Choosing a CMA-compliant KYC platform in Saudi Arabia

Key takeaways

• The CMA does not certify or approve KYC platforms. The licensed firm keeps every duty, even when software or a vendor does part of the work [3].
• A CMA firm's KYC duties come from the Anti-Money Laundering Law and its Implementing Regulation. The CMA rescinded its own AML rules in November 2018 and points firms to that law [1][2][3][4].
• The CMA lets firms open accounts "by technology means", with due diligence based on risk. No CMA text names a particular identity service [4].
• Fourteen checks cover what matters, from verification and beneficial owners to suitability, expiry, records, hosting and vendor exit.
• A firm assesses the risk of a new technology before using it, and notifies the CMA 30 days before outsourcing an important function [2][3].

The short answer

A CMA-compliant KYC platform is one that lets a capital market institution meet its own duties, and prove it. Those duties sit in the AML Law and its Implementing Regulation, the CMA's Capital Market Institutions Regulations and Investment Accounts Instructions, and the CMA's rules on sanctions, PEPs and beneficial owners [2][3][4][5][6][7]. They include verifying clients from reliable, independent sources, finding beneficial owners, screening for PEPs and sanctions, classifying clients, assessing suitability, refreshing data over time and keeping records for ten years. The CMA does not approve platforms, and the firm stays responsible when it uses one [3]. So the real test is simple: can the platform show an inspector how each duty was met, for each client?

Where a CMA firm's KYC duties come from

The CMA once had its own Anti-Money Laundering and Counter-Terrorist Financing Rules. On 21 November 2018, the CMA Board rescinded them when it approved amended Investment Accounts Instructions [1]. Guides that still cite those rules are out of date.

Today the duties come from these texts:

• The AML Law and its Implementing Regulation. Issued by Royal Decree M/20 in 1439H, they set customer due diligence, beneficial owners, PEPs, ongoing monitoring and records [2]. The CMA's regulations tie every capital market institution to them: before any securities business with a client, the firm must meet all its obligations under the AML Law [3]. The Investment Accounts Instructions say the same for opening an account [4].
• The Capital Market Institutions Regulations. Amended in January 2026, they set client classification, the Know Your Client form, suitability and outsourcing [3].
• The Investment Accounts Instructions. Also amended in January 2026, they set how accounts are opened, how client data is updated, and what happens when an ID expires [4].
• The CMA's newer instruments. The Targeted Financial Sanctions Implementation Rules of December 2025, the guideline on politically exposed persons (PEPs) and the supervisory guidance on beneficial ownership [5][6][7].

What "by technology means" allows

A capital market institution may open an investment account by technology means. It must carry out due diligence according to the level of risk and any requirement the CMA specifies [4]. Every verification must use documents, data or information from a reliable and independent source [4]. For a Saudi client, the firm obtains and verifies the client's valid national ID card information [4].

The CMA texts do not name a channel for this. In practice, firms in Saudi Arabia verify identity through national services such as Nafath, the national digital identity app from the National Information Center [8], and Yakeen, Elm's service for verifying identity data electronically, which SAMA has allowed banks to use since 2015 [9]. For companies, firms pull official commercial registration data, for example through Wathq. These are market practice, not CMA requirements.

One duty applies before any platform goes live. The AML Implementing Regulation requires a firm to assess the risk of a new delivery mechanism or new technology before it is launched or used [2]. In our reading, a new digital onboarding platform falls under this.

Fourteen checks before you choose a platform

Each check says what the rules require (rule) and what a good platform adds (good practice).

