SAMA Cyber Security Framework (CSF) for Fintechs: What You Need and a Compliance Checklist

WaqiSec Compliance Team · Last reviewed: 2026-09-26

What is the SAMA Cyber Security Framework?

The Saudi Central Bank (SAMA) issued version 1.0 of its Cyber Security Framework on 24 May 2017. It gives regulated financial institutions a common way to identify and address cyber risk. It remains in force and is the reference that SAMA's other rulebooks, licensing guidelines and supervisors point to.

Saudi fintech has grown fast. According to the Financial Sector Development Program, 261 fintech companies were operating in the Kingdom at the end of 2024. For most of them, "show us your CSF compliance" is now a standard question from SAMA, partner banks and investors.

The 4 domains of the SAMA CSF

Maturity levels: why Level 3 matters

The CSF measures each control on a six-level maturity scale:

0. Non-existent
1. Ad-hoc
2. Repeatable but informal
3. Structured and formalized
4. Managed and measurable
5. Adaptive

The minimum expected level is Level 3: structured and formalized. At this level, controls are written down as approved policies and procedures, applied consistently and backed by evidence. This is where most young fintechs fall short: engineering teams often do good security work that is simply not documented.

Does the SAMA CSF apply to your fintech?

• Banks, financing companies, credit bureaus and financial market infrastructure are named directly in the CSF.
• Payment service providers are brought in by SAMA's PSP Regulations. Article 15.6 requires PSPs to "put in place and maintain cyber security requirements in accordance with SAMA's cyber security framework". Article 11.6(d) ties data protection controls to the CSF. The regulations also require business continuity arrangements (Art. 15.5), notification of material outsourcing changes (Art. 15.8) and notification to SAMA within 14 days of events that disrupt payment services (Art. 6.18(a)).
• Insurance companies are now supervised by the Insurance Authority, which became the sector's sole regulator in March 2024. SAMA's existing insurance rules stay in force until the Insurance Authority replaces them, so check with your regulator.

The CSF also requires that cyber incidents rated medium or above be reported to SAMA immediately.

Sandbox and licence applications

If you are entering SAMA's regulatory sandbox or applying for a licence, SAMA's Cyber Resilience Fundamental Requirements (CRFR), issued January 2022, apply to you. SAMA's sandbox guidance notes list the cyber and resilience areas that applicants must address:

• cybersecurity policy, standards and processes;
• cybersecurity regulatory compliance, with the SAMA CSF as the reference;
• vulnerability assessment and penetration testing;
• data privacy compliance and data sovereignty;
• cyber response and business continuity plans (with the SAMA BCM Framework as the reference);
• technology and cyber risk management, with a governance and operational risk matrix;
• security monitoring and incident management;
• change and release management.

Preparing this documentation early is one of the easiest ways to avoid delays in the operational readiness stage.

Other SAMA requirements that sit alongside the CSF

• Business Continuity Management Framework (February 2017): BCM governance, plans and testing.
• IT Governance Framework (November 2021): IT strategy, risk and operations governance.
• Cloud computing: covered under the CSF's third-party domain, including requirements that apply before you adopt cloud services.

SAMA CSF, NCA controls and the PDPL

A SAMA-regulated fintech falls under NCA's ECC-2:2024 only if it owns, operates or hosts critical national infrastructure. Its SAMA obligations apply either way. Every fintech that handles customer data must also comply with the Saudi Personal Data Protection Law, including 72-hour breach notification to SDAIA. And NCA's new NCNICC-1:2025 private-sector controls set the baseline for non-CNI private companies generally. The frameworks overlap heavily, so a single well-structured policy set mapped to all of them saves significant effort.

SAMA CSF checklist for fintechs

• Board-approved cybersecurity strategy and policy
• Cybersecurity function with defined roles, including a CISO or equivalent
• CSF gap assessment against all applicable subdomains, rated by maturity level
• Remediation plan to reach at least Level 3 for every applicable control
• Cyber risk assessment and risk register
• Identity and access management with MFA for privileged and remote access
• Data protection controls aligned with the CSF and the PDPL
• Vulnerability management and penetration testing programme
• Event, incident and threat management, with a SAMA reporting procedure
• Business continuity and disaster recovery plans, tested
• Third-party, outsourcing and cloud security requirements in contracts
• Staff awareness programme with records
• Periodic self-assessment, with evidence kept ready for SAMA review

Related guides

This guide is general information, not legal advice. Always check the official text from the relevant authority before making decisions.