.svg)
A CMA-licensed firm screens its clients, their beneficial owners, the managers and signatories who act for them, and other related parties. It screens them against the UN Security Council lists and the Saudi national sanctions lists [3]. It does this at six set moments, on automated, real-time systems [5][6]. It updates its lists every day and logs each update [7]. A confirmed match means a freeze without delay and a notice to the CMA [8]. Every step leaves a record, kept for at least ten years [9].
The Rules define Sanctions Lists by their source: the mechanisms that apply UN Security Council resolutions. These resolutions cover terrorism, the proliferation of weapons of mass destruction, and the financing of both [3]. A firm screens against the latest Security Council decisions and the national Sanctions Lists [3].
The Rules name the official websites and channels for updates [3]:
All updated lists go into one approved internal list. The firm may also add names from other countries' lists [3].
The Rules do not name every list used in Saudi Arabia. Saudi screening programs often add local lists such as Nafith and Makken. They also add lists from the Ministry of Interior and the Ministry of Finance, and SAMA's shared lists and circulars.
PEP screening is a separate duty. It comes from Article 8 of the Anti-Money Laundering Law, and the CMA explains it in its PEP guideline [4]. The guideline expects reliable screening tools and ongoing adverse media monitoring to identify PEPs [4].
Paragraph 3.5 of the Rules lists six moments for screening. Paragraph 3.6 sets the timing for each [5].
The Rules require robust, highly reliable automated systems that match against the Sanctions Lists in real time [6]. The systems must catch names, aliases, spelling variations, names that sound alike, and transliterations [6]. This matters for Arabic names, which can be written in Latin letters in more than one way.
Manual tools are the exception. A firm may use them only with the CMA's written non-objection, and only if [6]:
The firm must document its matching method. It must also test its screening regularly, including for missed matches and indirect matches [6].
The firm updates its internal lists as soon as a new listing is announced. It also checks and updates them every day through the official websites and channels [7]. It keeps a log of when each update was received, applied and confirmed in its internal systems [7].
Each alert needs a record too. At a minimum, the record shows [7]:
Two qualified staff review each alert, as a dual control [8]. With enough grounds, they may close a false positive with a written reason. Otherwise they escalate it directly to the senior officer for targeted financial sanctions [8].
If that officer finds enough grounds for a link to a listed person, the funds are frozen without delay [8]. The Rules define "without delay" as within hours of the announcement that a person was listed [8][11]. Once a match is confirmed, the firm may not wait for a committee, a legal review or senior management approval [8].
The freeze comes without prior notice to the client. It covers funds the listed person owns, controls or holds, directly or indirectly. That includes the funds of companies they own or control, and funds held jointly with others [8]. The firm then notifies the CMA by email at CMA-AML@cma.org.sa [8].
No one may tell the client or any third party about a match, a planned freeze or an ongoing review. The exceptions are reports to the CMA and the Financial Intelligence Unit [8]. Signs of sanctions evasion go to the Financial Intelligence Unit as a suspicious activity report [8].
Delisting moves at the same speed. When a UN sanctions committee removes a name, the firm lifts the freeze without delay, unless told the person stays designated under Resolution 1373. Names frozen on the competent authorities' instructions stay frozen until the CMA instructs [8]. The firm then informs the CMA in writing immediately [8].
Once a year, an independent auditor, internal or external, tests the firm's policies, procedures and controls under the Rules. The results go to the board or senior management, which acts on any gaps [9].
The records to keep include list directives and updates, alerts and their results, event-based screening, and freezes and unfreezes. They also include reports to the CMA, suspicious activity reports, reviews of screening systems, board reports and training [9]. Records must be secure, retrievable immediately on request, and indexed by date, type of action, and client or transaction. The firm keeps them for at least ten years from the end of the transaction or action [9].
Ayn is Dal's compliance platform. As described on getdal.sa, it maps to each point like this:
Some duties stay with your people in any system: confirming a match, freezing the funds, notifying the CMA, and arranging the annual test. As the Rules put it, relying on screening tools is not a guaranteed assurance of compliance [7].
To see how Ayn handles each of the six moments, Book a Demo at getdal.sa.
The CMA Board issued them on 22 December 2025 by Resolution 4-163-2025. They set the minimum sanctions duties of every CMA-supervised financial institution. They apply from their publication on the CMA's website, and they replaced the CMA's earlier circulars on Security Council resolutions [1][2].
At least once every three months [5]. This is in addition to the other five moments, such as screening on every list update.
Only with the CMA's written non-objection [6]. Even then, trained staff must run the process, it must cause no delay, and every record and decision must be documented. Otherwise, the Rules require automated, real-time matching.
Within hours of the announcement that a person was listed or delisted [8][11]. Once a match is confirmed, the freeze cannot wait for a committee, a legal review or senior management approval [8].
No. PEP screening comes from Article 8 of the Anti-Money Laundering Law and the CMA's PEP guideline [4]. Adverse news links the two: it is a trigger event under the TFS Rules and part of PEP screening [4][5].
Yes, with conditions [10]. After it confirms the match is false, a firm may add the name to an internal whitelist. The board or senior management reviews and approves the list periodically. The list still goes through the quarterly, post-update and event-based screens.
At least ten years from the end of the transaction or action [9]. Records must be retrievable immediately on request.
.png)
