Saudi Arabia AML Law 2017: What Accountants Should Know

Saudi Arabia's anti-money laundering (AML) rules for accountants start with the Anti-Money Laundering Law issued by Royal Decree No. M/20 on 14 November 2017. This guide works from the English text of that Law as published on the website of the Ministry of Investment (MISA). It sets out what the Law itself says, and is clear about the practical points it leaves to the Implementing Regulations, which we could not open when writing this guide.

How accountants come into the picture

Article 1(8) of the Law defines designated non-financial businesses and professions (DNFBPs) only as "any commercial or professional activity specified by the Regulations". The Law therefore does not list accountants as a DNFBP in that definition. Article 15, which deals with reporting, does refer to persons providing legal or accounting services. In short, whether and how a particular accountancy service is caught depends on the Regulations, so you need to read both together.

The Ministry of Commerce has also published guidelines for the sector. The copy we read is dated January 2017, which is before the Law was issued in November 2017, and it lists chartered accountants among the covered businesses. Because it pre-dates the Law, we have not used its monetary thresholds, and you should ask the Ministry for the current version.

Who monitors compliance

The Law defines a "monitoring agency" in Article 1(12) as the body that verifies compliance by financial institutions, DNFBPs and non-profit organisations. Under Article 25 it can issue warnings and orders, impose fines of up to five million riyals per violation, and take licensing action. The Law does not name the monitoring agency for accountants. That depends on the Regulations and on the sector's designated authority, which we have not confirmed.

Customer due diligence

Article 7(1) requires covered institutions to apply due diligence measures in dealings with customers, with the Regulations setting out the types of measure. Article 7(2) makes the scope risk-based and calls for enhanced measures where the money laundering risk is high. The detail on identification, beneficial owners and thresholds sits in the Regulations. For the general principles, see our guide to customer due diligence in accountancy practices.

Record keeping

Article 12(1) requires records to be kept "for at least ten years from the date of completion of the transaction or closure of the account". Under Article 12(3), the Public Prosecution may extend that period. Compared with the five-year minimum in some other countries, such as Ghana, this is a long period, so check your storage and deletion routines.

Reporting suspicions

Under Article 15, where there is suspicion or reasonable grounds, the entity must "immediately and directly" notify the General Administration of Financial Investigations, which Article 17 identifies as the financial intelligence unit and which reports to the President of State Security. Reports must include all available data on the transaction and the parties. The Law sets no number of days. The word is "immediately".

Tipping off

Article 16(1) prohibits entities and their staff from alerting customers or any other person about a report or investigation. Article 16(2) says reporting in good faith carries no liability towards the person reported. The article itself sets no penalty.

Penalties in the Law

These are the headline penalties in the text we read:

• money laundering by an individual (Article 26): imprisonment of not less than two and not more than 10 years, or a fine of not more than five million riyals, or both;
• aggravated cases (Article 27): imprisonment of three to 15 years, or a fine of up to seven million riyals, or both;
• legal persons (Article 31(1)): a fine of not more than fifty million riyals and not less than double the value of the funds involved;
• administrative fines (Article 25): up to five million riyals per violation.

What we could not confirm

• The Implementing Regulations, which define the DNFBPs, the due diligence detail and any cash threshold, were not accessible to us.
• Which authority supervises accountants and auditors, and how professional licensing bodies fit in.
• Whether the Law has been amended since the version we read on the MISA site.
• Whether auditors are treated differently from accountants.

Practical steps: our suggestions

These are our suggestions, not requirements of the Law.

1. Read the Law with the Implementing Regulations before deciding whether a service is in scope.
2. Ask your licensing or supervisory authority for the current sector guidance in writing.
3. Build a reporting route that can reach the financial intelligence unit "immediately", with a named reporting officer.
4. Keep records for at least ten years from completion or account closure.
5. Train staff on tipping off, since the Law prohibits it outright.

For the global standards behind these rules, see our guide to the FATF recommendations, and for a comparable regime in practice, our guide to Pakistan.

Frequently asked questions

How long must records be kept in Saudi Arabia?

At least ten years from completion of the transaction or closure of the account, according to Article 12(1) of the Law. The Public Prosecution may extend it.

Who receives suspicious activity reports?

The General Administration of Financial Investigations, the financial intelligence unit named in Article 17.

Are accountants definitely covered?

Article 15 mentions persons providing legal or accounting services, but the definition of DNFBPs depends on the Regulations. Confirm your position with the relevant authority.

This guide is general information, not legal advice.