Initial Public Offering (IPO) Rules for Receiving and Lending Banks

Liquidity Requirements 19. Banks shall effectively manage its balance sheet and plan well in advance to ensure continuous compliance with the LDR , SAMA Liquidity Ratio, LCR , NSFR , and any other liquidity requirements required by SAMA. 20. Banks shall review the collateral pledged with SAMA and their daytime limits to ensure they have sufficient collateral to cover large intraday transfers and liquidity needs during the IPO process. 21. Banks shall take due diligence when recycling application monies in the money market, if needed. A Receiving Bank is encouraged to participate in the interbank lending, as needed. 7. Cybersecurity 22. Banks shall establish appropriate precautionary cybersecurity controls to protect the information assets and data of banks and subscribers from cyberattacks, taking into account compliance with the regulatory requirements related to cybersecurity . 23. Banks shall ensure that controls related to cybersecurity monitoring are applied to all systems and applications used in the IPO process. The monitoring incident response capabilities shall be governed by the cybersecurity incident response policy, and ensuring the readiness of incident response teams. 24. Banks shall conduct a comprehensive testing program to ensure cyber resiliency and controls effectiveness of the systems and applications used in the IPO process, including - but not limited to - the following: a. Vulnerability assessment and penetration testing. b. Cybersecurity compromise assessment. 25. Banks shall ensure operational resiliency by testing a range of potential disruptive scenarios, in line with regulatory requirements related to business continuity management . 26. Banks shall implement preventive measures to reduce the risks arising from the third-party and service providers dependencies and should also ensure the readiness of third-party arrangements to support the systems and applications involved in the IPO process. 8. Subscription Surplus Refund 27. Banks shall establish documented procedures to refund the value of the subscription surplus, if any, after share allocation. 28. Banks shall inform subscribers of the subscription surplus refund process and timeline. The surplus amount shall be refunded to the subscriber's account via electronic means only. 29. In the event of IPO cancellation or incompleteness, banks shall return the entire subscription amounts to the subscriber’s account via electronic means only, according to the respective timetable. 30. Banks shall exercise due diligence in handling subscription amounts refunds and, at minimum, shall verify the identity of the subscriber before refunding the amount. 9. Reporting 31. Banks shall submit to SAMA an IPO data report based on the following: a. End of Offering Period report. b. In the event that an IPO falls under the definition of a large-scale IPO or a Government Offering, reports shall be submitted on daily basis during the Offering Period. 32. Reports shall be submitted to SAMA within a maximum of one working day based on abovementioned instructions. 33. Reports shall be submitted to SAMA via e-mail: [email protected] 34. SAMA, at its sole discretion, may apply Article 31-b to subscriptions that do not fall under the definition of a large-scale IPO or Government Offering. 10. Implementation and Effective Date 35. These Rules shall come into force from issuing date.