Governance of Banks and Financial Institutions: Principal Rules under SAMA Frameworks | Nova Legal

The Legal Framework: Who Regulates the Governance of Banks and Financial Institutions in Saudi Arabia?

The legal framework begins with the Saudi Central Bank Law (M/36) which defines the financial institution as "any person subject to the supervision, oversight and regulation of the Bank, whether of a natural or juridical nature", and decides in its fourth article that among the tasks of the Bank is "supervision and oversight of the financial institutions in accordance with the relevant laws" and "issuance of the regulations and instructions related to the financial institutions and their businesses", powers upon which the "Rulesbook" published by SAMA was based, from which the section "Governance of Financial Institutions" available on the page of the governance of financial institutions in the Rulesbook.

And upon this basis were issued the Principal Governance Rules for Financial Institutions Subject to the Supervision and Oversight of the Saudi Central Bank pursuant to Circular No. (42081293) dated 21/11/1442H corresponding to 30/6/2021AD, and the Rules clarify in their general provisions that they "aim at setting the minimum requirements that would enhance the effective management of the financial institutions, and directing their financial and non-financial resources towards achieving their strategic objectives, and maintaining their stability", and confirm that the effective governance system "requires independence and separation of the position of the chairman of the board of directors from the position of the chief executive officer", and that the Rules "do not prejudice the requirements imposed on the financial institutions pursuant to the other relevant laws, regulations and instructions".

And the Rules are read alongside the related governance instructions that they enumerated in their text, namely: the Principles of Conduct and Business Ethics in Financial Institutions, and the Compliance Principles for Banks and Commercial Lenders, and the Requirements for Appointment to Leadership Positions in Financial Institutions, and the Shariah Governance Framework for Local Banks and Lenders, and the Shariah Governance Instructions in Financing Companies, all of which are published in the section of the governance of financial institutions in the Rulesbook of the Central Bank. The Rules also refer to the international interest in corporate governance, and attribute the foundations upon which they were based to the reference organizations: the Basel Committee on Banking Supervision (BCBS), the Organisation for Economic Co-operation and Development (OECD), the Islamic Financial Services Board (IFSB), the World Bank (WB), and the Committee on Payments and Market Infrastructures (CPMI).

And the important distinction between two sources of governance in the one entity is recalled here: for if the institution was a listed or non-listed joint stock company, it remains subject -without prejudice- to the provisions of the Companies Law and the governance regulations issued by the Capital Market Authority or the Ministry of Commerce as the case may be, however the special texts on the financial governance imposed by the Central Bank take precedence over the mere general practices in their specialized scope, and the Rules remain in this regard explicit that they do not prejudice the other laws, regulations and instructions, but rather all of them are read together.

The Scope of Application and the Degree of Bindingness: Banks Mandatorily and the Rest of the Institutions as Guidance

Article Three (Scope of Application) of the Principal Governance Rules determines the rule of bindingness in two parts: the first is that the Rules "apply mandatorily to the local banks and lenders, the financing companies and the real estate refinancing companies"; and the second is that "taking into account what the relevant laws and regulations provided as to its mandatory nature, these Rules apply as guidance to the credit information companies, the payment and financial technology companies, the exchange companies and institutions, the micro or micro-financing consumer financing companies, the companies supporting the financing activity, the companies registering the financial leasing contracts, and the debt crowdfunding companies", with the note that the exchange companies and institutions are subject "to the provisions contained in the governance controls of the exchange sector" mandatorily, and the Central Bank may "at any time" apply all or some of the provisions of the Rules to the institutions guided by them.

And the scope of bindingness has expanded by a subsequent circular mentioned in the margin of the official text: pursuant to Circular No. (472039139) dated 9/7/1447H corresponding to 29/12/2025AD, "it was decided the obligation of all the financing companies and the payment services companies to comply with the Principal Governance Rules for Financial Institutions Subject to the Supervision of the Saudi Central Bank, no later than 9/7/1448H". Which means the transformation of the financing and payment services companies from the guidance framework to the mandatory framework within a predetermined period, and it is a development that requires those companies to align their foundational systems and internal policies with the Rules before the expiry of the period.

And it is observed that the degree of bindingness in the Rules differs in nature from the regulations of purely guidance nature; for the Rules were formulated in most of their provisions in a decisive form ("must", "may not", "is required") in the mandatory scope, and left some provisions in a preference form ("is preferred") as best practice provisions, with mandatory margins specific to the banks and lenders such as those related to the number of members (nine to eleven) and the collection of the audit committee members from the independents, and the Rules decide in their second article that among the instructions related to them are those that must be complied with "as the case may be" such as the requirements for appointment to leadership positions and the Shariah governance framework, and they are mandatory instructions in their scope.

