banks total exposure to the top 20 net exposures was 200 percent of capital or more (highest around 380 percent). - Related-party rules (findings): - Related Parties Rules (Circular no. 43095743 dated June 2022) broaden coverage but gaps remain: - Definition of affiliates is not as broad as Basel; does not include subsidiaries of the bank’s controlling shareholder nor some influential non-managerial advisers. - No related party limit for banks that are related parties; aggregate related party exposure limit set at 50 percent of eligible Tier 1 capital—assessors find this higher than expected under the BCP (25 percent). - Exposures to Saudi Government and government-owned commercial entities are exempt from large exposure limits; SAMA is encouraged to increase monitoring of these exposures as they are expected to grow under Vision 2030. - Reporting: RMS includes Q27.5 Statement Showing Exposures to Related Counterparties that Exceed 5 percent of Bank's Eligible Capital Base—assessors note this is a high threshold and recommend broader reporting. - Principle 20 assessment: Materially non-compliant. ### Market risk and derivatives activity - Market risk regulation: - “Minimum Capital Requirements for Market Risk” circular applies on consolidated basis; banks not approved to use internal models approach for market risk. - Supervisory tools: ICAAP, Treasury inspections, Control Assessment Questionnaires, biannual stress tests including market risk. - Derivatives transaction volumes (five banks aggregated, six-month period) — exact figures: - Total: 2,601,029 (SAR million) - FX: 2,041,490 (SAR million) - Interest Rate: 559,539 (SAR million) - o/w trading: 2,191,658 (SAR million) - o/w trading FX: 1,700,630 (SAR million) - o/w trading Interest Rate: 491,028 (SAR million) - o/w customer: 409,371 (SAR million) - o/w customer FX: 340,860 (SAR million) - o/w customer Interest Rate: 68,511 (SAR million) - Trading as % of total: 84% overall; 83% FX; 88% Interest Rate - Supervisor observations: - End-quarter market risk exposures are small (average 3 percent of RWAs; no more than 6 percent in any one bank) but transaction flows are large and supervisors recommend reconciliations and deeper understanding of flows. - Recommendations: - Issue a market risk guidance document and valuation adjustment requirements for less liquid positions. - Expand KRIs to capture trading activity and intra-period exposures; add measures for interest rate risk. - Provide specific guidance to onsite supervisors for market risk inspection. ### Interest rate risk in the banking book (IRRBB) and liquidity - IRRBB: - ICAAP/ILAAP returns include IRRBB templates; SAMA imposes Pillar 2 add-ons for IRRBB (noted add-ons “over 100bp” in files reviewed). - KRIs: two IRRBB measures (both reflect a 200bp parallel shift); assessors recommend broader scenarios (non-parallel shocks). - Assessment: Largely compliant. - Liquidity: - LCR adopted 2013; NSFR adopted 2014; both consistent with Basel III. - ILAAP Guidelines issued October 18, 2020; banks required to have CFP and three-year funding plan; SAMA conducts annual ILAAP reviews. - Liquidity monitoring frequently at consolidated level; recommendation to introduce and formalize solo-level liquidity requirements and monitoring. - Encumbrance monitoring: recommended to set formal encumbrance limits and monitor them. ### Operational risk, IT/cyber, outsourcing, and business continuity - Operational risk: - Existing circulars and guidance (some “for information purposes”) cover operational risk; gaps include absence of a single enforceable operational risk regulation. - SAMA has completed “6 targeted onsite inspections on operational risk in the last three years” and over 30 inspections covering Information Technology, Cyber Security, and Business Continuity risks (July 2022–June 2023). - IT/cyber: - Cyber Security Framework and IT Governance Framework published; banks must report maturity against mandatory controls quarterly. - SAMA developed Cyber Threat Intelligence principles and runs red-teaming exercises. - Outsourcing: - Rules on Outsourcing (circular no. 410270170000 dated December 15, 2019) require SAMA no-objection for Material outsourcing and set comprehensive governance and contract requirements. - Business continuity and disaster recovery: - BCM framework (issued February 2017) requires BCPs for critical activities, Disaster Recovery live testing and ability to operate from DR site; Board retains ultimate responsibility (delegation noted but assessors recommend not delegating ultimate responsibility). - Recommendation: - Introduce an overarching enforceable operational risk management regulation to ensure full coverage and remove “for information” status of some principles. ### Internal control, internal audit, external audit, disclosure and transparency - Internal control and internal audit: - SAMA’s Principles of Internal Auditing (January 2021), Corporate Governance Principles (2021) and Internal Controls Guidance (2011) set expectations; SAMA conducts targeted reviews and onsite verification. - Recommendation: supervisors should routinely meet with Head of Audit Committee to test tone from the top. - External audit: - Saudi accounting and reporting standards substantially equivalent to IFRS; banks required to have two external auditors; rotation of audit partners every three years. - SAMA requires auditors to include contractual clauses to permit direct communication with SAMA; recommendation to tighten requirement for auditors to report issues directly to SAMA and to hold regular bilateral meetings with auditors. - Disclosure and Pillar 3: - Circular no. 440471440000 dated December 28, 2022 includes Pillar 3 Disclosure Requirements (principally consolidated). - All domestic banks listed on Tadawul; quarterly financial statements published with SAMA prior no-objection (recommendation to revisit prior approval requirement as it could introduce moral hazard). - Recommendation to expand disclosure of solo prudential metrics, related-party details, restructured loans, and intra-period exposures. ### AML/CFT and counter-fraud supervision - Framework and capacity: - AMLL (Royal Decree M/20, October 2017) with Implementing Rules designates SAMA as AML/CFT supervisor; Guide issued 2019 provides detailed guidance (including Section 13 on correspondent banking). - SAMA’s AML/CFT department: 34 staff; two sections (supervision and policy). - Onsite inspections: six-month inspection cycle; all local banks inspected at least once a year for AML/CFT. - Powers and sanctions: - Under AMLL Article 25 and CTFTL Article 83 SAMA can impose sanctions including written warnings, orders to comply, monetary fines up to 5.000.000 riyals per violation, bans on employment, appointment of temporary controllers, dismissal/replacement of directors, suspension/revocation of license. - Table of AML/CFT sanctions (2018–Q1 2023): - 2018: Number of Sanctions 14; Amount of Fine(s) 6,747,900 - 2019: Number of Sanctions 11; Amount of Fine(s) 2,337,500 - 2020: Number of Sanctions 14; Amount of Fine(s) 2,015,000 - 2021: Number of Sanctions 33; Amount of Fine(s) 8,001,000 - 2022: Number of Sanctions 15; Amount of Fine(s) 2,789,000 - Q1 2023: Number of Sanctions 0; Amount of Fine(s) 0 - Counter-fraud: - Counter Fraud Framework established October 2022; banks required to notify SAMA of significant fraud incidents and new typologies. - Assessment for CP29: Compliant. - Recommendations: - Continue regular inspections, bilateral engagement with SAFIU and other authorities, and maintain sanctions and remediation. ### Corrective actions, sanctions, and resolution - Legal constraints highlighted: - Under current law, SAMA (or Minister/Council) is empowered to take corrective actions when a bank breaches legal/regulatory requirements or adopts a policy that could threaten solvency/liquidity, but not clearly to act on supervisory judgment ahead of a breach. - Article 22 of BCL authorizes SAMA, with Minister approval where required, to impose measures including appointing advisers, suspending/removing directors/officers, limiting credits or deposits, and “require the bank to take such other steps, as it may consider necessary.” - Article 23 prescribes criminal and monetary penalties including fines up to SAR 20,000 and imprisonment up to two years in certain cases. - Practice and gaps: - During the past five years SAMA “has not taken any material corrective actions and has not imposed sanctions against banks’ senior management or board” though situations warranted such actions. - Areas where powers are inadequate or unavailable include: ring-fencing the bank; restricting current activities; imposing more stringent prudential limits; withholding approval of new activities or acquisitions; suspending payments to shareholders; restricting asset transfers; barring individuals from the banking sector; replacing or restricting powers of managers, board members, or controlling owners. - Laws do not contain provisions to avoid undue delay in taking appropriate corrective actions. - Resolution framework: - SIFIL (Royal Decree number (253) dated December 10, 2020) adopted in 2021; implementing regulations drafted but not issued — SIFIL not yet operational. - Under SIFIL, SIFIs required to submit recovery plans to SAMA; SAMA to prepare resolution plans and submit them to Council of Economic and Development Affairs (CEDA) for approval. SAMA has not yet formally designated a bank as a SIFI or prepared resolution plans. - No bank-specific bankruptcy law exists; corporate bankruptcy regime applies for liquidation. - Recommendations: - Equip SAMA with a broader range of corrective actions and sanctions (consistent with international standards) and legal provisions to avoid undue delay. - Operationalize SIFIL by issuing implementing regulations and designate SIFIs; require recovery and resolution planning and clarify coordination with CEDA and other authorities. - Operationalize the Depositors Protection Fund (DPF) and complete Safety Net Development Project within three years. ### Key policy recommendations and next steps (prioritized) - Legal reform priorities: - Move the draft Banking Control Law forward expeditiously to address independence and powers gaps identified. - Revise SCBL to specify that the primary objective of banking supervision is “to promote the safety and soundness of banks and the banking system” and subordinate other objectives. - Eliminate or limit requirements for prior Minister/Council approvals for core supervisory actions; clarify statutory powers to act on supervisory judgment. - Update statutory minimum paid-up capital (BCL current statutory minimum: SAR 2.5 million). - Strengthen legal protections for SAMA staff (including former staff) and agents against lawsuits and costs of defence for actions taken in good faith; clarify coverage for omissions. - Supervisory and operational priorities: - Mandate and operationalize solo-bank reporting and monitoring (capital, liquidity, related parties, large exposures) in line with regulations. - Enhance consolidated supervision: obtain global consolidated reports, incorporate group and reputation/contagion risks into RAM, and adopt policies for foreign operations’ examination scope and frequency. - Strengthen licensing and changes-in-control processes: require UBO identification, fit-and-proper periodic assessments, binding timelines to commence operations after licensing, and enhanced supervision of new entrants. - Strengthen remedial powers and sanctioning regime and reduce undue procedural delays for urgent supervisory interventions. - Conclude MoUs and operational arrangements with remaining home and host supervisors and relevant foreign resolution authorities; make information sharing systematic and proactive. - Operationalize DPF within planned three-year horizon; establish ELA and crisis management protocols. - Supervisory practice improvements: - Reorient onsite inspections from compliance-only to broader qualitative assessment of risk culture, governance, and management effectiveness. - Institute regular formal engagement with bank boards and independent/non-executive directors. - Undertake periodic independent reviews of quality, effectiveness and integration of onsite and offsite functions and supervisory toolkits. *Prepared as part of the IMF/World Bank 2024 FSAP detailed assessment. Source: 1sauea2024003-print-pdf — Excerpt (sections 4–28, 29, 45, 60, 73 and related sections).* ### EXECUTIVE SUMMARY __________________________________________________________________________ 6 ### EXECUTIVE SUMMARY ### Progress in regulatory and supervisory framework - Recent updates to primary and secondary legislation include the Saudi Central Bank Law (SCBL; 2020) and the Anti-Money Laundering Law (2017). - Draft Banking Control Law (BCL): public consultation on the Bill ended in early-2023; authorities intend to use the new draft BCL to further strengthen the framework. - SAMA’s Banking Policy Development Framework (2021) is reviewing and updating all regulations. - Recent circulars noted as fit for purpose: financial fraud, disaster recovery, and Basel III disclosures. - Areas needing new or updated regulations: overarching risk management, country and transfer risk, market risk, and interest rate risk in the banking book (IRRBB). ### SAMA’s legal mandate, powers, and operational independence - SAMA’s responsibility for banking supervision is clearly set out in the law, although the law does not clearly establish the promotion of safety and soundness of banks and the banking system as an explicit or primary mandate. - SAMA lacks a full suite of supervisory powers, including the ability to: - calibrate prudential requirements and supervisory reporting proportionate to risk profile and systemic relevance; - review, reject, and impose prudential conditions on proposals to transfer significant ownership and controlling interest in banks; - take timely corrective actions and impose sanctions based on supervisory judgment, ahead of legal or regulatory breach; - access banks’ boards and banking groups’ boards, management, staff, and records; and - review the activities of parent companies and companies affiliated with parent companies. - Operational independence and accountability enhancements recommended: - set qualifying criteria for Governor and Vice Governors and establish grounds for their removal while in office; - make the appointment and removal process for Governor, Vice Governors, and members of SAMA’s governing body more transparent; - reduce requirements for SAMA to obtain prior approval of the Minister or Council of Ministers at several stages of banking supervision; - strengthen legal protection for SAMA, its staff, retired staff, and its agents. ### Licensing, ownership transfer, and major acquisitions - Strengthening powers and developing internal guidelines will help formalize and streamline assessment processes for licensing, transfers of significant ownership and controlling interest, and major acquisitions. - Key elements to be explicitly considered in these processes include: - identification and due diligence on ultimate beneficial owners; - assessment of risks to the bank and the banking group; - SAMA’s ability to supervise and take appropriate corrective actions; and - resolvability of the bank and the banking group. ### Domestic coordination and cross-border cooperation - Effective domestic coordination and cross-border cooperation are important given the structure of the banking system. - Cross-border cooperation arrangements are largely yet to be established. Current arrangements include MoUs with the Capital Market Authority (CMA) in KSA and with one host supervisor. - It will be important to establish full MoUs with: - the recently established Insurance Authority (IA); - the remaining seven host supervisors; and - all relevant home supervisors and stakeholders relevant for resolution. - Banking system international footprint and ownership: - There are 23 foreign banks from 18 jurisdictions which are licensed to have a branch presence (of which 16 from as many jurisdictions are currently operating). - Saudi banks are operating branches or subsidiaries in eight jurisdictions. - Three foreign banks hold majority or controlling shareholding in three Saudi banks. ### Risk-based supervision, scope, and supervisory focus - SAMA employs a well-established risk-based approach embedded in supervisory activities. - Areas for enhancement: - increase focus on safety and soundness of the solo bank and risk assessment of group entities and their impact on bank or banking group risk profiles; - assess resolvability of banks and banking groups and reflect associated risks in risk profiles; - engage systematically with boards, board committees, and independent board members to challenge strategy and discuss supervisory examinations, external audits, and risk profiles; - periodically undertake: (i) formal assessment of quality, effectiveness, and integration of on-site and off-site functions; and (ii) independent