Enter the Quantum State
Burraq Quantum

AI strategy and governance · Riyadh

AI strategy and governance for fintech companies in Riyadh

We help fintech companies in Riyadh choose which AI uses are worth funding. The rules we write then show your compliance lead and your partner bank how that AI is controlled.

Enter the Quantum State

The problem

Most fintech companies in Riyadh already use AI somewhere. A support agent drafts replies with a chatbot. A risk analyst pastes transaction data into a tool to spot fraud patterns. Often nobody approved the tool, and nobody checked where the customer's financial data went. Your compliance lead will want that answered before anyone else asks.

The AI projects that matter tend to stay small. A pilot that speeds up know your customer checks or flags suspicious payments works in a demo, then stops. The model is rarely the reason. The data it can reach was never agreed, and nobody owns the result or can show how each decision is checked and logged. A payments firm licensed by SAMA and an investment platform under the CMA face different questions, so a generic policy fits neither.

Selling raises the stakes. Your buyers may be banks, government-linked companies or large private groups in Riyadh. If so, the decision sits with senior people and passes through several layers of approval. Their security and compliance reviewers now ask how your AI is controlled. They expect written answers, often in Arabic as well as English. A strong first meeting can stall at that stage.

What you get

  • AI inventory: Every AI tool your support, risk, growth and product teams already use, approved or not, and which customer financial data each one touches.
  • Uses worth funding: A short list such as onboarding checks, fraud review or support, each with a business case and how its return will be measured.
  • Build, buy or partner: A decision for each tool, with your partner bank's requirements and where customer data is stored and transferred weighed before you commit.
  • AI policy for staff: Which tools, which customer data and which decisions a person must approve, written so a marketer or support agent can follow it.
  • Risk register and approval rules: Mapped to SAMA or the CMA, the PDPL, NCA controls and the terms in your partner bank and enterprise contracts.
  • Named owners: Who runs each system, who approves changes and who answers for it when a partner bank, auditor or buyer asks.

What it looks like

A payments provider selling software to banks

A payments provider in Riyadh sells reconciliation software to banks and wants AI agents to handle support tickets and back-office checks. Each bank's security review asks how those agents are controlled, and the team has no written answer. After an inventory, a staff policy and a risk register mapped to NCA controls and the PDPL, each agent has a named owner and an approval rule. The team can now answer the review in writing instead of rebuilding the answer for every buyer.

A consumer lending app with unapproved tools

A consumer lending app in Riyadh finds staff summarizing loan applications in public AI tools, with personal data inside. Leadership also wants AI in underwriting, and the compliance lead blocks it. The inventory shows where customer data has gone. The short list puts support replies first and keeps a person approving every credit decision. Staff get a policy that names the approved tools, and the first use goes live with the rules tested on real work.

The rules that apply in Riyadh

Saudi Arabia does not have a single AI law. AI governance here is a mix of data law, sector regulators and published national guidance. For fintech, SAMA covers banking, payments and the licensing of financial technology firms. The CMA covers securities and investment related services. Which one applies depends on what you do.

The Personal Data Protection Law (PDPL), overseen by SDAIA, governs how personal data is collected, used, stored and transferred. That matters as soon as customer data feeds an AI tool. SDAIA also publishes AI ethics principles. The NCA sets national cybersecurity standards, including the Essential Cybersecurity Controls, and the CST regulates cloud services. Your risk register is mapped to the rules that apply to you. We are not a law firm, so we work with your lawyers, and current requirements should be confirmed with them.

How we work with companies in Riyadh

We work with fintech companies in Riyadh from Dubai, and we have no office in Riyadh. The work runs with your senior leadership, compliance lead and technology team, and every system ends with a named owner on your side. Buyers here often ask how a consultant builds local skills. For that reason we plan from the start how your own staff will run the rules after we step back. Whether documents are needed in Arabic is agreed in each engagement's scope.

Questions

Does Saudi Arabia have one AI law that applies to fintech?

No. AI governance in Saudi Arabia is a mix of data law, sector regulators and published national guidance. For a fintech that usually means the PDPL, SAMA or the CMA depending on your activity, NCA cybersecurity controls and SDAIA's AI ethics principles. Requirements change, so confirm the current position with your lawyers.

Do you replace our lawyers or compliance team?

No. We are not a law firm and we do not give legal opinions. With your compliance lead, we build the plan, the policy, the risk register and the approval rules. Your lawyers then review how they map to SAMA, CMA and PDPL requirements.

What will we have at the end of the work?

You leave with a plan your leadership can fund, the rules that keep AI safe and a named owner for each part. That covers the AI inventory, a short list of uses with business cases, the staff policy, the risk register and a rollout plan for the first uses. Each part is written so you can share it in a partner bank or buyer review.

More for Fintech in Riyadh

AI strategy and governance elsewhere

Start here

Start witha straightanswer.

A 30-minute call to see whether we can really move your numbers. You leave with a clear next step, even if we never work together.

Enter the Quantum State