The Qualifications of the Members of the Board of Directors and Their Required Attributes

Principle One of the Principal Governance Rules (Qualifications of the Board Members) opens with a fundamental rule: "the members should be qualified to perform the businesses entrusted to them, and have a clear understanding of the role required of them, and the ability to take the decision impartially and objectively without any external influence from within the financial institution or outside it", and adds two organizational conditions: that the "curricula vitae of the members be available to the public; so that the stakeholders can measure their competence and their ability to perform their tasks effectively", and that the member be "of professional competence, with various practical, administrative skills and experiences, and appropriate personal attributes especially honesty and integrity".

And the Rules stipulate five essential attributes of the member, namely: the leadership represented in "enjoying leadership skills enabling him to delegate the powers which stimulates the performance, and applying the best practices in the effective management, and instilling the professional values and ethics"; and the competence which "is reflected by the level of education, experience, skills and the desire to continue learning"; and the guidance by enjoying "technical and administrative capabilities, and speed in taking the decisions, and absorbing the technical requirements related to the workflow, and the ability for the strategic guidance, the long-term planning, and the clear future vision"; and the financial knowledge with "the skills of reading and understanding the financial statements, reports and the ratios used to measure the performance"; and the physical fitness that the member not have "a health impediment preventing him from practicing his tasks and competencies".

And the Rules also require in the member three behavioral attributes: the honesty that his relationship with the financial institution be "an honest professional relationship, disclosing to it any relevant information before executing any transaction or contract with the financial institution or one of its subsidiary companies"; and the loyalty by avoiding the dealings that involve a conflict of interest and ensuring the fairness of the dealings; and the care and attention by performing the duties effectively, and practical obligations follow from this last attribute that the Rules stipulate literally: attending the meetings of the board regularly and not being absent without excuse, and taking the decisions "based on complete information and in good faith", and not exempting the member from the responsibility "if he refrained from voting without clarifying his opinion on the decision subject of the voting", and developing the knowledge, and ensuring the inclusion of the important topics in the agenda of the board, and the executive member providing comprehensive information to the board when requested.

The Formation of the Board of Directors: The Number, the Terms, the Chairmanship, the Quorum and the Independence Impairments

Article Seven of Principle Two (Formation, Appointment and Board Affairs) regulates the construction of the board with decisive rules: that the articles of association determine the number of the members "in proportion to its size and the nature of its businesses" provided that "the number of the members should not be less than five, nor exceed eleven members", and that "the number of the independent members should not be less than two members, or a third of the board members, whichever is greater", and that "the number of the executive members should not exceed two". And the Rules allocate in their margins to the banks and lenders a higher rule: "it should not be less than nine, nor exceed eleven members, in accordance with the followed best practices".

And Article Eight decides that "the general assembly elects the board members for the term provided in the articles of association of the financial institution; provided that it does not exceed three years, and they may be re-elected unless the articles of association of the financial institution provide otherwise", and Article Ten obliges the members "to choose a non-executive member to chair the board and another as his deputy, taking into account that the chairman and his deputy not practice any of the tasks of the executive management", with the preference of the independence of the chairman of the board in the banks and lenders. And a fundamental control is added to that in Article Twelve: "the prior written non-objection of the Saudi Central Bank must be obtained before nominating any member of the board and the committees emanating from it, or appointing any of the occupants of the leadership positions, in accordance with the relevant instructions of the Saudi Central Bank", which links the formation of the board directly to the licensing authority of the Saudi Central Bank.

"The number of the members should not be less than five, nor exceed eleven members" and "the number of the independent members should not be less than two members, or a third of the board members, whichever is greater" and "the number of the executive members should not exceed two" - Article (7) of Principle Two of the Principal Governance Rules (Rulesbook of the Saudi Central Bank)

And the Rules control the board memberships with four cumulative rules: the first in Article Thirteen: "the member of the board may not hold the membership of the board of directors of a similar financial institution operating inside the Kingdom"; and the second in Article Fourteen: "the member may not hold the membership of the board of directors of more than five joint stock companies listed on the market at the same time"; and the third in Article Fifteen: "the service of the member should preferably not exceed more than twelve continuous or intermittent years"; and the fourth in Articles Sixteen and Seventeen relating to the disclosure of the conflict of interest at the nomination and at the time of the membership, with "the commitment not to participate in the voting on the decision taken in this regard". And added to them is the confidentiality obligation provided in Article Eighteen, and the orientation program of the institution required to be provided to each member in Article Nineteen, and the commitment of the members to be familiar with the relevant laws, regulations and instructions and to follow up their developments in Article Twenty-One.