review of adequacy and effectiveness of available supervisory tools and their use. ### Prudential requirements and supervisory monitoring - Prudential requirements mostly apply at both a solo and consolidated level; monitoring in practice is largely at the domestic level. - Specific monitoring gaps: - related parties and large exposures monitoring is at the domestic level and excludes exposures in overseas branches and subsidiaries; - liquidity monitoring is undertaken at the global consolidated and domestic consolidated levels, but not at the solo level. - Recommendation: reporting and monitoring should be undertaken at the solo and consolidated levels, in line with SAMA’s regulations. ### Consolidated supervision and group-wide risks - Making SAMA’s consolidated supervision framework and tools more comprehensive is a priority given banking groups’ significance. - Identified areas for improvement include: - assessment of reputation and contagion risks (including financial, technology, and other interdependencies) from entities in the banking group and wider group and incorporation in risk profile and supervisory rating of banking groups; - applying, monitoring, and enforcing all relevant prudential requirements at the level of global consolidation; - obtaining supervisory reports at global consolidated level to determine risk profile of banking groups; - adopting a policy on scope and frequency of offsite and onsite examinations of local bank’s foreign operations, and requiring additional reporting as necessary; - considering quality and effectiveness of host supervision when determining risk profile and supervisory approach for foreign operations; - obtaining powers to limit the range of activities of the consolidated group and the locations in which activities can be conducted (including closure of foreign offices), if necessary. - Group structure statistics: - All 11 local banks in KSA are part of banking groups. - These banks have 69 subsidiaries and 24 associates, that include 3 banking, 10 insurance, and 8 securities market or other financial entities, and 72 non-financial entities. - In 9 of the 11 banks, at least one of three parameters (assets, capital, and profits) is about 10 percent or more and in two it is 5 to 10 percent. - Of the 11 local banks, at least six have controlling shareholders/parent entities that have investment in several other entities. ### Regulatory alignment with Basel standards and specific prudential gaps - Most SAMA regulations are compliant in substance with Basel standards; some regulations are more conservative in specific areas (for example, scope of HQLA in the liquidity regime). - Enhancements needed on related party and country and transfer risks: - definition of affiliates in related party rules should be broadened to match Basel standards; - there is no related party limit for banks and for government owned entities related to controlling shareholders; - the limit on aggregate related party exposures is higher than expected under the BCP and some banks have exceeded these higher limits; - SAMA is encouraged to increase monitoring of exposures to government and government-owned commercial entities from a concentration risk perspective because these exposures are exempt from large exposure limits, banks have significant exposures to these entities, and they are expected to grow as part of Vision 2030. ### Onsite inspections and qualitative assessment - Onsite inspections are thorough, compliance-focused checks and are useful for verifying banks’ risk management and controls. - Suggested enhancements: - extend onsite inspections to assess qualitative aspects such as a bank’s overall risk culture; - hold meetings with relevant board members and more probing meetings with senior management; - tilt towards a broader and more qualitative assessment of the bank and its risk culture. ### Corrective actions and sanctions - Current law does not adequately empower SAMA to initiate timely corrective action or to access and use the full range of corrective actions and sanctions. - SAMA’s practice: - SAMA takes corrective actions when a bank breaches any requirement set in laws or regulations. - SAMA has powers to take corrective action (with the approval of the Minister, where required) when a bank adopts a policy that could threaten its solvency or liquidity, but SAMA has not used this power. - Under the law, SAMA is not empowered to take corrective actions based on supervisory judgment ahead of a regulatory or legal breach or in response to unsound or unsafe practices. - During the past five years SAMA has not taken significant corrective actions and has not imposed similar sanctions against banks’ senior management or board, or the individuals therein for their negligence or ineffectiveness or mismanagement though there were situations that warranted such actions. - Recommendation: SAMA should be equipped with a much wider range of corrective actions and sanctions—including those listed in the core principles—and provisions that avoid undue delay in taking appropriate corrective actions should be included in the law. ### AML/CFT framework and supervisory enforcement - Saudi Arabia has legislation, implementation rules, and guidelines that deliver a full AML/CFT supervisory framework. - SAMA’s onsite supervisors are adequately resourced and conduct comprehensive examinations. - SAMA has applied financial penalties in cases of noncompliance. - Recent counter-fraud framework is actively promoted and used as a base for on-site inspections; efforts have been made to upskill the industry. ### Assessment methodology and context - This BCP assessment was conducted from January 16 to February 5, 2024, as part of the 2024 Financial Sector Assessment Program (FSAP) conducted by the IMF and the World Bank. - The BCP assessment methodology issued by the Basel Committee on Banking Supervision (BCBS) in September 2012 was used. - The authorities opted to be assessed against both essential and additional criteria, but to be graded only against the essential criteria (EC). - The 2012 BCP methodology contains 247 separate essential and additional criteria. ### Complementary assessment - The BCP assessment was complemented by an ungraded assessment against the Core Principles for Islamic Finance Regulation (CPIFRs). - SAMA implements the same regulatory and supervisory framework to its mixed system of Islamic banks and conventional banks that also offer Islamic products (Islamic windows). - The findings of the CPIFR assessment are presented in a separate Technical Note. *Prepared as part of the IMF/World Bank 2024 FSAP detailed assessment.* ### 4. An assessment of compliance with the BCPs is not, and is not intended to be, an exact ### 4. An assessment of compliance with the BCPs is not, and is not intended to be, an exact ### Assessment approach and methodology - The assessment is judgment-based; banking systems differ and banking activities are rapidly changing after the GFC, so conclusions required judgments by the assessment team. - By adhering to a common, agreed methodology, the assessment provides an internationally consistent measure of the quality and effectiveness of banking supervision in relation to the BCPs. - The ratings are not directly comparable to the 2011 detailed BCP assessment because: - (i) the 2011 BCP assessment was based on the 2006 BCP methodology; and - (ii) the 2012 methodology used for this assessment places considerable emphasis on evidence of implementation and strengthens requirements for supervisors and supervision approaches. - The 2012 methodology reinforces proportionality—expectations on supervisors and standards imposed on banks should be commensurate with the risk profile and systemic importance of banks and banking systems. - The Basel Committee issued new BCPs in April 2024; these were not finalized at the time of this assessment and therefore not used. - The assessment is based on review of laws, regulations, policies, and practices in place at the time and included extensive meetings with SAMA, CMA, Insurance Authority, auditing and legal firms, accounting and auditing oversight agency, and banking sector participants. Authorities provided a detailed self-assessment and additional questionnaire responses. - Assessors avoided double-counting common deficiencies across Core Principles by: - clearly articulating gaps or deficiencies with respect to each CP; and - reflecting common deficiencies in the grading of only the most relevant CP while documenting cross-CP considerations in the comments sections. ### Legal and legislative context—opportunities and constraints - Authorities have consulted on a new law to replace the Banking Control Law (BCL); consultation ended in early 2023 and authorities are considering feedback and awaiting FSAP results before finalizing a Bill. - Assessors had access to the draft law which, as currently written, would appear to address some findings (particularly around independence and powers of the supervisor). - The assessment is based on the existing legislation; assessors encourage authorities to move the draft law forward as fast as the legislative process allows to address issues raised in this report and elsewhere. - Assessment limitations noted by assessors include: - (i) timeliness and completeness of data; and - (ii) information accessible to the assessors. - Specific constraints: requests for meetings with Ministry of Finance officials were not granted; SAMA officials participated in some meetings with external stakeholders; administrative procedures, delays and restrictions related to sharing information and lack of English translations caused constraints. ### Institutional structure and roles - SAMA: - Responsible for prudential regulation and supervision of banks, finance companies and payment service providers. - Designated Resolution Authority for the banking sector and other institutions under its supervision. - Administers the Depositors Protection Fund (DPF), the country’s deposit insurer. - Responsible for conduct of monetary policy. - Until November 2023, responsible for prudential regulation and supervision of insurers (other than health insurers); this role has been transferred to the Insurance Authority. - Capital Markets Authority (CMA): - Responsible for supervision of securities business, oversight of Tadawul (the Saudi stock exchange). - Designated Resolution Authority for institutions under its supervision. - Mandates disclosure requirements for listed companies; all Saudi-incorporated banks are listed on Tadawul. - National Financial Stability Committee (NFSC): - Cross-agency coordinating committee founded in 2015, chaired by the Minister of Finance. - Membership comprises Minister of Finance (Chair), Governor of SAMA (Secretariat), Chair of CMA, and will eventually include the Insurance Authority. - Meets quarterly to discuss financial stability risks and cross-agency actions; includes a ministerial committee and two sub-committees (Preparatory Committee and Technical Committee). ### Banking sector overview and structure - System size and composition: - The Saudi financial system is 143 percent of 2022 GDP. - Commercial banks account for 61 percent of system assets or 87 percent of GDP. - There are 11 locally-incorporated domestic banks and 23 licensed Foreign Bank Branches (FBB), of which seven have yet to start operations. - Domestic banks account for over 97 percent of banking system assets. - The two largest domestic banks account for almost half the sector’s assets—system is highly concentrated. - Government and state ownership: - The Saudi Government has direct and indirect stakes in all domestic banks; largest percent ownership at 39 percent. - General Organization for Social Insurance (GOSI) holds assets amounting to 31 percent of GDP and acts as an index investor in listed banks. - Public Investment Fund (PIF) owns shares in some commercial banks and finance companies. - There are 12 state-owned development funds with assets collectively amounting to 10 percent of GDP, coordinated under the National Development Fund (NDF). - NDF and its 12 development funds are not subject to independent prudential supervision. - Shari’ah-compliant (SC) banking: - SC products account for approximately an 80 percent share of both the assets and total funding base. - Islamic windows have a dominant share of the asset base of their parent banks. - Islamic banking is dominated by relatively simple products with a low share of complicated and/or risk-sharing SC products/contracts. - This BCP assessment was complemented by an ungraded assessment against the Core Principles for Islamic Finance Regulation (CPIFRs); findings are presented in a separate Technical Note. - Business models and balance sheet composition: - Banks have simple deposit-taking and lending business models; balance sheets largely comprise customer deposits/PSIA and lending. - Largest segment at end-2023 is corporate lending at 26 percent of total assets and 40 percent of total credit. - Home loans account for about 24 percent of total credit (growth following legislative change). - Many domestic banks hold USD-denominated government debt for liquidity purposes. ### Key financial metrics and performance (exact figures preserved) - Industry average capital adequacy ratio: 20.1 percent (as of end-2023). - Liquidity Coverage Ratio (LCR): 180.3 percent (at end-June 2023). - Net Stable Funding Ratio (NSFR): 115.8 percent (at end-June 2023). - Non-performing loans (NPLs): 1.5 percent (at end-2023). - Banking sector ROA: 2.2 percent (as at end-2023). - Banking sector ROE: 12.8 percent (as at end-2023). - Total bank credit growth: average annual rate of 14 percent between end-2020 and end-2023. - Retail real estate loans more than tripled from 2019 to 2023; credit growth in this segment peaked at 59 percent in 2020 and decelerated to 10 percent in 2023. - Public Investment Fund (PIF) has invested 77 percent of its assets under management domestically (noted in national statistics PIF investments are classified as private). ### Risks and vulnerabilities - Primary risks stem from global developments: - Vulnerability to an abrupt global economic slowdown and oil price volatility—falling oil prices would deteriorate fiscal and external balances and weaken domestic economic activity. - Delays in implementation of the National Investment Strategy under Vision 2030 could slow economic growth and expose banks to losses from large corporate credit portfolios (corporate credit accounted for just over 40 percent of all lending by Saudi banks at end-2023). - Strong growth in banks’ mortgage books leaves them moderately vulnerable to a sharp downturn in real estate prices. ### Preconditions for effective supervision and financial infrastructure - Macroeconomic performance: - Saudi Arabia grew at 7.5 percent in 2022 and contracted by 0.8 percent in 2023 (primarily due to cuts on oil production). - Non-oil GDP growth: 5.3 percent in 2022 and 3.8 percent in 2023. - Private consumption and non-oil private investment have been robust; inflation is contained with low and declining headline and core inflation. - External and fiscal buffers are substantial. - Macroprudential framework and responsibilities: - SAMA is the competent national authority for defining macroprudential objectives and policy for sectors under its supervision; operational responsibility delegated to SAMA’s Financial Stability Committee (FSC). - FSC objectives include establishing and managing macroprudential policies and implementing procedures for crisis management; financial stability risks are communicated in the Financial Stability Report. - The Countercyclical Capital Buffer (CCyB) was added to SAMA’s toolkit in 2016 but has always been set at 0 percent. - NFSC brings together Minister of Finance, SAMA, CMA, National Debt Management Center and will eventually include the Insurance Authority for cross-agency financial stability discussion. - Legal, accounting, and professional infrastructure: - Shariah law forms the basis for the legal framework; business laws including corporate, bankruptcy, contract, consumer protection and private property laws exist; backlog in commercial courts is being substantially reduced. - Professionals (accountants, auditors, lawyers) are subject to transparent standards with oversight by respective regulatory boards; national accounting and auditing standards are equivalent to international principles. - Banking Control Law requires banks to be audited by two firms; SOCPA is overseen by the Ministry of Commerce. - Credit culture is strong with historically conservative lending standards and two established credit bureaus. - Payments systems and financial market infrastructure: - SAMA has primary regulatory responsibility for payments systems, including systemically important payment systems and FMIs. - The Law of Payments and Payment Services of October 2021 and Implementing Regulations established the legal architecture, including classification of systemically important payment systems and settlement finality. - Resolution and crisis management: - Systemically Important Financial Institution Law (SIFIL) adopted in 2021; without implementing regulations the law is not yet in effect. - Under SIFIL, SIFIs are required to submit recovery plans to SAMA; SAMA to prepare resolution plans and submit them to the Council of Economic and Development Affairs for approval. - The SIFIL is not yet operational; implementing regulations have been drafted but not issued. - No bank-specific bankruptcy law exists under the current framework; corporate bankruptcy regime applies for liquidation of banks. - SAMA is developing a comprehensive crisis management framework, has established a SIFI Resolution Division and is establishing a crisis management protocol to enhance coordination and information sharing. - Deposit insurance and emergency liquidity: - Depositors Protection Fund (DPF) guarantees deposits up to SAR 200,000 (USD53,000) per depositor per bank. - The guarantee covers 97.6 percent of depositors in full, corresponding to 16.2 percent of the deposit-base. - Payouts must be made within one month of the claim being received from the liquidator. - DPF has been collecting premiums from the industry since 2016 but is still to be operationalized. - SAMA is establishing a Safety Net Development Project to make DPF fully operational within three years. - SAMA would be the provider of Emergency Liquidity Assistance (ELA) in need and has developed a framework with criteria and plans for operationalization. ### Key policy recommendation(s) and next steps noted by assessors - Encourage authorities to move the draft law replacing the Banking Control Law forward as fast as the legislative process allows, ensuring it addresses issues with the current framework raised in this report and elsewhere (particularly around independence and powers of the supervisor). - Operationalize the Depositors Protection Fund (DPF) and complete the Safety Net Development Project within the planned three-year horizon. - Issue implementing regulations for the Systemically Important Financial Institution Law (SIFIL) to make SIFIL operational and clarify resolution and recovery regimes, including consideration of bank-specific bankruptcy provisions. *Source: 1sauea2024003-print-pdf — Excerpt (sections 4–28).