A note before you read. Dal makes AIN, one of the eight platforms below. Every claim about another vendor comes from that vendor's own website or press release, read on 22 October 2026. Where a page did not say something, we write "not stated on the pages we read". It may still be true, so ask the vendor.
Key takeaways
- A compliance platform for a Saudi firm has to cover six jobs: onboarding (KYC), business checks (KYB), screening, transaction monitoring, case management, and suspicious transaction reports to the General Directorate of Financial Investigation (SAFIU).
- All eight platforms state screening, transaction monitoring and case or alert management on their pages. They differ most on KYB, on regulatory reporting, and on Saudi specifics.
- Two are built in Saudi Arabia: AIN by Dal and FOCAL by Mozn. AIN names Nafith, Makken and the Saudi lists and states that all data is hosted in Saudi Arabia [8]. FOCAL states Arabic-first name matching and a Riyadh headquarters [10][11].
- The enterprise suites (NICE Actimize, Oracle, SAS) cover the full AML cycle for large banks [16][17][20]. Their pages read did not state Arabic, Saudi lists or hosting in the Kingdom.
- The CMA does not approve compliance software. The firm keeps its duties, assesses the risk of a new technology before it goes live, and gives the CMA 30 days' notice before it outsources an important function [2][3].
The short answer
There is no single best compliance platform for every Saudi firm. For a CMA-licensed capital market firm, or a SAMA, REGA or Insurance Authority entity, that wants onboarding, KYB, screening (including Nafith and Makken), monitoring and STRs in one Arabic and English platform hosted in the Kingdom, AIN by Dal is built for that [8][9]. For a bank or large fintech that wants AML and fraud on one Saudi-built platform, compare FOCAL by Mozn [10][11]. For a large bank that wants an enterprise suite, NICE Actimize, Oracle Financial Crime and Compliance Management and SAS Anti-Money Laundering are the established options [16][17][20]. For a digital business that wants onboarding and screening by API, Sumsub and ComplyAdvantage are cloud suites sold worldwide [22][23]. azakaw is an option built for the MENA region that puts onboarding, screening and monitoring in one tool [15].
What a Saudi compliance platform has to do
The rules come from the regulator's texts, not from any vendor. A platform helps a firm meet them; it does not take the duties over.
- KYC and beneficial owners. A CMA-licensed firm's KYC duties come from the Anti-Money Laundering Law and its Implementing Regulation; the CMA rescinded its own AML rules in 2018 [1][2]. They include verifying clients from reliable, independent sources, finding beneficial owners at 25%, PEP checks, a written risk assessment and ten-year records [2]. Our guide to choosing a CMA-compliant KYC platform covers these in detail.
- Screening. CMA-licensed firms screen the UN Security Council lists and the Saudi national sanctions lists at onboarding, on every list update and in a full screen at least every three months, with automated matching that catches transliterations, dual control on alerts and a written reason to close a false positive [4]. CMA-licensed firms also screen the Nafith and Makken order lists [5].
- Transaction monitoring and STRs. Firms monitor transactions and report suspicious ones to the General Directorate of Financial Investigation (SAFIU) [2].
- New technology and outsourcing. A firm assesses the risk of a new technology before it is used [2], and gives the CMA 30 days' notice before it enters into, or materially changes, the outsourcing of an important function [3].
- Data. The Personal Data Protection Law applies to client data. Transfers outside the Kingdom need a permitted ground or a safeguard [6]. Draft amendments open for comment until 5 November 2026 would require personal data to be stored in the Kingdom [7].
- Arabic. Client names, documents and many official texts are in Arabic. Your team and your clients will work in both languages.
The eight platforms at a glance
- AIN by Dal: built in Saudi Arabia for CMA, SAMA, REGA and Insurance Authority entities. All six jobs stated; Nafith, Makken and Saudi lists; data hosted in Saudi Arabia; Arabic and English [8][9].
- FOCAL by Mozn: built in Riyadh, with an office in Dubai. KYC, screening, monitoring, fraud and financial crime reporting; Arabic-first matching [10][11].
- azakaw: built for the MENA region. KYC, KYB, screening, monitoring and case management; management reporting [15].
- NICE Actimize: an enterprise suite for banks. KYC, sanctions screening, suspicious activity monitoring, case management and transaction reporting [16].
- Oracle FCCM: an enterprise suite with a cloud service. Screening, KYC, monitoring, investigations and reporting; Oracle runs cloud regions in Jeddah and Riyadh [17][18][19].
