Saudi RegTech is moving from filing reports to proving controls continuously

Compliance in Saudi financial services used to be a reporting function. An institution ran its business, and periodically produced evidence that it had done so within the rules. The direction of travel now is different in kind, and it changes what compliance costs and who supplies it. SAMA's 2026 supervisory roadmap, published in February, names three priority areas: digital payments and fintech, non-bank financial institutions, and cross-border correspondent banking. Those are precisely the segments that have grown fastest and that sat, until recently, in a lighter supervisory position than the banks. The clearest expression of the change is in licensing. Fintech licences obtained after 1 July 2026 are reported to require AML controls meeting the same standards as traditional banks, including suspicious activity reporting within a same-day window. Read that requirement carefully, because it is not a reporting obligation in the old sense. Same-day filing means detection has to happen in something close to real time, which means monitoring has to be automated, which means the control is a running system rather than a periodic review. That is the whole shift in one clause. A quarterly report can be produced by people with access to data. A same-day obligation cannot. The wider framework points the same way. SAMA's approach already emphasises continuous monitoring, risk-based detection, electronic monitoring systems and prompt suspicious transaction reporting, alongside its counter-fraud framework setting expectations for how institutions prevent, detect and respond to fraud. Open banking added technical standards for data sharing, payment initiation and system security as a condition of licensed activity. The consequence for buyers is that compliance stops being a cost centre staffed by people and becomes an infrastructure purchase with an uptime requirement. If a control has to demonstrate that it was operating at every moment, it needs logging, retention, alerting and an audit trail that a supervisor can inspect. Those are engineering properties. Institutions that treated compliance as a documentation exercise discover that their evidence does not exist in a form anyone can verify after the fact. This is also why compliance has become a real software market in the Kingdom rather than a services one. Mozn, the Riyadh-based enterprise AI company, has built FOCAL as a combined fraud and anti-money-laundering platform covering onboarding, in-app activity, payments and ongoing monitoring, and in January 2026 FOCAL was named a category leader in Chartis Research's RiskTech Quadrant for both AML transaction monitoring and KYC data and solutions. A domestically built platform recognised in a global category ranking is a meaningful data point about where this capability is being produced. The regional dimension matters for the same reason. A monitoring system tuned on Western transaction patterns generates false positives on ordinary behaviour in this market, and false positives are the actual cost of compliance technology. Every alert is a person's time, and a system with poor precision consumes the headcount it was bought to replace. Local pattern knowledge is a genuine technical advantage rather than a marketing claim, and it is the argument that has allowed regional vendors to compete with much larger incumbents. There is a limit that deserves stating. Continuous control evidence sounds like continuous supervision, and those are not the same thing. Emerging approaches may eventually allow institutions to provide dynamic compliance data directly to the regulator, enabling ongoing supervision rather than periodic review, but that is a described direction rather than an implemented system. Nothing published indicates that Saudi institutions are today streaming control evidence to SAMA in real time, and buyers should not purchase on the assumption that they will need to imminently. The counterpoint to the whole framing is worth giving. Tightening AML standards on newer entrants raises the cost of entry, and the companies most affected are the small ones the licensing regime was partly designed to enable. A framework that makes a startup meet bank-grade obligations from day one is safer and slower. The alternative, a permanently lighter regime for smaller institutions, produces the regulatory arbitrage that has caused problems in other markets. Both effects are real and the trade is a judgement rather than a mistake. For anyone assessing RegTech at Money20/20, the questions that separate products are narrow. What is the false positive rate, measured how, and on what population. What evidence does the system retain, for how long, and in what form. Can it produce a same-day filing without a person in the loop. And has it been examined by a supervisor in this market, which is the only test that counts.