Anti-Money Laundering Law in Saudi Arabia: Duties and Penalties

Saudi Arabia’s Anti-Money Laundering Law makes it a crime to convert, transfer, conceal, acquire, hold or use money or property while knowing it is the proceeds of a crime. It also places preventive duties on financial institutions and on a defined list of non-financial businesses and professions: know your customer, monitor transactions, keep records, and report suspicious transactions to the General Directorate of Financial Intelligence. The penalties include imprisonment and fines, which can be imposed together, as well as confiscation of the funds involved. This guide is general information, not legal advice on a specific case.

What money laundering means under Saudi law

Money laundering usually aims to give funds that come from a crime the appearance of a lawful source. The law covers acquiring, holding, using, converting, transferring or concealing funds while knowing that they are the proceeds of a crime. The crime that produced the money is called the predicate offense, and the law treats laundering as a separate crime from it. Attempting to launder money, and helping, inciting or agreeing with others to do it, are also punishable.

Laundering is usually described in three stages:

• Placement: introducing illegal cash into the financial system, for example through deposits, purchases of valuable goods, or mixing it with the takings of a cash business.
• Layering: moving the money through many transfers, accounts, companies or invoices so the trail becomes hard to follow.
• Integration: bringing the money back into the economy as what looks like clean income, such as property, company shares or business profits.

Trade is a common channel: over-invoicing or under-invoicing, fake service contracts and loans between related companies with no commercial reason all move value. That is why the law reaches beyond banks to businesses that see these transactions every day.

Who must comply with the law

The criminal provisions apply to everyone: any person or company that launders money commits a crime. The preventive duties, however, fall on two groups.

Financial institutions

Banks, money exchange and transfer businesses, finance companies, insurance companies and securities firms. Each is supervised by the authority that licenses it, such as the Saudi Central Bank (SAMA) for banks or the Capital Market Authority for securities firms, and each authority issues its own detailed rules.

Designated non-financial businesses and professions

• Real estate agents and brokers when they take part in buying or selling property for clients.
• Dealers in precious metals and precious stones.
• Lawyers, notaries, accountants and other independent legal and accounting professionals when they prepare or carry out certain transactions for clients, such as buying and selling property or businesses, managing client money, securities or bank accounts, organizing contributions to set up companies, or setting up and managing companies.

Each of these sectors has a supervisory authority, and for several of them it is the Ministry of Commerce. The implementing regulations and the supervisor’s guidance set out exactly which activities trigger the duties, so check the text for your own sector.

Core duties for businesses covered by the law

The duties follow a risk-based approach: the higher the risk of a customer, product or transaction, the deeper the checks must go.

• Assess your risks. Identify and document the money laundering risks in your customers, products, delivery channels and the countries you deal with, and keep the assessment up to date.
• Know your customer (KYC). Identify every customer and verify that identity from reliable documents before starting the relationship or carrying out a covered transaction.
• Identify the beneficial owner. Find the natural person who ultimately owns or controls the customer, not only the name on the commercial registration.
• Apply enhanced due diligence to higher-risk cases, including politically exposed persons, complex structures with no clear purpose, and dealings linked to high-risk countries.
• Monitor on an ongoing basis. Check that transactions match what you know about the customer and their business, and update the customer file when something changes.
• Keep records. Retain identification documents, account files and transaction records for the period set by the law, in a form that lets you rebuild a transaction if the authorities ask.
• Stop when checks cannot be completed. If you cannot complete due diligence, do not open the relationship or carry out the transaction, and consider whether a report is needed.

Internal controls and training

A covered business must have internal policies, procedures and controls that match its size and risks. In practice this means:

• A compliance officer at management level with the authority and access to information needed to do the job.
• Written procedures for onboarding, monitoring, escalation and reporting that staff actually use.
• Screening when hiring staff for sensitive roles.
• Regular training so front-line staff can recognize warning signs and know whom to tell.
• An independent review that tests whether the controls work, with its findings followed up.

Supervisors look at how the program works day to day, not only at the policy document.

Reporting suspicious transactions

If a covered business suspects, or has reasonable grounds to suspect, that funds are the proceeds of a crime or linked to terrorism financing, it must report to the General Directorate of Financial Intelligence without delay. The duty includes attempted transactions that were never completed. The report should set out the parties, what happened, the amounts and dates, and the reason for suspicion.

Three rules apply once a report is made:

• No tipping off. You must not tell the customer or anyone else that a report has been filed or is being considered.
• Do not investigate on your own. Your role is to report what you saw; the investigation belongs to the competent authorities.
• Keep cooperating. Keep the records and respond to requests for further information from the authorities.

The law protects those who report in good faith from liability for disclosing the information.

Penalties for money laundering in Saudi Arabia

The law punishes money laundering with imprisonment, a fine, or both, and the penalty can be increased when aggravating circumstances listed in the law are present, for example when the crime is committed through an organized criminal group or when the offender abuses a public office or a position of influence.

Other consequences can follow:

• Confiscation of the laundered funds, their proceeds and the instruments used in the crime, or of property of equal value.
• Penalties on companies. A company used in laundering can be fined and face other sanctions, and this does not shield its managers or staff from personal liability.
• Penalties for breaching preventive duties. A covered business that fails to check its customers, keep records, report suspicions or keep a report confidential can face administrative penalties from its supervisor, ranging from warnings and fines to restrictions on its activity and suspension or cancellation of its license, even when no laundering is proven.

The exact ranges of imprisonment and fines, and the full list of aggravating circumstances, are in the law itself: read the official text published by the Bureau of Experts at the Council of Ministers rather than figures quoted on social media.

Common compliance mistakes

• Assuming the law only concerns banks, when real estate, gold and some professional services are covered too.
• Collecting identity documents once and never updating them.
• Stopping at the company name and not identifying who really owns and controls it.
• Accepting large cash payments without asking where the money came from.
• Telling a customer that their transaction is “under review for money laundering”.
• Keeping a policy on file that no one has been trained on.

Frequently asked questions

Where to start

Start by confirming whether your activity is covered, then name a compliance officer, write down your risk assessment and customer checks, train your staff and set up a clear reporting route. Innovant’s advisors can help you organize the documentation, customer files and internal procedures around these duties. For a specific legal question or an open investigation, speak to a licensed lawyer, and follow your supervisor’s guidance.

Book a free consultation with an Innovant advisor.