* ### 29. Banks disclose transparent information to the public. Saudi Arabian accounting and ### 29. Banks disclose transparent information to the public. Saudi Arabian accounting and ### Transparency and public disclosure - Saudi Arabian accounting and reporting standards are substantially equivalent to the International Financial Reporting Standards (IFRS). - Domestic banks make Pillar 3 disclosures (under SAMA’s regulations) and publish full annual as well as interim quarterly statements (under both SAMA and stock exchange requirements). - All domestic banks are listed on the Saudi Arabian stock exchange, Tadawul, which requires adherence to Tadawul disclosure requirements, for example of market sensitive news. ### Responsibilities, objectives, powers, and independence (CP 1–2) - Legal mandate and scope - Article 3 of Saudi Central Bank Law (SCBL) states SAMA’s objectives as: (i) maintaining monetary stability; (ii) supporting the stability of the financial sector and promoting trust therein; and (iii) supporting economic growth. - Article 4 of SCBL makes SAMA responsible for overseeing and supervising financial institutions (which includes banks) in accordance with relevant laws. - SAMA’s remit includes supervision of finance companies, credit bureaus, money exchange companies, trade repositories, payment systems and fintech companies, and covers financial sector development, resolution and consumer protection for supervised institutions. - Gaps and conflicts - Primary legislation does not specify that the primary objective of banking supervision is to promote the safety and soundness of banks and the banking system, nor that secondary objectives are subordinate to the primary objective. - Laws or regulations have not established a clear link between the different objectives in the SCBL and SAMA’s functions, nor introduced organizational separation to avoid conflicts of interest. - SAMA has not yet established policies and processes to address conflicts of interest arising in its banking supervision role. - Institutional arrangements and governance - Main decision-making levels for banking supervision: the Governor, the Vice Governor of Supervision and Technology, and the Supervision Deputy Governor; responsibilities are documented in SAMA’s Authority Matrix. - SAMA recruitment and capacity building have produced staff viewed by industry as professional and credible. - Powers and legal framework shortcomings - The Banking Control Law (BCL) was enacted in 1966 and remains in force; a revised BCL was in consultation at the time of assessment. - Existing laws do not adequately empower SAMA to perform several Core Principles tasks, including powers to: (i) cooperate and collaborate with relevant authorities to achieve an orderly resolution of banks, including triggering resolution; (ii) calibrate prudential requirements by risk profile and systemic relevance; (iii) have full access to and engage with banks’ boards, group boards, management, staff, and records; (iv) take timely corrective action, impose a range of sanctions, and revoke bank licenses based on supervisory judgment before breaches occur; and (v) review activities of parent companies and affiliated companies to determine impact on safety and soundness. - Regulatory modernization and timing - SAMA established a Banking Policy Development Framework in 2021 and is reviewing and updating regulations; several regulations remain dated (examples: loan classification, provisioning, and credit review (2004); commercial banks accounting standards (2009); rules and guidance for banks in Saudi Arabia to organize their audit committee (1996)). - Some regulations are mere endorsements of Basel standards without customization (examples: market risk, interest rate risk in the banking book (IRRBB), and operational risk management). - Independence, accountability, and transparency issues - SCBL provisions do not set qualifying criteria for the Governor and Vice Governors, do not establish removal grounds while in office, and do not require disclosure of reasons for removal. - SAMA publishes an Annual Report; the last available report pertained to the accounting year ended on June 30, 2020 and was published in July 2021—timely publication is not a legal requirement. - The Annual Report’s supervision content is brief and multi-year delays do not satisfy core principles’ transparency and accountability expectations. - Article 16 of SCBL requires disclosure of direct or indirect conflicts of interest by board members and prohibits voting on matters involving a conflict, but does not require avoidance of involvement in decision-making or expression of opinion on conflicted matters at board level as required for SAMA staff—Article 16 does not adequately address conflict of interest at SAMA board level. - BCL requires SAMA to obtain approval of the Minister or the Council of Ministers at several stages (issuing general rules, conducting inspections, requiring specific corrective actions, imposing certain sanctions), which may interfere with SAMA’s operational independence. - BCL empowers the Minister to exempt banks, with Council approval, from certain provisions of the law in exceptional circumstances and to appoint an external committee for adjudicating contraventions punishable under the law. - SIFIL requires SAMA to obtain approval of CEDA for resolution plans prepared for SIFIs. - Laws do not assure legal protection for SAMA top management, staff and agents against omissions and costs of defending their actions and omissions; protection for former staff is not available except in the strict case of “resolution procedures” under article 35 of the SIFIL. ### Permissible activities, licensing, changes in control, and acquisitions (CP 4–7) - Definition and scope of banking activities - The term “bank” and “banking activities” are defined in the BCL, but definitions are not sufficiently clear and controlled; references to “any of the banking business” and “other banking business” leave ambiguity, potentially misleading the public that deposit taking is not confined to licensed banks. - Finance companies can accept savings and time deposits from non-individual customers and juristic persons with SAMA’s prior approval. - The Social Development Bank, not a licensed commercial bank and not supervised by SAMA, is offering deposit products. - Laws currently allow other financial entities to use the word “bank” in their names and offer deposit products without a banking license or bank-level regulation and supervision. - Licensing authority, criteria, and capital requirements - The BCL designates the Minister as licensing authority for new banks and empowers the Council of Ministers to decide on cancellation or revocation of licenses; SAMA is empowered to receive and process license applications but the law does not explicitly empower SAMA, the Minister, or the Council to: (i) set licensing criteria; (ii) reject an application if criteria are not fulfilled or information provided is inadequate; and (iii) revoke a license if it was based on false information. - Current minimum initial capital amount: SAR 2.5 million; the BCL should be revised to establish a much higher minimum initial capital amount reflecting infrastructure and technological investment needs. - Licensing process and supervision of new entrants - Over the past five years SAMA received 18 license applications: two conventional banks, six digital banks, and 10 foreign bank branches. - As on December 31, 2023, SAMA has issued licenses for three digital banks and remaining applications were under assessment; no application has been denied or withdrawn. - SAMA uses a template but lacks a licensing policy or license processing guidelines; license processing currently does not explicitly document or include: (i) verification of source of funds for initial capital; (ii) assessment and quantification of shareholders’ financial strength and ability to provide additional support; (iii) identification and due diligence of ultimate beneficial owners (UBOs); (iv) assessment of whether ownership and governance of the wider group hinder effective supervision and corrective action implementation; (v) assessment of collective knowledge and individual backgrounds/skills of board members and senior management; and (vi) due diligence on home supervisors’ supervisory frameworks and consolidated supervision capabilities. - Laws, regulations, and internal guidelines lack binding time limits for commencing operations after license approval, creating risk that material changes may invalidate the original licensing assessment; guidelines should be strengthened to avoid or respond to long/indefinite delays. - Newly established banks are not subject to an enhanced supervision cycle and/or reporting requirements after licensing; SAMA should subject new banks to more rigorous offsite and onsite supervision in initial years to monitor progress against business and strategic goals and to ensure prudential conditions are met. - Changes in ownership and major acquisitions - SAMA has an arrangement with the CMA to exercise control over transfer of significant ownership based on a semi-formal MoU and exchange of letters; these are not legally enforceable and do not cover all changes in significant or controlling beneficial ownership. - Due diligence emphasis should shift from immediate shareholders to ultimate beneficial owners; SAMA should obtain periodic reporting of names and holdings of significant shareholders and identities of beneficial owners. - Laws do not empower SAMA to remedy, reject or reverse a change in significant ownership or restrict exercise of voting rights ex post. - SAMA should perform periodic fit and proper assessments of existing beneficial owners above a certain threshold and undertake enhanced due diligence on controlling shareholders. - Laws should require banks to notify SAMA promptly of material information that may negatively affect suitability of significant or controlling shareholders. - SAMA lacks internal guidelines for processing bank proposals for major acquisitions; current processing is guided by high-level criteria in 2011 regulations. - Explicit criteria to be considered when processing major acquisitions: (i) SAMA’s ability to require or undertake effective corrective measures in the bank and across the banking group; (ii) effectiveness of supervision in the host country and SAMA’s ability to exercise consolidated supervision; and (iii) assessment of risks from the activities of the entity being acquired and the bank’s ability to mitigate or manage these. - Laws or regulations should empower SAMA to prohibit banks from major acquisitions/investments (including cross-border operations) in countries with laws prohibiting information flows necessary for consolidated supervision. - Current prior-approval requirements do not explicitly extend to major acquisitions by entities in the banking group. ### Supervisory cooperation and cross-border supervision (CP 3, 13) - Domestic coordination - NFSC established in 2015 with MOF, SAMA and CMA as members; NFSC is the main forum for cooperation and coordination among domestic regulators. - Coordination and confidentiality frameworks among domestic authorities are reasonably in place, but can be made more comprehensive through full MoUs (including supervision) with the recently established Insurance Authority and other local stakeholders relevant for resolution. - Arrangements should promote collaborative supervision and proactive periodic sharing and exchange of data and information on banks and banking groups supervised by SAMA in the context of ongoing microprudential supervision; current practices are more reactive. - Cross-border footprint and foreign presence - Saudi banks have 18 subsidiaries, four associates and eight branches in foreign jurisdictions; these include three banking subsidiaries in Turkey, Pakistan, and Malaysia. - Of the eleven Saudi banks, one is a subsidiary of a foreign bank from a neighboring jurisdiction and in two other local banks, foreign banks licensed in other jurisdictions have a controlling interest; these three banks account for about 16 percent market share of KSA banking system assets. - Foreign banks operating through branch presence in Saudi Arabia are from 16 jurisdictions and these branches account for about 4 percent of banking system assets. *Source: 1sauea2024003-print-pdf - 29. Banks disclose transparent information to the public. Saudi Arabian accounting and* ### 45. The overseas presence of Saudi banks, and the presence of foreign banks in KSA calls ### The overseas presence of Saudi banks, and the presence of foreign banks in KSA calls for expanding effective cooperation and coordination arrangements with home and host supervisors and resolution authorities ### Cross-border cooperation, information sharing, and crisis management - SAMA participates occasionally in the supervisory colleges of two banks hosted by the respective home authorities. - SAMA has established MoUs and information sharing arrangements with only one of the 24 relevant home and host jurisdictions. - There is no systematic, ongoing, and proactive sharing of information between the supervisors on: material risks and risk management practices of the bank and the banking group; and supervisors’ assessments of the safety and soundness of the relevant entity under their supervision. Information sharing, if any, is generally initiated by a request from one of the supervisors. - SAMA has yet to establish joint communication strategy with relevant home and host supervisors. - SAMA and the host/home authorities do not undertake collaborative supervisory exercises as a practice; they generally undertake these independently but keep each other informed ahead of the exercise. - Considering the nascent stage of inter-institutional crisis management and resolution arrangements in KSA, SAMA has not yet established cross-border crisis management or resolution arrangements with the relevant home or host supervisors and resolution authorities. - Note: KSA currently lacks a designated resolution authority for the insurance sector; an MOU cannot substitute for amending the SIFIL to designate such authority, though an MOU could provide for mechanisms for exchanging information about the insurance sector with SAMA. ### Banking group structure and key statistics - All 11 Saudi banks are part of banking groups. - These banks have 69 subsidiaries (51 domestic and 18 foreign), and 24 associates (20 domestic and 4 foreign). - These banking groups include: 3 banking entities, 10 insurance entities, 8 securities market or other financial entities, and 72 non-financial entities, of which 14 are outside Saudi