Money laundering and terrorist financing red flags (AML/CFT): the warning signs that sales, contracts and finance staff must watch for, the internal escalation steps and reporting to the Saudi Financial Intelligence Unit, the ten-year record-keeping rule, and the ban on tipping off the customer.
Many money laundering cases do not start in a bank. They start in a car showroom, a real estate office, a gold shop, or a trading company that accepted a large cash payment without asking questions. The employee who takes the payment is the first line of defense, and if that employee does not know what should raise suspicion, the business and its staff bear the consequences of a deal they never meant to take part in.
The Anti-Money Laundering Law issued by Royal Decree No. (M/20) of 1439H and its Implementing Regulations require the entities subject to it to detect suspicious transactions and report them immediately. This guide explains the main red flags, what to do when one appears, and what your internal policy should contain.
Who Must Monitor for Red Flags?
The law addresses two groups: financial institutions and designated non-financial businesses and professions (DNFBPs). The second group includes activities people deal with every day:
| Sector | Why it is exposed |
|---|---|
| Real estate brokerage and real estate businesses | High transaction values, and assets are easily registered in another party's name |
| Dealers in gold, precious metals and precious stones | High value in a small volume, and widespread use of cash |
| Lawyers and accountants | Structuring deals, forming companies and managing client funds |
| Commercial companies in general | Selling high-value assets and receiving payments from multiple parties |
Each sector is supervised by a regulator within its jurisdiction, such as the Ministry of Commerce, the Real Estate General Authority and the Ministry of Justice. Even a business outside these categories remains subject to the criminal prohibition on money laundering itself, so a clear internal policy protects both the business and its employees.
What Are Red Flags?
A red flag is a behavior or financial transaction that does not fit what you know about the customer or does not make commercial sense. A red flag is not proof of guilt; it is a reason to pause and escalate. The main categories are:
| Category | Practical examples |
|---|---|
| Identity and beneficial owner | The customer refuses or hesitates to provide valid identification, declines to disclose the beneficial owner of the deal, or presents documents that appear altered or inconsistent |
| Cash payment and structuring | Insisting on paying large amounts in cash with no commercial reason, or splitting the deal value into several payments or transfers to stay under monitoring thresholds |
| Multiple parties and intermediaries | Asking to register the contract or asset in the name of a third party with no clear link to the customer, or payments arriving from accounts of persons or companies unrelated to the contract |
| Lack of economic logic | Accepting a price above market value without negotiation, selling assets at a heavy loss for immediate cash, or a deal size that does not match the customer's declared activity |
| Repeated cancellation and refund | Paying money and then asking to cancel the deal and recover it by certified cheque or by transfer to a bank account other than the one it came from |
Several red flags in one transaction raise the level of suspicion, and a transaction does not have to reach a particular value before it must be reported.
Red Flags Specific to Real Estate and Precious Metals
In real estate
- Buying a property without viewing it or showing interest in its specifications.
- Reselling the property quickly at a very different price for no apparent reason.
- Payments from outside the Kingdom or from a party unrelated to the buyer.
- Asking for a value to be written in the contract that differs from the real value.
In gold and precious metals
- Large or repeated cash purchases out of line with the customer's apparent income.
- Buying and then asking to sell back within a short period.
- Refusing to have the invoice issued in the name of the actual buyer.
- Splitting purchases across several people or branches on the same day.
For real estate investors, see our guide to real estate investment and financing in Saudi Arabia.
Mandatory Steps When a Red Flag Is Detected
When a red flag appears, the employee follows these escalation steps:
- Pause: do not complete the contracting process or accept the suspicious cash until the compliance officer has reviewed the case.
- Document internally: complete the internal suspicion form and attach every document and message that shows the reason for the suspicion.
- Report confidentially: raise the report immediately to the compliance officer, who files it with the Saudi Financial Intelligence Unit (SAFIU) where the suspicion is established.
- Keep records: retain all customer records and transaction documents for at least 10 years from the end of the transaction.
The law requires the report to be made immediately and directly, with a detailed report containing the available information about the transaction and its parties, and requires a response to any request for further information. SAFIU reports to the President of State Security and is the national body responsible for receiving and analyzing these reports.
The Ban on Tipping Off the Customer
No employee or manager may inform the customer, or hint, that the transaction is under suspicion or that a report has been filed. Tipping off is a separate violation of Article 16 that exposes the business and the employee to sanctions by the supervisory authority, including a fine of not more than SAR 5 million per violation and a ban from working in the sector, even if money laundering is never proven in the transaction itself.
- Do not explain the real reason for the delay; say only that the process is under review.
- Do not discuss the case with colleagues who are not involved.
- Do not record suspicion notes in a file the customer can see.
- Keep all communication about the report with the compliance officer only.
