Saudi Arabia Adopts Financial Oversight Law: What Businesses Should Know

Saudi Arabia adopted a new Financial Oversight Law and SAMA’s proposed payments framework signal a clear move toward stronger, risk-based oversight of public funds and critical financial infrastructure. For investors and businesses operating in the Kingdom, early alignment with these rules will be key to managing compliance risk and supporting sustainable growth.

On December 12, 2025, Saudi Arabia published the Financial Oversight Law (hereinafter, the “Law”), issued by Royal Decree No. (M/122) dated 10/06/1447H, following approval under Council of Ministers Decision No. (415) dated 4/6/1447H. The Law repeals and replaces the Financial Representatives Law issued in 1960, marking a substantive shift away from a legacy framework that relied heavily on embedded financial representatives and prescriptive controls.

The new Law introduces a modern, risk-based approach to the oversight of public funds, reflecting the Kingdom’s broader efforts to strengthen fiscal discipline, enhance transparency, and modernise public financial management.

Oversight is no longer conceived as a uniform or intrusive mechanism, but instead as a flexible, report-driven model that allows the Ministry of Finance (MoF) to tailor its supervision based on the nature, scale, and risk profile of the funds or activities involved. This evolution is particularly relevant given the increasing role of private-sector participation in government projects, procurement, and revenue-related activities.

Overview of Saudi Arabia Financial Oversight Law

Scope of application

The Law applies automatically and comprehensively to all government entities. In addition, and of particular significance for the private sector, the Law extends to non-government entities that meet specific statutory triggers linking their activities to public money or delegated public financial functions.

Where a private entity receives direct support from the State Treasury, executes works or procurement on behalf of a government entity, or collects public revenues pursuant to law or contract, the MoF is empowered to exercise oversight. Crucially, this oversight is limited to the relevant funds, activities, systems, and records connected to the public-finance function in question, rather than the entity’s business as a whole.

The Law also preserves institutional boundaries by explicitly excluding certain bodies from its scope, including:

• The Saudi Central Bank;
• The Oversight and Anti-Corruption Authority; and
• The General Court of Audit.

These exclusions reflect the continuation of separate statutory mandates and supervisory competencies for these institutions.

Timing and implementing regulations

The Law will enter into force 120 days after its publication, on April 11, 2026.

An implementing regulation is expected to be issued around the same time and will play a decisive role in shaping compliance in practice. The regulation is anticipated to define key concepts, including thresholds for application, reporting formats, submission timelines, and procedural rules governing MoF oversight.

Until these details are clarified, entities potentially in scope are expected to adopt conservative interpretations and prepare for evolving compliance requirements.

Non-government entities

The three statutory triggers

Coverage of non-government entities under the Law is determined by three functional triggers, each tied directly to public finances or delegated public roles. A private entity falls within scope where it:

• Receives direct financial support, grants, or subsidies from the State Treasury;

• Executes works or undertakes procurement on behalf of a government entity; or

• Collects public revenues pursuant to a statute or a government contract.

These triggers reflect a functional, rather than institutional, approach to oversight. The focus is on how public money is handled or administered, regardless of whether the entity itself is public or private.

Activity-based coverage

Find Business Support

Navigate shifting trade dynamics with expert tariff advisory to reduce costs and safeguard your supply chain.

Importantly, the Law adopts an activity-based model of oversight. MoF supervision applies only to the specific activities, financial flows, systems, and records associated with the public funds or delegated functions, and does not extend automatically to an entity’s entire operations. This distinction is particularly relevant for diversified companies, contractors, or special purpose vehicles that engage in both public and private projects.

The implementing regulation is expected to clarify key interpretive issues, including what constitutes “direct” Treasury support and how to assess whether activities are performed “on behalf of” a government entity. These clarifications will be central to determining the scope and intensity of oversight for many private-sector participants.

Oversight mechanisms and compliance obligations

Report-based oversight by the MoF

For in-scope non-government entities, oversight under the Law is primarily report-based. The MoF may request periodic reports and supporting documentation relating to the relevant public funds or activities, assess internal control frameworks, and issue observations or require corrective actions where deficiencies are identified. This approach is designed to be proportionate and targeted, avoiding the need for embedded financial representatives or prior approval of private expenditures.

The detailed procedures, formats, and timelines for reporting will be set out in the implementing regulation, which is expected to operationalize Article 13 of the Law and shape day-to-day compliance practices.