Arabia. - About 71 percent of these entities belong to five banks; two banks have 17 group entities each, two have 11 group entities, and one has 10 group entities. - All 11 local banks have at least two domestic subsidiaries, and nine have foreign subsidiaries. - Based on data available with SAMA, the group entities collectively account for 3 to 22 percent of the net profits, 1 to 7 percent of total assets, and 3 to 18 percent of capital of their respective consolidated bank. - In 9 of the 11 banks, at least one of these three parameters is about 10 percent or more, and in two it is between 5 to 10 percent. ### Supervisory approach, techniques and tools - SAMA adopts a risk-based supervision (RBS) framework with a mix of onsite and offsite tools and techniques, including: risk profiling of banking groups updated at least annually; using systemic importance combined with risk profile to determine supervisory stance; and a forward-looking approach to inform supervisory intensity and resource allocation. - The risk rating process assesses inherent risks and related controls across nine risk categories: credit, liquidity, market, operational, banking book interest rates, technology, legal, strategic and AML/CFT. - Inputs used for risk profiling include periodic prudential and statistical returns at weekly, monthly, quarterly, semiannual and annual frequency (such as Basel III and self-assessment returns), ICAAP and ILAAP documents, SRV presentations, QMM, and quarterly financial statements reviewed by external auditors. - SAMA has established reliable information systems to facilitate processing, monitoring and analyses of offsite inputs. ### Gaps in scope, consolidated vs. solo supervision, and resolvability - The supervisory framework is largely focused on the banking group and not adequately on the solo bank. Main prudential requirements on capital, leverage and liquidity are largely monitored and enforced at the banking group level; large exposures and related party exposures are monitored and enforced at the level of domestic consolidation (excluding foreign operations and exposures). - Supervisory reporting is generally at two levels—global consolidation and domestic consolidation (global consolidation minus foreign branches and foreign subsidiaries)—leaving the supervisory focus on the safety and soundness of the solo bank unclear. - Supervision does not explicitly and adequately assess risks in the group entities, including risks in the parent or controlling entity and its group entities, and does not factor these into the bank or banking group risk assessment. - Supervision has not yet assessed the resolvability of the banks and the banking groups; resolvability risks are therefore not reflected in risk profiles. - Given all domestic banks are part of banking groups and groups are evolving, these gaps are significant and require prompt attention. ### Recommendations to improve supervisory approach and framework - Achieve explicit identification, assessment, and addressing of risks and issues at the solo bank level in addition to the current banking group approach. - Establish, monitor and enforce prudential requirements distinctly for: the solo bank, the consolidated bank, and each bank within the group. - Review and revise the RBS framework and risk assessment matrix (RAM) to include reputation risk, contagion risk and group risks; improve assessment of group structure and the nature, impact and scope of risks posed by entities in the wider group; and assess group-wide governance, oversight, risk management, compliance, and internal audit frameworks. - Assess bank’s and banking group’s resolvability where appropriate, having regard to the bank’s risk profile and systemic importance, and address bank-specific barriers to orderly resolution. - Establish crisis preparedness, crisis management, recovery, and resolution plans in partnership with other relevant authorities to enable orderly resolution where necessary. - Strengthen the quality control framework to apply to all components of the RAM and to outputs of onsite inspections. - Engage formally with banks’ boards, non-executive or independent board members to challenge board strategy and discuss supervisory examinations, external audits, and risk profiles. - Undertake periodic formal assessment of: the quality, effectiveness and integration of onsite and offsite functions; integration of inputs and outputs of specialist departments (e.g., AML-CFT and cybersecurity); and periodic independent review of the adequacy and effectiveness of supervisory tools to adapt to changing business models and operating environment. ### Reporting, data access, and enhancements - Laws should be amended to empower SAMA to require banks to submit any relevant data and information, including internal management information, on a solo and consolidated basis, about individual entities in the banking group and wider group. - Current supervisory returns are collected at frequencies from weekly to annual and at global and domestic consolidation levels; quality and integrity are verified through automated checks and sometimes onsite visits. - The scope of reporting should be overhauled to obtain data and information at: (i) solo bank level; (ii) banking group level; (iii) each bank within the banking group; and (iv) each relevant group entity. - Supervisory reporting can be enriched by obtaining flow data such as turnover, related party transactions and intragroup transactions and using these in risk profiling. Reporting requirements (contents, frequency) should reflect risk profile, risk rating and systemic relevance. ### Consolidated supervision: further actions - Given the relevance of consolidated supervision for KSA, SAMA should: - Assess risks from entities in the banking group, the controlling entity and entities in the wider group (for example reputation and contagion risks, including financial, technology and other interdependencies) and incorporate these in the banking group risk profile and supervisory rating. - Apply, monitor, and enforce all relevant prudential requirements at the level of global consolidation. - Obtain supervisory reports at the global consolidated level to determine banking group risk profiles. - Establish a policy on scope and frequency of offsite and onsite examinations of local banks’ foreign operations, including requiring additional reporting as necessary. - Consider the quality and effectiveness of host supervision when determining risk profile and supervisory approach for foreign operations. - Obtain powers to limit the range of activities of the consolidated group and the locations in which activities can be conducted (including closure of foreign offices), if necessary. ### Corrective and sanctioning powers - Laws do not adequately empower SAMA to initiate timely corrective action or access the full range of corrective actions and sanctions. Under law, SAMA, or the Minister, or the Council of Ministers is empowered to take corrective actions when a bank breaches any requirement set in law or regulations, or when a bank adopts a policy that could threaten its solvency or liquidity. The powers do not extend to taking corrective actions based on supervisory judgment ahead of a regulatory or legal breach or in response to unsound or unsafe practices. - SAMA has powers to take corrective action (with approval of the Minister, where required) when a bank adopts a policy that could threaten its solvency or liquidity, but SAMA has not used this power in the past five years. - It is unclear whether SAMA can take material corrective actions or impose significant sanctions without prior approval of the Minister. During the past five years SAMA has not taken any material corrective actions, and has not imposed any sanction against banks’ senior management or board members for negligence, ineffectiveness or mismanagement, though one local bank was placed on “high” supervisory stance over the past three years and one other local bank was placed on similar supervisory stance for two of the past three years. - Areas where powers are inadequate or unavailable include: (i) ring-fencing the bank; (ii) restricting current activities of the bank; (iii) imposing more stringent prudential limits and requirements; (iv) withholding approval of new activities or acquisitions; (v) suspending payments to shareholders or share repurchases; (vi) restricting asset transfers; (vii) barring individuals from the banking sector; and (viii) replacing or restricting powers of managers, board members, or controlling owners. - Laws do not contain provisions to avoid undue delay in taking appropriate corrective actions. Supervisors do not engage directly with bank boards at an early stage to require timely remediation, nor do they meet directly with the board when significant corrective actions are needed or when banks’ corrective actions are inadequate. - On sanctions, SAMA largely relies on monetary penalties, drawing banks’ attention to breaches or violations and requiring the bank to warn the concerned employee; SAMA needs prior approval of the Minister to apply other types of sanctions. SAMA does not inform other supervisors (other domestic regulators, home, and host) of its corrective actions or sanctions or coordinate actions with them. ### Corporate governance, board engagement and on-site inspections - Corporate governance policies are largely in place, but improvements are needed. SAMA has established regulatory requirements on key elements relevant for corporate governance; supervisory assessments cover compliance and implementation. - Areas for enhancement include: - Systematic meetings with boards, board committees and board members to assess collective and individual effectiveness and knowledge of the bank’s and banking group’s operational structure and risks. - Explicit assessment of individual board members with reference to duty of care and duty of loyalty and reflecting these in individual assessments. - Developing explicit guidance or manuals for performing the above assessments. - Amending laws to empower SAMA with explicit power to require changes in board composition if individuals are not fulfilling duties or exercising duty of care or loyalty adequately. - SAMA has no program to regularly meet boards or key board members on a bilateral basis; board effectiveness is largely assessed indirectly via agendas and minutes. Regular bilateral meetings (e.g., with Board Chairs and Chairs of Audit Committees) would improve assessment of board culture, tone from the top and individual capabilities. - On-site inspections are thorough, compliance-focused checks and could be extended to assess overall culture by: meeting relevant board members, conducting more probing meetings with senior management, and adopting broader qualitative assessments of risk culture. ### Capital framework and monitoring - SAMA has a comprehensive capital framework consistent with Basel III on capital instrument eligibility and risk weightings. SAMA uses supervisory add-ons to minimum capital ratios to reflect risk differentials. Requirements apply at solo and consolidated levels, but SAMA does not routinely monitor capital adequacy of banks on a solo basis. - The lack of routine solo monitoring is material: group entities account for 3 to 18 percent of capital of the respective consolidated banks. Many banks are seeking to grow overseas and non-banking operations. - Risk weight reporting by banks should be more actively verified; supervisors should carry out a sense check on key risk weighting numbers on receipt of returns, as this is not done automatically and returns may present a misleading picture if not analyzed thoroughly. - SAMA adjusts minimum capital ratios to account for systemic importance and risk profile and has developed a CCyB framework. There is an established DSIB buffer framework. Minimum capital ratios for individual banks are reviewed at least annually as part of the ICAAP process. SAMA is encouraged to develop a fuller set of indicators and market guidance on criteria for changing the level of the CCyB. *IMF staff summary based on the chapter "The overseas presence of Saudi banks, and the presence of foreign banks in KSA calls for expanding effective cooperation and coordination arrangements with home and host supervisors and resolution authorities."* ### 60. SAMA has a well-established ICAAP framework. This serves as a major annual focus for ### SAMA has a well-established ICAAP framework. This serves as a major annual focus for ### ICAAP and forward‑looking capital management - SAMA has a well-established ICAAP framework that serves as a major annual focus for banks and supervisors. - The framework embeds a forward-looking approach to capital management. - Banks are required to conduct two stress tests a year to assess their capital adequacy under adverse conditions. - ICAAP processes enable banks and SAMA to understand risks that sit outside the Basel measurement framework (Pillar 1) and set appropriate minimum capital ratios. ### Credit risk, problem assets, provisions, and reserves (CP 17–18) - Credit risk is one of the main risks to which Saudi banks are exposed and receives significant supervisory resource. - Existing guidance: - Credit risk management guidance (2013). - Loan classification and provisioning guidance (2004). - Banks are subject to IFRS 9 rules for provisioning. - Findings: - The guidance remains helpful and is referenced by banks and on-site inspectors for compliance purposes, but has coverage gaps and is dated. - The current definition of forbearance (rescheduled loans) is less comprehensive than the Basel 2017 document “Prudential treatment of problem assets—definitions of non-performing exposures and forbearance.” - The current credit risk management guidelines are silent on foreign exchange risk. - Recommendations: - In updating credit risk guidance, SAMA should include more detailed requirements reflecting developments since 2013. - Require that large, risky, or unusual exposures be subject to a particular level of approval at Board or senior management level. - The Financial Stability Committee (FSC) should include systematic review of provisioning levels, taking account of macro indicators and system trends to assess whether risk build-up should flow through to provisioning levels. ### Risk management framework and circulars (CP 15, 19–25) - SAMA has a stock of Circulars issued over the last two decades; some need updating and some gaps need to be filled. - Recent circulars follow a new SAMA protocol requiring they be stand-alone and clearer in laying down specific requirements. - Recommendations: - Undertake a program of progressively updating older circulars and filling gaps. - Issue an overarching risk management circular, a country and transfer risk framework circular, and updated operational risk management guidance. - Issue market risk and IRRBB guidance. - Make all these documents publicly available on SAMA’s website. - Specific supervisory gaps: - Country risk would benefit from closer supervisory attention; lack of consideration of indirect country risk is an important gap. - Monitoring of market risk in banks needs to be stepped up, as derivative transaction volumes appear significant. ### Related party rules, large exposures, and concentration risks - Most SAMA regulations are compliant in substance with Basel standards, but related party rules have significant deficiencies. - Gaps in related party rules: - Definition of affiliates is not as broad as under Basel standards. - There is no related party limit for banks. - The limit on aggregate related party exposures is higher than expected under the Basel Core Principles, and banks are allowed to exceed these. - Exposures to government and government-owned commercial entities: - Banks have significant exposures to government and government-owned commercial entities, expected to grow as part of Vision 2030. - These exposures are exempt from the large exposure limits. - SAMA is encouraged to increase monitoring of these exposures from a concentration risk perspective. ### Scope of monitoring and reporting levels - Requirements mostly apply at both a solo and consolidated level, but monitoring is only at the domestic level in some areas. - Examples: - Monitoring for related parties and large exposures is at the domestic level, excluding exposures in overseas branches and subsidiaries. - Liquidity monitoring is undertaken at the consolidated and domestic level, and not at the solo level. - Recommendation: - Reporting and monitoring for related parties, large exposures, and liquidity should be undertaken at the solo and consolidated levels, in line with the regulations. ### On‑site and off‑site supervision, stress testing, ICAAP/ILAAP (supervisory practices) - On-site and off-site supervision of regulatory requirements is risk-based and well-embedded. - Supervisory process includes off-site monitoring, regular meetings covering banks’ ICAAP, ILAAP and stress testing, and an on-site inspection