New Banking Products and Services Regulation

They are competent and appropriately trained; and thoroughly understand the products and services’ features, characteristics, risks, and ensure that corrective actions are taken to mitigate identified risks related to products and services. 6.7 Products and Services On-going Monitoring and Control 6.7.1 Banks must ensure that the requirement of monitoring products and services on an ongoing basis is in place and implemented, to ensure that the interests, objectives and characteristics of targets market continue to be appropriately taken into account. In addition, the banks must address consumer complaints and rectify them on timely basis. 6.7.2 If the bank identifies a problem/risk related to products or services in the market, or when monitoring the performance of the products or services as required, the bank must take necessary corrective actions and implement measures to prevent future recurrence. The corrective action plan, which may include suspension or withdrawal of products or services must be approved by the senior management function or other functions within the bank accountable for approval of product and services. Banks must also report to SAMA such incidents including the corrective action plan that have been or will be taken. 6.7.3 In the case of product or services suspension or withdrawal, banks are required to notify SAMA at least prior to (45) business days by email before suspending or withdrawing any products or services via ( [email protected] ) . The notification must include justifications for the suspension or withdrawal and the plan to deal with beneficiary customers (exiting plan) affected by discontinuation of products or services. 6.7.4 After the introduction of new products or services, SAMA may, at any time, suspended the product or service if any regulatory incompliance has been identified and/or there is a negative impact on the banking sector or on consumers. SAMA will direct banks to provide corrective actions in such case for approval and implementation. 6.8 Documentations and Reporting Requirement 6.8.1 Banks are required to submit a report to SAMA which include all products and services. The report must be signed by the Chief Executive Officer, and submitted by Compliance Function to Banking Licensing Division via ( [email protected] ) – by 1 st March of each year, according to the table provided in (Annexure 5) . 6.8.2 Banks must document all actions taken while implementing the internal policies and procedures, preserve these documents for audit purposes and to make them available to SAMA upon request. In addition, the banks must retain all the documents relating to the risk assessment of the new products and services including key risks from both the bank’s and customer’s perspective, together with the systems and processes that are in place to mitigate these risks. 6.8.3 An inventory of bank’s existing products and services containing information such as (but not limited to): name of a product and service, target market, risk classification, developer of the product or service, reviewer of the product, approver of the product, approval date, launch date, last review date, latest changes made including the description and the date of changes. 7. Notification and Non-Objection Requirements 7.1 Notification Requirements The following requirements applies to banks that satisfy the required maturity level in Cyber Security Framework , Counter-Fraud Framework , Business Continuity Framework , and Information Technology Governance Framework , which must be independently validated by a qualified and experienced third party on annual basis. 7.1.1 Banks are required to notify SAMA by email at least (10) business days before launching any new products and services via ( [email protected] ) .