INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(272895, 26310, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignleft\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"508\" height=\"338\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
(272896, 26310, 'MetaLink', 'content'),
(272897, 26310, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7961&amp;action=edit'),
(272898, 26310, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignleft\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"508\" height=\"338\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>|<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignright\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"508\" height=\"338\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
(272899, 26310, 'ClientIP', '86.98.5.18'),
(272900, 26310, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(272901, 26310, 'CurrentUserID', '8'),
(272902, 26310, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(272903, 26311, 'PostID', '7961'),
(272904, 26311, 'PostType', 'law_update_articles'),
(272905, 26311, 'PostTitle', 'Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
(272906, 26311, 'PostStatus', 'publish'),
(272907, 26311, 'PostDate', '2018-08-01 07:31:23'),
(272908, 26311, 'PostUrl', 'http://www.tamimi.com/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
(272909, 26311, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7961&amp;action=edit'),
(272910, 26311, 'ClientIP', '86.98.5.18'),
(272911, 26311, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(272912, 26311, 'CurrentUserID', '8'),
(272913, 26311, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(272914, 26312, 'PostID', '7961'),
(272915, 26312, 'PostType', 'law_update_articles'),
(272916, 26312, 'PostTitle', 'Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
(272917, 26312, 'PostStatus', 'publish'),
(272918, 26312, 'PostDate', '2018-08-01 07:31:23'),
(272919, 26312, 'PostUrl', 'https://www.tamimi.com/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
(272920, 26312, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7961&amp;action=edit'),
(272921, 26312, 'ClientIP', '86.98.5.18'),
(272922, 26312, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(272923, 26312, 'CurrentUserID', '8'),
(272924, 26312, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(272925, 26313, 'PostID', '7961'),
(272926, 26313, 'PostType', 'law_update_articles'),
(272927, 26313, 'PostTitle', 'Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
(272928, 26313, 'PostStatus', 'publish'),
(272929, 26313, 'PostDate', '2018-08-01 07:31:23'),
(272930, 26313, 'PostUrl', 'http://www.tamimi.com/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
(272931, 26313, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7961&amp;action=edit'),
(272932, 26313, 'ClientIP', '86.98.5.18'),
(272933, 26313, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(272934, 26313, 'CurrentUserID', '8'),
(272935, 26313, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(272936, 26314, 'PostID', '7961'),
(272937, 26314, 'PostTitle', 'Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
(272938, 26314, 'PostStatus', 'publish'),
(272939, 26314, 'PostType', 'law_update_articles'),
(272940, 26314, 'PostDate', '2018-08-01 07:31:23'),
(272941, 26314, 'PostUrl', 'http://www.tamimi.com/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
(272942, 26314, 'MetaID', '224274'),
(272943, 26314, 'MetaKey', 'content');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(272944, 26314, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignright\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"538\" height=\"359\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
(272945, 26314, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignright\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"508\" height=\"338\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
(272946, 26314, 'MetaLink', 'content'),
(272947, 26314, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7961&amp;action=edit');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(272948, 26314, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignright\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"508\" height=\"338\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>|<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignright\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"538\" height=\"359\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
(272949, 26314, 'ClientIP', '86.98.5.18'),
(272950, 26314, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(272951, 26314, 'CurrentUserID', '8'),
(272952, 26314, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(272953, 26315, 'PostID', '7961'),
(272954, 26315, 'PostType', 'law_update_articles'),
(272955, 26315, 'PostTitle', 'Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
(272956, 26315, 'PostStatus', 'publish'),
(272957, 26315, 'PostDate', '2018-08-01 07:31:23'),
(272958, 26315, 'PostUrl', 'http://www.tamimi.com/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
(272959, 26315, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7961&amp;action=edit'),
(272960, 26315, 'ClientIP', '86.98.5.18'),
(272961, 26315, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(272962, 26315, 'CurrentUserID', '8'),
(272963, 26315, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(272964, 26316, 'PostID', '7961'),
(272965, 26316, 'PostType', 'law_update_articles'),
(272966, 26316, 'PostTitle', 'Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
(272967, 26316, 'PostStatus', 'publish'),
(272968, 26316, 'PostDate', '2018-08-01 07:31:23'),
(272969, 26316, 'PostUrl', 'https://www.tamimi.com/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
(272970, 26316, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7961&amp;action=edit'),
(272971, 26316, 'ClientIP', '86.98.5.18'),
(272972, 26316, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(272973, 26316, 'CurrentUserID', '8'),
(272974, 26316, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(272975, 26317, 'PostID', '7961'),
(272976, 26317, 'PostType', 'law_update_articles'),
(272977, 26317, 'PostTitle', 'Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
(272978, 26317, 'PostStatus', 'publish'),
(272979, 26317, 'PostDate', '2018-08-01 07:31:23'),
(272980, 26317, 'PostUrl', 'http://www.tamimi.com/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
(272981, 26317, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7961&amp;action=edit'),
(272982, 26317, 'ClientIP', '86.98.5.18'),
(272983, 26317, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(272984, 26317, 'CurrentUserID', '8'),
(272985, 26317, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(272986, 26318, 'PostID', '7961'),
(272987, 26318, 'PostTitle', 'Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
(272988, 26318, 'PostStatus', 'publish'),
(272989, 26318, 'PostType', 'law_update_articles'),
(272990, 26318, 'PostDate', '2018-08-01 07:31:23'),
(272991, 26318, 'PostUrl', 'http://www.tamimi.com/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
(272992, 26318, 'MetaID', '224274'),
(272993, 26318, 'MetaKey', 'content'),
(272994, 26318, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignright\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"590\" height=\"394\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(272995, 26318, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignright\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"538\" height=\"359\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
(272996, 26318, 'MetaLink', 'content'),
(272997, 26318, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7961&amp;action=edit'),
(272998, 26318, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignright\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"538\" height=\"359\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>|<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignleft size-full wp-image-8048\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_775810141.jpg\" alt=\"\" width=\"6000\" height=\"1520\" /></em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In May 2017, the Saudi Arabian Monetary Authority issued version 1.0 of its Cyber Security Framework. Noting the importance of the need to safeguard sensitive data and transactions to ensure confidence in the Saudi financial sector, the Framework was designed to enable SAMA regulated entities (basically, banks, insurance companies and finance companies) to identify and address cyber security risks. In this article, we summarise key aspects of the Framework.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework is based on SAMA requirements and industry standards (including ISO, BASEL and PCI-DSS). Its stated objectives are to create a common approach for addressing cyber security, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. It supersedes all prior SAMA circulars relating to cyber security.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Entities subject to the Framework include all banks, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Saudi financial market infrastructure. The Framework also has some degree of application to subsidiaries and the personnel of such entities, as well as to third party contractors and customers.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security is defined in the Framework as:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the member organization’s information assets against internal and external threats.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The ‘information assets’ to which the Framework relates include electronic information, hardcopies, applications, software, databases, computers and machines such as ATMs, data storage devices, and networks and other technical infrastructure.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The three basic premises upon which the Framework has been developed are confidentiality, integrity and availability. More specifically, confidentiality refers to information assets being accessible only to those who are authorised, and protected from unintended or unauthorised disclosure; integrity refers to information assets being accurate, complete and processed correctly, and protected from unauthorised modification; and availability refers to information assets being resilient and accessible, and protected from unauthorised disruption.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework prescribes key cyber security principles and objectives to be embedded and achieved by each regulated entity. These are broken down in terms of four main cyber security ‘domains’: Leadership &amp; Governance, Risk Management &amp; Compliance, Operations &amp; Technology, and Third Party considerations. The Framework also contemplates regulated entities meeting a minimum level of cyber security maturity (the criteria of which are specified in detail in the Framework), and to subject themselves to periodic self-assessments, reviewed by SAMA.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Leadership &amp; Governance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework contemplates the implementation of a board-endorsed, defined cyber security governance structure to lead the overall approach to cyber security within the regulated entity. As well as establishing a cybersecurity committee (with representatives from all relevant departments in the organisation), regulated entities also need to establish a cyber security function, independent of the information technology function, and led by a Chief Information Security Officer who is a Saudi national and sufficiently qualified for the CISO role.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Each regulated entity needs to define a cyber security strategy aligned with its own strategic objectives and the broader banking sector’s cyber security strategy. It must also develop a cyber security policy to document and communicate its cyber security commitment and objectives. The policy should be considered in the development of other corporate policies (such as HR policies and IT policies), based on best practices, and supported by detailed security standards. The policy also needs to ensure that information is classified appropriate to its importance, and protected in line with the entity’s risk appetite. Owners need to be appointed for all information assets, and all stakeholders need to be made aware of cyber security. The policy also needs to contain requirements that ensure compliance with regulatory and contractual obligations, and provide for reporting of cyber security breaches and suspected weaknesses.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The ultimate responsibility for cyber security lies with the regulated entity’s board of directors. This responsibility ranges from ensuring an appropriate budget is available for cyber security measures, through to endorsing the entity’s cyber security governance, strategy and policy. The entity’s cyber security committee is responsible at a more operational level.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework imposes an obligation on regulated entities to ensure that relevant stakeholders are aware of, and understand, their cyber security responsibilities. It requires the development of an organisational culture of cyber security risk awareness, enabling personnel, third parties and customers to protect the regulated entity’s information assets. Additionally, it requires the implementation of training to ensure that personnel are equipped with the necessary skills and knowledge to protect the entity’s information assets (including by operating the entity’s systems securely) and to meet its cyber security responsibilities. Cyber security needs to be an integrated part of the regulated entity’s project management methodology, enabling the entity to identify and address cyber security risks as part of any project.