program. - Banks’ ICAAP and ILAAP processes appear comprehensive and useful and enable SAMA supervisors to identify risks outside regulatory measurement, such as IRRBB, additional operational risks, and concentration of exposures and of funding. - The required biannual stress tests cover a broad range of risks, for both solvency and liquidity. ### Disclosures and transparency (CP 27–28) - Auditor relations and requirements: - SAMA has well-established relations with the audit profession, but bilateral engagement with auditors should be increased. - Recommendation to tighten and clarify the requirement for auditors to report issues directly to SAMA, as it currently relies on contract. - Recommendation for SAMA to set up regular bilateral meetings with bank auditors to encourage the flow of information. - KSA accounting standards, set by SOCPA, are aligned with international standards. - Legislation requires all banks to have two external auditors. - SAMA imposes further requirements, such as rotation of audit partners every three years. - Public disclosure requirements: - CMA has established disclosure requirements for listed entities that apply to domestic banks, including publication of quarterly financial statements. - Publication of quarterly financial statements requires SAMA’s prior no-objection. - Banks are required to make full Basel III disclosures and need SAMA’s prior approval before publication of the quarterly financials. - Recommendation: - The prior approval requirement should be revisited as it could introduce moral hazard for SAMA. ### Abuse of financial services, AML/CFT, and counter‑fraud (CP 29) - Saudi Arabia has legislation, implementation rules and guidelines delivering a full AML/CFT framework. - As the AML/CFT supervisor, SAMA’s on-site supervisors are adequately resourced and conduct comprehensive examinations. - SAMA has applied financial penalties in cases of non-compliance. - SAMA recently established a counter-fraud framework that is actively promoted and forms a base for on-site inspections of banks. - Counter-fraud is taken seriously by banks and SAMA, with efforts made to upskill industry. ### Assessment methodology and treatment of overlapping deficiencies - Assessors have consciously avoided double-counting common deficiencies that are relevant and material to more than one core principle (CP). - Approach: - Clearly articulate gaps or deficiencies identified with respect to requirements in each CP. - Where common deficiencies affect more than one CP, document in comments which gaps or deficiencies have been considered in the grading of which CP (examples given include CPs 1 and 2; and CPs 3, 8, 9, 10, 12, 13, 19, and 20). *Source: 1sauea2024003-print-pdf - 60.* ### 73. The assessment noted that, in its supervisory role, SAMA acted though powers are not ### The assessment noted that, in its supervisory role, SAMA acted though powers are not directly vested in it by law. ### Overall assessment outcomes - Principle 1 (Responsibilities, objectives, and powers): Assessment = Materially non-compliant. - Principle 2 (Independence, accountability, resourcing and legal protection): Assessment = Materially non-compliant. - Principle 3 (Cooperation and collaboration): Assessment = Largely compliant. - Principle 4 (Permissible activities): Assessment = Largely compliant. - Principle 5 (Licensing criteria): Assessment = Materially non-compliant. - Principle 6 (Transfer of significant ownership): Assessment = Materially non-compliant. - Principle 7 (Major acquisitions): Assessment = Largely compliant. - Principle 8 (Supervisory approach): Assessment = Materially non-compliant. - Principle 9 (Supervisory techniques and tools): Assessment = Largely compliant. - Principle 10 (Supervisory reporting): Assessment = Largely compliant. - Principle 11 (Corrective and sanctioning powers of supervisors): Assessment = Materially non-compliant. - Principle 12 (Consolidated supervision): Assessment = Materially non-compliant. - Principle 13 (Home-host relationships): Assessment = Materially non-compliant. - Principle 14 (Corporate governance): Assessment = Largely compliant. ### Key factual findings on legal and institutional powers - SCBL (Saudi Central Bank Law) and BCL (Banking Control Law) set SAMA’s objectives and some supervisory powers but: - Certain powers in practice are exercised by SAMA though “powers are not directly vested in it by law.” - BCL designates the Minister as licensing authority; for some actions SAMA must obtain Minister or Council of Ministers prior approval (e.g., issuing general rules—Article 16; conducting inspections—Article 18; imposing certain sanctions—Articles 22 and 23). - SAMA asserts delegation of some powers but assessors “have not seen evidence of the delegation.” - The draft BCL is noted as an “ideal opportunity to remedy this gap.” - Specific statutory constraints and ambiguities: - Article 3 of SCBL sets SAMA objectives: (i) maintaining monetary stability; (ii) supporting the stability of the financial sector and promoting trust therein; (iii) supporting economic growth — SCBL “does not articulate the priority” among objectives. - BCL (Article 3, Articles 7–12, Articles 15–18, Articles 21–23) lists licensing, permitted activities, data and inspection powers and cases requiring Minister/Council approval; Article 21 allows Minister (with Council approval) to exempt banks from provisions for “exceptional circumstances” (term undefined). - Article 22 of the BCL authorizes SAMA, with Minister approval where required, to impose measures including appointing advisers, suspending/removing directors/officers, limiting credits or deposits, and “require the bank to take such other steps, as it may consider necessary.” - Article 23 of the BCL prescribes criminal and monetary penalties (e.g., fines up to SAR 20,000, imprisonment up to two years in certain cases). - Legal protections for SAMA staff and institution: - Article 15 of SCBL: SAMA staff may not be subject to liability or claim for carrying out duties “except in cases of bad faith or gross breach.” - Limitations: protections do not clearly cover omissions, former staff, agents, or costs of defence; Article 7 immunity of SAMA assets does not excuse honoring court judgments or defence costs. ### Supervisory powers, remit, and gaps (selected items) - Powers SAMA lacks or where legal basis is unclear (examples drawn from assessment): - Explicit power to set and enforce all prudential standards and to vary prudential requirements by bank risk profile and systemic importance (SAMA has required DSIBs to maintain capital buffer of 0.5 to 1.0 percent and has applied Pillar 2 to select banks only). - Explicit power to access boards and group-level entities (parent companies and affiliates) and their records to assess impact on bank safety and soundness. - Explicit power to take corrective action or impose sanctions based on supervisory judgment prior to legal/regulatory breaches and in response to “unsafe or unsound practices” (terms not defined in law or internal guidance). - Explicit power to reject or reverse changes in significant/beneficial ownership or prevent exercise of voting rights; laws do not define “significant ownership” or “controlling interest.” - Clear legal authority to require reporting on a solo basis (standalone bank) and full consolidated reporting covering entities in the wider group. - Licensing and fit-and-proper processes: - BCL designates the Minister as licensing authority; SAMA processes applications and issues recommendations. SAMA’s “Licensing Guidelines and Minimum Criteria (December 2018)” and “Additional Licensing Guidelines and Criteria for Digital-Only Banks (February 2020)” set criteria but the law is silent on who may set licensing criteria — legal enforceability unclear. - Minimum paid-up capital in law: SAR 2.5 million (Article 3 of BCL), noted as “not adequate for establishing a new bank in 2024.” Example: initial capital for one digital bank set at SAR 1.5 billion. - No explicit statutory power to reject an application if information is inadequate, to revoke licenses obtained by false information, or to set binding time limits to commence operations after licensing. - SAMA’s licensing practice: 18 applications in five years (two conventional banks, six digital banks, 10 foreign bank branches); licenses issued for three digital banks as of December 31, 2023; several applications pending; no rejections recorded. - Transfer of ownership and major acquisitions: - No statutory definitions of “significant ownership” or “controlling interest.” SAMA relies indirectly on CMA (Capital Market Authority) arrangements for 5 percent+ shareholding no-objection, via MoU and a June 2, 2013 Governor letter — arrangements “informal” and “not legally binding.” - SAMA’s circular on major acquisitions (21 March 2011) requires prior no-objection for restructurings or expansions that could impact risk profile; criteria include strategic rationale, capital impact, group structure and supervision effect — but internal guidelines lacking and systemic cross-border supervision considerations are not consistently applied. - SAMA cannot reliably prevent concerted shareholdings below 5 percent that collectively change control; UBO identification and periodic fit-and-proper of large shareholders insufficiently enforced. ### Supervisory approach, tools, reporting, and quality assurance - Risk-based supervision framework (RBS) and Risk Assessment Model (RAM): - RAM assesses nine risk categories: credit risk, liquidity risk, market risk, interest rate risk in the banking book (IRRBB), operational risk, technology risk, legal and regulatory risks, AML/CFT related risk, and strategic risk. - RAM combines inherent risk, controls and oversight assessments, capital and earnings ratings, and an impact rating (DSIB framework: Size; Interconnectedness; Substitutability; Complexity). - Direction of risk (increasing/decreasing/stable) assessed for a 12-month outlook; influences supervisory stance and intensity. - Key limitations identified in supervisory methodology and its application: - RAM and supervisory processes principally applied to consolidated (group) levels as reported domestically; they do not generate standalone (solo) bank risk profiles systematically nor incorporate foreign branches or foreign group entities in many metrics. - Prudential returns coverage: of ~190 offsite returns required from banks: - 23 returns are obtained both at the solo bank and consolidated bank levels; - about 105 are obtained only at the global consolidated bank level; - about 66 are obtained only for the domestic consolidated bank; - about 6 are obtained separately for domestic branches and for foreign branches/subsidiaries. - Capital adequacy, Leverage ratio, LCR, NSFR are monitored at global consolidated level; large exposures and related party exposures monitored/enforced at domestic consolidated level; many requirements are not monitored at solo-bank level. - Onsite inspection practice: since 2019 SAMA “has not conducted full-scope inspection in any bank”; inspections are often compliance focused; full-scope inspections for high-stance banks are “not routine” and quality assurance over inspection outputs is “less evident.” - Data systems and validation: RMS and SAP BI exist with >450 validation rules; thematic inspections on data quality have been performed. - Supervisory reporting and data gaps: - Offsite reporting frequency: 75 percent of returns are quarterly; 18 percent monthly; liquidity returns sometimes argued to merit higher frequency. - Gaps include limited solo-bank reporting, limited entity-level reporting for group entities, limited flow data (turnover, intragroup transactions), incomplete reporting on related party transactions and UBOs. - Use of external experts and quality control: - SAMA uses external consultants (e.g., Big Four) for specialized inspections; governance and clear mandates are in place; SAMA staff lead and remain involved; internal Framework Oversight Section (FOS) provides quality assurance on RAM outputs but “SAMA does not have an arrangement for regular independent assessment of the quality, effectiveness, and integration of its on-site and off-site functions.” ### Corrective action, sanctions, and resolution - Current powers and practice: - BCL Article 22 and Article V of IR-BCL outline measures SAMA may take, many requiring Minister approval; Article 23 enumerates penalties including fines and imprisonment for specific contraventions. - SAMA uses corrective actions mostly after legal/regulatory breaches; it “has not used” broad omnibus power (Article 22(d)) to require “other steps” and has not acted on some supervisory judgment powers because of legal uncertainty. - During the past five years SAMA “has not taken any material corrective actions and has not imposed sanctions against banks’ senior management or board” though at least two banks were placed on “high” supervisory stance for extended periods. - Limitations to timely early intervention: - Laws/regulations do not clearly empower SAMA to act pre‑emptively on unsafe or unsound practices or where the interests of depositors could be threatened (terms undefined). - Many corrective measures listed in international standards (e.g., ring-fencing, restricting activities, forcing changes in ownership or management without Minister approval, suspension of shareholder payments) are not clearly available or tested in practice. - Resolution framework: - Law of Systemically Important Financial Institutions (SIFIL), Royal Decree number (253) dated December 10, 2020, designates SAMA or CMA as competent authorities for resolution for institutions under their supervision; SIFIL requires designation of SIFIs based on criteria (size, interconnectedness, complexity) but: - SIFIL implementing regulations are not issued and SIFIL “has not been operationalized” fully. - SAMA “is yet to formally designate a bank as a SIFI,” has “yet to review the recovery plans received” (DSIBs submitted plans in the first half of 2023) and “has not prepared resolution plans for SIFIs.” - SIFIL does not fully address resolution authority coordination for financial conglomerates including insurance entities (Insurance Authority established November 23, 2023). - Articles 6–13 of SIFIL set recovery and resolution plan requirements but implementation is incomplete. ### Cross-border, consolidated, home-host and group supervision findings - Banking group footprint and materiality (selected figures): - Local banks collectively: 69 subsidiaries (51 domestic, 18 foreign), 24 associates (20 domestic, 4 foreign). - Group entities composition (across banks): 3 banking entities, 10 insurance entities, 8 securities/other financial entities, 72 non-financial entities (14 outside KSA). - Based on SAMA data, group entities account for “3 to 22 percent of the net profits, 1 to 7 percent of total assets and 3 to 18 percent of capital” of the respective consolidated banks; in 9 of 11 banks at least one of these three parameters is about 10 percent or more. - Home-host cooperation and MoUs: - SAMA has MoU with UAE host supervisor and a “split of responsibilities” agreement with UK-PRA; MoUs with other host/home supervisors are limited or absent. - Of 8 host and 16 home jurisdictions relevant to Saudi banks, SAMA has formal MoUs with only one host (UAE); MoUs often provide information exchange “on request” rather than systematic periodic sharing. - SAMA informed assessors that MoUs with foreign supervisors “need to be first cleared by the Council of Ministers” which constrains agility. - Onsite thematic inspections of foreign branches: - Between August 2023 and January 2024 SAMA undertook thematic inspections of foreign branches and met host supervisors; these were first such exercises and reports were pending finalization at time of assessment. - Home-host shortcomings and risks: - No systematic, ongoing, proactive exchange of supervisory information with most home/host supervisors; collaboration limited and largely reactive. - SAMA treats foreign bank branches (FBB) differently from domestic banks: - FBBs are subject to Regulations for Foreign Bank Branches (September 2019); differences include that FBBs may not be required to maintain capital in KSA (but a Funding Ratio/quasi-capital can be required on a case-by-case basis), and minimum LCR/NSFR requirements apply only to FBBs with significant retail activities or systemically important wholesale FBBs. - Materiality thresholds given: “significant retail activity” defined by either more than SAR 5 billion of retail and MSME balances or more than 1,000 retail and MSME account holders or more than five branches; “systemically important wholesale FBB” indicative threshold average of SAR 10 billion in Saudi footprint. - Cross-border crisis coordination and cross-border resolution planning frameworks are not yet established; SIFIL not operationalized, and cross-border resolution MoUs not established. ### Select supervisory statistics and operational figures (exact values