Saudi Central Bank

SAMA Counter-Fraud Framework Readiness

Connect counter-fraud governance, customer journeys, identity controls and detection evidence through a focused SAMA readiness and gap assessment.

Discuss your readiness اقرأ هذه الصفحة بالعربية

Published Counter-Fraud Framework and applicable Fundamental RequirementsSources reviewed: 4 November 2026

Understand the requirement. Connect it to operations.

SAMA’s Counter-Fraud Framework addresses governance and the prevention, detection and response to fraud. The Rulebook identifies the framework issued in October 2022 as in force and categorizes it under the Banking Sector. The document states that institutions required to implement it will be notified by SAMA. It operates alongside the Cyber Security Framework rather than replacing cybersecurity-specific requirements.

A counter-fraud readiness review should examine how business decisions, customer interactions and technical safeguards work together. IRIS Technology can support the cybersecurity, identity, integration and evidence aspects within an agreed scope, coordinated with the institution’s counter-fraud, risk, business and legal teams. The activities below are practical implementation suggestions, not an exhaustive statement of mandatory controls. Effective controls can reduce exposure and improve response; no platform or assessment eliminates fraud or guarantees a regulatory outcome.

Confirm applicability before choosing controls.

Confirm the institution’s license, supervisory notification and applicable counter-fraud instrument. SAMA also publishes separate Counter-Fraud Fundamental Requirements, issued in April 2025 and effective from 13 April 2026. The Rulebook places those requirements under Finance Sector and Payment Systems and Payment Services Providers and states that they replace the Anti-Fraud Rules for Finance Companies. Do not automatically apply the banking framework to every finance or payment institution, or treat the newer requirements as replacing the banking framework.

For the agreed regulatory scope, trace relevant customer and employee activities through identity, applications, data, transactions, suppliers and response processes. Keep anti-fraud governance distinct from cybersecurity governance while identifying shared controls and evidence. For example, an authentication mechanism may support both disciplines, but a secure login alone cannot demonstrate appropriate decisions across onboarding, account changes, payments and suspicious-activity handling. Access to assessment data should be authorized and proportionate to the review.

Turn requirements into implementation and evidence.

Practical examples, not an exhaustive assessment or mandatory product list
Focus area	Implementation examples	Evidence to maintain
Governance and fraud risk	Connect ownership, business exposure and decisions to the relevant counter-fraud requirements.	Approved responsibilities, risk assessments and documented decisions.
Customer-journey safeguards	Review how identity and verification controls operate across important customer activities.	Journey maps, control rationale and approved test evidence.
Detection and data integration	Assess whether useful signals reach the responsible teams with enough context.	Data-flow maps, coverage checks and reviewed detection scenarios.
Response coordination	Define how fraud, cybersecurity and business teams exchange information and act.	Escalation procedures, case records and exercise results.
Effectiveness and remediation	Track control limitations, improvement priorities and validated outcomes.	Evidence index, action register and repeatable review results.

What this looks like in practice.

A customer changes a contact method

Examine how the change affects verification, notifications and subsequent high-risk activities. A practical review follows the sequence across channels rather than testing only whether a login succeeded.

A security alert may indicate account compromise

Review how the security team shares context with the counter-fraud function, who can authorize action and how the decision is recorded. Test the handoff using approved scenarios and protected data.

From readiness assessment to working controls.

Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.

Assess and prioritize

Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.

Design the improvements

Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.

Implement and validate

Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.

Handover and sustain

Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.

Agree concrete deliverables.

A scope and applicability record with assumptions and responsibilities.
A gap/risk register and prioritized remediation roadmap.
Control mapping, architecture recommendations and operating procedures.
An evidence register, agreed validation results and handover material.

Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.

Common questions.

Is counter-fraud readiness the same as SAMA CSF readiness?

No. The frameworks address different responsibilities and outcomes. Shared identity, monitoring and response controls can support both, with separate mappings and accountable functional owners.

Which counter-fraud document applies to finance and payment businesses?

Review the Fundamental Requirements and current institution-specific directions. Confirm the actual license and supervisory requirements rather than assuming that the banking framework applies identically.

Can identity technology solve fraud on its own?

It supports important safeguards, but customer decisions, business processes, monitoring, investigation and response also matter. Evaluate coverage across the actual service and customer journey.

What should a gap assessment produce?

An agreed scope, a requirement and control map, evidence-supported findings and a prioritized implementation plan. Distinguish missing technology from weaknesses in data, ownership, configuration or operational handoffs.

Can readiness work guarantee that fraud will stop?

No. The objective is to identify exposure, strengthen relevant controls and improve evidence and response. Fraud risks evolve, and continuing review remains necessary.

Start with the official sources.

Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.

General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.

Related frameworks and requirements

SAMA Cyber Security Framework →SAMA CRFR →SAMA IT Governance →SAMA F.E.E.R. →Saudi PDPL →

Define the right scope for your organization.

Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.

Discuss your readiness