October 29, 2026 · Jurisdiction Briefing · 8 min read

Saudi Arabia: what SAMA’s AML rules require on every wire transfer, and the transfers they say not to accept

Saudi Arabia’s wire transfer rules start with a core list: the originator’s and beneficiary’s names and account numbers travel with the payment. The Saudi Central Bank (SAMA) then adds requirements of its own: the purpose of the transfer, a declaration from the customer, a bar on charitable transfers into and out of the Kingdom, and a rule for foreign-currency transfers that only pass through it.

This briefing works from two texts in SAMA’s rulebook. The first is Article 10 of the Anti-Money Laundering Law (Royal Decree No. M/20, 5/2/1439H) and the eleven paragraphs of its Implementing Regulation (No. 14525, 19/2/1439H, In-Force). The second is Section 14, Wire Transfer, of SAMA’s AML/CTF Guide, issued by circular No. (18318/486) dated 20/3/1441H, corresponding to 17 November 2019, and shown as In-Force. The rulebook files the Guide under “All Financial Institutions”.

What is covered

The Implementing Regulation applies Article 10 to cross-border and domestic wire transfers in any currency, including serial payments and cover payments, that a financial institution in the Kingdom receives, sends or processes. It includes credit, debit and prepaid cards, mobile phones and other digital devices when they are used to make a person-to-person transfer of funds.

Two kinds of transfer are outside the scope:

a transfer that flows from a card, phone or similar device used exclusively to buy goods or services, provided the card number accompanies the transfer;
a transfer or settlement between two financial institutions where both the originator and the beneficiary are financial institutions acting on their own behalf.

The Guide’s paragraph 14.8 repeats both exclusions. Neither Article 10 of the Implementing Regulation nor Section 14 sets an amount below which the information requirements stop applying.

The information that goes with the transfer

The Law sets the principle. A financial institution that provides wire transfers must obtain information on the originator and beneficiary and make sure it stays with the transfer, or the related message, throughout the payment chain. If it cannot obtain the required information, it must not permit the transfer to be executed.

Paragraph 10/2 of the Implementing Regulation lists the minimum:

Originator: full name; the account number used for the transaction or, where there is no account, a unique transaction number that permits traceability; and the originator’s address, or customer identification, or date and place of birth.
Beneficiary: full name; and the account number or, where there is no account, a unique transaction number.

The Guide’s paragraph 14.1 asks for more. Before processing a transfer, the institution obtains the originator and beneficiary information, keeps it with each transfer and verifies it. Its list adds the originator’s ID number as one of the options, and a sixth item: the purpose of the wire transfer and the relationship between the originator and the beneficiary. If the institution cannot meet paragraph 14.1, paragraph 14.9 says it should not perform the transfer.

The customer’s declaration

Paragraph 14.2 has no counterpart in Article 10 of the Implementing Regulation. Before executing a wire transfer, the institution obtains a declaration from the customer. In it the customer confirms knowing that Saudi Arabia’s laws prohibit transferring funds without knowing the beneficiary, without a legal relationship with the beneficiary, or without a legitimate purpose.

Read with the purpose and relationship fields in 14.1, the declaration puts the customer’s own statement on file. In our view, that statement is useful evidence when the purpose given turns out to be untrue, and the purpose and relationship fields give monitoring something to test.

The ordering institution

Under paragraph 10/3, the ordering institution includes verified originator information and the required beneficiary information with each transfer. Where there is a suspicion, it files a suspicious transaction report under Article 15 of the Law. If it cannot comply, it must not order the transfer.

Batch files. Where several individual cross-border transfers from one originator are bundled for several beneficiaries, paragraph 10/4 requires the batch file to carry the verified originator information, beneficiary information that is fully traceable within the beneficiary country, and the originator’s account number or a unique transaction reference number. The Guide’s paragraph 14.3 says the same.

Domestic transfers. Paragraph 10/5 allows a lighter message. If the ordering institution can make all the required information available to the receiving institution or the competent authorities by other means, the transfer may carry only the account number or a unique reference that links it to that information. The ordering institution must then produce the information within three business days of a request from the receiving institution or a competent authority. Paragraph 14.4 of the Guide sets the same three working days.

Intermediaries and receiving institutions

For cross-border transfers, an institution processing an intermediary element of the chain keeps all the originator and beneficiary information that accompanies the transfer (paragraph 10/7). Where technical limitations stop that information from staying with a related domestic transfer, the intermediary keeps a record for ten years of everything it received (paragraph 10/8).

The receiving institution, and any intermediary, must have and apply procedures for three things (paragraph 10/9; Guide paragraph 14.5):

identifying wire transfers that lack the required originator or beneficiary information;
deciding, on a risk basis, when to execute, reject or suspend such a transfer;
taking risk-based follow-up action, which may include restricting or terminating the business relationship.

An institution ultimately receiving a cross-border transfer takes reasonable measures to identify transfers with missing information. These may include post-event monitoring, or real-time monitoring where feasible. If the beneficiary’s identity has not been verified before, the receiving institution verifies it and keeps the information (paragraph 10/10; Guide paragraph 14.6).

