New Banking Products and Services Regulation

The risk management function must perform comprehensive fraud risk assessment covering fraudulent events across different channels and assessment of prevention, detection, and investigation capabilities from people, process and technology perspective taking into consideration emerging technologies. The risk assessment must also include evaluation of all possible scenarios and dynamic fraud techniques such as social engineering, phishing. that ensures safety and soundness of the bank against dynamic fraudulent scenarios. In addition, the bank must enforce defense in depth mechanism in their environment to ensure deep protection for the customers such as using multichannel technique to ensure customer identity and confirmation of the financial service/transaction for example: registration and activation/approval of services from different channels whenever applicable. 6.3.9 The risk management function must conduct comprehensive risk assessment which cover cyber resilience and data privacy including evaluating threats, vulnerabilities and weaknesses needed to be analyzed for potential impact on the bank that leads to improve member organizations cyber posture. 6.3.10 The risk management function must assure that its people, systems and processes have the ability to adequately capture and report risks and financial commitments relating to its new products and services in a timely manner. 6.3.11 The risk management function must assure that all material risks posed by the introduction of new products and services or by the modification of existing products and services are identified, assessed, monitored and managed appropriately; and must be regularly reviewed in light of the changing market conditions not previously factored. 6.3.12 The risk management function must assess how new products and services will affect the bank's current and projected financial and capital positions. 6.4 Products and Services Compliance The compliance function must ensure the following: 6.4.1 Review all new products and services from compliance, regulatory and financial crimes perspective and ensure that they conform to all applicable rules and regulations issued by SAMA and all other relevant regulators. 6.4.2 Products and services offered are compliant with all rules and regulations issued by SAMA and all other relevant authorities at all time. 6.4.3 Identify the risks of non-compliance that might arise from products and services, set plans to manage it, and evaluate these risks at least once annually. 6.4.4 Report to the Board at least once annually the risks of non-compliance and how it would be mitigated. 6.4.5 The compliance function must be the main contact point for liaison for submission of all applications for non-objection to introduce new products and services and to notify SAMA of any products and services in cases where non-objection is not required. 6.5 Products and Services Auditing The internal audit function must ensure the following: 6.5.1 Timely identification of internal control weaknesses, adherence to regulatory requirements and products and services policies and procedures. 6.5.2 To audit all new products and services in a reasonable time i.e. within one year after launching the product or service depending on the nature, type, complexity, and riskiness of the new products and services. 6.5.3 Report to the Audit Committee the results of the audit process that was conducted on the bank’s products and services at least once annually. In case, products and services associated risks increase or violating any rules and regulations issued by SAMA and all other relevant regulators, the internal audit must include them in their yearly audit plan. 6.6 Product Development Function The product development function (business units) must ensure the following: 6.6.1 They are familiar with products and services policies and procedures and all applicable rules and regulations issued by SAMA and all other relevant regulators.