preserved) - Licensing and applications: During the past five years SAMA received 18 applications for licenses: two conventional banks, six digital banks, and 10 foreign bank branches. As of December 31, 2023 SAMA has issued licenses for three digital banks. - SAMA staffing and resources (Banking Supervision Department): - BSD staff complement increased from 75 in 2018 to 100 in 2022. - General Department of Cyber Risk Control doubled to 61 staff (incl. General Director); IT Risk supervision team: 21 dedicated staff; Cyber fusion center: nine staff. - Fraud Team increased from three full-time employees to 29 (including 24 supervisors); AML-CFT department houses 35 full-time employees (including 25 supervisors). - Average tenure for top five layers of management in Supervision Deputyship: about 11 years; average tenure for the day-to-day supervision layer: about six years. - Staff resignations: on average about five staff per year (2018–2021 ~7 percent of BSD) but increased to 17 in 2022 (~17 percent). - Financial position (SAMA): SAMA “has been consistently transferring each of the three years up to June 30, 2020, about SAR 2 billion surplus revenues to its reserves accounts.” - Returns reporting volume and frequency: Approximately 190 offsite returns collected from banks — 23 returned at both solo and consolidated levels, about 105 only at global consolidated level, about 66 only for domestic consolidated, about 6 obtained separately for domestic and foreign branches/subsidiaries. - Regulatory capital example: SAMA required DSIBs to maintain a capital buffer of “0.5 to 1.0 percent” in addition to minimum Pillar 1 requirements; one digital bank license set initial capital at SAR 1.5 billion; statutory minimum in BCL remains SAR 2.5 million (outdated per assessors). - Supervisory actions taken (counts): - Actions related to SAMA supervisory and regulatory regulations: 2019: 182; 2020: 220; 2021: 204; 2022: 265; 2023: 160 — applied across a varying number of banks (2019: 17 banks; 2020: 24; 2021: 25; 2022: 21; 2023: 19). - Actions related to AML/CFT regulations: 2019: 11; 2020: 13; 2021: 30; 2022: 13; 2023: 7. - Actions related to consumer protection regulations: 2019: 37; 2020: 38; 2021: 36; 2022: 20; 2023: 2. ### Core policy recommendations (preserve original substance and targeted reforms) - Legal and powers reforms: - Revise laws (SCBL and BCL) to explicitly empower SAMA with all relevant powers to conduct effective banking regulation and supervision, removing uncertainty where SAMA currently acts though powers are not directly vested in law. - Specify in SCBL that the primary objective of banking supervision is “to promote the safety and soundness of banks and the banking system” and that other objectives are subordinate. - Eliminate requirements for prior Minister/Council approvals for core supervisory actions where such approvals impede SAMA’s operational independence (e.g., issuing general rules, conducting inspections, taking corrective actions). - Establish statutory powers for SAMA to: - Require and obtain consolidated and solo supervisory reporting and internal management information from banks and entities in the wider group, including UBO information. - Review, approve, reject, and impose conditions on licensing and on major ownership transfers and acquisitions (including ability to reverse or modify changes when based on false information). - Vary prudential requirements by bank risk profile and systemic importance as part of regular supervision. - Take corrective action based on supervisory judgment before a breach occurs and in response to unsafe or unsound practices; enumerate and clarify sanctions and measures applicable to banks, boards, senior management and shareholders without undue procedural delay. - Restrict or require structural changes to banking groups, ring-fence banks, and address cross-border impediments to consolidated supervision. - Revise BCL minimum paid-up capital to a materially higher absolute amount reflecting modern bank start-up needs (e.g., technological/infrastructure needs) and align law to SAMA’s practice. - Provide clear legal protections for SAMA, its staff (including former staff), and agents from lawsuits and defence costs when acting in good faith, including coverage for omissions where appropriate. - Supervisory methodology and operational reforms: - Revise RBS/RAM and supervisory approach to: - Produce and maintain distinct, ongoing solo-bank (standalone) risk profiles in addition to consolidated group assessments. - Incorporate contagion risk, reputation risk, and cross-sectoral developments into core risk ratings (not only supervisory intensity). - Include resolvability assessments and barriers to resolution into risk profile and supervisory planning. - Institute full-scope inspections across banks at defined periodicity (for example, once every three to five years) to avoid supervisory blind spots. - Migrate onsite inspections from a compliance focus to broader qualitative assessments (risk culture, governance, senior management and board engagement). - Strengthen supervisory engagement with bank boards: - Require supervisors to meet board and independent/non-executive members in bank-specific settings, challenge strategies and decisions, and document these engagements. - Empower SAMA to require changes in board composition where directors fail duties of care or loyalty. - Enhance reporting and data framework: - Expand offsite returns to ensure reporting on both solo and consolidated bases, entity-level reporting for group entities and parent/affiliated entities, flow data (turnover, intra-group transactions), and more complete related-party and large exposure details. - Tailor contents and frequency of reporting to bank risk profile and systemic importance; include KRIs at solo and group levels. - Ensure statutory powers to require any relevant information from banks and group entities (including internal management information) and periodic review of reporting relevance. - Improve licensing processes: - Legislate clear authority to set licensing criteria and to reject applications lacking adequate information or if criteria are not met; empower revocation when licenses were based on false information. - Adopt internal licensing guidelines documenting timelines, required verification (including source of initial capital), UBO identification, shareholder financial strength assessment, assessment of board collective knowledge, and fit-and-proper of proposed directors and senior management. - Set binding deadlines for commencement of operations post-license to avoid stale authorizations. - Strengthen consolidated and cross-border supervision: - Revise RAM and prudential reporting to support supervision at global consolidated level; apply and enforce prudential standards (capital, liquidity, large exposures, related party limits) appropriately at solo and consolidated levels. - Establish policy and periodic on-site access to foreign branches and subsidiaries based on risk and materiality; systematically assess host supervision quality and incorporate results into supervisory stance. - Home-host and crisis cooperation: - Conclude MoUs and operational information-sharing arrangements with remaining relevant home and host supervisors and foreign resolution authorities; remove procedural bottlenecks that require Council clearance for MoUs where feasible. - Make information exchange systematic, ongoing and proactive (not reactive on request); consider shared templates for financial/prudential indicators, risk assessments, supervisory findings, corrective actions, and sanctions. - Develop cross-border crisis cooperation and group resolution planning frameworks, including group resolution plans for SIFIs and coordination protocols with host authorities; operationalize SIFIL implementing regulations. - Governance and accountability reforms: - Clarify SAMA board appointment/removal processes and disclosure requirements; define appointment/removal criteria for Governor and Vice Governors, and require public disclosure of reasons for removal. - Strengthen staff conflict-of-interest rules, post-employment restrictions, and penalties for breaches; extend relevant protections/obligations to SAMA agents. - Institute periodic independent review of supervisory tools, quality, effectiveness, and integration of on-site and off-site functions. - Corrective action and enforcement reforms: - Provide explicit statutory powers to take corrective actions and impose sanctions without seeking Minister prior approval in circumstances requiring immediacy; enable a broader menu of enforceable measures (e.g., ring-fencing, restricting activities, forcing changes in ownership/management, limiting shareholder distributions) consistent with international practices. - Require SAMA to inform other domestic supervisors and coordinate with them when taking formal corrective action affecting group entities; formalize processes for cross-agency coordination. *Source: IMF assessment text (excerpts and findings reproduced verbatim for the content unit titled “1sauea2024003-print-pdf - 73. The assessment noted that, in its supervisory role, SAMA acted though powers are not directly vested in it by law.”)* ### Section 11 of the ICAAP and Section 12 of the ILAAP requires banks to recognize the ### 1sauea2024003-print-pdf - Section 11 of the ICAAP and Section 12 of the ILAAP requires banks to recognize the ### EC7 — Information systems for risk, capital and liquidity reporting - SAMA’s ILAAP Guidelines require banks to have the framework and IT systems for identifying, measuring, managing, and monitoring and both internal and external reporting of liquidity and funding risks, including intraday risk. The assumptions and methodologies adopted should be described, key indicators should be evidenced, and the internal information flows described. - There is no equivalent requirement in the ICAAP Guidelines. - SAMA’s Rules on Credit Risk Management for Banks (2013) set out requirements for systems and procedures, stress testing of credit risk, management information system and internal controls system. - Key Principles for Corporate Governance (2021) require the Risk Committee to: - Oversee the financial institution’s risk management system, and evaluate the effectiveness of the systems and mechanisms for identifying, assessing and monitoring the risks that may endanger the financial institution so as to determine areas of inadequacy therein (para 94d). - Prepare and submit to the Board detailed reports on exposure to risks and the proposed steps to manage these risks (para 94f). - Verification of information systems and reports to Senior Management and the Board is carried out via offsite and onsite supervision. - Annual control assessment questionnaire includes questions on banks’ systems and reporting framework to senior management. - Onsite inspectors test design and operational effectiveness of controls, including within information systems; identified risks are monitored and followed up via established processes. - Finding: Overall framework adequately covers supervisory assessment of information systems, but adoption of a holistic regulation for risk management would ensure full coverage. ### EC8 — New products, material modifications and major initiatives - SAMA issued “New banking products and services guideline” in October 2017; it covers existing products/services that have undergone material/significant modifications. - Requirements include: - Section 2.1: “Banks are required to have a board (or its delegated authority) approve new products/services policy to guide the development and approval process for new banking products.” - Section 2.2: “The board of directors (the board) and senior management of the bank are responsible to ensure that the new product/services risks are well managed.” - Control functions (risk management and compliance) must review new products to ensure inherent risks and operational aspects are studied and fully understood. - Corporate governance guidance requires Board and senior management ownership of new products and major initiatives. - Post-launch review must be carried out by internal audit within a SAMA-specified timeline. - Onsite inspections review the entire framework; shortcomings are highlighted in inspection reports and communicated to banks. ### EC9 — Risk management functions, independence and resourcing - Key Principles for Corporate Governance (2021) require banks to put in place policies covering major risks, and to have adequate resources to monitor those risks (para 94). - Risk functions are required to have direct reporting lines to the CEO/Board Risk Committees and duties segregated from risk-taking functions (Corporate Governance Guidelines para 36). - Risk functions are subject to regular review by internal audit and are reviewed during onsite inspections covering Board/Board Committees oversight, policies, procedures, limits, organizational structure, resources, major risks, etc. - Shortcomings are highlighted in inspection reports and corrective actions are monitored. ### EC10 — Dedicated CRO function and governance of CRO removal - SAMA circular no. 3411000036442 dated January 2013 requires banks to have a credit risk framework with organizational structure commensurate with size and complexity. - Key Principles require establishment of a Board Risk Committee through which the bank’s risk manager reports to the Board (para 92); Risk Committee provides recommendations to the Board regarding appointment/termination of the manager of the risk unit or department. - Paragraph 36 requires effective units for compliance, internal auditing and risk management, independent from business departments, with adequate powers and resources. - Circular “Appointment Requirements for Leadership Positions in the Financial Institutions Under the Supervision of SAMA” (Article 9) requires: - Regular assessment of suitability of holders of leadership positions, at a minimum once a year, and immediate notification to the Central Bank of information with material impact on eligibility and suitability. - Finding: There is no requirement to publicly disclose a CRO’s departure or the reasons for it. ### EC11 — Standards for credit, market, liquidity, interest rate and operational risk - Issued requirements include: - Rules on Credit Risk Management (circular no. 341000036442, dated February 2, 2013). - Principals for Sound Liquidity Risk Management and Supervision (circular no. 351000147075, dated September 19, 2017). - Risk Management Framework for Banks Practicing Islamic Banking Activities (circular no. 43038156, dated December 2, 2021). - Guidelines on the Internal Liquidity Adequacy Assessment Plan (ILAAP) (circular no. 42012157, dated October 18, 2020). - Guideline Document on The Internal Capital Adequacy Assessment Plan (ICAAP) (circular no. 581, dated September 22, 2008) and Enhancements (dated September 10, 2011) covering identification of Credit Risk, Market Risk, Operational Risk, Liquidity Risk, Concentration Risk, Securitization Risk, Strategic Risk, Interest Rate Risk in the Banking Book. - Gaps identified: - No specific standard covering market risk. - Operational risk circular of 2014 was “for information purposes” and therefore does not set standards. - Recommendation: Fill gaps with an overarching risk management standard; refresh operational risk circular of 2014 to make clear it sets minimum requirements. ### EC12 — Contingency arrangements and recovery planning - SAMA issued stress testing guidelines in 2011; banks undertake stress tests at least twice a year covering various areas including liquidity. - Inspections review stress testing frameworks, integration with overall risk management and use of results in contingency arrangements. - Under ICAAP and ILAAP, banks must assess risks under stress and provide contingency plans; required under ILAAP Guidelines (Section C: Contingency Funding Plan (CFP)) and Rules on Stress Testing (Section 9: Remedial Actions). - Systemically Important Financial Institution Law (Royal Decree no. 253 issued December 2020) Article 6 requires recovery plans to include (selected components exactly as specified): - A summary of its key components and an indication of the financial institution’s ability to recover its position. - A summary of the fundamental changes in the financial institution since the last recovery plan submitted to the competent authority. - An outreach and disclosure plan to address any anticipated negative reaction from the markets as a result of the impact of the fundamental changes on the financial institution. - Steps to recover capital and liquidity requirements, preserve the financial institution, and regain its financial position. - An estimation of the timeframe required to implement the primary components of the plan. - A detailed description of potential risks which may hinder implementation. - identification of the critical activities provided by the financial institution. - A detailed description of