As for the conduct of the meetings of the board, the Rules organize it in the articles from Twenty-Two to Twenty-Six: "holding no less than four meetings a year with one meeting every three months", and requiring the validity of the meeting with "the attendance of half of its members, taking into account that the number of the attendees should not be less than three, unless the articles of association of the financial institution provide a larger number", and taking the decisions "based on the voting of the members and on the principle of the majority", and the permissibility of the attendance by the technical means, and the non-validity of the absence except with an excuse notified to the chairman of the board in advance, with a clear practical penalty: "in the event of the member not participating in three meetings a year" the appropriate legal action is taken, and documenting the meetings in minutes in which the names of the attendees, the non-attendees and those invited from outside the board are mentioned. Articles Twenty-Seven and Twenty-Eight also oblige the appointment of a secretary from among the board members or from others, provided that he holds a university degree in law, finance, accounting or administration -or its equivalent- with appropriate experience, and his tasks are numerous from preparing the minutes, preserving the reports, notifying the dates, providing the members with the agenda and the documents, organizing the disclosure register of the members and the executive management, and following up the recommendations of the board.

And the Rules define in their first article the independent member as "the member who enjoys complete independence in his position and decisions, and to whom -by way of example not limitation- none of the following independence impairments apply", and they are nine impairments: the first that he be an owner of a percentage of "five percent or more of the shares of the financial institution or the shares of another company of its group, or have a kinship with whoever owns this percentage"; the second that he have a kinship with any of the board members or the senior executives in the institution or a company of its group; the third that he be a member of the board of directors of another company of the group of the institution; the fourth that he "works or has worked during the past two years for the financial institution or a company of its group or its major shareholders or major suppliers and auditors, or be an owner of controlling stakes"; the fifth that he have a direct or indirect interest in the businesses and contracts concluded on account of the institution; the sixth that he "receives financial amounts from the financial institution, in addition to the remuneration of the membership of the board of directors or any of its committees, exceeding two hundred thousand riyals or fifty percent of his remunerations in the previous year"; the seventh that he participates in a work that would compete with the institution in its principal activity or trade in a branch of its activities; the eighth that he has "spent more than nine continuous or intermittent years in the membership of the board of directors of the financial institution"; the ninth that he have "a credit relationship in his name or in the name of one of his relatives with the financial institution exceeding (one million) Saudi riyals". And Article Eleven obliges the board "to conduct an annual assessment to measure the extent of the independence of the independent member, and to ensure the absence of any relationships or circumstances affecting or that may affect his independence, and also the member must inform the board upon the occurrence of any of the independence impairments".

And related to these impairments are definitions no less important in the first article of the Rules: the relatives are defined as "the fathers and mothers, the grandfathers and grandmothers, the children and their children, the husbands and wives"; and the major shareholders are defined as "everyone who owns five percent or more of the shares of the financial institution or the voting rights therein"; and considered among the related parties are the major shareholders, the board members and the senior executives in the institution or its subsidiary companies and their relatives, and the members of the boards of the major shareholders and their senior executives, and the establishments owned by the member or the senior executives or the companies in which they participate or whose boards they chair, and the joint stock companies in which they own five percent or more, and the holding or subsidiary companies of the institution; and the stakeholders are defined as "everyone who has an interest with the financial institution, including: the shareholders, the investors, the customers and the suppliers". And Principle Two also addresses the resignation of the member, as Article Twenty-Nine provides that if the member resigns "and has observations on the performance of the financial institution, he must submit a written statement to the chairman of the board, and the statement must be presented to the rest of the board members, with providing the Saudi Central Bank with a copy of it".

