This is where ethics and audit discipline meet the customer
This is the closing piece of SCI’s three-part GRC Foundations series. Part 1 — Ethics & Anti-Corruption Compliance established the legal and ethical foundation; Part 2 — Internal Audit under IIA Standards showed how independent assurance tests whether controls work. The operational question now is the one compliance teams face every day: can the bank identify the customer, understand who ultimately owns or controls the relationship, assign the right risk level, apply the right depth of due diligence, and keep that understanding current after onboarding?
For professionals actively choosing training in this area, SCI’s KYC & Customer Due Diligence (CDD) Compliance course is designed for KYC/onboarding specialists, CDD analysts, AML/CFT officers, MLROs, financial-crime analysts, sanctions-screening professionals and transaction-monitoring investigators. The course has six modules, is available in Arabic and English, and SCI describes the award as a certificate of completion after the required assessments; the final assessment requires 70% to pass. If that matches your role, review the curriculum now and compare it with the gaps in your own onboarding process.
SAMA’s banking rules make the operating objective clear: banks should know who the customer is, understand the nature of the customer’s activities and transactions, assess the risk the customer poses, and maintain procedures that are reviewed and updated according to risk. That makes KYC/CDD a continuing control system, not a document-collection event.
Source: SAMA Rulebook — Application of KYC Principle and AML/CFT Requirements
Risk-Based Customer Categorization: Low, Standard, and High Risk
SAMA requires a risk-based approach, but it does not prescribe one universal three-label taxonomy for every bank. The table below is therefore a practical operating model: “lower risk” maps to cases where simplified measures may be appropriate, “standard risk” represents normal baseline CDD, and “higher risk” requires EDD and stronger monitoring. A bank should use its own approved methodology, products, customer base, delivery channels and geographic exposure to define the exact scoring rules.
|
Practical tier |
When it may fit |
CDD depth |
Approval/monitoring |
|---|---|---|---|
|
Lower risk |
Risk assessment supports a lower ML/TF exposure and there is no suspicion |
Simplified measures may be proportionate; core identity and relationship understanding still remain |
Risk-based review; simplified monitoring only where justified |
|
Standard risk |
No material higher-risk indicators; customer profile is understandable and evidence is coherent |
Baseline CDD: identify and verify customer, understand purpose/nature, identify beneficial owner where applicable, assess risk and screen |
Normal approval route; ongoing monitoring against expected activity |
|
Higher risk |
PEP exposure, complex ownership, high-risk geography, unusual/inconsistent activity or other material risk factors |
Enhanced CDD: additional evidence, source information, deeper ownership/control review and other measures proportionate to risk |
Senior-management approval where required; enhanced and more intensive monitoring |
Source: SAMA Rulebook — Due Diligence Measures
Source: SAMA Rulebook — Enhanced Due Diligence Measures
Source: Implementing Regulation to the Anti-Money Laundering Law — risk-based CDD
Infographic: a practical three-tier customer-risk model for scaling CDD intensity.
Source: SAMA Rulebook — risk-based due diligence and EDD — Operational labels are illustrative, not a SAMA-prescribed taxonomy.
Standard vs. Enhanced Due Diligence: What Triggers Each
Standard CDD is the baseline control. SAMA’s due-diligence guidance requires the institution to identify and verify the customer using reliable independent sources, understand who is acting on the customer’s behalf, identify the beneficial owner, understand the relationship, and scale the depth of checks to risk. CDD is required before a new business relationship, and it must be revisited when previously obtained information becomes doubtful, suspicion arises, or activity is inconsistent with the known customer profile.
Source: SAMA Rulebook — Due Diligence Measures
EDD is not simply “more documents.” It is a stronger investigation and approval process for higher-risk relationships. SAMA’s in-force EDD guidance points to risk factors such as complex organizational structures, high-risk countries, PEP exposure and other customer or relationship factors that increase ML/TF risk. Additional measures may include deeper information on occupation or business, source of funds/income, assets and expected transactions, extra documents, and — for high-risk customers — senior-management approval before establishing or continuing the relationship.
Source: SAMA Rulebook — Enhanced Due Diligence Measures
Source: SAMA Rulebook — Politically Exposed Persons
A practical trigger list for escalation should include: unresolved identity inconsistencies; unclear or unnecessarily complex ownership; a customer or beneficial owner identified as a PEP; material exposure to higher-risk jurisdictions; source-of-funds explanations that do not fit the profile; activity inconsistent with the stated purpose; doubts about documents or previously collected information; sanctions or adverse screening alerts; and information that another institution refused the customer for an ML/TF-related reason. The presence of a trigger does not automatically prove wrongdoing; it means the bank must apply the deeper process required by its risk framework.