procedures for determining the market value of each activity in the financial institution as well as its operations and assets, and their potential to be marketed and sold. - Arrangements and procedures to obtain liquidity, including identification of potential sources for liquidity and evaluation of the guarantees available for acquiring such liquidity. - Arrangements and procedures for rescheduling the financial institution's debts; structuring or restructuring its activities; and reducing any potential risks. - Arrangements and procedures required to ensure the continued access to settlement systems. - Arrangements necessary for the sale of certain assets or activities of the financial institution in order to recover its financial position within an appropriate time. - Governance procedures of the plan, including identification of persons in charge of its preparation and implementation. - Article 6 also empowers the competent authority to require quantitative and qualitative indicators in recovery plans. - Article 7 procedures and timelines: - Submit plan or update to competent authority upon management approval. - Competent authority shall, within 90 days from receipt of the recovery plan, approve or return it for amendment and resubmission within a period specified by the competent authority. - Financial institution shall update the recovery plan at the request of the competent authority within a period specified thereby. - Competent authority shall, upon requesting a recovery plan, take into account importance, size, interconnectedness, complexity, modus operandi, and associated risks. - Finding: Legal framework for SIFI resolution is in place; SAMA has begun implementation but this is at an early stage and is encouraged to progress this work. ### EC13 — Forward-looking stress testing programs - SAMA’s Rules on Stress Testing for Banks (circular no. 60697.BCS.28747, dated November 23, 2011) require banks to adopt robust stress testing techniques and use stress tests as a tool of risk management. - Banks must conduct comprehensive stress testing covering all material risks on a regular basis and design programs in line with nature, size, complexity and risk profile. - Integration of stress testing into ICAAP and ILAAP documents demonstrates use for risk identification, scenario suitability, Board and senior management involvement, documentation and comprehensiveness. - SAMA shares observations and requires corrective actions in annual ILAAP and ICAAP letters; may review stress testing frameworks during on-site examinations. - SAMA requires remedial action to address potential risks identified by stress testing results. - Board is required to sign off on stress testing and ICAAP and ILAAP documents. - Recommendation: SAMA could increase comfort with Board ownership and understanding of stress tests by direct bilateral meetings with key Board members. ### EC14 — Accounting for risks in internal pricing, performance measurement and new product approval - ICAAP guideline requires identification of all significant risks and assessment to inform how risks are to be managed, including consideration of markets, products, organizational structure, financial position, experience from past disruptions, and assessments of potential outcomes if risk materializes. - Annual Supervisory Review Visits and ICAAP meetings discuss how assessment results are reflected in business, performance measures, and risk appetite statement. - Finding: BCP assessors did not evidence pricing being covered in files reviewed; pricing is not covered in SAMA’s New Banking Products and Services Guideline (2017). Funds Transfer Pricing can be covered during ILAAP meetings. - Approval process: banks must do due diligence per SAMA New Banking Products and Services Guidelines and apply for non-objection letter; SAMA reviews submissions to ensure risks are assessed. ### AC1 — Assessment of other material risks (reputational, strategic) - Key Principles of Governance Circular (July 2021) requires Boards to “develop and monitor the implementation of a comprehensive risk management strategy and to review on annual basis, taking into account to link the level of risks that the financial institution desires to bear in a specific period of time with its strategy and capital plan” (para 37). This implicitly covers risks holistically but lacks explicit reference and specific mention of such other risks. - Guidelines require banks to prepare a Risk Appetite Statement (RAS) reviewed and approved annually by the board; RAS should cover all material risks. - Review of RAS, operational and strategic risks is undertaken during onsite inspections. ### Assessment of Principle 15 — Summary findings and recommendations - Assessment: Largely compliant. - Key comments and recommendations: - SAMA’s framework around risk management requirements is largely complete: Board Risk Committee, separate risk function and RAS supported by reporting and monitoring systems. - Two key gaps (EC11): - Circulars cover individual risks (credit, cyber risk, business continuity management) but no detailed requirements for an overall risk management framework. - Market risk and operational risk lack a single enforceable document. - In practice, SAMA covers these areas via ICAAP/ILAAP and detailed assessments, but a more comprehensive regulatory foundation is recommended to ensure full offsite and onsite coverage (EC11). - SAMA supervisors meet Board members rarely and have no structured framework for doing so; recommendation to establish one to ensure Board members are fully across risk management issues (EC4). Cross-referenced to CP9. - Onsite inspections should give more emphasis to testing and assessing risk culture with a tilt from mainly compliance focus to broader qualitative assessment of the bank’s approach to risk (EC4). - No requirements to publicly disclose dismissal or replacement of CEO, CRO, Chief Compliance Officer, and Internal Audit Executives, and reasons (EC10). - Pricing was not evidenced in files reviewed and not covered in New Banking Products and Services Guideline (2017) (EC14). - SIFIL passed in 2021 will enable SAMA to build full resolution and recovery framework for SIFIs; continued attention to full implementation encouraged. ### Selected capital framework and supervisory points (Principle 16 highlights) - Banking Control Law (1966) sets minimum capital requirement of SAR 2.5mn; in practice SAMA requires much higher levels for new banks and existing banks have paid-up capital well in excess of this level. Recommendation: update minimum required capital in legislation. - SAMA documents implementing Basel III: - ‘Finalized Guidance Document Concerning the Implementation of Basel III’ issued December 2012 (enforceable despite label “guidance”). - ‘Guidance Note on the Scope of Application of SAMA’s Basel Framework’ issued December 2022. - Baseline minimum capital ratios specified in 2012 document: CET1 (4.5 percent), Tier1 capital ratio (6 percent) and total capital ratio (8 percent). - Capital conservation buffer: 2.5 percent comprised of CET1 capital. - DSIB buffer: up to 2.5 percent based on a formula including size and interconnectedness (circular ‘Domestic Systematically Important Banks (D-SIBs) Framework’ issued 2014). - Counter Cyclical Capital Buffer (CCyB) added in 2016 (circular dated January 4, 2016) with reciprocity arrangements; recommendation to develop fuller set of indicators and market guidance for changing CCyB. - Solo monitoring: supervisors pay limited attention to solo capital adequacy; recommendation to consistently check solo capital adequacy (EC2). Files showed potential risk-weighting reporting issues—recommended supervisors carry out a sense check on key risk weighting numbers on receipt of returns. - SAMA can impose specific capital charges and include on- and off-balance sheet risks in capital calculations; December 2022 circular (no. 44047144) requires calculation based on Basel RWA framework including CCR and CVA. - Stress testing: SAMA requires banks to include three-year forward capital plans in ICAAP, submit at least two stress tests each year, and SAMA reviews and adjusts Pillar 2 add-ons as part of ICAAP. *Source: 1sauea2024003-print-pdf — https://www.imf.org/-/media/files/publications/cr/2024/english/1sauea2024003-print-pdf.pdf* ### Section 5.6 sets out the credit risk monitoring requirements, enabling them to monitor ### 1sauea2024003-print-pdf - Section 5.6 sets out the credit risk monitoring requirements, enabling them to monitor ### Credit risk monitoring requirements (Section 5.6) - Enables monitoring of individual credits as well as the overall credit portfolio. - Emphasizes the need for effective controls around the use of models to identify and measure credit risk and set limits. - Specifies requirement for controls related to the quality, reliability, and relevance of data. - Specifies requirement for validation procedures for the models being used. ### Model governance and control expectations - Controls must address: - The use of models to identify credit risk. - The use of models to measure credit risk. - The use of models to set limits. - Data-related controls must ensure: - Quality of data. - Reliability of data. - Relevance of data. - Model validation requirements must be established and applied. ### Regulatory reference - SAMA circular no. 44047144 dated December 2022 concerning Basel III Reforms, Section 5.6. *Source: 1sauea2024003-print-pdf - Section 5.6 sets out the credit risk monitoring requirements, enabling them to monitor* ### 6.3 requires that: “Banks should have in place effective internal policies, processes, ### 1sauea2024003-print-pdf - 6.3 requires that: “Banks should have in place effective internal policies, processes, ### Credit risk management framework and supervisory approach (Principle 17 — ECs summary) - Regulatory requirements and guidance: - 2013 Circular “Rules on Credit Risk Management” sets requirements for banks to have a full credit risk management framework, including risk appetite, processes, lending authorities and systems. - Chapter 9 describes credit risk mitigation techniques and requires banks to have clear and robust procedures integrated into credit policies. - SAMA circular no. 42081293 dated 21/11/1442 on Corporate Governance Principles includes provisions related to credit risk management and monitoring total indebtedness (consumer focus). - Responsible Lending Principles for Individual Customers (May 2018) require banks (para 8) to obtain and continuously update information on all the customer’s other credit obligations (applies to consumers only). - Supervisory tools and practices: - Off-site monitoring: continuous assessment of banks’ inherent credit risk via KRIs, asset quality data; credit risk is a common topic in supervisory meetings. - On-site inspections: regular reviews of credit risk management strategy, policies, approval authorities, organizational structure, systems, risk reports, risk appetite/limits, quality of data/MIS, governance oversight, credit administration, and integration with business strategies. - External experts are contracted when additional specialist expertise is required. - Key findings and gaps: - No explicit requirement in the Rules for large, risky, or unusual exposures to be subject to specific Board or senior management approval (EC6). - No specific mention of foreign exchange risk in relevant SAMA circulars (EC4). - Requirement to identify a customer’s total indebtedness sits in Responsible Lending Guidelines that apply only to individuals (EC4). - Rules do not require loan officers to be free of conflicts for decisions in which they participate (EC5); SAMA circular no. 43095743 on Related Party Rules requires arm’s length treatment for related party credit decisions, but credit risk management circular no. 341000036442 lacks a staff conflict requirement. - Assessment: - Principle 17: Largely compliant. - Comment: The 2013 Rules are helpful and cover most requirements but could be tightened to align more fully with the Basel Core Principles (notably EC4, EC5, EC6). *Source: 1sauea2024003-print-pdf* ### Problem assets, provisioning and loan workout (Principle 18 — ECs summary) - Regulatory framework and guidance: - SAMA Rules Governing Loan Classification, Provisioning and Credit Review circular no. 241000000312 dated January 19, 2004—defines loan classification categories, provisioning requirements, regular review, and write-off processes. - January 2020: SAMA ‘Rules on the Management of Problem Loans’ require banks to formulate policies and processes for identifying and managing problem assets and to establish EWS and workout frameworks. - SAMA issued ‘Guidelines on Management of Problem Loans’ to support implementation. - Saudi Arabia implemented IFRS 9 effective January 1, 2018, and issued IFRS 9 guidance for the Kingdom. - SAMA Rules on Stress Testing 2011 require banks to conduct stress testing; credit exposures form a major part of biannual stress tests. - Requirements and supervisory verification: - Rules require banks to develop Early Warning Signals (EWS) integrated into risk management and to have documented workout plans and a dedicated Workout Department/Section/Unit independent of business units (Sections 2.1 and 4.1; Section 4.11 staffing requirements). - Offsite supervisors assess prudential returns, KRIs, and problem assets at individual and portfolio levels; onsite inspections assess adequacy of grading, provisioning, and controls (including third-party expert reviews, e.g., 2021 IFRS9 thematic review with external experts). - SAMA monitors RMS returns quarterly and compares regulatory provisioning with accounting provisioning; SAMA can require banks to allocate more provision if shortfalls exist. - Findings and specific points: - SAMA’s 2004 Circular applies to both on- and off-balance sheet exposures (EC3). - Minimum provisioning requirements (Section II, para 2.3 (ii) of 2004 Circular) require banks to “factor in local and international economic conditions” for general provisions (EC4). - Banks’ IFRS9 methodologies use quantitative and qualitative parameters that implicitly consider market and macroeconomic factors. - SAMA assesses documentation adequacy and has full access during onsite inspections; RMS returns include Q41-1, Q41-2, Q41-3 (ECL and exposures reporting) (EC6). - SAMA requested banks in 2023 to maintain a NPL coverage ratio above 150 percent; some banks increased provisioning to comply (EC7). - The 2004 definition of “rescheduled loans” requires updating to align with Basel 2017 language (counterparty must have resolved its financial difficulties) — recommended update within next two years (EC5 comment). - Recommendation: SAMA should embed a more systematic process via the Financial Stability Committee to use macro indicators and specific triggers to advise banks on provisioning adjustments (EC12). - Assessment: - Principle 18: Compliant. - Comment: While updates are recommended (rescheduled loan definition, systematic macro-to-provision triggers), asset quality and provisioning receive significant supervisory attention; over half of SAMA’s KRIs relate to credit risk and half of those concern asset quality and provisioning. *Source: 1sauea2024003-print-pdf* ### Concentration risk and large exposures (Principle 19 — ECs summary) - Regulatory framework and governance: - Large Exposure (LEX) Rules for Banks issued August 2019 require bank-wide management of credit concentration risk covering on- and off-balance sheet exposures, trading and banking books, and contingent liabilities. - LEX Rules require Board oversight, policies and procedures, stress testing and scenario analysis, adequate systems and controls, and quarterly review of large exposures and concentrations. - Credit Risk Management Circular (2013, Sections 3.iv and 6.1) also addresses concentration risk; ICAAP requires inclusion of concentration risks (on- and off-balance sheet). - Definitions and thresholds: - A large exposure is when the sum of exposure values to a single counterparty or group of connected counterparties is equal to or above 10 percent of the bank’s eligible capital base (Tier 1 capital used as denominator) (EC6). - Exposure limits as a percent of Tier 1 capital: - 5 percent for individuals and sole proprietorships. - 25 percent for commercial undertakings majority owned by Saudi government. - 25 percent for exposures to banks unless the bank counterparty is a DSIB when the limit is reduced to 15 percent. - 15 percent for all other exposures. - Aggregate of all large exposures limited to 600 percent of Tier 1 capital. - SAMA may allow breaches in exceptional circumstances with prior approval; maximum single exposure to a non-bank, non-government entity that SAMA would allow under such circumstances is 35 percent of Tier 1 capital (assessors recommend exceptions be strictly temporary). Exposures to or guaranteed by the Saudi government are exempt. - Identification of connected counterparties: - LEX Rules define a group of connected