SAMA expectations and AI operations roles in Saudi banks

Saudi banks that use AI agents remain fully answerable to the Saudi Central Bank for security, continuity and fair treatment of customers. SAMA's frameworks on cybersecurity, business continuity, outsourcing and consumer protection, together with the Personal Data Protection Law, mean banks need staff who review agent decisions, protect access and escalate problems. Those are the AI operations roles.

What does SAMA expect of the people around agents?

SAMA supervises banks, insurers, finance companies and payment service providers in Saudi Arabia. It has not issued one rulebook for AI agents. Its existing frameworks, in substance, cover what an agent touches: cybersecurity, including staff awareness and access control; business continuity, so critical services keep running through disruption; outsourcing and third-party risk, which reaches AI platforms and model providers; and the fair treatment of customers, including clear communication and proper complaint handling.

Two national layers sit alongside. The Personal Data Protection Law governs how personal data is collected, used and disclosed. SDAIA, the national data and AI authority, has published AI ethics principles that many organisations use as a reference for responsible AI.

For staff, that adds up to four duties: keep the agent within its permitted scope, protect access and data, treat customers fairly in every approval, and escalate incidents through the bank's process.

Who is covered?

Banks licensed by SAMA, along with insurers, finance companies and payment firms under its supervision. Large Saudi banks run major operations centres in Riyadh, Jeddah and the Eastern Province, and digital banks and fintechs licensed by SAMA add further demand.

Saudi employers operate under national workforce localisation policies, so check whether a role is open to your situation before applying. That shapes the market for both Saudi nationals and expatriates.

Which roles and competence does this create?

Saudi bank adverts are often in English, sometimes Arabic, with titles such as operations officer, customer service officer, KYC analyst, fraud analyst and quality assurance specialist. Read the duties for review, exceptions, approvals, quality checks and escalation.

Around agents, SAMA's expectations land in these roles:

• KYC and onboarding reviewer. Checks agent-prepared customer files and approves or rejects onboarding. The route from analyst work is described in AI operations careers for KYC analysts in Saudi Arabia.
• Customer servicing reviewer. Approves agent-drafted replies and account changes against fair treatment expectations, including for complaints.
• Fraud and payments reviewer. Holds agent-drafted payment actions, alert to social engineering.
• Operations or practice manager. Coordinates the team, the queues and the escalation route. See AI operations careers for practice managers in Saudi Arabia.
• Agent owner. Answers for one agent's scope and controls, and for evidence when SAMA or internal audit asks.

The common competence is controlled, documented decision-making. Saudi banks are closely supervised, and they value staff whose records show they followed the process.

How do you show employers you meet SAMA's expectations?

What might a Saudi interviewer ask?

1. "The agent drafted a reply to a customer complaint that promises a refund the policy does not allow. What do you do?" Correct the draft, explain the right position to the customer clearly, and report the pattern to the agent owner.
2. "The agent's provider has an outage during peak hours. What happens to customers?" Move urgent work to people, inform the incident owner, and follow the continuity plan.
3. "A caller claiming to be a branch manager asks you to approve a held transfer urgently. Do you?" Not without verification through the bank's process. Urgency is a common social engineering tactic.

A KYC analyst we will call Noura prepared by explaining how she verified documents for corporate customers and where an agent could miss forged details. It turned a general question into a precise answer. Contacts help too in this market; see how to network into AI operations roles.

What do SAMA's expectations not cover?

They do not certify individuals or require a specific AI course. They do not apply to firms outside SAMA's supervision, which answer to the PDPL and other authorities. SDAIA's AI ethics principles are guidance rather than detailed rules. And SAMA's expectations differ in detail from those of supervisors elsewhere; compare NYDFS expectations and AI operations roles in New York financial services.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where the Academy fits

Pryme Intelligence Academy's Operator track covers human review, teaching the agent and what to do when something goes wrong, with module tests set in banking for a banking candidate. Certified Pryme Operator includes a two-week practicum signed off by an assessor. The certificate is issued through VerifyDoc.ai and can be checked by number or QR code, which helps when an employer verifies credentials from another country.