Core obligations for in-scope entities

Entities subject to oversight must:

• Provide the MoF with access to relevant information, systems, and records;
• Maintain effective internal controls and audit trails; and
• Respond promptly to any observations or requests issued by the Ministry.

Where violations occur (such as refusal of access, provision of inaccurate information, failure to respond, or failure to implement corrective measures) entities are required to document, remediate, and report back on the actions taken.

Implications for government contractors, PSP projects, and SPVs

For companies doing business with the Saudi government, the Financial Oversight Law introduces a clearer (and more structured) set of expectations around how public funds are managed. Contractors that receive direct Treasury funding, act as procurement agents, or are delegated purchasing authority should expect closer, but more targeted, engagement with the MoF. Oversight will focus on how public money is used within a specific project, not on a company’s wider commercial operations.

The Law is especially relevant for Private Sector Participation (PSP) projects and special purpose vehicles (SPVs). Where an SPV receives capital grants, procures public assets, or collects tolls, fares, or regulated fees that qualify as public revenues, those activities will fall squarely within scope. In practice, this means investors and sponsors will need to pay closer attention to how project cash flows are structured, tracked, and reported.

SAMA’s consultation on the oversight framework for payment systems

Why it matters to the market

Find Business Support

Execute the right market entry plan with our expert advisory support.

Alongside the Financial Oversight Law, the Saudi Central Bank (SAMA) has proposed a major update to how payment systems and their operators are supervised in the Kingdom. Released for public consultation in November 2025, the draft Oversight Framework is designed to modernise regulation in line with Saudi Arabia’s rapidly growing digital payments market.

For investors, banks, fintech firms, and payment providers, the message is clear: Saudi Arabia is aligning its payments oversight with global best practice. The proposed framework builds on the Law of Payments and Payment Services and formally incorporates international standards such as the CPMI-IOSCO Principles for Financial Market Infrastructures. This alignment is intended to support market confidence, resilience, and long-term growth.

Formal classification of systemically important payment systems

One of the most commercially significant proposals is the formal classification of systemically important payment systems (SIPS). Under the draft framework, systems may be designated as systemically important based on objective criteria such as transaction volumes, transaction values, and the number of participants.

For fast-growing platforms, this creates a clearer pathway, but also a clearer compliance horizon. Systems that are not currently classified as SIPS may transition into that category as they scale, triggering higher governance, risk-management, and reporting expectations.

Cross-regulatory coordination and market impact

The proposed framework also formalises cooperation between SAMA and the Capital Markets Authority, particularly for shared infrastructures and payment-linked market utilities. For businesses active across banking, payments, and capital markets, this should result in more consistent regulatory treatment and fewer grey areas between supervisory regimes.

Taken together, these changes point to a more mature and integrated financial ecosystem.

Banks, fintech firms, and cross-border payment providers should expect closer scrutiny, but also benefit from clearer rules and a more stable operating environment.

What businesses should do now

For companies already operating in Saudi Arabia—or considering entry—the immediate priority is to understand where these frameworks may apply. This means mapping exposure under the Financial Oversight Law, identifying any use of public funds or delegated public roles, and assessing whether payment activities could fall within SAMA’s expanded oversight perimeter.

Practical preparation includes reviewing internal controls, reporting systems, data segregation, and governance structures, as well as stress-testing contracts and project structures against the new oversight model. Payment system operators should also begin assessing their alignment with PFMI standards, particularly if rapid growth could push them toward systemically important status

Conclusion: A clear signal to the market

Find Business Support

HR & Payroll Compliance Advisory

Together, the Financial Oversight Law and SAMA’s proposed Oversight Framework send a strong signal to investors and businesses: Saudi Arabia is building a more transparent, risk-aware, and internationally aligned financial oversight environment. For companies that handle public funds, deliver government-linked projects, or operate critical payment infrastructures, early preparation will be a competitive advantage.

Rather than viewing these developments as purely regulatory hurdles, businesses that engage early and structure their operations accordingly can position themselves as trusted partners in the Kingdom’s next phase of growth.

• Previous Article UAE Unveils Sweeping Capital Markets Reform with Two New Federal Decree Laws
• Next Article UAE Civil Transactions Law Updates: Age Limits, Contracts, Expats Assets Implications