Instructions for Practicing Aggregation Activity

Developing the procedures necessary to ensure the provision of up-to-date information, such as the national address. 5. Requirements for the Retention of Information Provided Taking into account the laws and instructions related to data and information protection issued by the competent authorities, the entity shall, at a minimum: 5.1 Develop the necessary procedures and controls to maintain the confidentiality of all data and information obtained through the platform, and not disclose such data and information to any external party unless SAMA’s prior approval is obtained and in a manner consistent with the relevant regulations. 5.2 Ensure the security, integrity and availability of the information provided through the platform, including, but not limited to, the information provided for the consumer and the information collected and stored by the entity or the other party it contracted with as a service provider. The entity shall particularly protect the consumer’s personal information from loss and unauthorized access, including use, modification and disclosure. 5.3 Keep all consumer documents, records and files in an orderly, clear and safe manner and ensure that all files are complete and updated regularly, for a period of at least 10 years from the date of the end of the relationship with the consumer. 6. Conflict of Interest The entity shall develop an appropriate written organizational policy that addresses potential conflicts of interest. Such policy must include adequate measures to be taken to avoid and address any conflict of interest to ensure fair treatment of all consumers and financiers. 7. Disclosure The entity shall: 7.1 Clarify and post on its platform all terms and conditions of the platform, security instructions, payment methods, information confidentiality, any other instructions related to the use of the platform, and all data that must be disclosed under the relevant laws and instructions. 7.2 Disclose all fees and commissions charged for the entity’s services. 7.3 Post on its platform the entity’s licensing information. 8. Obligations of the Entity 8.1 The entity shall strengthen the platform’s cybersecurity and promptly deal with any cases of breach. In case of a breach, the entity shall immediately notify SAMA. 8.2 The entity shall ensure that the electronic linkage between the entity and the financier serves the provision of aggregation activity only and is not used for any other purposes, unless approved by SAMA. 8.3 The entity shall have on its platform a feature that allows consumers to communicate directly with the entity to submit feedback and complaints. This feature must also allow for documentation and preservation of any communication occurring through it. 8.4 The entity shall set appropriate approvals and acknowledgments and allow consumers to read and agree to them before using the platform, provided that such approvals and acknowledgments are shown as a Pop-Up Window. 8.5 The entity shall inform, through the documented channels, the consumer of the reason if the finance application is not accepted or of the need to submit additional documents if required. 8.6 The entity shall consider the needs and desires of consumers and provide them with information in a clear, transparent and not misleading manner. 8.7 The entity shall provide visual and print messages and materials to raise awareness of and educate consumers about major risks, thus helping them make informed and effective decisions before obtaining finance from the financier. 8.8 The entity shall not receive or deliver funds on behalf of the financier unless SAMA’s approval is obtained. 8.9 The entity shall make a list of the financiers it deals with so that the consumer can choose from them. 8.10 The entity shall not participate in any marketing campaigns for any financier and shall not prefer a financier to another.