SAMA expects banks and other regulated institutions to govern outsourcing as a board-level risk. Here is how to turn the rules into a working process.
SAMA’s Rules on Outsourcing set requirements for regulated financial institutions that outsource activities to third parties, including group entities. Always work from the current text published by SAMA; this guide summarizes the practical implications.
| Requirement | What to have in place |
|---|---|
| Outsourcing policy | Board-approved policy, roles and risk appetite |
| Materiality assessment | Documented method to decide whether an arrangement is material |
| Regulatory approval | SAMA non-objection obtained before material outsourcing |
| Due diligence | Capability, financial, security and compliance review of the provider |
| Contract | Service levels, confidentiality, audit and access rights, sub-contracting, termination and exit |
| Location | Assessment of outsourcing outside the Kingdom and data location |
| Monitoring | Ongoing performance and risk monitoring, periodic review |
| Exit | Documented and realistic exit strategy |
Outsourcing oversight overlaps with NCA ECC subdomain 4-1 (third-party cybersecurity) and SAMA Cyber Security Framework domain 3.4 (third-party cyber security). One assessment process can evidence all three if questionnaires are mapped to each.
Boards should approve the outsourcing policy, receive regular reporting on material arrangements and be informed of significant issues. A quarterly report covering the outsourcing register, material arrangements, non-objection status, overdue reviews, open issues and exit-plan testing gives the board what it needs to discharge its oversight responsibilities.
NAZZTEC AI TPRM automates this end to end — with AI assistance, segregation of duties, analytics and signed reports — and is available as SaaS, in your private cloud or on-premises, hosted in the Kingdom. Our consultants design and run the process alongside it through our Governance, Risk & Compliance services.
Next step: request a demo of NAZZTEC AI TPRM or read more on the product page.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
Spreadsheets and e-mailed questionnaires cannot keep up with hundreds of vendors. Here is what AI-driven TPRM software must deliver — and where human judgement must stay in charge.
A 300-question spreadsheet sent to every supplier produces fatigue, not assurance. Design questionnaires by tier, ask for evidence, and review answers consistently.
Every asset passes through the same stages. Control each transition and the register stays accurate without annual clean-ups.
Tell us what you are working on. A senior NAZZTEC consultant will come back within one business day with a practical view.
We respond to every enquiry within one business day.