SAMA Outsourcing: A Clear Guide to the 4 Core Rules

SAMA outsourcing rules turn a commercial decision into a supervised one. Once an arrangement is classified as material, a Saudi financial institution cannot simply sign it — the Saudi Central Bank’s prior no-objection is required, and the accountability for the outsourced activity stays exactly where it was.

This guide covers the materiality test, what a no-objection submission has to show, what belongs in the contract, and the cloud question that catches most programmes.

The principle behind the SAMA outsourcing rules

The SAMA outsourcing rules rest on one idea: you can outsource the activity, but not the responsibility. The board and senior management remain accountable for outsourced functions as if they were performed in-house, and SAMA’s supervisory reach follows the activity to the provider. That single idea explains every requirement that follows — due diligence, contract terms, audit and access rights, monitoring, exit planning.

It also explains why the rules bite hardest on concentration. An arrangement that is unremarkable for one bank becomes a supervisory concern when the same provider serves most of the sector.

The materiality test

Classification is the decision the whole SAMA outsourcing regime turns on. A SAMA outsourcing arrangement is treated as material where failure or poor performance would meaningfully affect the institution, its customers or its regulatory standing. In practice you assess:

• Criticality of the activity — is it core banking, payments, credit decisioning, or a supporting service?
• Impact of failure on customers, on financial position, and on the ability to meet regulatory obligations.
• Data involved — customer data raises materiality on its own, whatever the activity.
• Substitutability — how quickly the service could be moved or brought back in-house.
• Aggregation — several small arrangements with one provider can be material together even when each is not.

Write the criteria down and apply them consistently, because the classification is the first thing a supervisor will test. Understating materiality to avoid a submission is the mistake that turns a routine approval into a finding.

Material means prior no-objection

For material SAMA outsourcing arrangements, the institution seeks a non-objection before entering into the contract. The submission has to show the work already done rather than promise it: the business case, the due diligence on the provider, the risk assessment, the proposed contract terms, the monitoring arrangements and the exit plan. Build the timeline into the deal — a supervisory submission is not a formality to run in parallel with signature.

What the contract has to carry

Audit and access is the clause providers resist and the one you cannot trade away — a supervisor’s right of access that exists only in your regulatory file and not in the contract is worth nothing.

Data location, cloud, and the question everyone asks

Offshoring is where SAMA outsourcing programmes slow down. Arrangements that place customer data or core processing outside the Kingdom attract additional scrutiny and, in the general case, prior approval — and the answer depends on the activity, the data and the current framework rather than on a blanket yes or no. Before designing an architecture around a foreign region, confirm the current position in the SAMA Rulebook and with your supervisor. It is the single question most worth asking early, because it constrains the whole solution.

The related cybersecurity requirements travel with the arrangement: third-party controls sit inside the SAMA Cyber Security Framework, and the maturity expectation applies to how you manage providers, not just to your own estate. Our guides to SAMA compliance and the CSF maturity model and SAMA CSF vs NCA ECC cover that side.

Where SAMA outsourcing programmes go wrong

Materiality decided by contract value. A cheap service holding customer data can be more material than an expensive one that does not.

Due diligence performed once. The rules expect ongoing monitoring, not a pre-signature assessment filed away for five years.

Exit plans that are paragraphs. An exit plan naming a successor, the data format, the transition period and who pays is a plan. “Terminate on 90 days’ notice” is a clause.

Sub-outsourcing unmonitored. The chain beyond your direct provider is where concentration and location risk actually sit, and where the register is usually silent.

Frequently asked questions

What counts as material outsourcing?
An arrangement whose failure would significantly affect the institution, its customers or its ability to meet regulatory obligations. Customer data involvement and core activities push arrangements into materiality quickly.

Do we need SAMA approval before signing?
For material arrangements, yes — a prior no-objection. Non-material arrangements are governed by your internal framework, and still have to be registered and monitored.

Can data be hosted outside Saudi Arabia?
It depends on the activity and the data, and it attracts additional scrutiny. Confirm the current position in the Rulebook and with your supervisor before committing to an architecture.

Does this apply to fintechs and insurers?
SAMA-supervised entities are subject to its outsourcing requirements, with the detail varying by sector. Check which rules instrument applies to your licence category.

Who owns the arrangement internally?
The board and senior management remain accountable. A named business owner plus a central register and monitoring function is the structure that survives supervision.

Where this leaves you

Get the materiality criteria written and applied consistently, then build the no-objection timeline into the deal rather than around it. Secure audit and access rights for SAMA as well as for yourself, settle the data location question before the architecture is fixed, and make monitoring and exit planning ongoing obligations with owners. The accountability never leaves your board — the paperwork is just how you demonstrate you understood that.

References

• SAMA Rulebook — Rules on Outsourcing — the current requirements as published by the Saudi Central Bank.
• SAMA rules and instructions — the wider set of circulars and frameworks that apply alongside them.

More on Saudi financial regulation

• SAMA outsourcing — you are here
• SAMA compliance and the CSF
• SAMA CSF vs NCA ECC
• Third-party risk management

Materiality assessments, contract checklists and the outsourcing register are in the SAMA Compliance Toolkit, or start with the free ISO templates.