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Risk Management &amp; Compliance</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework describes risk management as the ongoing process of identifying, analyzing, responding to, monitoring and reviewing risks. To manage cyber security risks, the Framework requires regulated entities to undertake cyber security risk identification (identification of their cyber security risks), risk analysis (assessment of the likelihood of occurrence, and the resulting impact), risk response (determining the appropriate response to cyber security risks), and monitoring and review (monitoring the risk treatment and review of the effectiveness of the cyber security control).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure cyber security risks are properly managed to protect the confidentiality, integrity and availability of a regulated entity’s information assets, and to ensure alignment of the cyber security risk management process with the entity’s enterprise risk management process, each regulated entity is required to define, approve and implement a cyber security risk management process.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This involves identification (and treatment) of the entity’s cyber security risks and threats, bearing in mind the relevant information assets of the entity, as well as its existing cyber security controls and vulnerabilities, and the likelihood of occurrence of the risks identified and the likely resulting impact. The Framework contemplates this exercise being performed on a rolling basis, so as to ensure its continued effectiveness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to establish a process whereby they identify, communicate and comply with the cyber security implications of relevant regulations, and adopt mandatory local and international industry standards.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is an expectation that information assets of regulated entities will be subjected to thorough, independent and regular cyber security audits, in accordance with generally accepted auditing standards and the Framework.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"wp-image-8110 alignright\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_287395955-1024x683.jpg\" alt=\"\" width=\"590\" height=\"394\" />Operations &amp; Technology</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Framework makes it is necessary for regulated entities to ensure that security requirements for their information assets are defined, approved and implemented.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are required to incorporate cyber security requirements into their human resources processes. At a minimum, these should include: cyber security awareness training for personnel at induction and during their employment, personnel agreements setting out cyber security responsibilities and obligations of non-disclosure, post-employment cyber security implications (such as revocation of access rights, and obligations to return access badge, tokens, mobile devices, all electronic and physical information). The Framework also provides for requirements relating to Bring Your Own Device (BYOD) policies, so as to ensure that business and sensitive information is securely handled by personnel when using personal devices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is also an obligation to ensure appropriate physical security, by ensuring that all facilities that host information assets are physically protected. These should include: physical entry controls, monitoring and surveillance (e.g., CCTV), protection of data centres and data rooms, environmental protection, and consideration of the physical protection of information assets during their lifecycles (such as during transportation and destruction, and by avoiding unauthorized access and data leakage). The secure disposal of information assets is also contemplated, so as to ensure that business, customer and other information, is protected from unintended or unauthorized disclosure when no longer required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">More generally, there is an obligation to ensure that access to information assets is restricted in line with need to know/have principles. This requirement brings with it a need to ensure that identity and access be managed and controlled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to know what information assets they have, and where (both physically and logically) they are located, in order to ensure cyber security. The Framework requires regulated entities to maintain an accurate and up-to-date inventory, including location and other relevant details, of all information assets.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities are also required to define their cyber security architecture, outlining the cyber security requirements in their enterprise architecture and addressing the design principles for developing cyber security capabilities. They also need to make sure that they follow and review their cyber security architecture. Similarly, regulated entities need to make sure that cyber security controls are formally documented and implemented for all applications, and that the compliance is monitored and effectiveness evaluated on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Cyber security standards for infrastructure components need to be documented, and compliance monitored. This needs to include all instances of infrastructure (e.g., workstations, laptops, tablets, mobile devices, virtual machines, servers, operating systems, firewalls, network devices, wireless networks, email gateways, external connections, databases, file-shares, PBX), and it needs to cover all relevant locations, including data centres, disaster recovery sites and offices.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Regulated entities need to define, approve, implement and monitor cyber security standards for payment systems and electronic banking services in order to safeguard the confidentiality and integrity of shared banking systems and customer information and transactions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Third party considerations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is almost certain that regulated entities will need to engage with third party service providers (including the likes of information services providers, outsourcing providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the regulated entities have implemented, then such engagements could bring with them cyber security risks. With this in mind, the Framework introduces expectations with regard to the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. We consider this in more detail in a separate article.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework, which was developed in coordination with a leading consultancy firm, provides a very clear outline of what SAMA expects, in terms of cyber security, of the entities that it regulates. Just as the types of technology being used in the financial services sector will continue to develop, the volume and nature of cyber security risks to financial services sector business will continue to develop. SAMA’s Cyber Security Framework should go some way to ensuring that businesses operating in the financial services sector are aware of the nature and scope of their information assets and the potential cyber risks to such assets. The processes implemented in compliance with the Framework will also provide a mechanism for future-proofing regulated financial services businesses against new cyber risks as they develop.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Technology, Media &amp; Telecommunications team regularly advises on issues relating to cyber security, including regulatory compliance and breach notification obligations. For further information please contact Nick O’Connell, Partner (n.oconnell@tamimi.com) or Andrew Fawcett, Senior Counsel (a.fawcett@tamimi.com)</em></p>'),
(272999, 26318, 'ClientIP', '86.98.5.18'),
(273000, 26318, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273001, 26318, 'CurrentUserID', '8'),
(273002, 26318, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273003, 26319, 'PostID', '7961'),
(273004, 26319, 'PostType', 'law_update_articles'),
(273005, 26319, 'PostTitle', 'Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
(273006, 26319, 'PostStatus', 'publish'),
(273007, 26319, 'PostDate', '2018-08-01 07:31:23'),
(273008, 26319, 'PostUrl', 'https://www.tamimi.com/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
(273009, 26319, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7961&amp;action=edit'),
(273010, 26319, 'ClientIP', '86.98.5.18'),
(273011, 26319, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273012, 26319, 'CurrentUserID', '8'),
(273013, 26319, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273014, 26320, 'PostID', '7961'),
(273015, 26320, 'PostType', 'law_update_articles'),
(273016, 26320, 'PostTitle', 'Cyber security in the Saudi financial services sector: The SAMA Cyber Security Framework'),
(273017, 26320, 'PostStatus', 'publish'),
(273018, 26320, 'PostDate', '2018-08-01 07:31:23'),
(273019, 26320, 'PostUrl', 'http://www.tamimi.com/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/'),
(273020, 26320, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7961&amp;action=edit'),
(273021, 26320, 'ClientIP', '86.98.5.18'),
(273022, 26320, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273023, 26320, 'CurrentUserID', '8'),
(273024, 26320, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273025, 26321, 'PostID', '7960'),
(273026, 26321, 'PostType', 'law_update_articles'),
(273027, 26321, 'PostTitle', 'Guiding Charter for Family Owned Businesses in Saudi Arabia'),
(273028, 26321, 'PostStatus', 'publish'),
(273029, 26321, 'PostDate', '2018-08-01 07:32:04'),
(273030, 26321, 'PostUrl', 'https://www.tamimi.com/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
(273031, 26321, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7960&amp;action=edit'),
(273032, 26321, 'ClientIP', '86.98.5.18'),
(273033, 26321, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273034, 26321, 'CurrentUserID', '8'),
(273035, 26321, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273036, 26322, 'PostID', '7960'),
(273037, 26322, 'PostType', 'law_update_articles'),
(273038, 26322, 'PostTitle', 'Guiding Charter for Family Owned Businesses in Saudi Arabia'),
(273039, 26322, 'PostStatus', 'publish'),
(273040, 26322, 'PostDate', '2018-08-01 07:32:04'),
(273041, 26322, 'PostUrl', 'http://www.tamimi.com/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
(273042, 26322, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7960&amp;action=edit'),
(273043, 26322, 'ClientIP', '86.98.5.18'),
(273044, 26322, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273045, 26322, 'CurrentUserID', '8'),
(273046, 26322, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273126, 26330, 'ClientIP', '86.98.5.18'),
(273127, 26330, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273128, 26330, 'CurrentUserID', '8'),
(273129, 26330, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273130, 26331, 'PostID', '7960'),
(273131, 26331, 'PostType', 'law_update_articles'),
(273132, 26331, 'PostTitle', 'Guiding Charter for Family Owned Businesses in Saudi Arabia'),
(273133, 26331, 'PostStatus', 'publish'),
(273134, 26331, 'PostDate', '2018-08-01 07:32:04'),
(273135, 26331, 'PostUrl', 'https://www.tamimi.com/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
(273136, 26331, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7960&amp;action=edit'),
(273137, 26331, 'ClientIP', '86.98.5.18'),
(273138, 26331, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273139, 26331, 'CurrentUserID', '8'),
(273140, 26331, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273141, 26332, 'PostID', '7960'),
(273142, 26332, 'PostType', 'law_update_articles'),
(273143, 26332, 'PostTitle', 'Guiding Charter for Family Owned Businesses in Saudi Arabia'),
(273144, 26332, 'PostStatus', 'publish'),
(273145, 26332, 'PostDate', '2018-08-01 07:32:04');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(273146, 26332, 'PostUrl', 'http://www.tamimi.com/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
(273147, 26332, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7960&amp;action=edit'),
(273148, 26332, 'ClientIP', '86.98.5.18'),
(273149, 26332, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273150, 26332, 'CurrentUserID', '8'),
(273151, 26332, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273152, 26333, 'PostID', '7960'),
(273153, 26333, 'PostType', 'law_update_articles'),
(273154, 26333, 'PostTitle', 'Guiding Charter for Family Owned Businesses in Saudi Arabia'),
(273155, 26333, 'PostStatus', 'publish'),
(273156, 26333, 'PostDate', '2018-08-01 07:32:04'),
(273157, 26333, 'PostUrl', 'http://www.tamimi.com/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
(273158, 26333, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7960&amp;action=edit'),
(273159, 26333, 'ClientIP', '86.98.5.18'),
(273160, 26333, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273161, 26333, 'CurrentUserID', '8'),
(273162, 26333, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273163, 26334, 'PostID', '7960'),
(273164, 26334, 'PostTitle', 'Guiding Charter for Family Owned Businesses in Saudi Arabia'),
(273165, 26334, 'PostStatus', 'publish'),
(273166, 26334, 'PostType', 'law_update_articles'),
(273167, 26334, 'PostDate', '2018-08-01 07:32:04'),
(273168, 26334, 'PostUrl', 'http://www.tamimi.com/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
(273169, 26334, 'MetaID', '224226'),
(273170, 26334, 'MetaKey', 'content'),