counterparties where failure of one would likely cause failure of all; criteria include control relationship, economic interdependence, or other connections identified by the bank. SAMA can challenge bank assessments and require reclassification (EC5). - Supervisory information systems and gaps: - Article 7 of “Rules on Credit Risk Management for Bank” requires robust MIS for reports on portfolio composition, concentrations, and large exposures; inspection teams review systems during onsite credit inspections (EC2). - RMS returns provide sectoral, geographical, and currency concentration data: - Sectoral: M28 Credit Facilities by Economic Activity; Q16.3 Economic Sector Risk Concentration; Q28.2 Economic Activity for MSME. - Geographical: Q2 Non Resident Assets by Country; Q3 Non Residents Exposures by Country; Q4 Non Resident Liabilities by Country. - Currency: Q6 Maturity schedule of assets and Liabilities by major currency; Q8 Deposit structure by amount and number of accounts and currency. - Reporting is “Domestic” and does not include overseas branches and subsidiaries — identified reporting gap and recommendation that SAMA require reporting to include all overseas units to avoid underreporting total exposures to a counterparty (also referenced in CP8). - Observed concentrations and supervisory action: - Figures from banks’ reports to SAMA showed that, for eight domestic banks, total exposure to the top 20 net exposures was 200 percent of capital or more — highest around 380 percent of capital (indicative of high credit concentration). SAMA should increase monitoring of government and government-owned commercial companies given expected growth as part of Vision 2030 (EC2, EC6). - Onsite Banking Inspection verifies senior management monitors limits and that they are not exceeded (EC6). - Assessment: - SAMA’s LEX Rules and supervisory practice broadly address concentration risk; limits are more conservative than Basel benchmarks. Recommendation to close reporting gap on overseas units and to strictly limit temporary exceptions to exposure limits. *Source: 1sauea2024003-print-pdf* ### Section 3.iii of the 2019 Large Exposures Rules requires banks to conduct stress testing ### Section 3.iii of the 2019 Large Exposures Rules requires banks to conduct stress testing ### Additional Criteria (AC1) - For credit exposure to single counterparties or groups of connected counterparties: - (a) ten per cent or more of a bank’s capital is defined as a large exposure; and - (b) twenty-five per cent of a bank’s capital is the limit for an individual large exposure to a private sector non-bank counterparty or a group of connected counterparties. - Minor deviations from these limits may be acceptable, especially if explicitly temporary or related to very small or specialized banks. ### Description and findings regarding AC1 - The Large Exposures Rules define a Large Exposure as 10 percent or more of Tier 1 capital. The rules apply on both a consolidated and solo basis. - The sum of all exposures values a bank has to a single non-bank counterparty must not be higher than 15 percent of the banks available eligible capital base at all times, excluding: - individuals and sole proprietorships which attracts a limit of 5 percent; and - commercial undertakings majority owned by Saudi government which attracts a limit of 25 percent. - The aggregate of all Large Exposures shall not exceed 6 times of the bank’s eligible capital. - Article 8 of Banking Control Law 1966 states that “No bank shall grant a loan or extend a credit facility, or give a financial guarantee with respect to any natural or juristic person for amounts aggregating more than 25 percent of the Bank's reserves and paid-up or invested capital.” ### Assessment of Principle 19 - Largely compliant. ### Comments on Large Exposures and concentration monitoring - The Large Exposures Rules set appropriate limits on exposures to single counterparties or groups of connected counterparties. - SAMA has allowed breaches on an exceptional basis with prior approval up to 35 percent of tier 1 capital. The assessors recommend it should be explicit in the rules that this must be on a strictly temporary basis (EC6). - Requirements to manage credit concentration risk are contained in the Credit Risk Management Circular of 2013. - Verification of compliance and of processes is undertaken as part of the onsite inspection program, which the assessors found to be effective. - SAMA’s reporting requirements are confined to the “domestic” business of the bank (defined as the bank’s Saudi branches and subsidiaries), so exposures incurred by overseas branches or subsidiaries are not included, creating the risk that breaches and risky concentrations are missed by the bank and the supervisor (EC4). - Overseas offices are currently a small proportion of banks’ balance sheets, which may reduce the practical risk, but SAMA’s rules do not allow for de minimis exclusions. - Connectivity between banks’ large exposures merits more attention: - For eight of the domestic banks, the total exposure to the top 20 net exposures was 200 percent of capital or more—with the highest at around 380 percent of capital. - SAMA is encouraged to increase system-wide monitoring of exposures to government and government-owned commercial companies from a concentration risk perspective, given expected growth as part of Vision 2030 (EC6). ### Principle 20 — Transactions with related parties (overview) - Supervisor requires banks to: - enter into transactions with related parties on an arm’s length basis; - monitor these transactions; - take appropriate steps to control or mitigate the risks; and - write off exposures to related parties in accordance with standard policies and processes. ### EC1 — Definition of “related parties” - SAMA circular no. 43095743 dated June 2022 defines related parties. - Article 9 of the Banking Control Law 1966 prohibits a limited range of related party transactions (such as all loans to directors) but its coverage is not as broad as the 2022 Circular. - The Circular’s definition extends coverage to some parties not included in footnote 73 of Basel Core Principle 20, including Shariah Committee members, their interests and their relatives (Article 2.vi). - Gaps in the Circular’s definition: - Does not include subsidiaries of the bank’s controlling shareholder and those entities’ directors and senior management. SAMA’s rules cover the bank’s “affiliates (Associates and joint ventures as per the definition given by the accounting standard)”, which is not as broad as required under Basel and does not cover subsidiaries of a parent entity. - Does not include key non-managerial advisers; covers “Senior Executives of the bank or any of its subsidiaries/affiliates and their relatives” (Article 2.vi.c and 2.x) but not influential advisers. - The rules exempt (Article 5.2i) exposures to the Saudi Government and (Article 5.2ii) exposures to Entities that are related to the Bank only due to sovereign ownership in both, including where there is a joint Board member in both the Bank and the entity. - Recommendation: revise rules to be consistent with the Basel definition, and treat government-owned companies with a director in common with the bank as related, deeming the relevant Board member conflicted even if the exposure is exempt. ### EC2 — Arm’s length treatment of related-party transactions - SAMA’s Key Principles of Governance for Financial Institutions Subject to Saudi Central Bank’s Oversight and Supervision (July 2021, circular no. 42081293, para 43) requires banks to conduct transactions with related parties on a commercial basis. - Related Parties Rules for Banks 2022, Article 4 (4) states: - “Exposures/transactions to related parties shall only be considered on arm’s length basis and without any preferential treatment. Furthermore, any such credit exposures/ transactions should also be strictly in line with the bank’s credit policy and procedures and policies and procedures on related party exposures/transactions.” ### EC3 — Board approval and conflict exclusion - Related Parties Rules for Banks clause 4 (v) requires any exposure/transaction to a related party or any variation of the terms of a related party exposure/transaction to be approved at the level of “Board of Directors or its delegated authority”. - The term delegated authority allows the possibility of approval below the Board level, potentially below a Board Sub-Committee. - Assessors consider it appropriate that all such transactions are subject to prior approval by the Board itself. - Clause 4 (v) also requires that the concerned board member “would neither participate in the discussion nor influence such a decision.” - Assessors recommend a stronger requirement that the concerned board member be absent from the discussion. - There is no requirement in the rules for write-off of related party exposures to be subject to prior approval by the bank’s Board. ### EC4 — Policies to prevent beneficiaries influencing transactions - Related Parties Rules for Banks issued in 2022 set requirements; their completeness is subject to the comments in ECs 1–3. - The supervisor assesses banks’ credit risk policy and processes regarding related party exposures/transactions; results are included in banks’ risk profiles and considered when identifying targeted inspection and other supervisory activities. - SAMA’s inspection teams have undertaken targeted inspections on related party exposures and include the matter in credit inspections. - Historical activity: - Thematic related parties review on all domestic banks in 2017/2018. - Two further targeted inspections since then. - Assessors view this frequency as low and insufficiently frequent. ### EC5 — Limits and capital treatment for related-party exposures - Related Parties Rules for Banks define limits for exposures to related parties, an aggregate limit of related parties exposures to capital, and requirement for collateralization of related parties exposures. - Exposure limits: - Individual related parties: 5 percent of eligible capital (except listed Saudi corporates where the limit is 10 percent) — these are stricter than the Large Exposures limit for single counterparties and groups of connected counterparties (15 percent of eligible capital). - Aggregate limit on exposures to non-bank related counterparties: 50 percent of the bank’s eligible Tier 1 capital. This is higher than the 25 percent maximum required under this EC. - There is no limit on exposures to related banks, which is identified as a gap. - Data provided by banks to SAMA showed aggregate exposures of more than 50 percent in the case of three banks, underscoring the importance of monitoring related party exposures and understanding exposures to government entities as part of Vision 2030 (see CP19, EC6). *Content based solely on the supplied section of the source PDF.* ### Section 5.1 of the Related Party Rules Circular requires banks to report immediately any ### 1sauea2024003-print-pdf - Section 5.1 of the Related Party Rules Circular requires banks to report immediately any ### Related party governance and monitoring (EC6) - Requirement: Section 5.1 of the Related Party Rules Circular requires banks to report immediately any breaches of the exposure/transaction limits to SAMA. The communication to SAMA must also include the bank’s action plan to bring the exposure/transaction to within the required limit. - Supervisor determines banks have policies and processes to: - identify individual exposures to and transactions with related parties; - identify the total amount of exposures; - monitor and report on them through an independent credit review or audit process. - Supervisor determines exceptions to policies, processes and limits are reported to appropriate senior management and, if necessary, to the Board for timely action. - Supervisor determines senior management monitors related party transactions on an ongoing basis and the Board provides oversight. - Governance and risk management requirements in the Related Party Rules: - The Board is ultimately responsible for oversight of the bank’s associations with its related parties and for approving policies governing dealings and associations with related parties; the Board must ensure these policies are reviewed at least annually and remain adequate and appropriate for the bank’s risk appetite, risk profile, capital, balance sheet size and complexity. - Banks are required to have policies and procedures on related party exposures/transactions. - Banks must have adequate systems and controls to identify, measure, monitor and report related party exposures/transactions on a timely basis and ensure related party exposures/transactions are reviewed at least quarterly. - SAMA inspection findings: - Inspection teams assess banks have related party policies approved by the Board and are adequately identifying related parties and obtaining approvals from designated higher levels for related party transactions. - Reviewed whether Board Audit Committees are regularly reviewing related party transactions. ### Aggregate reporting on related-party exposures (EC7) - RMS reporting: The RMS for Large exposures includes the Q27.5 Statement Showing Exposures to Related Counterparties that Exceed 5 percent of Bank's Eligible Capital Base. - Note: This is described as a high threshold—reporting of all related party exposures would be appropriate and normal. - SAMA’s reporting requirements are confined to the “domestic” business of the bank (defined as the bank’s Saudi branches and subsidiaries); reporting should be on a solo legal entity and consolidated basis to ensure full capture. - 2022 Circular Scope and Application: defined as “all locally incorporated banks... and all foreign branches and subsidiaries of locally incorporated banks operating outside the Kingdom.” This definition does not cover the full consolidated group—it omits subsidiaries of a parent company, and non-banks. - Recommendation: SAMA should write a fuller definition in the revised policy and extend individual reporting to all related parties. - Compliance verification: On-site inspections verify compliance and adherence to processes; assessors judge these inspections to be appropriately comprehensive. ### Assessment and material gaps under Principle 20 - Assessment of Principle 20: Materially non-compliant. - SAMA strengths: - SAMA defined related parties in June 2022 Circular with a definition broader than the BCP definition to include banks’ Shariah Committee members, their interests, and their relatives (Article 2.vi). - SAMA regulations require exposures/transactions to related parties be on an arm’s length basis and without preferential treatment. - Related Party Rules (June 2022) set limits on exposures to related parties; require processes to limit risks and require arm’s length treatment. - SAMA obtains details of banks’ exposures to related parties at the level of domestic consolidation. - Material gaps identified: - The definition of related party does not include all affiliates, their directors and senior management, nor potentially key staff who do not hold executive positions (EC1). - There is no limit for related parties that are banks (EC5). - The aggregate exposure to related parties (set at 50 percent of Tier 1 capital) should be no higher than that for single counterparties (set at 25 percent of Tier 1 capital). - Rules for write-off of related party exposures permit approval by a delegate, not by the Board (EC3). - There is no requirement for directors to absent themselves from a meeting considering a transaction in which the director has a related party interest (EC3). - Reporting is confined to “domestic” business and the Scope and Application does not extend to the full consolidated group, omitting subsidiaries of a parent and non-banks (EC7). - Specific recommendation: Extend individual reporting to all related parties (EC7). ### Country and transfer risk framework (Principle 21) — overview and EC1 findings - Principle 21 assessment: Materially non-compliant. - EC1 findings: - SAMA’s rules contain no specific requirements on banks to give due regard to country and transfer risk. - Circular no. 341000036442 dated 2013 on Credit Risk Management requires banks’ Credit Policy to cover “broad parameters for taking credit exposures to...geographic areas/countries.” Country and transfer risk are not explicitly mentioned. - Implementation Rules for the Banking Control Law (dated 14/10/1406H Article I. 2(d)) requires banks to obtain SAMA’s pre-approval for overseas exposures; in practice banks request limits for exposures in particular classes/currencies. - SAMA circular no. BCS 771 dated December 5, 2008 notes importance of monitoring and managing cross-border transaction risks, including transfer risk. - Supervisors monitor country risk quarterly via RMS for resident and non-resident investments and resident and non-resident loans and via quarterly risk returns; one KRI measures exposures in countries with a sovereign rating of