1. Verification from reliable, independent sources. Rule: verify each client and the people acting for them from reliable, independent documents, data or information, before or during the start of the relationship [2][4]. If due diligence cannot be completed, the firm does not open the account and considers a suspicious transaction report [2]. Good practice: connections to national services such as Nafath and Yakeen, and to official commercial registration data.
2. Risk-based digital onboarding you can document. Rule: accounts opened by technology means with due diligence based on risk [4], and a risk assessment of the new technology before use [2]. Good practice: a vendor that gives you its data flows, controls and hosting details for that assessment.
3. Beneficial owners. Rule: for a company client, identify the natural persons who own or control 25% or more; if no one does, or there is doubt, the person who controls it by other means; as a last resort, the senior managing official. Take reasonable steps to verify them and understand the ownership and control structure [2]. The CMA's guidance counts indirect holdings by multiplying the percentages down each chain and adding each person's holdings [7]. Good practice: an ownership tree with the evidence for each owner.
4. A risk score you can explain and change. Rule: a written, current risk assessment that covers customers, countries, products, services, transactions and delivery channels; enhanced due diligence where risk is higher; enhanced measures for high-risk countries [2]. Good practice: weights your compliance team can change, and a history of every score change.
5. PEP checks. Rule: "appropriate systems" to find whether a client or beneficial owner is, or becomes, a PEP, in the Kingdom or abroad, including senior posts in international organisations, family members to the second degree and close associates [2]. For foreign PEPs, and for domestic PEPs where the risk is higher: senior management approval, the source of wealth and the source of funds, and enhanced ongoing monitoring [2][6]. The CMA's Know Your Client form asks the PEP question [3].
6. Sanctions screening. Rule: screen clients, beneficial owners and related parties against UN Security Council decisions and the Saudi national sanctions lists, at onboarding, on every list update, and in a full screen at least every three months. Matching must be automated and real-time, and catch aliases, spelling variations and transliterations. Alerts need dual control, and closing a false positive needs a written reason [5]. Good practice: other global and Saudi lists, such as the Nafith and Makken order lists, and adverse media.
7. Client classification and the KYC form. Rule: classify each client as retail, qualified or institutional, in one category only, with enough information recorded to support it. Collect at least what the Know Your Client form in Annex 5.3(A) asks. A client who refuses the information cannot be served [3].
8. Suitability. Rule: judge advice and transactions against eight factors, including the client's knowledge, financial standing, objectives and time horizon, and give the client a suitability report first. If a client insists on an unsuitable transaction, a registered person independent of the report must review the client's written acknowledgment [3]. Automated suitability needs the CMA's approval and standing procedures to check its results [3].
9. Refresh and ID expiry. Rule: keep data current through reviews based on risk [2]. Update client information when it changes, when it expires, or at the end of a period set by risk, and review the need for updates at least once every five years [3][4]. Warn clients at least 90 days before their documents expire, and freeze all their accounts on the expiry date if they have not updated them [4]. Good practice: automatic reminders and expiry alerts.
10. Approvals with a maker and a checker. Rule: senior management approval for PEP relationships [2], dual control on sanctions alerts [5], and independent review of an insisting client's acknowledgment [3]. The CMA's cybersecurity guidelines ask for separation of duties, backed by an approved matrix of authorities [13]. Good practice: a maker and a checker on every risk, suitability and onboarding decision.
11. Records, reports and an audit trail. Rule: keep due diligence records, account files and copies of ID documents, including any analysis, for at least ten years after the relationship ends, in a form that lets the authorities reconstruct what happened [2]. Keep an electronic record that links each account to its opening documents [4], and a record of every classification and all KYC information [3]. Good practice: a time-stamped log of who did what, and a version history that never overwrites.
12. Arabic. Rule: sanctions matching must handle transliterations and spelling variations [5]. The official texts of the CMA's regulations are in Arabic [3][4]. Good practice: an Arabic interface for your team, Arabic name matching, and Arabic onboarding for your clients.
13. Hosting and data protection. Rule: the Personal Data Protection Law (PDPL) applies to the personal data a KYC platform holds. Transfers outside the Kingdom need a permitted ground or an appropriate safeguard, such as SDAIA's standard contractual clauses, and in some cases a risk assessment [11]. Today there is no general rule that personal data must be stored in Saudi Arabia, but draft amendments to the PDPL's Implementing Regulation would add one. They are open for comment from 6 October to 5 November 2026 [12]. The NCA moved its own data localisation controls to SDAIA's National Data Management Office in 2024 [10]. Good practice: hosting in the Kingdom, a separate environment for each client firm, and encryption.
14. Vendor governance and exit. Rule: outsourcing does not reduce the firm's obligations. The firm must assess the vendor, set documented limits and confidentiality standards, plan for continuity, be able to get any information within ten days, and take remedial action when needed [3]. It must notify the CMA 30 days before entering into, or materially changing, the outsourcing of an important function [3]. Good practice: contract terms for returning your data and deleting it securely at the end of the service, as the NCA's controls ask of providers in their scope [10].

Questions to ask a vendor

Ask each vendor to show, not tell. A short demo on your own data answers more than a feature list.

• Show a client verified end to end, with the source of each check and the record it leaves.
• Show a company client's ownership tree and how each beneficial owner was found.
• Show how a risk score was reached for one client, and who changed it and when.
• Show a sanctions alert from match to closure, with both people who handled it.
• Show what happens 90 days before an ID expires, and on the day it does.
• Show the log an inspector would see for one client, ten years from now.
• Show where the data is hosted, who can reach it, and how you get it back if you leave.

How Ayn covers each point

Ayn is Dal's compliance platform. As described on getdal.sa, it covers the checks like this:

• Onboarding. A white-labelled onboarding portal on your firm's own domain, with a no-code flow builder, and onboarding workflows, risk rules and reporting templates aligned to CMA, SAMA, REGA and IA requirements [14][15].
• Businesses and owners. Ayn verifies Saudi businesses directly from Wathq, surfaces every UBO across layered ownership, and covers both tests: 25% ownership and effective control [15].
• Risk, suitability and EDD. Every client is risk-scored during onboarding, with suitability and qualification in the same flow. High-risk answers route the client into enhanced due diligence automatically [14]. Country risk is scored automatically every week [15].
• Approvals. First-level and second-level approvers sign off before a profile goes live [14].
• Screening. 2,700+ international watchlists, Nafith, Makken and adverse media across 600K+ sources, with continuous screening, an Arabic matching algorithm and AI-powered match recommendations [15].
• Refresh and records. ID and KYC expiry alerts fire before records go stale. Every profile keeps its full KYC version history, and nothing is overwritten [14]. Full auditable logs [15].
• Data and language. All data is hosted in Saudi Arabia, in a dedicated database for each client. The platform and every client-facing experience are fully bilingual, Arabic and English [15].

Some duties stay with your people in any system: setting your risk appetite, judging control when no one reaches 25%, approving PEPs, and deciding when a case needs a report.

To see Ayn onboard a client from first form to approval, Book a Demo at getdal.sa.