(273171, 26334, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft size-full wp-image-8046\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_641258596.jpg\" alt=\"\" width=\"4928\" height=\"1748\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Ministry of Commerce and Investment (\"MoCI\") issued a Guiding Charter for Family Owned Businesses (\"Charter\") on 02-08-1439H corresponding to 18-04-2018G.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This article will provide a summary of the key provisions of the Charter and the added benefits it will bring to family owned businesses in Saudi Arabia (\"FOBs\" or the \"Company\" as the case may be).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs play an important role in Saudi Arabia’s economy, investment environment and job market. However, despite their various contributions to the economy, FOBs have at times failed to realize their full potential due to various factors some of which include a lack of transparency with respect to the management and operations of the Company, inadequate succession planning and the absence of a well-defined dispute resolution mechanism for addressing conflicts within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Although the Charter is not binding, the issuance of the Charter is a welcome development as its main aim is to promote the growth of FOBs in Saudi Arabia, and provide them with a set of guiding principles that will allow them to operate in line with international best practices and standards.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>To which Companies does the Charter apply?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter is intended for use by FOBs that are incorporated as closed joint stock companies in Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs that are listed on the Saudi Arabian stock exchange (the \"Tadawul\") as open joint stock companies are already subject to the Capital Market Authority’s corporate governance regulations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">However, the vast majority of FOBs operating in Saudi Arabia are not listed on the Tadawul. MoCI therefore recognized a need to fill this gap by establishing protocols for FOBs to follow.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Companies Law issued by Royal Decree no. M/3 dated 28-01-1437H corresponding to 11-11-2015G (as amended) (the \"Companies Law\") will take precedence over the provisions of the Charter as the Charter is meant to be complementary to the Companies Law and provide a set of guiding principles for FOBs to implement in conjunction with their existing regulatory obligations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>What are the Charter’s Objectives?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The objectives of the Charter include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Provide a guiding framework for FOBs to operate in an efficient and growth-oriented manner in conformance with international best practices and standards.</li>\r\n 	<li dir=\"LTR\">Provide a common vision for family members with respect to the Company’s values and strategic objectives.</li>\r\n 	<li dir=\"LTR\">Enhance accountability and control mechanisms for the shareholders of FOBs.</li>\r\n 	<li dir=\"LTR\">Set-up well-defined strategies and protocols that promote transparency and govern the interaction of the family within the Company.</li>\r\n 	<li dir=\"LTR\">Achieve a proper and fair balance between the interests of the family members and the interests of the Company.</li>\r\n 	<li dir=\"LTR\">Put succession plans into place (for both ownership and management) to ensure their survival and orderly transition.</li>\r\n 	<li dir=\"LTR\">Provide a well-defined mechanism for the timely resolution of any family disputes that may occur, and to ensure that such disputes do not impede decision-making within the Company.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft wp-image-8108\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_574104421-2-1024x1024.jpg\" alt=\"\" width=\"322\" height=\"322\" />Shareholders’ Assemblies</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, shareholder meetings are conducted through the Ordinary General Assembly and Extraordinary General Assembly (collectively referred to as the \"Shareholders’ Assemblies\").</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Shareholders’ Assemblies are required to hold all of their meetings in accordance with the provisions of the Companies Law and the Company’s articles of association.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Resolutions passed during any meeting held by the Shareholders’ Assemblies are valid and binding upon all of the family members in the Company, regardless of whether such family members attended the meetings in which the resolutions were issued.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is entitled to submit a written request to the Board of Directors to invite the Ordinary General Assembly (or the Extraordinary General Assembly as the case may be) to convene provided the written request contains justifications for convening the Ordinary General Assembly. In the event the Board of Directors fails to respond to the Family Board’s written request, then the Family Board (discussed in further detail below) is entitled to seek the written approval of family members representing at least 5% of the Company’s share capital in order to obligate the Board of Directors to invite the Ordinary General Assembly to convene.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure that the Company operates in an institutional manner, family members are prohibited from taking any adverse actions that would prevent the Shareholders’ Assemblies from exercising their functions set out in the Companies Law, the Company’s articles of association and Charter.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Family Board</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter prescribes the formation of a Family Board. The Family Board’s competencies include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Monitor the overall performance of the Board of Directors and ensure they are compliant with the provisions of the Companies Law and the articles of association of the Company. For this purpose, the Family Board can provide an opinion on potential candidates for the Board of Directors. They also have the authority to investigate whether any member of the Board of Directors is engaging in an activity that is detrimental to the Company such as whether there is a potential conflict of interest or unauthorized disclosure of the Company’s trade secrets.</li>\r\n 	<li dir=\"LTR\">Resolve any disputes that arise between family members that may affect the Company’s operations (further details on the dispute resolution mechanism will be provided below).</li>\r\n 	<li dir=\"LTR\">Consider recommendations from family members for the investment of the Company’s assets and presenting them to the Board of Directors for their approval.</li>\r\n 	<li dir=\"LTR\">Take any necessary actions to ensure that new generations of family members are trained and prepared to manage the Company in the future.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The competencies of the Family Board cannot be in direct conflict with the competencies of the Shareholders’ Assemblies and Board of Directors under the Companies Law, the articles of association of the Company and the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is recommended for a Family Board to be formed when there are more than 12 family members in the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure the Family Board exercises its competencies in an effective manner, there should not be more than 6 Family Board members. Members of the Family Board are elected by secret ballot at a special meeting held for this purpose. Members should be elected based on their personal and professional capabilities.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A member of the Family Board is not permitted to be a member of the Board of Directors or the executive team of the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Family Board members is restricted to 3 years, and a member is not permitted to be on the Family Board for more than 2 consecutive terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8111 alignright\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_169062704-1024x683.jpg\" alt=\"\" width=\"571\" height=\"381\" />Elections for Family Board members take place under the direction of an Election Committee consisting of 5 family members or any other members appointed by the Ordinary General Assembly. A member appointed to the Election Committee is prohibited from serving as a Family Board member. The Election Committee is required to hold elections for the Family Board members at least 25 days prior to the end of their term. The Election Committee should ensure that the election process is held transparently and impartially.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board should have a Chairman and Deputy-Chairman. They are selected by the Family Board members through secret ballot under the supervision of the Election Committee.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is required to hold at least 4 meetings each financial year. The Family Board should hold a special meeting prior to any meeting held by the Shareholders’ Assemblies in order to consider the agenda items and to make any recommendations it considers necessary within the scope of its competencies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The majority of the Family Board members should be present in order for a meeting to be valid. Resolutions issued by the Family Board will need to be approved by a majority of the members present at the meeting. In the event of a deadlock, the Chairman will have the casting vote. The Chairman will invite the Family Board to convene when requested to do so by 2 or more members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Family Board members are entitled to receive remuneration for attending meetings. Remuneration will be equivalent to what is prescribed to Board of Directors members who attend meetings.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As referenced above, the Charter prescribes a multi-tiered mechanism for the resolution of any disputes that may occur between family members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Initially, private discussions are held between members of the Family Board to determine the reasons for the dispute and the most optimal way forward to resolving the dispute. The Family Board assigns the Chairman or one of its members who do not have any involvement in the dispute to take the lead in amicably resolving the dispute. The Family Board member assigned to resolve the dispute will then hold discussions with the disputing parties in an effort to resolve the dispute in a manner that is in the best interests of both the family members and the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the event the dispute cannot be settled amicably, a conciliation body consisting of non-family members will be formed in an attempt to settle the dispute in a fair and impartial manner. The Family Board, in consultation with the disputing members, will determine the scope and composition of the conciliation body.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If the conciliation body referred to in the preceding paragraph cannot be formed or is unable to resolve the dispute, the Family Board will recommend the disputing parties to resolve their dispute through arbitration or a court. The Family Board will need to take necessary measures to ensure that this does not have an adverse effect on the Company’s operations. The Family Board should continue to make an effort to resolve the dispute until a final binding decision is issued by the arbitration tribunal or court. When a final binding decision is issued, the Family Board should ensure that this decision is implemented.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Board of Directors</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, the Board of Directors has wide ranging authority to manage the affairs of the Company and maximize its value. All shareholders are prohibited from interfering with the Board’s functions or the executive team of the Company, unless they are members of the Board or the executive team.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Board members of the Company will be elected by the Ordinary General Assembly. The recommended number of Board members should be between 5 and 9.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A Chairman and a Deputy Chairman will need to be elected by the Board of Directors through secret ballot. The Chairman of the Board of Directors is not permitted to hold an executive position within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">When electing Board members, the Ordinary General Assembly should take into consideration each candidate’s personal and professional capabilities such as his or her ability to lead, competence, financial expertise and medical fitness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Board of Directors cannot exceed 3 years. Board members may be re-elected for 1 or more terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The CEO of the Company is selected through a resolution issued by the Board of Directors. It is not permissible for the CEO to be the Chairman or Deputy Chairman of the Board of Directors.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form an Advisory Board to assist it with its functions. The members of the Advisory Board should have the necessary experience and competence to assist the Board of Directors in developing strategic objectives to ensure the Company’s continuity and growth. The Board of Directors is tasked with establishing the bylaws for the Advisory Board which must then be submitted to the Ordinary General Assembly for approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form additional committees as it deems necessary to assist it with its functions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft size-full wp-image-8047\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_737881615-Converted-01.jpg\" alt=\"\" width=\"3967\" height=\"1751\" /></strong></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Sale of Shares</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any shareholder who intends to sell all or part of his or her shares in the Company will be required to notify all of the shareholders in writing through the Board of Directors. Each shareholder may exercise their priority right to purchase the shares put up for sale within 30 days from the date of notification. In the event 30 days elapse and no shareholder exercises his or her right to purchase the shares, the shareholder may proceed to sell the shares to a third party. It should be noted that this procedure will not be applicable to any transfer of shares by legal inheritance.