Source: SAMA Rulebook — Enhanced Due Diligence Measures
For a deeper Saudi-specific discussion of PEP escalation, SCI’s PEP compliance guide explains why political exposure changes the due-diligence and monitoring decision without making the customer automatically suspicious.
Identifying the Ultimate Beneficial Owner (UBO): A Step-by-Step Method
Beneficial ownership is where a corporate onboarding file often becomes difficult. The legal customer may be a company, but SAMA’s guidance requires the financial institution to identify the natural person who ultimately owns or controls it, directly or indirectly, and to verify that person using appropriate independent evidence.
Source: SAMA Rulebook — Beneficial Owner
-
Verify the legal entity itself. Confirm its legal name, form, proof of existence, registered address, powers, directors or senior managers, and the authority of the person acting for it.
-
Map the ownership and control structure. Use corporate records such as the commercial register, articles or memorandum of association, shareholder registers and other reliable corporate information to trace each ownership layer.
-
Identify natural persons at the 25% threshold. SAMA’s guidance says the institution should identify the natural person who owns or controls 25% or more of the legal person and take sufficient measures to verify that identity.
-
Do not treat 25% as a safe harbour. SAMA explicitly notes that a person holding a 25% controlling share may not necessarily be the beneficial owner. If no one reaches the threshold, or the threshold owner is not the true controller, trace other control mechanisms, owners below 25% where they exercise real control, or the relevant senior-management person.
-
Verify through reliable and independent evidence. Do not rely mainly on a customer’s written declaration. The file should show how ownership and control were understood and checked.
-
Use current Saudi data sources where applicable. In March 2026, SAMA issued an in-force circular on technical integration with the Ministry of Commerce “Wathq” service for access to disclosed UBO data of registered companies.
-
Screen the UBO and relevant parties. PEP and targeted-financial-sanctions checks should extend beyond the visible customer name to beneficial owners and other related parties where the rules require it.
-
Record the reasoning. Keep the ownership chart, source documents, verification evidence, exceptions, unresolved questions, reviewer decision and the basis for concluding who the UBO is.
Source: SAMA Rulebook — Beneficial Owner, clauses 3.17-3.21
Source: SAMA Rulebook — 2026 Wathq UBO verification circular
Source: SAMA Rulebook — Targeted Financial Sanctions screening procedures
SCI’s corporate e-KYC and UBO audit-readiness article provides additional context on how digital onboarding evidence and ownership verification fit together.
Infographic: trace legal ownership and control until the natural-person UBO is verified.
Source: SAMA Rulebook — Beneficial Owner — The 25% threshold is a starting point; actual control must still be understood.
Ongoing Monitoring After Onboarding
“Ongoing” means the customer file remains a living risk baseline after the account opens. The bank should monitor and scrutinize transactions and data so that activity remains consistent with what it knows about the customer, the customer’s business and risk profile, and — where necessary — source of funds. The information collected through due diligence should also stay current and relevant, with particular attention to higher-risk relationships.
Source: Anti-Money Laundering Law — Article 13
Source: Implementing Regulation — ongoing due diligence
For banks specifically, SAMA’s account-monitoring rules state that manual transaction monitoring is not sufficient: banks should use appropriate electronic systems to identify suspicious or incorrect behaviour and continuously monitor transactions. The monitoring system should fit the bank’s risk profile and connect to core systems, with manual controls used where integration limitations exist.
Source: SAMA Rulebook — On-Going Monitoring of Accounts and Transactions
In practice, monitoring should ask two questions at the same time: “Does the transaction make sense against the expected profile?” and “Has anything changed that means the profile itself must be refreshed?” Trigger events can include a material change in ownership or control, a new high-risk country in the relationship, a new transaction pattern, a higher customer risk rating, a sanctions-list update, new PEP status, adverse information, or doubts about the accuracy of previously collected data.
Source: SAMA Rulebook — 2025 Targeted Financial Sanctions screening triggers
Source: SAMA Rulebook — Due Diligence Measures
The operational cycle is therefore: compare behaviour with the baseline; investigate anomalies; refresh data when needed; re-score risk; apply EDD or management approval if the risk rises; escalate suspicion through the bank’s AML process; and preserve a defensible record of what was reviewed and why the decision was made.
Infographic: ongoing monitoring compares customer behaviour with the onboarding baseline and reacts to risk-changing events.