Confidentiality rules under Saudi law do not stop an institution from exchanging information with other domestic or foreign institutions processing part of the transaction (paragraph 10/11; Guide 14.7). Paragraph 14.13 adds that information exchanged with a correspondent or an intermediary must be used only for authorised purposes.

Records. Article 10 of the Law requires all originator and beneficiary information to be recorded and kept under Article 12. Article 12 sets a period of no less than ten years from the date of concluding the transaction or closure of the account.

The Saudi-specific rules

Charitable transfers. Paragraph 14.10 says institutions should not accept executing a wire transfer abroad in any currency for charitable purposes, regardless of the source of funds or the beneficiary. Paragraph 14.11 applies the same bar to transfers received from outside the Kingdom. A footnote sets an exception: where SAMA has approved certain parties to transfer gifts, subsidies or donations under specific conditions, the institution acts on that approval.

The Guide’s legal framework explains why. It cites Supreme Royal Order No. (55871) dated 09/11/1436H, which makes the King Salman Humanitarian Aid and Relief Center the sole authority to collect relief, charitable or humanitarian donations, from government or private sources, for delivery to those in need outside the country. SAMA restated this in circular No. 000046005535 of 30 July 2024 (24/1/1446H, In-Force). It told institutions to ensure that such donations and external transfers are made through the Center, and to review donation operations through external platforms using bank and credit cards.

Foreign-currency transfers passing through. Paragraphs 14.14 to 14.16 deal with a transfer received from outside the Kingdom for a beneficiary at a financial institution outside the Kingdom:

if it is in a currency other than the Saudi riyal, the institution must not receive it;
if it is in Saudi riyals, it may be received, taking into account paragraphs 14.1, 14.5 and 14.8;
the institution receiving such a riyal transfer must set out its purpose clearly and in detail.

Occasional customers. The Guide’s paragraph 5.7 says that when a transaction for an occasional customer involves a money transfer or a cheque, the institution takes a copy of the ID, or passport and visa, and meets the Wire Transfer Section. Paragraph 5.8 limits what an occasional customer may do: currency exchange, money transfer and cashing of cheques are allowed up to SAR 5,000 or its equivalent per transaction, or no more than SAR 50,000 or its equivalent in one year. The Implementing Regulation also requires due diligence before carrying out a wire transfer for a customer who is not in an established business relationship (paragraph 7/1(c)).

Reading the English against the Arabic

SAMA’s rulebook also carries both texts in Arabic. Three points are worth checking against the Arabic; the readings below are our own translations.

Paragraph 10/10: whose identity. The English Implementing Regulation says the receiving institution “shall verify the identity of wire-transfer sender’s information”. The Arabic says the beneficiary: هوية المستفيد من التحويل, the identity of the beneficiary of the transfer, which the institution verifies if it has not done so before. The Guide’s English paragraph 14.6 says “beneficiary”, in line with the Arabic. Treat the English “sender’s” as a translation slip.
Paragraph 14.10: which direction. The English says “a cross-border wire transfer”. The Arabic says تحويل برقي إلى خارج المملكة, a wire transfer to outside the Kingdom, which makes 14.10 the outgoing rule and 14.11 the incoming one. Together they cover both directions.
“Should” in the Guide. The English Guide says “should” in 14.1 (obtain, keep and verify the information) and 14.9 (do not perform the transfer). The Arabic opens both with على المؤسسة المالية, “the financial institution must”. In our reading these are obligations, and the Law’s Article 10 says the same in mandatory terms.

What to do with it

These are our suggestions, not SAMA’s.

Map your payment data to both lists. Check that the purpose and the originator-beneficiary relationship (Guide 14.1) are captured for every transfer, alongside the 10/2 fields.
Keep the declaration where you can find it. Decide whether paragraph 14.2 is met by a standing clause or by a declaration per transfer, record the decision, and make sure the customer’s declaration can be retrieved with the transfer record.
Write the missing-information procedure. Paragraph 10/9 needs a documented risk basis for executing, rejecting or suspending, and a follow-up path that can end a relationship. Include repeat offenders among ordering institutions.
Screen for charitable purposes. Build the purpose field and the Center-only rule into transfer review in both directions, and keep SAMA’s approval on file for any party allowed to transfer donations. Include card donations through external platforms, as the 2024 circular asks.
Test the pass-through rule. Confirm that a non-riyal transfer from abroad for a beneficiary abroad is stopped, and that riyal transfers of that kind carry a detailed purpose.
Set the occasional-customer limits in the system. SAR 5,000 per transaction and SAR 50,000 a year are limits a payment system can enforce.
Be ready for a domestic request. If you rely on paragraph 10/5, make sure you can answer a receiving bank or an authority within three business days.

Sources

This article draws on the following sources. Follow the links for the original text.

For information only. This briefing is not legal advice: check the cited sources and take advice on your own position.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator saudi-arabia