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Company Policy</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A human resources policy should be developed for the Company that contains clear rules for employing a family member, which will address issues such as qualifications, experience, performance, evaluation and termination.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is not permissible to create a position for the specific purpose of appointing a family member. Additionally, it is not permissible to terminate, without a valid justification, an employee who is not a family member in order to replace him or her with a family member instead.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The salary of an employee, whether or not a member of the family, should be commensurate with the employee’s position, responsibilities, academic qualifications and level of performance.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The work of a family member employed in the Company should not be subject to the supervision of another family member. In addition, no more than 1 member of the family should work in the same department unless it is in the best interests of the Company.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Additional Provisions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A family member is entitled to submit a proposal to amend the Charter. The Family Board will assess the proposal to amend the Charter and prepare a report on its findings which will be presented to the Ordinary General Assembly for its consideration and approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The articles of association of the Company should be amended in order to be commensurate with the provisions of the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter should be reviewed by shareholders on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is advisable for the Charter to include the names and signatures of each shareholder of the Company on the final page.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\nIn conclusion, even though the Charter is merely a guide and is not mandatory for FOBs operating in Saudi Arabia, its issuance is nevertheless a positive development as it will raise a general awareness amongst FOBs of the importance of implementing proper governance frameworks and point the way to international best practice and standards and allow them to increase their contribution to the local economy. It may also provide a roadmap for the enactment of future legislation that will be binding on FOBs.\r\n\r\n&nbsp;'),
(273172, 26334, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft size-full wp-image-8046\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_641258596.jpg\" alt=\"\" width=\"4928\" height=\"1748\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Ministry of Commerce and Investment (\"MoCI\") issued a Guiding Charter for Family Owned Businesses (\"Charter\") on 02-08-1439H corresponding to 18-04-2018G.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This article will provide a summary of the key provisions of the Charter and the added benefits it will bring to family owned businesses in Saudi Arabia (\"FOBs\" or the \"Company\" as the case may be).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs play an important role in Saudi Arabia’s economy, investment environment and job market. However, despite their various contributions to the economy, FOBs have at times failed to realize their full potential due to various factors some of which include a lack of transparency with respect to the management and operations of the Company, inadequate succession planning and the absence of a well-defined dispute resolution mechanism for addressing conflicts within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Although the Charter is not binding, the issuance of the Charter is a welcome development as its main aim is to promote the growth of FOBs in Saudi Arabia, and provide them with a set of guiding principles that will allow them to operate in line with international best practices and standards.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>To which Companies does the Charter apply?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter is intended for use by FOBs that are incorporated as closed joint stock companies in Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs that are listed on the Saudi Arabian stock exchange (the \"Tadawul\") as open joint stock companies are already subject to the Capital Market Authority’s corporate governance regulations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">However, the vast majority of FOBs operating in Saudi Arabia are not listed on the Tadawul. MoCI therefore recognized a need to fill this gap by establishing protocols for FOBs to follow.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Companies Law issued by Royal Decree no. M/3 dated 28-01-1437H corresponding to 11-11-2015G (as amended) (the \"Companies Law\") will take precedence over the provisions of the Charter as the Charter is meant to be complementary to the Companies Law and provide a set of guiding principles for FOBs to implement in conjunction with their existing regulatory obligations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>What are the Charter’s Objectives?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The objectives of the Charter include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Provide a guiding framework for FOBs to operate in an efficient and growth-oriented manner in conformance with international best practices and standards.</li>\r\n 	<li dir=\"LTR\">Provide a common vision for family members with respect to the Company’s values and strategic objectives.</li>\r\n 	<li dir=\"LTR\">Enhance accountability and control mechanisms for the shareholders of FOBs.</li>\r\n 	<li dir=\"LTR\">Set-up well-defined strategies and protocols that promote transparency and govern the interaction of the family within the Company.</li>\r\n 	<li dir=\"LTR\">Achieve a proper and fair balance between the interests of the family members and the interests of the Company.</li>\r\n 	<li dir=\"LTR\">Put succession plans into place (for both ownership and management) to ensure their survival and orderly transition.</li>\r\n 	<li dir=\"LTR\">Provide a well-defined mechanism for the timely resolution of any family disputes that may occur, and to ensure that such disputes do not impede decision-making within the Company.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft wp-image-8108\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_574104421-2-1024x1024.jpg\" alt=\"\" width=\"322\" height=\"322\" />Shareholders’ Assemblies</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, shareholder meetings are conducted through the Ordinary General Assembly and Extraordinary General Assembly (collectively referred to as the \"Shareholders’ Assemblies\").</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Shareholders’ Assemblies are required to hold all of their meetings in accordance with the provisions of the Companies Law and the Company’s articles of association.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Resolutions passed during any meeting held by the Shareholders’ Assemblies are valid and binding upon all of the family members in the Company, regardless of whether such family members attended the meetings in which the resolutions were issued.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is entitled to submit a written request to the Board of Directors to invite the Ordinary General Assembly (or the Extraordinary General Assembly as the case may be) to convene provided the written request contains justifications for convening the Ordinary General Assembly. In the event the Board of Directors fails to respond to the Family Board’s written request, then the Family Board (discussed in further detail below) is entitled to seek the written approval of family members representing at least 5% of the Company’s share capital in order to obligate the Board of Directors to invite the Ordinary General Assembly to convene.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure that the Company operates in an institutional manner, family members are prohibited from taking any adverse actions that would prevent the Shareholders’ Assemblies from exercising their functions set out in the Companies Law, the Company’s articles of association and Charter.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Family Board</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter prescribes the formation of a Family Board. The Family Board’s competencies include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Monitor the overall performance of the Board of Directors and ensure they are compliant with the provisions of the Companies Law and the articles of association of the Company. For this purpose, the Family Board can provide an opinion on potential candidates for the Board of Directors. They also have the authority to investigate whether any member of the Board of Directors is engaging in an activity that is detrimental to the Company such as whether there is a potential conflict of interest or unauthorized disclosure of the Company’s trade secrets.</li>\r\n 	<li dir=\"LTR\">Resolve any disputes that arise between family members that may affect the Company’s operations (further details on the dispute resolution mechanism will be provided below).</li>\r\n 	<li dir=\"LTR\">Consider recommendations from family members for the investment of the Company’s assets and presenting them to the Board of Directors for their approval.</li>\r\n 	<li dir=\"LTR\">Take any necessary actions to ensure that new generations of family members are trained and prepared to manage the Company in the future.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The competencies of the Family Board cannot be in direct conflict with the competencies of the Shareholders’ Assemblies and Board of Directors under the Companies Law, the articles of association of the Company and the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is recommended for a Family Board to be formed when there are more than 12 family members in the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure the Family Board exercises its competencies in an effective manner, there should not be more than 6 Family Board members. Members of the Family Board are elected by secret ballot at a special meeting held for this purpose. Members should be elected based on their personal and professional capabilities.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A member of the Family Board is not permitted to be a member of the Board of Directors or the executive team of the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Family Board members is restricted to 3 years, and a member is not permitted to be on the Family Board for more than 2 consecutive terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft size-large wp-image-8111\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_169062704-1024x683.jpg\" alt=\"\" width=\"640\" height=\"427\" />Elections for Family Board members take place under the direction of an Election Committee consisting of 5 family members or any other members appointed by the Ordinary General Assembly. A member appointed to the Election Committee is prohibited from serving as a Family Board member. The Election Committee is required to hold elections for the Family Board members at least 25 days prior to the end of their term. The Election Committee should ensure that the election process is held transparently and impartially.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board should have a Chairman and Deputy-Chairman. They are selected by the Family Board members through secret ballot under the supervision of the Election Committee.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is required to hold at least 4 meetings each financial year. The Family Board should hold a special meeting prior to any meeting held by the Shareholders’ Assemblies in order to consider the agenda items and to make any recommendations it considers necessary within the scope of its competencies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The majority of the Family Board members should be present in order for a meeting to be valid. Resolutions issued by the Family Board will need to be approved by a majority of the members present at the meeting. In the event of a deadlock, the Chairman will have the casting vote. The Chairman will invite the Family Board to convene when requested to do so by 2 or more members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Family Board members are entitled to receive remuneration for attending meetings. Remuneration will be equivalent to what is prescribed to Board of Directors members who attend meetings.