Source: SAMA Rulebook — ongoing monitoring and screening triggers
Documentation Checklist a Compliance Officer Can Follow
A defensible onboarding file should let another qualified reviewer reconstruct the decision without relying on the relationship manager’s memory. The exact evidence varies by customer type and risk, but the following sequence gives a practical file structure:
1. Customer identity evidence: verified identifying information from reliable independent sources, with dates and verification method.
2. Legal-person evidence where applicable: legal form, proof of existence, registered address, directors/senior management and principal place of business.
3. Authority evidence: proof that any representative, signatory or person acting for the customer is authorized, plus identity verification for that person.
4. Purpose and intended nature: why the relationship is being opened, expected products, business activity, expected transaction types/volumes and relevant geographic exposure.
5. Beneficial ownership file: ownership/control chart, source documents, identified natural-person UBO(s), verification evidence and the reasoning used when the 25% threshold did not identify the real controller.
6. Customer risk assessment: risk factors considered, score or rationale, final risk category, reviewer and date.
7. Screening evidence: sanctions and PEP screening results for the customer, beneficial owners and other relevant parties, including how alerts were resolved.
8. EDD evidence where triggered: additional identity/business information, source of funds or wealth where applicable, extra documents, site visit or other enhanced measures, and senior-management approval where required.
9. Onboarding decision: approval, rejection, restriction or escalation; unresolved exceptions; compensating controls; responsible approver; and decision date.
10. Ongoing-monitoring and refresh plan: review frequency or triggers, monitoring expectations, data-update actions and escalation path. Keep CDD and transaction records for the legally required retention period; the AML Law sets a minimum of ten years for specified records.
Source: SAMA Rulebook — Due Diligence Measures
Source: SAMA Rulebook — Beneficial Owner
Source: Anti-Money Laundering Law — record keeping and ongoing monitoring
SCI’s existing CDD gaps article can be used as a companion diagnostic when reviewing files for missing identity, ownership, purpose or risk evidence.
What Happens When CDD Fails
The first consequence is operational: if an institution cannot comply with required due-diligence obligations, the Implementing Regulation says it may not open the account, establish the business relationship or carry out the transaction. For an existing relationship, it should terminate the relationship and, in all cases, consider whether a suspicious transaction report is required. That is why unresolved identity or beneficial-ownership questions cannot be treated as minor missing paperwork.
Source: Implementing Regulation to the Anti-Money Laundering Law — clause 7/8
The second consequence is supervisory. Under Article 25 of the Anti-Money Laundering Law, a supervisory authority may impose measures for failure to comply with the law, implementing regulation, or related decisions and circulars. The menu includes warnings, compliance orders, periodic remediation reporting, a monetary fine of up to SAR 5 million per violation, employment bans, restrictions or replacement of directors or management, suspension or restriction of activities, and suspension, restriction or revocation of a licence. These are administrative/supervisory consequences; they should not be confused with the separate criminal penalties that apply when a person actually commits the offence of money laundering.
Source: Anti-Money Laundering Law — Article 25
SAMA’s public supervisory reporting material also tracks concrete KYC outcomes such as accounts frozen because documents or information are incomplete and accounts closed after problems verifying the banking relationship. That is not a published bank-by-bank enforcement finding, but it shows that incomplete KYC files are explicitly monitored as a supervisory control outcome. No granular official SAMA page naming individual banks for CDD audit findings was used in this draft.
Source: SAMA Rulebook — supervisory reporting fields for KYC file completeness
GRC Foundations: Part 3 of 3
This article closes SCI’s three-part GRC Foundations series. Part 1 covers Ethics & Anti-Corruption Compliance; Part 2 covers Internal Audit under IIA Standards; Part 3 applies those principles to the customer-facing KYC/CDD workflow.
Conclusion
A strong Saudi-bank onboarding process does more than collect an ID and assign a customer number. It establishes a defensible understanding of who the customer is, why the relationship exists, who ultimately owns or controls it, what activity should look like, how much risk the bank is accepting, and what evidence will prove the decision later.
The practical sequence is simple to remember even when the cases are complex: verify the customer, understand the relationship, identify the UBO, classify risk, apply the right CDD depth, screen relevant parties, document the decision, then keep monitoring after onboarding. Ethics tells the organization what responsible conduct looks like; internal audit tests whether the control system works; KYC/CDD is where that discipline becomes visible at the customer level.
If you are now choosing structured training for this work, the KYC & Customer Due Diligence (CDD) Compliance course covers customer identification, beneficial ownership, risk classification, EDD, screening, transaction monitoring, governance and audit readiness in six modules. SCI describes the award as a certificate of completion after the required assessments. Review the curriculum against your role and your team’s current onboarding gaps before enrolling.