Penalties Under the Anti-Money Laundering Law
According to the official text of the law published by the Bureau of Experts at the Council of Ministers, as amended by the amendment published in the Umm Al-Qura Gazette in 1447H (2026), the penalties are as follows:
| Case | Penalty | Article |
|---|---|---|
| The money laundering offense | Imprisonment for not less than two years and not more than ten years, or a fine of not more than SAR 5 million, or both | 26 |
| The offense with an aggravating circumstance, including commission through an organized criminal group, use of violence or weapons, or abuse of public office or influence | Imprisonment for not less than three years and not more than fifteen years, or a fine of not more than SAR 7 million, or both | 27 |
| The offense committed by a legal person | A fine of not more than SAR 50 million and not less than double the value of the funds involved in the offense | 31 |
| Violation by the business, its managers or its employees of the law and its regulations, including the duty to report and the tipping-off ban | Sanctions imposed by the supervisory authority: a written warning, an order to comply with specific instructions, an order to submit regular reports, a fine of not more than SAR 5 million per violation, or a ban from working in the sector | 25 |
In addition, a Saudi national sentenced to imprisonment is banned from travel for a period equal to the prison term, and laundered funds, proceeds and instrumentalities are confiscated by court judgment. The 1447H amendment covered Articles 14, 15, 16, 18, 28, 33 and 50 and added Article 49 bis; it did not change the prison terms or fines in Articles 26 and 27.
What Should Your Internal Policy Contain?
- Purpose and scope: the departments and employees covered.
- Appointment of a compliance officer, with powers and a contact channel.
- A list of red flags suited to the nature of the business.
- Due diligence procedures for verifying identity and the beneficial owner.
- The internal suspicion form and escalation path.
- Record keeping: period and method.
- The tipping-off ban and disciplinary consequences for breaching it.
- Regular training and an annual review of the policy.
Nova Legal has prepared a short model policy for detecting red flags and reporting suspicious transactions, designed for commercial companies, real estate businesses and precious metals dealers, which can be adapted to each business. To link the policy to your corporate governance, see our guide to governance of non-listed companies and LLCs.
Mistakes That Expose the Business and Its Staff to Liability
- Accepting cash without asking about its source in large deals.
- Relying on a copy of the ID without verifying the beneficial owner.
- A copied policy that employees have never read.
- Delaying the report until the deal is completed.
- Telling the customer why the transaction was put on hold.
- Destroying documents before ten years have passed.
- No training for sales and front-desk staff.
In some cases liability extends to management. See our guide to the civil and criminal liability of board members.
How Does Nova Legal Help You Comply?
- Drafting your AML policy and forms to fit your business.
- Risk assessment and identifying gaps in sales and collection procedures.
- Staff training on spotting red flags and escalating without tipping off the customer.
- Advice on suspicious cases before and after a report is filed.
- Representation before regulators and courts during inspections or proceedings.
- Before an acquisition or partnership, request our legal due diligence for companies service and read our guide to legal due diligence before an acquisition.
- For ongoing legal support, see the legal package for medium-sized companies.
Frequently Asked Questions
What are money laundering red flags?
They are behaviors or transactions that do not fit what is known about the customer or do not make commercial sense, such as insisting on large cash payments, refusing to disclose the beneficial owner, splitting amounts, registering the asset in a third party's name, and asking for cancellation with a refund to a different account.
Who receives suspicious transaction reports in Saudi Arabia?
The employee reports internally to the compliance officer, who reports immediately and directly to the Saudi Financial Intelligence Unit (SAFIU) where the suspicion is established.
Can the customer be told that the transaction is under suspicion?
No. The law prohibits informing the customer, or hinting, that a suspicion or report exists, and tipping off is a violation of Article 16 of the law that exposes the business and the employee to sanctions by the supervisory authority, including a fine of not more than SAR 5 million per violation.
How long must customer and transaction records be kept?
For at least ten years from the end of the transaction or the end of the business relationship, under the Anti-Money Laundering Law.
Does a transaction have to reach a certain amount before it is reported?
No. A suspicious transaction must be reported whenever red flags are present, regardless of its value or size.
Does your business have a clear policy for detecting suspicious transactions?
We draft your AML policy and forms, train your staff to spot red flags and escalate, and represent you before the regulators.
info@novalegal.sa | Al Sahaba Road, Al-Ishbiliyah District, Riyadh
Conclusion: Detecting Red Flags Protects Your Business First
Detecting and reporting red flags is not an administrative burden; it protects the business and its employees from criminal liability and fines. The rule is simple: pause, document, report to the compliance officer, keep the records, and do not tip off the customer.
The Nova Legal team in Riyadh can help you draft the policy and train your team, alongside our legal due diligence for companies service. Address: Al Sahaba Road, Al-Ishbiliyah District, Riyadh – Building 2/2 Al Hamra City, Second Floor, Office 202.