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As referenced above, the Charter prescribes a multi-tiered mechanism for the resolution of any disputes that may occur between family members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Initially, private discussions are held between members of the Family Board to determine the reasons for the dispute and the most optimal way forward to resolving the dispute. The Family Board assigns the Chairman or one of its members who do not have any involvement in the dispute to take the lead in amicably resolving the dispute. The Family Board member assigned to resolve the dispute will then hold discussions with the disputing parties in an effort to resolve the dispute in a manner that is in the best interests of both the family members and the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the event the dispute cannot be settled amicably, a conciliation body consisting of non-family members will be formed in an attempt to settle the dispute in a fair and impartial manner. The Family Board, in consultation with the disputing members, will determine the scope and composition of the conciliation body.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If the conciliation body referred to in the preceding paragraph cannot be formed or is unable to resolve the dispute, the Family Board will recommend the disputing parties to resolve their dispute through arbitration or a court. The Family Board will need to take necessary measures to ensure that this does not have an adverse effect on the Company’s operations. The Family Board should continue to make an effort to resolve the dispute until a final binding decision is issued by the arbitration tribunal or court. When a final binding decision is issued, the Family Board should ensure that this decision is implemented.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Board of Directors</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, the Board of Directors has wide ranging authority to manage the affairs of the Company and maximize its value. All shareholders are prohibited from interfering with the Board’s functions or the executive team of the Company, unless they are members of the Board or the executive team.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Board members of the Company will be elected by the Ordinary General Assembly. The recommended number of Board members should be between 5 and 9.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A Chairman and a Deputy Chairman will need to be elected by the Board of Directors through secret ballot. The Chairman of the Board of Directors is not permitted to hold an executive position within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">When electing Board members, the Ordinary General Assembly should take into consideration each candidate’s personal and professional capabilities such as his or her ability to lead, competence, financial expertise and medical fitness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Board of Directors cannot exceed 3 years. Board members may be re-elected for 1 or more terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The CEO of the Company is selected through a resolution issued by the Board of Directors. It is not permissible for the CEO to be the Chairman or Deputy Chairman of the Board of Directors.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form an Advisory Board to assist it with its functions. The members of the Advisory Board should have the necessary experience and competence to assist the Board of Directors in developing strategic objectives to ensure the Company’s continuity and growth. The Board of Directors is tasked with establishing the bylaws for the Advisory Board which must then be submitted to the Ordinary General Assembly for approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form additional committees as it deems necessary to assist it with its functions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft size-full wp-image-8047\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_737881615-Converted-01.jpg\" alt=\"\" width=\"3967\" height=\"1751\" /></strong></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Sale of Shares</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any shareholder who intends to sell all or part of his or her shares in the Company will be required to notify all of the shareholders in writing through the Board of Directors. Each shareholder may exercise their priority right to purchase the shares put up for sale within 30 days from the date of notification. In the event 30 days elapse and no shareholder exercises his or her right to purchase the shares, the shareholder may proceed to sell the shares to a third party. It should be noted that this procedure will not be applicable to any transfer of shares by legal inheritance.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Company Policy</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A human resources policy should be developed for the Company that contains clear rules for employing a family member, which will address issues such as qualifications, experience, performance, evaluation and termination.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is not permissible to create a position for the specific purpose of appointing a family member. Additionally, it is not permissible to terminate, without a valid justification, an employee who is not a family member in order to replace him or her with a family member instead.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The salary of an employee, whether or not a member of the family, should be commensurate with the employee’s position, responsibilities, academic qualifications and level of performance.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The work of a family member employed in the Company should not be subject to the supervision of another family member. In addition, no more than 1 member of the family should work in the same department unless it is in the best interests of the Company.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Additional Provisions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A family member is entitled to submit a proposal to amend the Charter. The Family Board will assess the proposal to amend the Charter and prepare a report on its findings which will be presented to the Ordinary General Assembly for its consideration and approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The articles of association of the Company should be amended in order to be commensurate with the provisions of the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter should be reviewed by shareholders on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is advisable for the Charter to include the names and signatures of each shareholder of the Company on the final page.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\nIn conclusion, even though the Charter is merely a guide and is not mandatory for FOBs operating in Saudi Arabia, its issuance is nevertheless a positive development as it will raise a general awareness amongst FOBs of the importance of implementing proper governance frameworks and point the way to international best practice and standards and allow them to increase their contribution to the local economy. It may also provide a roadmap for the enactment of future legislation that will be binding on FOBs.\r\n\r\n&nbsp;'),
(273173, 26334, 'MetaLink', 'content'),
(273174, 26334, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7960&amp;action=edit');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(273175, 26334, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft size-full wp-image-8046\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_641258596.jpg\" alt=\"\" width=\"4928\" height=\"1748\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Ministry of Commerce and Investment (\"MoCI\") issued a Guiding Charter for Family Owned Businesses (\"Charter\") on 02-08-1439H corresponding to 18-04-2018G.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This article will provide a summary of the key provisions of the Charter and the added benefits it will bring to family owned businesses in Saudi Arabia (\"FOBs\" or the \"Company\" as the case may be).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs play an important role in Saudi Arabia’s economy, investment environment and job market. However, despite their various contributions to the economy, FOBs have at times failed to realize their full potential due to various factors some of which include a lack of transparency with respect to the management and operations of the Company, inadequate succession planning and the absence of a well-defined dispute resolution mechanism for addressing conflicts within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Although the Charter is not binding, the issuance of the Charter is a welcome development as its main aim is to promote the growth of FOBs in Saudi Arabia, and provide them with a set of guiding principles that will allow them to operate in line with international best practices and standards.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>To which Companies does the Charter apply?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter is intended for use by FOBs that are incorporated as closed joint stock companies in Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs that are listed on the Saudi Arabian stock exchange (the \"Tadawul\") as open joint stock companies are already subject to the Capital Market Authority’s corporate governance regulations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">However, the vast majority of FOBs operating in Saudi Arabia are not listed on the Tadawul. MoCI therefore recognized a need to fill this gap by establishing protocols for FOBs to follow.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Companies Law issued by Royal Decree no. M/3 dated 28-01-1437H corresponding to 11-11-2015G (as amended) (the \"Companies Law\") will take precedence over the provisions of the Charter as the Charter is meant to be complementary to the Companies Law and provide a set of guiding principles for FOBs to implement in conjunction with their existing regulatory obligations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>What are the Charter’s Objectives?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The objectives of the Charter include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Provide a guiding framework for FOBs to operate in an efficient and growth-oriented manner in conformance with international best practices and standards.</li>\r\n 	<li dir=\"LTR\">Provide a common vision for family members with respect to the Company’s values and strategic objectives.</li>\r\n 	<li dir=\"LTR\">Enhance accountability and control mechanisms for the shareholders of FOBs.</li>\r\n 	<li dir=\"LTR\">Set-up well-defined strategies and protocols that promote transparency and govern the interaction of the family within the Company.</li>\r\n 	<li dir=\"LTR\">Achieve a proper and fair balance between the interests of the family members and the interests of the Company.</li>\r\n 	<li dir=\"LTR\">Put succession plans into place (for both ownership and management) to ensure their survival and orderly transition.</li>\r\n 	<li dir=\"LTR\">Provide a well-defined mechanism for the timely resolution of any family disputes that may occur, and to ensure that such disputes do not impede decision-making within the Company.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft wp-image-8108\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_574104421-2-1024x1024.jpg\" alt=\"\" width=\"322\" height=\"322\" />Shareholders’ Assemblies</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, shareholder meetings are conducted through the Ordinary General Assembly and Extraordinary General Assembly (collectively referred to as the \"Shareholders’ Assemblies\").</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Shareholders’ Assemblies are required to hold all of their meetings in accordance with the provisions of the Companies Law and the Company’s articles of association.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Resolutions passed during any meeting held by the Shareholders’ Assemblies are valid and binding upon all of the family members in the Company, regardless of whether such family members attended the meetings in which the resolutions were issued.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is entitled to submit a written request to the Board of Directors to invite the Ordinary General Assembly (or the Extraordinary General Assembly as the case may be) to convene provided the written request contains justifications for convening the Ordinary General Assembly. In the event the Board of Directors fails to respond to the Family Board’s written request, then the Family Board (discussed in further detail below) is entitled to seek the written approval of family members representing at least 5% of the Company’s share capital in order to obligate the Board of Directors to invite the Ordinary General Assembly to convene.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure that the Company operates in an institutional manner, family members are prohibited from taking any adverse actions that would prevent the Shareholders’ Assemblies from exercising their functions set out in the Companies Law, the Company’s articles of association and Charter.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Family Board</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter prescribes the formation of a Family Board. The Family Board’s competencies include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Monitor the overall performance of the Board of Directors and ensure they are compliant with the provisions of the Companies Law and the articles of association of the Company. For this purpose, the Family Board can provide an opinion on potential candidates for the Board of Directors. They also have the authority to investigate whether any member of the Board of Directors is engaging in an activity that is detrimental to the Company such as whether there is a potential conflict of interest or unauthorized disclosure of the Company’s trade secrets.</li>\r\n 	<li dir=\"LTR\">Resolve any disputes that arise between family members that may affect the Company’s operations (further details on the dispute resolution mechanism will be provided below).</li>\r\n 	<li dir=\"LTR\">Consider recommendations from family members for the investment of the Company’s assets and presenting them to the Board of Directors for their approval.