SAMA Senior Appointment Requirements: Non-Objection, Saudisation and Training

If your firm is supervised by the Saudi Central Bank (SAMA) and you are about to appoint a board member, a managing director or a head of compliance, the appointment is not yours to make alone. SAMA operates a written non-objection regime, and the rulebook that governs it also carries obligations on qualifications, Saudisation, training and annual competence assessment that most firms discover only when a file is returned.

This guide works through the Requirements for Appointments to Senior Positions in Financial Institutions Supervised by SAMA, Second Edition issued in 2019 under document number 199400000067 and dated 9 September 2019. It is still the operative text. Everything below is taken from the articles themselves, and where the rulebook is silent on a point employers usually ask about, this guide says so rather than filling the gap.

The non-objection gate

Article 7 is the centre of the regime. A financial institution must obtain SAMA's written non-objection before a nomination to the board proceeds, and before an appointment is made to any of the senior management positions the rulebook lists. This is not a notification after the fact. It is a prior consent requirement, and the institution carries the burden of making the case.

Article 8 then closes the obvious loophole. Until the non-objection is in hand, the candidate may not assume the responsibilities of the position, may not exercise the role in practice, and — the provision most often breached inadvertently — the appointment may not be announced. A press release, an internal all-staff email or a LinkedIn update naming the person in the role before SAMA has responded is itself a breach of Article 8, independent of whether the person has started work.

Practically, that means the communications plan has to be sequenced behind the regulatory plan. Firms that treat the SAMA filing as a back-office formality running in parallel with onboarding and announcement routinely get this wrong.

Interim and acting appointments

Article 9 deals with the case every operations team hits: a senior position falls vacant and somebody has to cover it. An interim appointment of up to six months still requires non-objection. There is one carve-out, and it is narrow — a cover arrangement of 20 business days or less falls outside the requirement.

So a two-week absence is manageable internally. A three-month acting arrangement is a regulated appointment and needs a filing, even though nobody's title has formally changed.

Qualifications, and how they must be verified

Article 14(b) sets the substantive standard: the candidate must hold the necessary academic qualification for the position, or adequate experience and skills. It is phrased as an alternative, which gives firms real flexibility on candidates who came up through the business rather than through a credential.

Article 6 is where firms get caught. Certificates must be verified, and the rulebook names the acceptable routes: through the issuing body's own website, by direct contact with the issuer, or through a verification agency. A photocopy of a degree certificate in the personnel file is not verification under Article 6. If your HR process accepts documents at face value, that process does not meet the requirement, and the gap is visible the moment SAMA asks how a qualification was confirmed.

Saudisation and the replacement plan

Article 3 establishes priority for Saudi nationals in senior positions. Where a non-Saudi is appointed, the institution must have a replacement plan, and the rulebook is specific about what the plan contains: the procedures, the programmes and the courses through which a Saudi national will be prepared for the role, and the time period required to do it.

This is the provision that turns a Saudisation commitment into a training obligation with a documented syllabus and a date attached. A plan that says "we will recruit locally when a suitable candidate emerges" does not contain procedures, programmes, courses or a time period, and does not meet Article 3.

Article 4 goes further and reserves thirteen positions for Saudi nationals. Across financial institutions generally these are human resources, information security and cyber security, information technology, chief compliance officer, anti-money laundering and counter-terrorist financing, anti-financial crimes, anti-fraud, legal affairs, governance and board secretary, and financial enforcement. For insurance firms the list extends to customer services, motor claims and individual sales.

Read that list against your organisation chart before you begin a search. Several of those are roles firms habitually fill from the regional expatriate market, and the restriction is absolute rather than a preference.

The training obligation

Article 5.2(b) requires that specialised training programmes be continuously implemented. The word that matters is "continuously" — this is a standing programme requirement, not an induction box to tick.

What the rulebook does not do is state a number of CPD hours. There is no annual hours figure in this text. Firms benchmarking against the hours-based regimes elsewhere in the Gulf will find nothing equivalent here, and should not invent one; the obligation is that programmes exist, are specialised to the role, and run continuously. If you are mapping obligations across several jurisdictions, our guide to the UAE Central Bank's CPD and training plan requirements sets out a regime that does work on a filed plan, and the contrast is instructive.

Funding and delivery sit outside this rulebook. On the practical side of building the programmes an Article 3 replacement plan commits you to, the HRDF and Hadaf support available to Saudi employers is the route most firms use.

Annual assessment and records

Article 21 requires the institution to assess senior position holders at least annually. Article 15 requires the assessment to be documented. Together they create a recurring evidence obligation: the firm must be able to show, for each senior appointment, a dated assessment made within the last twelve months.

Article 15 does not state a retention period. That is a genuine silence in the text rather than an omission in this guide. Most firms default to the retention period that applies under their other SAMA obligations, and that is a reasonable position, but it is a firm decision rather than a rulebook requirement.

The notification calendar

The rulebook carries a set of deadlines expressed in business days, and they are easy to miss because they sit in separate articles:

• Article 10 — 30 business days and 20 business days, depending on the notification
• Article 16 — 5 business days
• Article 18 — 10 business days
• Article 22 — 5 business days
• Article 23 — biannual reporting, at the end of June and the end of December

Two of those are five-business-day windows. A notification obligation that short cannot be met by a process that routes through a monthly governance committee. It needs a named owner and a standing diary entry.

What to do with this

Three things are worth checking this week. First, whether any of the thirteen Article 4 positions in your firm is held by a non-Saudi, because that is a compliance question rather than a recruitment one. Second, whether your qualification checks actually satisfy Article 6, or whether they stop at collecting a document. Third, whether every senior position holder has a documented assessment dated within the last twelve months, as Article 21 requires.

Beyond that, the Article 3 replacement plans are where most of the real work sits, because they require named programmes and courses rather than an intention. Firms building that capability can see how structured CPD and professional development programmes are typically put together.

Limitations worth stating: this guide is built on the Second Edition 2019 text and does not cover the sector-specific appendices. A later SAMA circular on this subject is published in Arabic only and has not been read for this guide. Verify any specific appointment against the current text and your own legal advice.