- SAS Anti-Money Laundering: an enterprise suite. Monitoring, due diligence, watchlist screening, case management and regulatory reporting; an AML project at Al Rajhi Bank [20][21].
- ComplyAdvantage Mesh: a cloud suite. Screening, payment screening, monitoring, fraud and alert investigation [22].
- Sumsub: a cloud suite. ID verification, KYB, screening, monitoring, fraud and case management [23][24].
Built in Saudi Arabia
1. AIN by Dal
AIN is Dal's compliance platform, built by former CMA regulators for entities regulated by the CMA, SAMA, REGA and the Insurance Authority [8]. It covers onboarding on a white-labelled portal on the firm's own domain, KYB with a direct Wathq integration and beneficial owners by 25% ownership and by effective control, screening, foreign ID verification, transaction monitoring, and case management with automated STR generation [8].
- What stands out: Nafith and Makken automation with 2,700+ international watchlists and the Saudi lists; transaction monitoring with 13 built-in scenarios, behavioural rules and anomaly detection, wallets and transactions blocked automatically when a threshold trips, and editable STRs "in line with SAFIU recommendations" [8][9]. All data is hosted in Saudi Arabia, in a dedicated database for each client firm, and the platform is fully bilingual [8].
- What to check: AIN is priced per monitored client a year, with a minimum starter plan [8]. Ask for the price at your client count, and for references from firms like yours.
- Best for: CMA-licensed capital market firms and other Saudi-regulated firms that want every module in one Arabic and English platform hosted in the Kingdom.
2. FOCAL by Mozn
FOCAL is the platform of Mozn, headquartered in Riyadh with an office in Dubai [10]. It covers KYC and customer due diligence, customer screening, real-time transaction screening, transaction monitoring, behavioural monitoring, device intelligence and fraud, with "accelerated investigations, and streamlined financial crime reporting" [10].
- What stands out: what Mozn calls "patented Arabic-first AI" for Arabic names, screening against 1,300+ lists [11], and an agreement with STC Bank to deploy FOCAL for financial crime prevention [13]. In January 2026, Chartis Research named Mozn a category leader for both AML transaction monitoring and KYC data and solutions [12].
- What to check: KYB is not named on the pages we read, though its KYC page mentions Wathq, Saudi Arabia's business registry service [14]. Hosting and Nafith and Makken are not stated on the pages we read [10][11].
- Best for: banks and large fintechs that want AML and fraud prevention on one Saudi-built platform.
Built for the region
3. azakaw
azakaw calls itself "The Compliance Operating System" and was named an IDC Innovator in IDC's 2026 report on Middle East regulatory technology providers [15]. It covers digital KYC and KYB with ID and biometric verification and "sanctions, PEPs and negative news", digital onboarding, transaction monitoring with case management and real-time alerts, and corporate compliance with management reporting [15].
- What stands out: onboarding, screening and monitoring in one system, with regulator-specific templates you can use or replace with your own rules [15].
- What to check: Saudi lists, Arabic, hosting and filing STRs with SAFIU are not stated on the pages we read [15].
- Best for: firms across the region that want onboarding and monitoring in one workflow tool.
Enterprise suites
4. NICE Actimize
NICE Actimize's AML suite lists KYC, sanctions screening, screening in KYC, suspicious activity monitoring (SAM), and suspicious and currency transaction reporting (STAR and CTR), with investigation and case management and AI and machine learning built in [16]. Its case studies name global tier 1 banks, full-service banks and fintechs [16].
- What stands out: the breadth of a suite built for large banks, from KYC to transaction reporting [16].
- What to check: Saudi clients, Arabic, Saudi lists, deployment and hosting are not stated on the page we read [16].
- Best for: large banks that want an enterprise AML suite from KYC to reporting.
5. Oracle Financial Crime and Compliance Management
Oracle's cloud service covers "customer screening, KYC/CDD, transaction monitoring, investigations, and reporting", with out-of-the-box AML scenarios, custom scenario design and threshold tuning [17]. Its KYC module routes higher-risk customers into due diligence or enhanced due diligence [18].
- What stands out: one vendor for the full AML cycle, as a cloud service. Oracle runs public cloud regions in Saudi Arabia, in Jeddah and Riyadh [19].
- What to check: the pages we found do not say whether the AML cloud service runs in the Saudi regions, and do not mention Arabic or Saudi lists [17][19]. Ask Oracle to confirm where your data would sit.
- Best for: large banks already on Oracle that want AML on the same stack.
6. SAS Anti-Money Laundering
SAS describes an AML solution that "combines transaction monitoring, AI and machine learning, customer due diligence", with enhanced due diligence, watchlist screening, case management and regulatory reporting on one platform, on a cloud-native architecture [20].