</li>\r\n 	<li dir=\"LTR\">Take any necessary actions to ensure that new generations of family members are trained and prepared to manage the Company in the future.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The competencies of the Family Board cannot be in direct conflict with the competencies of the Shareholders’ Assemblies and Board of Directors under the Companies Law, the articles of association of the Company and the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is recommended for a Family Board to be formed when there are more than 12 family members in the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure the Family Board exercises its competencies in an effective manner, there should not be more than 6 Family Board members. Members of the Family Board are elected by secret ballot at a special meeting held for this purpose. Members should be elected based on their personal and professional capabilities.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A member of the Family Board is not permitted to be a member of the Board of Directors or the executive team of the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Family Board members is restricted to 3 years, and a member is not permitted to be on the Family Board for more than 2 consecutive terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft size-large wp-image-8111\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_169062704-1024x683.jpg\" alt=\"\" width=\"640\" height=\"427\" />Elections for Family Board members take place under the direction of an Election Committee consisting of 5 family members or any other members appointed by the Ordinary General Assembly. A member appointed to the Election Committee is prohibited from serving as a Family Board member. The Election Committee is required to hold elections for the Family Board members at least 25 days prior to the end of their term. The Election Committee should ensure that the election process is held transparently and impartially.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board should have a Chairman and Deputy-Chairman. They are selected by the Family Board members through secret ballot under the supervision of the Election Committee.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is required to hold at least 4 meetings each financial year. The Family Board should hold a special meeting prior to any meeting held by the Shareholders’ Assemblies in order to consider the agenda items and to make any recommendations it considers necessary within the scope of its competencies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The majority of the Family Board members should be present in order for a meeting to be valid. Resolutions issued by the Family Board will need to be approved by a majority of the members present at the meeting. In the event of a deadlock, the Chairman will have the casting vote. The Chairman will invite the Family Board to convene when requested to do so by 2 or more members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Family Board members are entitled to receive remuneration for attending meetings. Remuneration will be equivalent to what is prescribed to Board of Directors members who attend meetings.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As referenced above, the Charter prescribes a multi-tiered mechanism for the resolution of any disputes that may occur between family members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Initially, private discussions are held between members of the Family Board to determine the reasons for the dispute and the most optimal way forward to resolving the dispute. The Family Board assigns the Chairman or one of its members who do not have any involvement in the dispute to take the lead in amicably resolving the dispute. The Family Board member assigned to resolve the dispute will then hold discussions with the disputing parties in an effort to resolve the dispute in a manner that is in the best interests of both the family members and the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the event the dispute cannot be settled amicably, a conciliation body consisting of non-family members will be formed in an attempt to settle the dispute in a fair and impartial manner. The Family Board, in consultation with the disputing members, will determine the scope and composition of the conciliation body.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If the conciliation body referred to in the preceding paragraph cannot be formed or is unable to resolve the dispute, the Family Board will recommend the disputing parties to resolve their dispute through arbitration or a court. The Family Board will need to take necessary measures to ensure that this does not have an adverse effect on the Company’s operations. The Family Board should continue to make an effort to resolve the dispute until a final binding decision is issued by the arbitration tribunal or court. When a final binding decision is issued, the Family Board should ensure that this decision is implemented.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Board of Directors</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, the Board of Directors has wide ranging authority to manage the affairs of the Company and maximize its value. All shareholders are prohibited from interfering with the Board’s functions or the executive team of the Company, unless they are members of the Board or the executive team.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Board members of the Company will be elected by the Ordinary General Assembly. The recommended number of Board members should be between 5 and 9.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A Chairman and a Deputy Chairman will need to be elected by the Board of Directors through secret ballot. The Chairman of the Board of Directors is not permitted to hold an executive position within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">When electing Board members, the Ordinary General Assembly should take into consideration each candidate’s personal and professional capabilities such as his or her ability to lead, competence, financial expertise and medical fitness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Board of Directors cannot exceed 3 years. Board members may be re-elected for 1 or more terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The CEO of the Company is selected through a resolution issued by the Board of Directors. It is not permissible for the CEO to be the Chairman or Deputy Chairman of the Board of Directors.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form an Advisory Board to assist it with its functions. The members of the Advisory Board should have the necessary experience and competence to assist the Board of Directors in developing strategic objectives to ensure the Company’s continuity and growth. The Board of Directors is tasked with establishing the bylaws for the Advisory Board which must then be submitted to the Ordinary General Assembly for approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form additional committees as it deems necessary to assist it with its functions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft size-full wp-image-8047\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_737881615-Converted-01.jpg\" alt=\"\" width=\"3967\" height=\"1751\" /></strong></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Sale of Shares</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any shareholder who intends to sell all or part of his or her shares in the Company will be required to notify all of the shareholders in writing through the Board of Directors. Each shareholder may exercise their priority right to purchase the shares put up for sale within 30 days from the date of notification. In the event 30 days elapse and no shareholder exercises his or her right to purchase the shares, the shareholder may proceed to sell the shares to a third party. It should be noted that this procedure will not be applicable to any transfer of shares by legal inheritance.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Company Policy</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A human resources policy should be developed for the Company that contains clear rules for employing a family member, which will address issues such as qualifications, experience, performance, evaluation and termination.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is not permissible to create a position for the specific purpose of appointing a family member. Additionally, it is not permissible to terminate, without a valid justification, an employee who is not a family member in order to replace him or her with a family member instead.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The salary of an employee, whether or not a member of the family, should be commensurate with the employee’s position, responsibilities, academic qualifications and level of performance.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The work of a family member employed in the Company should not be subject to the supervision of another family member. In addition, no more than 1 member of the family should work in the same department unless it is in the best interests of the Company.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Additional Provisions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A family member is entitled to submit a proposal to amend the Charter. The Family Board will assess the proposal to amend the Charter and prepare a report on its findings which will be presented to the Ordinary General Assembly for its consideration and approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The articles of association of the Company should be amended in order to be commensurate with the provisions of the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter should be reviewed by shareholders on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is advisable for the Charter to include the names and signatures of each shareholder of the Company on the final page.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\nIn conclusion, even though the Charter is merely a guide and is not mandatory for FOBs operating in Saudi Arabia, its issuance is nevertheless a positive development as it will raise a general awareness amongst FOBs of the importance of implementing proper governance frameworks and point the way to international best practice and standards and allow them to increase their contribution to the local economy. It may also provide a roadmap for the enactment of future legislation that will be binding on FOBs.\r\n\r\n&nbsp;|<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft size-full wp-image-8046\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_641258596.jpg\" alt=\"\" width=\"4928\" height=\"1748\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Ministry of Commerce and Investment (\"MoCI\") issued a Guiding Charter for Family Owned Businesses (\"Charter\") on 02-08-1439H corresponding to 18-04-2018G.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">This article will provide a summary of the key provisions of the Charter and the added benefits it will bring to family owned businesses in Saudi Arabia (\"FOBs\" or the \"Company\" as the case may be).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs play an important role in Saudi Arabia’s economy, investment environment and job market. However, despite their various contributions to the economy, FOBs have at times failed to realize their full potential due to various factors some of which include a lack of transparency with respect to the management and operations of the Company, inadequate succession planning and the absence of a well-defined dispute resolution mechanism for addressing conflicts within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Although the Charter is not binding, the issuance of the Charter is a welcome development as its main aim is to promote the growth of FOBs in Saudi Arabia, and provide them with a set of guiding principles that will allow them to operate in line with international best practices and standards.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>To which Companies does the Charter apply?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter is intended for use by FOBs that are incorporated as closed joint stock companies in Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">FOBs that are listed on the Saudi Arabian stock exchange (the \"Tadawul\") as open joint stock companies are already subject to the Capital Market Authority’s corporate governance regulations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">However, the vast majority of FOBs operating in Saudi Arabia are not listed on the Tadawul. MoCI therefore recognized a need to fill this gap by establishing protocols for FOBs to follow.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Saudi Arabian Companies Law issued by Royal Decree no. M/3 dated 28-01-1437H corresponding to 11-11-2015G (as amended) (the \"Companies Law\") will take precedence over the provisions of the Charter as the Charter is meant to be complementary to the Companies Law and provide a set of guiding principles for FOBs to implement in conjunction with their existing regulatory obligations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>What are the Charter’s Objectives?</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The objectives of the Charter include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Provide a guiding framework for FOBs to operate in an efficient and growth-oriented manner in conformance with international best practices and standards.</li>\r\n 	<li dir=\"LTR\">Provide a common vision for family members with respect to the Company’s values and strategic objectives.</li>\r\n 	<li dir=\"LTR\">Enhance accountability and control mechanisms for the shareholders of FOBs.