Chapter Three: Screening Procedures and Controls

The Financial Institution shall adopt and implement a clear schedule for screening procedures in accordance with the cases specified in paragraph (3.5), provided that the specified timeframes comply with the following: a. Outgoing and incoming transactions: Screen all outgoing transactions before they are executed and incoming transactions as soon as they are received (without waiting for the end of the day or the specified period). b. Comprehensive Screening: Comprehensive screening of customer databases and information, transactions, beneficial owners, directors, and authorized signatories, and related parties shall be conducted at least once every three months. c. Post-update Screening: When an update to the sanctions lists is issued, all customer and transaction data and information, beneficial owners, directors, and authorized signatories, and related parties shall be screened against the updated list, with a record kept documenting the update, the screening process, and any actions taken as a result. d. Additional screening based on specific events: The systems and tools used for screening shall be activated based on any material changes or events that occur, including a change in ownership or control structure, the emergence of a new high-risk country in the customer's transactions or business relationships, or a change in transaction patterns that may indicate increased risk, or alerts from regulators or competent authorities indicating increased risk in a sector, country, or group of customers; an increase in a customer's risk rating following a periodic assessment; a customer's association with suspicious behavior prior to or following an update to sanctions lists; or the presence of adverse media associated with a specific customer, country, or sector. The Financial Institution shall identify and document these events in its internal policies and procedures, taking into account that these events are updated periodically and continuously to reflect the most prominent emerging risks or threats. 3.7 The screening systems and tools relied upon by the Financial Institution shall be capable of detecting any matches of names, aliases, variations in spelling, names with similar phonetic pronunciations, and transliterations, and the Financial Institution shall verify the effectiveness of these systems and tools on a periodic and ongoing basis. 3.8 The Financial Institution shall select screening systems and tools that are appropriate to the nature of its activities, the scale of its operations, and its level of exposure to risks, and shall rely on robust and highly reliable automated systems capable of real-time matching against sanctions lists, and shall periodically and continuously review the effectiveness of the real-time matching of those systems and address deficiencies based on the results of the assessment in accordance with paragraph (3.12). 3.9 The Financial Institution may, after obtaining written non-objection from SAMA, use robust and documented manual tools commensurate with the nature of its activities, the scale of its operations, and its level of exposure to risks, in accordance with the following requirements: a. ‌There shall be no delay in implementing the requirements for immediate screening against sanctions lists, freezing measures, reporting procedures, and unfreezing procedures. b. These procedures and tools shall support the regular updating of sanctions lists based on official sources. c. Accurate implementation of screening procedures by trained personnel. d. Assess partial or close matches using consistent and documented criteria. e. Fully documenting screening records and decisions and making them available for review upon request. f. The exception shall not apply to Financial Institution offer payment or transfer products or services.