What the Saudi Central Bank’s BCM Framework asks of the financial sector in the Kingdom, in plain words.
SAMA, the Saudi Central Bank, has issued a Business Continuity Management Framework for its member organisations, to strengthen operational resilience so that operations and services stay available around the clock. The requirements are drawn from SAMA’s own supervisory expectations, industry practice and international standards and guidance, including ISO 22301, ISO 27001, the BCI good practice guidelines and DRII professional practices. Member organisations are required to comply and to build the framework formally into their continuity programme. The framework also connects to related areas of the organisation such as enterprise risk management, health, safety and environment, physical security, cyber resilience and incident management.
It applies to SAMA member organisations, all banks operating in Saudi Arabia, banking subsidiaries of Saudi banks, and subsidiaries of foreign banks in the Kingdom, across the organisation’s full scope including subsidiaries, employees, subcontractors, third parties and customers. If your organisation works in or with the Saudi financial sector, this framework is worth understanding.
The Saudi Central Bank, the Kingdom’s central bank and financial regulator.
Issued under a 2017 circular and shown as In-Force on the SAMA Rulebook when this page was written.
Banks, finance-sector firms, payment systems, payment services providers and credit bureaus.
Draws on SAMA requirements plus ISO 22301, ISO 27001, BCI and DRII guidance.
An awareness summary of the thirteen requirement areas of the framework, section by section.
Board-level ownership and a funded, committee-led programme.
Continuity work aligned with the organisation’s strategic objectives.
A policy that states the commitment and what continuity is for.
Analysis of every relevant activity to find its continuity and recovery needs.
Plans that can actually be invoked when disruption hits.
Recovery of the technology the business depends on.
Continuity with a deliberate link into cyber security work.
A declared crisis structure with communications ready.
The programme proven by exercise, at set frequencies.
The people in the programme trained, every year.
A set reporting rhythm with the supervisor.
The framework documents kept under formal review.
Independent eyes on the programme at set intervals.
As described in the SAMA framework; confirm current requirements with SAMA. Key terms: MAO is the time beyond which disruption to a product or service becomes unacceptable; RTO is the time within which a product, service or activity must resume; RPO is the point data must be restored to; IT DR is the recovery of the technology infrastructure behind critical processes.
As described in the SAMA framework; confirm current requirements with SAMA.
A business continuity exercise, and a disaster recovery test alongside it.
The test programme for the year ahead shared with SAMA.
Test results shared with SAMA after each test.
An improvement action plan, after test results go to SAMA.
ADOX’s work is aligned with ISO 22301, UAE NCEMA 7000 and the BCI Good Practice Guidelines, as the live site states. SAMA’s framework draws on standards ADOX works with, including ISO 22301 and the BCI good practice guidelines. See the BCMS Framework, the BCM Maturity Model, NCEMA 7000 Awareness and Operational Resilience.
Business continuity programme framework review.
Business continuity programme peer review, auditing and benchmarking.
Business impact analysis and risk assessments.
Business continuity exercises and crisis simulations.
Business continuity awareness training and e-learning.
Design and implementation of business continuity and crisis management frameworks.
ADOX is not affiliated with, endorsed by or approved by SAMA, cannot certify, approve or guarantee compliance, and performs no SAMA-specific assessments or gap analyses. This page is general information, not legal, regulatory or compliance advice.
Read the current framework from SAMA itself. The rulebook’s text, including its Arabic version, prevails.
Source: SAMA Rulebook: Business Continuity Management Framework
We aim to reply to your enquiry within 2 hours.