On this page
Delivered with a verified NCA-registered partner
Summit runs VAPT for Saudi banks, insurers and fintechs end to end with our verified NCA-registered partner firm, and has served 115+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Talk to our team.
That distinction between annual (CSF) and twice yearly (CRFR) is the most common mix-up we see in Saudi fintech compliance decks.
Which SAMA document applies to you?
| You are | Main framework | Pentest expectation in the text |
|---|---|---|
| A licensed bank, insurer, finance company or other SAMA Member Organization | SAMA Cyber Security Framework (CSF) | Customer and internet-facing services: annual review and penetration tests (3.2.4) |
| A fintech entering SAMA’s Regulatory Sandbox, or applying for a licence | Cyber Resilience Fundamental Requirements (CRFR) | PT twice a year as a minimum, or after major or critical change (3.2.6) |
SAMA states that the CRFR does not replace its Cyber Security and Business Continuity frameworks. Once licensed, you are expected to comply with the full set of SAMA requirements. Many fintechs simply keep the twice-yearly rhythm after licensing. It is rarely wasted.
What 3.2.4 actually requires
Under “Cyber Security Review”, the CSF says:
- cyber security reviews should be performed periodically for critical information assets;
- customer and internet-facing services should be subject to annual review and penetration tests;
- details of each review (results, issues, recommended actions) should be recorded and reported to the business owner;
- follow-up reviews should confirm that issues were addressed and that critical risks were treated effectively.
The last point matters. SAMA’s text makes the follow-up part of the requirement, so a pentest with no tracked remediation and retest is half a control.
Maturity: why “we did a test” is not enough
The CSF assesses Member Organizations against a maturity model, and section 2.4 of the framework states that Member Organizations “should at least operate at maturity level 3 or higher”, with level 3 defined as “Structured and formalized”. In practice, a level 3 testing programme looks like this:
- Defined: a documented pentest standard with scope rules, a cadence and rules of engagement.
- Implemented consistently: every in-scope service tested on schedule, not just the flagship app.
- Followed up: findings tracked to closure, with retests documented.
Higher maturity levels add measurement: trend metrics, time to remediate, repeat-finding rates. SAMA also has a separate framework for intelligence-led red teaming of larger institutions, Financial Entities Ethical Red-Teaming (FEER). It sits alongside routine penetration testing and does not replace it.
Scoping a SAMA-ready penetration test
For a typical Riyadh bank or Jeddah payments company, “customer and internet-facing services” usually includes:
- internet and mobile banking apps (iOS and Android), with their APIs;
- open banking and partner APIs;
- payment pages and merchant portals;
- customer onboarding and e-KYC flows;
- internet-facing infrastructure: gateways, VPNs, email;
- third-party hosted components you are responsible for.
Two practical notes. First, production testing at a bank needs explicit authorisation, agreed windows, stop conditions and coordination with the SOC. Write these into the rules of engagement. Second, if your institution also owns or operates CNI, NCA’s ECC-2:2024 and possibly CSCC apply too. Map one test to all applicable controls rather than buying three separate tests.
The evidence a SAMA examiner expects
- Pentest policy or standard, approved through your governance.
- Annual test plan covering every customer and internet-facing service.
- Reports with methodology, severity ratings and evidence.
- Remediation tracker and retest reports (the “follow-up reviews” in 3.2.4).
- Reporting to business owners, plus summaries to the cyber security committee.
How Summit helps
Summit delivers VAPT for financial institutions with our verified NCA-registered partner firm, scoped to SAMA CSF 3.2.4, to the CRFR for sandbox and licence-stage fintechs, and to NCA controls where they apply. We handle the engagement end to end, from rules of engagement through retest and the evidence pack, and we have supported 115+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. A risk assessment from our services complements testing for the CSF’s risk management domain.
Make your next SAMA review uneventful
Talk to Summit about a pentest programme mapped to SAMA CSF and CRFR. Explore mobile app VAPT.
Related reading: ECC-2:2024 penetration testing · CSCC testing cadence
Frequently asked questions
Does SAMA require annual penetration testing?
Yes, for customer and internet-facing services. SAMA CSF subdomain 3.2.4 says they should be subject to annual review and penetration tests.
Where does the SAMA twice-a-year penetration testing rule come from?
From the Cyber Resilience Fundamental Requirements (CRFR), control 3.2.6, which applies to entities entering SAMA's Regulatory Sandbox or seeking a licence.
Do fintechs in the SAMA sandbox need penetration testing?
Yes. The CRFR sets penetration testing at least twice a year, or after a major or critical change.
What maturity level does SAMA expect?
Section 2.4 of the SAMA CSF states that Member Organizations should at least operate at maturity level 3 or higher, where level 3 means structured and formalized.
Does the SAMA CSF replace NCA requirements?
Not necessarily. Institutions that own or operate critical national infrastructure may also be in scope for NCA's ECC and CSCC.