The Responsibilities of the Board of Directors and the Executive Management

Principle Three of the Principal Governance Rules (Responsibilities of the Board) decides that the effective board of directors "its role is represented in directing the businesses of the financial institution towards what would safeguard its interests and develop its value, and it bears the responsibility for its businesses even if it delegated committees, bodies or individuals", and the Rules enumerate the responsibilities of the board in about twenty items from the Articles (30) to (53), the most important of which: forming the executive management and supervising it (Article 30), and setting the plans, policies and strategies and supervising their implementation (Article 31), and ensuring "the soundness of the financial institution and its financial solvency" and maintaining effective relations with the supervisory bodies (Article 32), and setting "clear limits for the responsibility and accountability" with "complete separation of the responsibilities at the level of the executive management" (Article 33), and approving a detailed written policy of the powers delegated to the executive management and determining the topics over which the authority of deciding is retained (Article 34), and ensuring the existence of "effective units for compliance, internal audit and risk management" and their independence from the business units (Article 36), and setting a comprehensive risk management strategy and reviewing it annually (Article 37), and selecting the senior executives and setting the replacement policy (Article 39), and verifying the independence of the internal and external auditor (Article 41), and exercising an appropriate supervisory role over the subsidiary companies taking into account their legal independence (Article 42), and approving a comprehensive remuneration policy with a minimum of three types (fixed, linked to the performance and granting shares) (Article 47), and verifying the accuracy and soundness of the annual and quarterly financial statements and approving them before their publication (Article 48).

And the SAMA framework is distinguished by three precise supervisory rules worth pausing at: the first in Article Forty: that the board inform the Saudi Central Bank in writing "about any penalties imposed by any supervisory, regulatory or judicial body that may affect the workflow of the financial institution, within ten working days from the date of imposing the penalty"; the second in Article Forty-Four: that "the board is not exempted from the responsibility, and its responsibility remains in case of assigning the operations of the financial institution to another party" (the external assignment/outsourcing); the third in Article Forty-Six: ensuring the existence of specific and effective policies and procedures, including "policies and procedures for the governance of the information technology and the cybersecurity", and "a policy determining the mechanism of reporting the violations in the financial institution and protecting the whistleblowers", and "policies and procedures for settling the complaints and objections", and "policies and procedures for maintaining the confidentiality of the information". And the board also addresses the conflict of interest policy in Article Forty-Three with practical requirements: the commitment of the members and the senior executives to avoid the conflict, and the illustrative examples, and the disclosure procedures and obtaining the approvals, and the commitment to the permanent disclosure and refraining from voting, with a special rule for dealing with the related parties: that it "be conducted on commercial bases only, provided that it includes the disclosure to the public and the Saudi Central Bank without delay of this dealing if it was equal to or exceeding (1%) of the total" as determined by the text.

And Principle Three devotes provisions to the chairman of the board (Article 51) from leading the board and supervising the effectiveness of its workflow, and ensuring the arrival of the complete and clear information to the members in a timely manner, and representing the institution before others, and supervising the preparation of the agenda of the board taking into account any point raised by a member or the auditor, as it obliges the board to disclose in its annual report the committees emanating from it, the scope of their work and the names of their members, and to provide the Saudi Central Bank with a list of these committees, their tasks and work procedures (Article 50), and that the general assembly approve -based on the recommendation of the board- the work charters of the nominations, remuneration and audit committees (Article 49), and the board is entrusted with ensuring the adoption of the social responsibility programs in accordance with the policy approved by the general assembly (Article 52), and that "the services of the financial institution meet the needs and requirements of the society at fair costs, and that the financial institution take the initiative to provide facilities to support and encourage the small and medium enterprises" (Article 53).

And in return for the responsibilities of the board, Principle Four (Responsibilities of the Executive Management) determines the role of the executive management in managing the daily work and ensuring the conformity of the activities with the business strategy, the level of the risk and the policies approved by the board, and among its responsibilities: implementing the approved plans and strategies (Article 54), and proposing the optimal capital structure and the financial objectives (Article 55), and proposing the comprehensive strategy, the work, investment, financing and risk management plans and the contingency plans (Article 56), and proposing the organizational and functional policies including the position of the chief executive officer and raising them to the board for their approval (Article 58), and proposing the professional conduct policy and the remuneration policy and raising them to the board (Articles 59 and 60), and applying the financial and accounting systems (Article 61), and developing a general perception of the risks and creating an environment of awareness of the risk mitigation culture (Article 62), and raising an annual report to the board on the internal control system and its application (Article 65), and keeping the board permanently informed of the material matters (Article 66), and understanding and directing the financial and non-financial structures at the group level (Article 67), and setting the procedures for the periodic communication with the major clients "to assess their risks, and it is important that they take into account the governance frameworks followed by the clients before entering with them into credit and similar relationships" (Article 68).