</li>\r\n 	<li dir=\"LTR\">Set-up well-defined strategies and protocols that promote transparency and govern the interaction of the family within the Company.</li>\r\n 	<li dir=\"LTR\">Achieve a proper and fair balance between the interests of the family members and the interests of the Company.</li>\r\n 	<li dir=\"LTR\">Put succession plans into place (for both ownership and management) to ensure their survival and orderly transition.</li>\r\n 	<li dir=\"LTR\">Provide a well-defined mechanism for the timely resolution of any family disputes that may occur, and to ensure that such disputes do not impede decision-making within the Company.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft wp-image-8108\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_574104421-2-1024x1024.jpg\" alt=\"\" width=\"322\" height=\"322\" />Shareholders’ Assemblies</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, shareholder meetings are conducted through the Ordinary General Assembly and Extraordinary General Assembly (collectively referred to as the \"Shareholders’ Assemblies\").</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Shareholders’ Assemblies are required to hold all of their meetings in accordance with the provisions of the Companies Law and the Company’s articles of association.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Resolutions passed during any meeting held by the Shareholders’ Assemblies are valid and binding upon all of the family members in the Company, regardless of whether such family members attended the meetings in which the resolutions were issued.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is entitled to submit a written request to the Board of Directors to invite the Ordinary General Assembly (or the Extraordinary General Assembly as the case may be) to convene provided the written request contains justifications for convening the Ordinary General Assembly. In the event the Board of Directors fails to respond to the Family Board’s written request, then the Family Board (discussed in further detail below) is entitled to seek the written approval of family members representing at least 5% of the Company’s share capital in order to obligate the Board of Directors to invite the Ordinary General Assembly to convene.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure that the Company operates in an institutional manner, family members are prohibited from taking any adverse actions that would prevent the Shareholders’ Assemblies from exercising their functions set out in the Companies Law, the Company’s articles of association and Charter.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Family Board</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter prescribes the formation of a Family Board. The Family Board’s competencies include the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Monitor the overall performance of the Board of Directors and ensure they are compliant with the provisions of the Companies Law and the articles of association of the Company. For this purpose, the Family Board can provide an opinion on potential candidates for the Board of Directors. They also have the authority to investigate whether any member of the Board of Directors is engaging in an activity that is detrimental to the Company such as whether there is a potential conflict of interest or unauthorized disclosure of the Company’s trade secrets.</li>\r\n 	<li dir=\"LTR\">Resolve any disputes that arise between family members that may affect the Company’s operations (further details on the dispute resolution mechanism will be provided below).</li>\r\n 	<li dir=\"LTR\">Consider recommendations from family members for the investment of the Company’s assets and presenting them to the Board of Directors for their approval.</li>\r\n 	<li dir=\"LTR\">Take any necessary actions to ensure that new generations of family members are trained and prepared to manage the Company in the future.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The competencies of the Family Board cannot be in direct conflict with the competencies of the Shareholders’ Assemblies and Board of Directors under the Companies Law, the articles of association of the Company and the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is recommended for a Family Board to be formed when there are more than 12 family members in the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In order to ensure the Family Board exercises its competencies in an effective manner, there should not be more than 6 Family Board members. Members of the Family Board are elected by secret ballot at a special meeting held for this purpose. Members should be elected based on their personal and professional capabilities.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A member of the Family Board is not permitted to be a member of the Board of Directors or the executive team of the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Family Board members is restricted to 3 years, and a member is not permitted to be on the Family Board for more than 2 consecutive terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8111 alignright\" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/shutterstock_169062704-1024x683.jpg\" alt=\"\" width=\"571\" height=\"381\" />Elections for Family Board members take place under the direction of an Election Committee consisting of 5 family members or any other members appointed by the Ordinary General Assembly. A member appointed to the Election Committee is prohibited from serving as a Family Board member. The Election Committee is required to hold elections for the Family Board members at least 25 days prior to the end of their term. The Election Committee should ensure that the election process is held transparently and impartially.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board should have a Chairman and Deputy-Chairman. They are selected by the Family Board members through secret ballot under the supervision of the Election Committee.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Family Board is required to hold at least 4 meetings each financial year. The Family Board should hold a special meeting prior to any meeting held by the Shareholders’ Assemblies in order to consider the agenda items and to make any recommendations it considers necessary within the scope of its competencies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The majority of the Family Board members should be present in order for a meeting to be valid. Resolutions issued by the Family Board will need to be approved by a majority of the members present at the meeting. In the event of a deadlock, the Chairman will have the casting vote. The Chairman will invite the Family Board to convene when requested to do so by 2 or more members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Family Board members are entitled to receive remuneration for attending meetings. Remuneration will be equivalent to what is prescribed to Board of Directors members who attend meetings.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As referenced above, the Charter prescribes a multi-tiered mechanism for the resolution of any disputes that may occur between family members.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Initially, private discussions are held between members of the Family Board to determine the reasons for the dispute and the most optimal way forward to resolving the dispute. The Family Board assigns the Chairman or one of its members who do not have any involvement in the dispute to take the lead in amicably resolving the dispute. The Family Board member assigned to resolve the dispute will then hold discussions with the disputing parties in an effort to resolve the dispute in a manner that is in the best interests of both the family members and the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the event the dispute cannot be settled amicably, a conciliation body consisting of non-family members will be formed in an attempt to settle the dispute in a fair and impartial manner. The Family Board, in consultation with the disputing members, will determine the scope and composition of the conciliation body.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If the conciliation body referred to in the preceding paragraph cannot be formed or is unable to resolve the dispute, the Family Board will recommend the disputing parties to resolve their dispute through arbitration or a court. The Family Board will need to take necessary measures to ensure that this does not have an adverse effect on the Company’s operations. The Family Board should continue to make an effort to resolve the dispute until a final binding decision is issued by the arbitration tribunal or court. When a final binding decision is issued, the Family Board should ensure that this decision is implemented.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Board of Directors</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Similar to what is provided in the Companies Law, the Board of Directors has wide ranging authority to manage the affairs of the Company and maximize its value. All shareholders are prohibited from interfering with the Board’s functions or the executive team of the Company, unless they are members of the Board or the executive team.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Board members of the Company will be elected by the Ordinary General Assembly. The recommended number of Board members should be between 5 and 9.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">A Chairman and a Deputy Chairman will need to be elected by the Board of Directors through secret ballot. The Chairman of the Board of Directors is not permitted to hold an executive position within the Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">When electing Board members, the Ordinary General Assembly should take into consideration each candidate’s personal and professional capabilities such as his or her ability to lead, competence, financial expertise and medical fitness.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The term of the Board of Directors cannot exceed 3 years. Board members may be re-elected for 1 or more terms.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The CEO of the Company is selected through a resolution issued by the Board of Directors. It is not permissible for the CEO to be the Chairman or Deputy Chairman of the Board of Directors.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form an Advisory Board to assist it with its functions. The members of the Advisory Board should have the necessary experience and competence to assist the Board of Directors in developing strategic objectives to ensure the Company’s continuity and growth. The Board of Directors is tasked with establishing the bylaws for the Advisory Board which must then be submitted to the Ordinary General Assembly for approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Board of Directors has the authority to form additional committees as it deems necessary to assist it with its functions.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong><img class=\"alignleft size-full wp-image-8047\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/shutterstock_737881615-Converted-01.jpg\" alt=\"\" width=\"3967\" height=\"1751\" /></strong></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Sale of Shares</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any shareholder who intends to sell all or part of his or her shares in the Company will be required to notify all of the shareholders in writing through the Board of Directors. Each shareholder may exercise their priority right to purchase the shares put up for sale within 30 days from the date of notification. In the event 30 days elapse and no shareholder exercises his or her right to purchase the shares, the shareholder may proceed to sell the shares to a third party. It should be noted that this procedure will not be applicable to any transfer of shares by legal inheritance.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Company Policy</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A human resources policy should be developed for the Company that contains clear rules for employing a family member, which will address issues such as qualifications, experience, performance, evaluation and termination.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is not permissible to create a position for the specific purpose of appointing a family member. Additionally, it is not permissible to terminate, without a valid justification, an employee who is not a family member in order to replace him or her with a family member instead.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The salary of an employee, whether or not a member of the family, should be commensurate with the employee’s position, responsibilities, academic qualifications and level of performance.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The work of a family member employed in the Company should not be subject to the supervision of another family member. In addition, no more than 1 member of the family should work in the same department unless it is in the best interests of the Company.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Additional Provisions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A family member is entitled to submit a proposal to amend the Charter. The Family Board will assess the proposal to amend the Charter and prepare a report on its findings which will be presented to the Ordinary General Assembly for its consideration and approval.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The articles of association of the Company should be amended in order to be commensurate with the provisions of the Charter.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Charter should be reviewed by shareholders on a regular basis.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is advisable for the Charter to include the names and signatures of each shareholder of the Company on the final page.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Conclusion</strong></p>\r\nIn conclusion, even though the Charter is merely a guide and is not mandatory for FOBs operating in Saudi Arabia, its issuance is nevertheless a positive development as it will raise a general awareness amongst FOBs of the importance of implementing proper governance frameworks and point the way to international best practice and standards and allow them to increase their contribution to the local economy. It may also provide a roadmap for the enactment of future legislation that will be binding on FOBs.\r\n\r\n&nbsp;'),
