Banking & Fintech

Why this matters

Saudi banks and fintechs operate under one of the strictest regulatory perimeters in the region — SAMA's Payment Service Provider framework, Open Banking rules, NCA cybersecurity controls, and ZATCA Phase 2 e-invoicing all apply simultaneously. Add in mandatory 3-D Secure 2.0 on every online Mada transaction, AML monitoring obligations, and customer expectations set by STC Pay's mobile-first UX, and the cost of building or maintaining a Saudi-grade financial product is high. Mantiqi builds the engineering layer that lets you ship in this environment without compromising on either compliance or product velocity.

How we deliver

1. 01

   Regulatory scope + threat model

   Weeks 1–2

   We map your product surface to the relevant SAMA framework (PSP / SVF / Open Banking), NCA cybersecurity controls, AML / KYC obligations, and ZATCA touchpoints. You leave with a written compliance plan that says which licences you hold, which you need, and what your aggregator covers.

   • SAMA framework fit-gap analysis
   • Threat model + data-classification map
   • AML / KYC workflow blueprint
   • Data-residency + tenant architecture
2. 02

   Secure foundation build

   Weeks 3–8

   We build the secure core: payment / wallet integrations (Mada, STC Pay, Apple Pay, aggregator route), KYC / Nafath identity verification, transaction monitoring, audit logging, and 3-D Secure 2.0 on every online card flow. Penetration testing is built into each sprint, not deferred to UAT.

   • Mada + STC Pay + Apple Pay integrations
   • Nafath KYC + sanctions screening
   • Transaction monitoring + AML rules engine
   • Encrypted audit trail + tamper-evident logs
3. 03

   ZATCA + reporting

   Weeks 7–10

   For B2B fintech and merchant-acquirer products: wire the quote-to-cash flow through ZATCA Phase 2 clearance so every invoice gets a Fatoora UUID + QR code before it leaves the system. SAMA reporting feeds are stood up alongside.

   • ZATCA Phase 2 Fatoora clearance pipeline
   • SAMA reporting + reconciliation feeds
   • Tax invoice templates (B2B + B2C)
   • Finance reconciliation dashboard
4. 04

   Go-live + run

   Ongoing

   Penetration test + SAMA pre-launch review support, runbook handover, SOC-style monitoring, and a release cadence aligned to SAMA's annual cyber audit. We don't disappear at go-live — managed services keep the compliance posture intact.

   • External penetration test + remediation
   • Production monitoring + alerting
   • Quarterly compliance refresh
   • Annual SAMA cyber-audit support

Compliance & regulators we work with