The Committees Emanating from the Board of Directors: The Formation, the Competencies and the Meetings

Principle Five of the Principal Governance Rules (Committees Emanating from the Board) obliges the board to form committees whose number is determined by the nature of the operations, the size of the institution and the relative experience of its members, provided that among them be four pivotal committees: the executive committee, the audit committee, the nominations and remuneration committee, and the risk committee. And the Rules decide general rules for the committees in the Articles (69) to (72): it is preferable that the member not be a member in more than two committees, and the attendance of half of the members is required for the validity of the meeting and the decisions are taken by the majority, and working in good faith away from any external influence, and that each committee have a secretary who prepares its minutes and reports and notifies its members of the meeting dates, with the permissibility of holding the meetings by the technical means.

First: The Executive Committee - it consists of at least three members and not more than five, and "the chief executive officer may not chair it" (Article 74), and "the meetings of the committee should not be less than six meetings a year" with the permissibility of inviting the risk manager to attend them without the right to vote (Article 75), and it must submit a report to the board on any important issue and determine the items to be included in the agenda of the board (Article 76).

Second: The Audit Committee - it consists "of at least three members and not more than five, all of them from the non-executive members, and among them be at least one independent member, and it is chaired by an independent member, and the members from outside the board are more than the members from inside the board, and the chairman of the board may not chair it" (Article 78), with a special requirement in the margins of the Rules for the banks and lenders: "all the members of the committee must be independent". And Article 79 provides that "the general assembly, based on the recommendation of the board, approves the work charter of the committee provided that it includes the controls and responsibilities of its work, the procedures of appointing its members, their membership term and their remunerations", and Article 80 requires in the members scientific qualifications and professional experiences in auditing and risk management including the knowledge of the accounting and auditing standards and the ability to read the financial reports. And the number of the meetings of the committee depends on the size of the institution and the scope of its tasks "provided that it is not less than four meetings a year" (Article 81). And the committee is concerned with monitoring the businesses of the institution and verifying the soundness and integrity of the reports and financial statements and the availability of the internal control systems, through four axes in Article 82: the financial reports by studying the quarterly and annual statements before presenting them to the board, and expressing the opinion on their fairness and balance, and studying the important or unusual matters and verifying the material accounting estimates; and the internal audit by studying the internal, financial control and risk management systems, and following up the corrective procedures, and supervising the performance of the internal auditor, and recommending the appointment of the internal audit manager and proposing his remunerations; and the auditor by recommending the nomination and removal of the auditors and determining their fees after verifying their independence, and reviewing their work plan, and studying their report and observations; and ensuring the compliance by reviewing the results of the reports of the supervisory bodies, and verifying the taking of the necessary procedures and raising the important matters to the board.

Third: The Nominations and Remuneration Committee - and it is the committee that combines in the SAMA framework both the nominations and remuneration competencies together (unlike what we find in some other regulations that dedicate a committee for each function). And it consists "of at least three members and not more than five, and among them be at least two independent members, and it is chaired by an independent member, and the chairman of the board may not chair it" (Article 83), and it is concerned "with searching and proposing candidates to be chosen as members of the board and the executive management, and preparing a clear policy for the remunerations of the board members, the committees emanating from it and the executive management, in accordance with the relevant instructions of the Saudi Central Bank" (Article 85), and "the meetings of the committee should not be less than two meetings a year during which the performance of the members is studied and assessed, new members are nominated, and the remunerations and incentives policy is discussed" (Article 86), and its tasks include coordinating with the human resources department to develop the replacement and functional succession policy, and setting a register of the qualifications of the board members to determine the additional skills required, and ensuring that the size of the remunerations "is consistent with the prevailing local customs and the regulatory systems, and is linked to achieving the interests of the shareholders, and achieving the long-term strategic objectives of the financial institution" (Article 87).

Fourth: The Risk Committee - it consists "of at least three members and not more than five, and among them be three non-executive members, and the chief executive officer may not chair it" (Article 88), with the requirement of "an appropriate level of knowledge of the risk management, and among them be one with experience in the cybersecurity and technical risks" (Article 89), and that "the risk manager in the financial institution be linked to the board through the risk committee" (Article 90), and "the committee must hold no less than four meetings a year" (Article 91). And its thirteen tasks in Article 92 include: setting a comprehensive risk management strategy and policies taking into account the cybersecurity and technical risks and verifying their implementation, and determining an acceptable level of the risk and maintaining it, and verifying the viability of the continuity of the institution during the next twelve months, and supervising the risk management system and evaluating the effectiveness of the systems of identifying, measuring and monitoring the risks, and re-evaluating the ability of the institution to bear the risks through the stress tests, and preparing detailed reports on the exposure to the risks and raising them to the board, and recommending the appointment/termination of the services of the manager of the risk unit or department, and ensuring the availability of the sufficient resources and systems for the risk management, and reviewing the organizational structure of the risk management before its adoption, and verifying the independence of the risk management employees from the business units, and working on increasing the awareness of the risk culture, and reviewing the matters raised by the audit committee that may affect the risk management. And the Rules allocate in their margins to the financing companies a special naming: "the committee is called (the Risk and Credit Management Committee)".