- What stands out: SAS announced an AML project at Al Rajhi Bank, run by a bilingual team at the bank's Riyadh head office and completed in about four months [21].
- What to check: Arabic, Saudi lists and hosting are not stated on the page we read [20]. The Al Rajhi announcement carries no date on the copy we found [21].
- Best for: large banks that want AML analytics, monitoring and case work on one platform.
Cloud suites sold worldwide
7. ComplyAdvantage Mesh
Mesh combines customer and company screening, transaction and payment screening, transaction monitoring and fraud detection, with alert reviews and investigations in the platform and a "regulator-ready audit trail" [22].
- What stands out: its own risk data, with sanctions changes available within minutes, and integration through APIs [22].
- What to check: KYC and KYB onboarding, STR filing, Arabic, Saudi lists and hosting are not stated on the page we read [22].
- Best for: fintechs and payment firms that want screening and monitoring by API.
8. Sumsub
Sumsub's product lines are ID verification, KYB, AML screening, AML transaction monitoring, fraud prevention, case management and the travel rule, and it says 4,000+ clients use it [23]. Its screening covers global and national sanctions lists, PEPs and adverse media [24].
- What stands out: identity verification and screening from one vendor, with a published price for screening from $1.35 per verification [24].
- What to check: STR filing, Arabic, Saudi lists and hosting are not stated on the pages we read [23][24].
- Best for: digital businesses that onboard clients by app.
How to choose
Start from your regulator and your size.
- A CMA-licensed capital market firm. You need investor classification, suitability, Nafith and Makken and the CMA's sanctions rules covered, and a record that answers a CMA inspector [3][4][5]. Shortlist platforms that name these.
- A SAMA-regulated finance company or fintech. Weigh onboarding speed, identity verification, transaction monitoring and automatic blocking, and STRs to SAFIU [2].
- A large bank. Weigh scale, data integration and model governance, and ask each enterprise suite where it would host your data and who would run it locally.
Then ask each vendor to show six things on your own test data: a Saudi list match from alert to closure; an Arabic name in several spellings; where the data sits and how you get it back; an STR drafted for SAFIU; the rule your regulator sets that the platform enforces; and an approval with a maker and a checker in the log.
To see AIN run onboarding, screening, monitoring and an STR in one place, Book a Demo at getdal.sa.
Frequently asked questions
What is the best compliance platform in Saudi Arabia?
It depends on the firm. For CMA-licensed and other Saudi-regulated firms that want every AML and KYC module in one Arabic and English platform hosted in the Kingdom, AIN by Dal covers onboarding, KYB, screening including Nafith and Makken, monitoring and STRs [8][9]. Banks that want AML and fraud together often compare FOCAL by Mozn and the enterprise suites [10][16][17][20].
Does the CMA or SAMA approve compliance software?
The CMA does not approve KYC or AML platforms; the licensed firm keeps its duties when it uses one [3]. The firm assesses the risk of a new technology before using it [2], and notifies the CMA 30 days before outsourcing an important function [3].
Which Saudi compliance platforms are built in the Kingdom?
Of the eight compared here, two: AIN by Dal and FOCAL by Mozn, which is headquartered in Riyadh [8][10].
Which platforms screen Nafith and Makken?
Of the eight, AIN states Nafith and Makken automation on its pages [8]. The others do not mention them on the pages we read. Our guide to Nafith and Makken screening explains what the lists are.
Must a compliance platform host data in Saudi Arabia?
Not under a general rule today. The Personal Data Protection Law allows transfers abroad on permitted grounds or with safeguards [6], and draft amendments open for comment until 5 November 2026 would require personal data to be stored in the Kingdom [7]. AIN states that all its data is hosted in Saudi Arabia [8]; Oracle runs cloud regions in Jeddah and Riyadh [19].
Can one platform file STRs with SAFIU?
AIN generates editable STRs in line with SAFIU's recommendations [9]. NICE Actimize, Oracle and SAS state regulatory or transaction reporting on their pages [16][17][20]. Ask each vendor to show an STR drafted for SAFIU.
What should a CMA-licensed firm look for first?
Investor classification and suitability, the CMA's sanctions screening moments, Nafith and Makken, and records an inspector can follow for ten years [2][3][4][5].
How was this comparison put together?
Dal makes AIN, which is on the list. We read each vendor's own pages and press releases on 22 October 2026, used only what they state, and marked what they do not state. We did not test the platforms ourselves. Ask each vendor to confirm the points that matter to you.
.svg)
.png)
