- info@dumusileyoziinc.co.za
Our expert staff is standing by to answer your questions
- (800) 123 1234
Our expert staff is standing by to answer your questions
The Saudi Central Bank (SAMA) introduced the Cyber Resilience Fundamental Requirements (CRFR) in January 2022 as part of its commitment to strengthen the cyber resilience of the Kingdom’s financial sector. The CRFR framework was specifically designed for newly established entities, fintech startups, and financial service providers that are either seeking entry into the SAMA Regulatory Sandbox or applying for a license to operate in Saudi Arabia.
In today’s digital economy, customers expect uninterrupted services, flawless user experience, and strong protection of their sensitive data. With the rapid growth of fintech solutions, online banking platforms, and digital payment services, organizations face increased exposure to cyberattacks, fraud, and operational disruptions. SAMA CRFR addresses these challenges by defining a minimum but fundamental set of cybersecurity and resilience requirements that organizations must implement to ensure service availability, data confidentiality, and regulatory compliance. By adopting SAMA CRFR compliance, organizations not only meet licensing requirements but also establish a foundation for trust, operational stability, and long-term growth.
The CRFR framework is structured into three key domains, each addressing essential aspects of cybersecurity and operational resilience. Together, they form the baseline controls that financial institutions must implement before scaling towards advanced frameworks like SAMA CSF (Cybersecurity Framework) and BCMF (Business Continuity Management Framework).
Key requirements include:
Establish a cybersecurity governance structure with defined responsibilities.
Develop and approve policies, procedures, and standards.
Conduct periodic reviews to keep policies aligned with evolving threats.
Integrate cyber and fraud risk assessments into business models.
Enforce strong password and access control policies.
Implement Identity and Access Management (IAM).
Enforce change management and secure SDLC practices.
Maintain secure network architecture and encryption protocols.
Conduct regular vulnerability assessments and penetration tests.
Deploy SIEM and monitoring tools for continuous incident detection.
Ensure timely patching and endpoint protection.
The resilience domain ensures that organizations can withstand, respond to, and recover from disruptions, whether caused by cyberattacks, system failures, or natural disasters.
Defining, approving, and periodically testing Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP).
Establishing backup and restoration procedures, including:
Backup frequency (daily, weekly, monthly).
Encryption of sensitive data.
Secure offsite or offline backup storage.
Secure destruction of obsolete backup media.
Conducting restoration tests to ensure data can be recovered quickly and reliably.
We offer a structured approach to help organizations achieve SAMA CRFR compliance through comprehensive audit, consultancy, and advisory services.
1. Gap Assessment: A detailed review of your current controls, governance, and resilience measures against SAMA CRFR requirements.
2. Risk Identification and Mapping: Each gap is analyzed to determine the cyber and business risks it poses, ensuring remediation is risk-driven.
3. Remediation Roadmap: We provide a prioritized, step-by-step action plan for achieving compliance efficiently.
4. Implementation Support: Our consultants assist in deploying the required policies, technical safeguards, and resilience measures.
5. Independent Compliance Audit: We perform a full audit to ensure your entity meets all CRFR controls before SAMA reviews or licensing.
6. Ongoing Advisory & Training: Since threats evolve, we provide continuous guidance, awareness training, and compliance monitoring.
Adopting SAMA MVC is not just about ticking a regulatory checkbox, it’s about building a trusted, resilient, and secure fintech environment.
Regulatory Obligation: Mandatory for organizations applying for a SAMA license or participating in the Regulatory Sandbox.
Enhanced Cyber Resilience: Strengthens your ability to anticipate, withstand, and recover from cyberattacks, fraud, and operational disruptions.
Customer Confidence: Demonstrates your commitment to safeguarding data and ensuring uninterrupted services, building stronger trust with clients.
Foundation for Future Compliance: Serves as a steppingstone towards broader SAMA frameworks such as the Cybersecurity Framework (CSF) and Business Continuity Management Framework (BCMF).
Reduced Licensing Risks: Minimizes the chance of application rejection, regulatory penalties, or operational restrictions due to non-compliance.
Partnering with us for SAMA CRFR compliance audit and consultancy services ensures that you are working with experienced professionals who understand both local regulatory requirements and global best practices.
Extensive experience with SAMA CRFR, CSF, BCMF, and MVC, ensuring deep understanding of regulatory expectations.
From gap assessments and remediation planning to audits and ongoing advisory, we provide complete compliance support.
Customized solutions that align security and resilience requirements with your unique business model and operational needs.
Trusted by fintech startups, financial institutions, and regulated entities across the Kingdom.
Recommendations designed to achieve compliance while minimizing disruption and supporting long-term growth.
Fintech Saudi, launched in April 2018 by the Saudi Central Bank in partnership with the Capital Market Authority, is dedicated to catalyzing the growth of the financial services technology (fintech) industry in Saudi Arabia. As the Saudi Arabian Financial Technology Initiative, Fintech Saudi aims to transform the Kingdom into an innovative fintech hub with a thriving and responsible ecosystem.
By fostering innovation, collaboration, and growth within the fintech sector, Fintech Saudi facilitates partnerships between startups, financial institutions, regulators, and other stakeholders.
This initiative drives digital transformation in the financial sector, enhances financial inclusion, and positions Saudi Arabia as a leading fintech hub in the region. Fintech Saudi provides comprehensive support to fintech startups, offering regulatory guidance, conducting research, and organizing events and programs to nurture the fintech community in the Kingdom.
United Kingdom
Australia
Saudi Arabia
Bahrain
Qatar
UAE
Ghana
© All rights reserved@GRC360