And the following table gathers the most important numbers of the four committees quoted literally from Principle Five:

The Shareholder Rights: The Cumulative Voting and the Prior Disclosure

Principle Six of the Principal Governance Rules (Shareholder Rights) decides that the board must ensure that the governance policies of the financial institution "protect the rights of the shareholders and facilitate the exercise of their rights, and contribute to providing effective communication channels and various means for communicating with all the shareholders of the financial institution", and that the institution have "specific procedures ensuring the exercise by the shareholders of their rights and their obtaining of the appropriate information without delay". And Article Ninety-Five imposes a direct supervisory obligation towards the Saudi Central Bank: "the financial institution must provide the Saudi Central Bank with a copy of the minutes of the general assembly meetings within a period not exceeding fifteen days from the date of their convening".

And Article Ninety-Six counts the principal rights of the shareholders: first "obtaining all the relevant information that enables the shareholders to exercise their rights fully on a periodic basis and without delay"; second "participating and voting in the general assembly meetings, taking into account the topics that the shareholders wish to raise in such meetings"; third "discussing the topics included in the agenda of the general assembly, and directing the inquiries to the board members and the legal accountant, and obtaining a statement regarding them"; fourth "choosing the board members by following the method of the cumulative voting", which is the text that makes the cumulative voting method the statutory method for choosing the board of directors of the financial institutions subject to the supervision of the Saudi Central Bank, which enhances the representation of the minorities and protects the interests of the shareholders with the lesser share.

And Articles Ninety-Seven and Ninety-Eight determine the procedural guarantees: the obligation to provide the shareholders "with information about the place and date of convening the general assembly and its agenda twenty-one days before its meeting", and granting the shareholders "the right to nominate and elect the board members and inquire about their qualifications, experiences and ability to perform their work, and discuss the size of the remunerations and financial incentives received by the board members and the senior executives", in addition to their right to submit the proposals related to the topics of the general assembly in accordance with what the relevant instructions detail.

Disclosure, Transparency and the Content of the Annual Report

Principle Seven of the Principal Governance Rules (Disclosure and Transparency) decides that the board "sets written disclosure policies consistent with the disclosure requirements contained in the relevant laws, regulations and instructions", with three fundamental considerations: that the policies include "appropriate disclosure methods enabling the stakeholders to review the financial and non-financial information related to the financial institution and its performance including the future directions of the financial institution and its strategic plans"; and that the disclosure be "in a clear, correct and non-misleading manner, and in a timely, regular and accurate manner"; and that the disclosure policies be reviewed "periodically, and verifying their conformity with the best practices, and with the provisions of the relevant laws, regulations and instructions".

And Article One Hundred details the content of the annual report that "is prepared by the board to reflect the operations of the concluded fiscal year", provided that it includes -at a minimum- eleven items: the names of the board members, the committee members and the executive management and their current and previous positions, qualifications and experiences; and the names of the companies inside or outside the Kingdom in which a member of the board of directors of the institution is a member of their current and previous boards of directors or among their managers; and the composition of the board and the classification of its members (executive, non-executive, independent); and the number of the board meetings during the last fiscal year, their dates and the attendance record of each meeting; and any penalty or sanctions imposed on the institution by the Saudi Central Bank or any supervisory, regulatory or judicial body with the statement of the reasons of the violation and the body that imposed it; and the details of the social contributions; and a statement of the dates of the convened general assemblies and the names of the board members who attended them; and a statement of each subsidiary company or a company of the group of the institution, its capital, the ownership percentage, its principal activity and the country of incorporation and management; and information about the businesses or contracts in which the institution is a party and in which one of the related parties had an interest with the names of those concerned, the nature of the contracts, their terms, duration and amount; and the disclosure of the remunerations granted to the board members, the committees emanating from it and five of the senior executives who received the highest remunerations provided that among them be the chief executive officer and the chief financial officer; and the results of the annual audit and the effectiveness of the internal control procedures and the extent of the efficiency of the internal control system.

The Requirements for Appointment to Leadership Positions: The Non-Objection of the Saudi Central Bank and the Fitness Criteria

The Requirements for Appointment to Leadership Positions in Financial Institutions Subject to the Supervision of the Saudi Central Bank (issued pursuant to Circular No. (1994/67) dated 10/1/1441H, and updated by subsequent circulars) are considered the regulatory tool that links the occupation of the leadership positions to the licensing authority of the Saudi Central Bank. And the Requirements define the leadership positions as "the jobs, tasks and responsibilities entrusted to their occupants with setting, proposing and implementing the strategic decisions and managing the daily operations of the financial institution, and they include the board of directors and the senior management of the financial institutions". And the Second Chapter of the Requirements determines the rule of the priority of the Saudis in occupying the leadership positions, with clarifying the justifications and proving the unavailability of the qualified Saudi when resorting to the non-Saudis, and it restricts a number of positions to the Saudis only, namely: the human resources manager, the information security/cybersecurity manager, the information technology manager, the compliance manager, the anti-money laundering and terrorism financing manager, the financial crimes combat manager, the fraud combat manager, the legal manager, the governance manager/secretary of the board of directors, the manager of the financial execution department, in addition to the customer care manager, the vehicle claims manager and the individual sales manager in the insurance companies, with the obligation of the institution to set a policy approved by the board for the replacement and functional succession to qualify the Saudis, and verifying the scientific and professional certificates of the occupants of the leadership positions and their candidates.

And the Third Chapter of the Requirements provides that "the financial institutions must obtain the prior written non-objection of the Saudi Central Bank on the nomination of the members of the boards of directors, and on appointing, assigning or extending the assignment of any person to perform the tasks or responsibilities of the senior management positions" contained in the six sectoral appendices, and prohibits "the candidates for the leadership positions from assuming the responsibilities entrusted to those positions or starting to practice their roles or announcing that except after obtaining the prior written non-objection of the Saudi Central Bank", and restricts the temporary assignment to not exceeding six months extendable with the approval of the Saudi Central Bank. And the appendices distribute the positions over the sectors: Appendix (1) for the banks operating in the Kingdom, and Appendix (2) for the credit information companies, and Appendix (3) for the insurance and reinsurance sector and the liberal professions, and Appendix (4) for the financing, real estate refinancing, micro-financing, supporting companies and contracts registration companies sector, and Appendix (5) for the exchange centers, and Appendix (6) for the payment and financial technology companies.

And Appendix (1) organizes the leadership positions in the banks in two parts: the board of directors represented in "the member of the board of directors (including the chairman of the board and his deputy)" and "the chairmen and members of the committees emanating from the board of directors"; and the senior management in a list of twenty-two positions including: the chief executive officer/managing director/general manager (and his deputy), the chief financial officer, the chief risk officer, the internal audit manager, the compliance manager, the customer care manager, the anti-money laundering and terrorism financing manager, the financial crimes combat manager, the fraud combat manager, the credit manager, the operations manager, the legal manager, the governance manager/secretary of the board of directors, the information security/cybersecurity manager, the information technology manager, the treasury manager, the human resources manager, the retail banking manager, the corporate banking manager, the assets and liabilities manager in the treasury or the official primarily responsible for determining the interbank lending rate (SAIBOR) for the local banks, the manager of the financial execution department, and any executive position directly linked to the chief executive officer/managing director/general manager and occupied by a non-Saudi.

And the Fourth Chapter of the Requirements determines the fitness criteria that the board of directors is entrusted with verifying in the candidates, and they are four axes: the honesty, integrity, good reputation and fairness by not having been "convicted of any offense involving dishonesty and breach of trust unless his reputation has been restored"; and the capability and competence by the availability of the appropriate scientific qualification or the sufficient experience, the necessary skills and the understanding of the technical requirements of the businesses, risks and administrative procedures; and the financial competence by the availability of the capability and previous experiences in managing the liabilities and financial affairs prudently (without that meaning the limitation of the financial capabilities); and the independence by the person not having interests, functional commitments or circumstances leading to a conflict of interest or affecting the performance of the duties. And the Requirements impose continuous supervisory obligations: conducting a periodic assessment of the fitness "at a minimum of once annually", and notifying the Saudi Central Bank in writing "upon the occupants of the leadership positions assuming the tasks and responsibilities entrusted to the position, and upon accepting the resignation or leaving the work or terminating the service for any reason within (5) working days from its date", and providing the Saudi Central Bank "with periodic semi-annual reports (end of June and December) including the data of the occupants of the leadership positions and the vacant positions among them", in addition to the obligation of the institution to assess the fitness of the occupants of the positions that do not require the non-objection and approving a policy and criteria for that, provided that the financial institutions remain free in the nomination and appointment for the positions not included in the appendices as long as they are committed to the fitness criteria and their internal policies.

And it is recalled in this regard that these Requirements enter into one system with the rest of the SAMA instructions related to the governance, especially the principles of conduct and business ethics, the compliance principles, the Shariah governance framework for the local banks and lenders, and the Shariah governance instructions in the financing companies, and that the compliance with them does not dispense with the compliance with the provisions of the Companies Law and the regulations of the Capital Market Authority or the Ministry of Commerce depending on the nature of the entity, but rather they complete with them to form the integrated framework of the governance of the financial institutions in the Kingdom.

The Official Sources and References

This article relied on the following official statutory sources, which are the reliable source of all the texts, numbers and circulars contained in the above sections, and it is always preferred to review from these official links to view the complete texts and the latest updates:

• The Principal Governance Rules for Financial Institutions Subject to the Supervision and Oversight of the Saudi Central Bank (Circular No. 42081293) and the Requirements for Appointment to Leadership Positions - the full text in the Rulesbook of the Saudi Central Bank
• The Rulesbook - the section of the governance of financial institutions at the Saudi Central Bank
• The Saudi Central Bank Law (M/36) - the official page on the website of the Saudi Central Bank
• The Saudi Central Bank Law (M/36) - the original PDF document
• The approval of the amendment of the Saudi Central Bank Law - the Official Gazette (Umm Al-Qura)
• The Companies Law issued by Royal Decree No. (M/132) - the Official Gazette (Umm Al-Qura)

A methodological note: all the numbers, dates, competencies and degrees of bindingness quoted in this article were taken literally from the official texts mentioned above (the Principal Governance Rules for Financial Institutions pursuant to Circular No. 42081293 dated 30/6/2021AD and its updates including Circular No. 472039139 dated 29/12/2025AD relating to obliging the financing and payment services companies, and the Requirements for Appointment to Leadership Positions pursuant to Circular No. 1994/67 and its updates, and the Saudi Central Bank Law M/36), and it is recommended to refer to these sources to verify any subsequent updates on the texts and their impact on the resulting obligations.

Frequently Asked Questions about the Governance of Banks and Financial Institutions in Saudi Arabia

We provide in the following answers to the most common questions among the boards of directors of the financial institutions and the governance practitioners about the governance system under the SAMA frameworks:

Conclusion: The Governance of the Financial Institutions an Integrated Supervisory System

The governing rules of the governance of the banks and financial institutions under the SAMA frameworks are summarized in three axes: the formation decided for a board of directors whose number of members ranges between five and eleven (and nine to eleven for the banks) with a maximum term of three years, and complete separation between the chairmanship of the board and the executive management, and at least two independent members or a third of the members, with prior written non-objection of the Saudi Central Bank for the nomination; and the supervision distributed between the broad responsibilities of the board towards the solvency, the policies and the internal control and informing the Saudi Central Bank of the penalties, and four specialized committees namely the executive, audit, nominations and remuneration and risk management; and the disclosure and accountability decided for the annual report with its eleven items, and the rights of the shareholders at the head of which is the cumulative voting, and the fitness criteria in the leadership positions and their periodic assessment.

And the essential advantage of this system is that it is supervisory in its essence: for the Saudi Central Bank is an effective partner in the formation of the boards, licensing the leadership positions, following up the penalties and reviewing the minutes of the assemblies, which makes the governance in the financial sector a tool of stability and protection for the depositors, the investors and the customers of the financial institutions. At Nova Legal for Law and Legal Consultations, we provide our specialized consultations in aligning the foundational systems and internal policies of the financial institutions with the Principal Governance Rules and the Requirements for Appointment to Leadership Positions issued by the Saudi Central Bank, and reviewing the formation of the boards of directors and their committees and the independence impairments, and preparing the nomination files of the leadership positions, the fitness criteria and verifying their satisfaction, and representing the financial institutions before the Saudi Central Bank and the regulatory and judicial bodies, and we are pleased to accompany you towards sound and sustainable financial governance.