(273176, 26334, 'ClientIP', '86.98.5.18'),
(273177, 26334, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273178, 26334, 'CurrentUserID', '8'),
(273179, 26334, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273180, 26335, 'PostID', '7960'),
(273181, 26335, 'PostType', 'law_update_articles'),
(273182, 26335, 'PostTitle', 'Guiding Charter for Family Owned Businesses in Saudi Arabia'),
(273183, 26335, 'PostStatus', 'publish'),
(273184, 26335, 'PostDate', '2018-08-01 07:32:04'),
(273185, 26335, 'PostUrl', 'http://www.tamimi.com/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
(273186, 26335, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7960&amp;action=edit'),
(273187, 26335, 'ClientIP', '86.98.5.18'),
(273188, 26335, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273189, 26335, 'CurrentUserID', '8'),
(273190, 26335, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273191, 26336, 'PostID', '7960'),
(273192, 26336, 'PostType', 'law_update_articles'),
(273193, 26336, 'PostTitle', 'Guiding Charter for Family Owned Businesses in Saudi Arabia'),
(273194, 26336, 'PostStatus', 'publish'),
(273195, 26336, 'PostDate', '2018-08-01 07:32:04'),
(273196, 26336, 'PostUrl', 'https://www.tamimi.com/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
(273197, 26336, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7960&amp;action=edit'),
(273198, 26336, 'ClientIP', '86.98.5.18'),
(273199, 26336, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273200, 26336, 'CurrentUserID', '8'),
(273201, 26336, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273202, 26337, 'PostID', '7913'),
(273203, 26337, 'PostType', 'lawyer'),
(273204, 26337, 'PostTitle', 'Monica Effio'),
(273205, 26337, 'PostStatus', 'publish'),
(273206, 26337, 'PostDate', '2018-07-24 08:17:59'),
(273207, 26337, 'PostUrl', 'http://www.tamimi.com/lawyer/monica-effio/'),
(273208, 26337, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7913&amp;action=edit'),
(273209, 26337, 'ClientIP', '83.111.236.141'),
(273210, 26337, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273211, 26337, 'CurrentUserID', '5'),
(273212, 26337, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273213, 26338, 'PostID', '7913'),
(273214, 26338, 'PostType', 'lawyer'),
(273215, 26338, 'PostTitle', 'Monica Effio'),
(273216, 26338, 'PostStatus', 'publish'),
(273217, 26338, 'PostDate', '2018-07-24 08:17:59'),
(273218, 26338, 'PostUrl', 'http://www.tamimi.com/lawyer/monica-effio/'),
(273219, 26338, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7913&amp;action=edit'),
(273220, 26338, 'ClientIP', '83.111.236.141'),
(273221, 26338, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273222, 26338, 'CurrentUserID', '5'),
(273223, 26338, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273224, 26339, 'PostID', '7913'),
(273225, 26339, 'PostTitle', 'Monica Effio'),
(273226, 26339, 'PostStatus', 'publish'),
(273227, 26339, 'PostType', 'lawyer'),
(273228, 26339, 'PostDate', '2018-07-24 08:17:59'),
(273229, 26339, 'PostUrl', 'http://www.tamimi.com/lawyer/monica-effio/'),
(273230, 26339, 'MetaID', '222348'),
(273231, 26339, 'MetaKey', 'recent_dealsexperience'),
(273232, 26339, 'MetaValueNew', '<ul>\r\n 	<li>Construction matters, claims and disputes over US$200M for 7 Projects executed by ESEC International Contracting LLC., Dubai, U.A.E.</li>\r\n 	<li>Settlement Agreement under a project for the construction of a Mosque in Jebel Ali</li>\r\n 	<li>Construction matters, claims and disputes over US$1.4B for the Design and Construction of the US $3.2B Third Set of Locks Expansion Program of the Panama Canal (TSL) Contract</li>\r\n 	<li>Construction matters for the Design and Construction of the Third Bridge over the Panama Canal – a US$400M Contract</li>\r\n</ul>'),
(273233, 26339, 'MetaValueOld', '<ul>\r\n 	<li>Construction matters, claims and disputes over US$200M for 7 Projects executed by ESEC International Contracting LLC., Dubai, U.A.E.</li>\r\n 	<li>Settlement Agreement under a project for the construction of a Mosque in Jebel Ali</li>\r\n 	<li>Construction matters, claims and disputes over US$1.4B for the Design and Construction of the US $3.2B Third Set of Locks Expansion Program of the Panama Canal (TSL) Contract</li>\r\n 	<li>Construction matters for the Design and Construction of the Third Bridge over the Panama Canal – a US$400M Contract</li>\r\n 	<li>Construction matters, claims, disputes and contract termination over US$150M for the Doha Metro, part of the Qatar Rail Integrated Rail Project (QRIP), a US $36B transportation rail system for the 2022 FIFA World Cup in Qatar.</li>\r\n</ul>'),
(273234, 26339, 'MetaLink', 'recent_dealsexperience'),
(273235, 26339, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7913&amp;action=edit'),
(273236, 26339, 'ReportText', '<ul>\r\n 	<li>Construction matters, claims and disputes over US$200M for 7 Projects executed by ESEC International Contracting LLC., Dubai, U.A.E.</li>\r\n 	<li>Settlement Agreement under a project for the construction of a Mosque in Jebel Ali</li>\r\n 	<li>Construction matters, claims and disputes over US$1.4B for the Design and Construction of the US $3.2B Third Set of Locks Expansion Program of the Panama Canal (TSL) Contract</li>\r\n 	<li>Construction matters for the Design and Construction of the Third Bridge over the Panama Canal – a US$400M Contract</li>\r\n 	<li>Construction matters, claims, disputes and contract termination over US$150M for the Doha Metro, part of the Qatar Rail Integrated Rail Project (QRIP), a US $36B transportation rail system for the 2022 FIFA World Cup in Qatar.</li>\r\n</ul>|<ul>\r\n 	<li>Construction matters, claims and disputes over US$200M for 7 Projects executed by ESEC International Contracting LLC., Dubai, U.A.E.</li>\r\n 	<li>Settlement Agreement under a project for the construction of a Mosque in Jebel Ali</li>\r\n 	<li>Construction matters, claims and disputes over US$1.4B for the Design and Construction of the US $3.2B Third Set of Locks Expansion Program of the Panama Canal (TSL) Contract</li>\r\n 	<li>Construction matters for the Design and Construction of the Third Bridge over the Panama Canal – a US$400M Contract</li>\r\n</ul>'),
(273237, 26339, 'ClientIP', '83.111.236.141'),
(273238, 26339, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273239, 26339, 'CurrentUserID', '5'),
(273240, 26339, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273241, 26340, 'PostID', '7913'),
(273242, 26340, 'PostType', 'lawyer'),
(273243, 26340, 'PostTitle', 'Monica Effio'),
(273244, 26340, 'PostStatus', 'publish'),
(273245, 26340, 'PostDate', '2018-07-24 08:17:59'),
(273246, 26340, 'PostUrl', 'http://www.tamimi.com/lawyer/monica-effio/'),
(273247, 26340, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7913&amp;action=edit'),
(273248, 26340, 'ClientIP', '83.111.236.141'),
(273249, 26340, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273250, 26340, 'CurrentUserID', '5'),
(273251, 26340, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273252, 26341, 'PostID', '7913'),
(273253, 26341, 'PostType', 'lawyer'),
(273254, 26341, 'PostTitle', 'Monica Effio'),
(273255, 26341, 'PostStatus', 'publish'),
(273256, 26341, 'PostDate', '2018-07-24 08:17:59'),
(273257, 26341, 'PostUrl', 'http://www.tamimi.com/lawyer/monica-effio/'),
(273258, 26341, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7913&amp;action=edit'),
(273259, 26341, 'ClientIP', '83.111.236.141'),
(273260, 26341, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273261, 26341, 'CurrentUserID', '5'),
(273262, 26341, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273263, 26342, 'PostID', '7913'),
(273264, 26342, 'PostType', 'lawyer'),
(273265, 26342, 'PostTitle', 'Monica Effio'),
(273266, 26342, 'PostStatus', 'publish'),
(273267, 26342, 'PostDate', '2018-07-24 08:17:59'),
(273268, 26342, 'PostUrl', 'http://www.tamimi.com/lawyer/monica-effio/'),
(273269, 26342, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7913&amp;action=edit'),
(273270, 26342, 'ClientIP', '83.111.236.141'),
(273271, 26342, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273272, 26342, 'CurrentUserID', '5'),
(273273, 26342, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273274, 26343, 'PostID', '638'),
(273275, 26343, 'PostType', 'practice'),
(273276, 26343, 'PostTitle', 'Litigation'),
(273277, 26343, 'PostStatus', 'publish'),
(273278, 26343, 'PostDate', '2017-09-27 10:30:33'),
(273279, 26343, 'PostUrl', 'https://www.tamimi.com/practice/litigation/'),
(273280, 26343, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=638&amp;action=edit'),
(273281, 26343, 'ClientIP', '83.111.236.141'),
(273282, 26343, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273283, 26343, 'CurrentUserID', '5'),
(273284, 26343, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273285, 26344, 'PostID', '848'),
(273286, 26344, 'PostType', 'lawyer'),
(273287, 26344, 'PostTitle', 'Dr. Hassan Arab'),
(273288, 26344, 'PostStatus', 'publish'),
(273289, 26344, 'PostDate', '2017-09-27 17:46:49'),
(273290, 26344, 'PostUrl', 'https://www.tamimi.com/lawyer/hassan-arab/'),
(273291, 26344, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=848&amp;action=edit'),
(273292, 26344, 'ClientIP', '83.111.236.141'),
(273293, 26344, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273294, 26344, 'CurrentUserID', '5'),
(273295, 26344, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273296, 26345, 'PostID', '582'),
(273297, 26345, 'PostType', 'lawyer'),
(273298, 26345, 'PostTitle', 'Zafer Sheikh Oghli'),
(273299, 26345, 'PostStatus', 'publish'),
(273300, 26345, 'PostDate', '2017-09-26 17:44:27'),
(273301, 26345, 'PostUrl', 'https://www.tamimi.com/lawyer/zafer-oghli/'),
(273302, 26345, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=582&amp;action=edit'),
(273303, 26345, 'ClientIP', '83.111.236.141'),
(273304, 26345, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273305, 26345, 'CurrentUserID', '5'),
(273306, 26345, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273307, 26346, 'PostID', '524'),
(273308, 26346, 'PostType', 'lawyer'),
(273309, 26346, 'PostTitle', 'El-Ameir Noor'),
(273310, 26346, 'PostStatus', 'publish'),
(273311, 26346, 'PostDate', '2017-09-26 14:43:06'),
(273312, 26346, 'PostUrl', 'https://www.tamimi.com/lawyer/el-ameir-noor/'),
(273313, 26346, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=524&amp;action=edit'),
(273314, 26346, 'ClientIP', '83.111.236.141'),
(273315, 26346, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273316, 26346, 'CurrentUserID', '5'),
(273317, 26346, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273318, 26347, 'PostID', '6853'),
(273319, 26347, 'PostType', 'lawyer'),
(273320, 26347, 'PostTitle', 'Saif El Fawaer'),
(273321, 26347, 'PostStatus', 'publish'),
(273322, 26347, 'PostDate', '2017-12-13 16:21:42'),
(273323, 26347, 'PostUrl', 'https://www.tamimi.com/lawyer/saif-el-fawaer/'),
(273324, 26347, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=6853&amp;action=edit'),
(273325, 26347, 'ClientIP', '83.111.236.141'),
(273326, 26347, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273327, 26347, 'CurrentUserID', '5'),
(273328, 26347, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273329, 26348, 'PostID', '7913'),
(273330, 26348, 'PostType', 'lawyer'),
(273331, 26348, 'PostTitle', 'Monica Effio'),
(273332, 26348, 'PostStatus', 'publish'),
(273333, 26348, 'PostDate', '2018-07-24 08:17:59'),
(273334, 26348, 'PostUrl', 'http://www.tamimi.com/lawyer/monica-effio/'),
(273335, 26348, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7913&amp;action=edit'),
(273336, 26348, 'ClientIP', '83.111.236.141'),
(273337, 26348, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273338, 26348, 'CurrentUserID', '5'),
(273339, 26348, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273340, 26349, 'PostID', '7913'),
(273341, 26349, 'PostTitle', 'Monica Effio'),
(273342, 26349, 'PostStatus', 'publish'),
(273343, 26349, 'PostType', 'lawyer'),
(273344, 26349, 'PostDate', '2018-07-24 08:17:59'),
(273345, 26349, 'PostUrl', 'http://www.tamimi.com/lawyer/monica-effio/'),
(273346, 26349, 'MetaID', '222348'),
(273347, 26349, 'MetaKey', 'recent_dealsexperience'),
(273348, 26349, 'MetaValueOld', '<ul>\r\n 	<li>Construction matters, claims and disputes over US$200M for 7 Projects executed by ESEC International Contracting LLC., Dubai, U.A.E.</li>\r\n 	<li>Settlement Agreement under a project for the construction of a Mosque in Jebel Ali</li>\r\n 	<li>Construction matters, claims and disputes over US$1.4B for the Design and Construction of the US $3.2B Third Set of Locks Expansion Program of the Panama Canal (TSL) Contract</li>\r\n 	<li>Construction matters for the Design and Construction of the Third Bridge over the Panama Canal – a US$400M Contract</li>\r\n</ul>'),
(273349, 26349, 'MetaLink', 'recent_dealsexperience');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(273350, 26349, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7913&amp;action=edit'),
(273351, 26349, 'ReportText', '<ul>\r\n 	<li>Construction matters, claims and disputes over US$200M for 7 Projects executed by ESEC International Contracting LLC., Dubai, U.A.E.</li>\r\n 	<li>Settlement Agreement under a project for the construction of a Mosque in Jebel Ali</li>\r\n 	<li>Construction matters, claims and disputes over US$1.4B for the Design and Construction of the US $3.2B Third Set of Locks Expansion Program of the Panama Canal (TSL) Contract</li>\r\n 	<li>Construction matters for the Design and Construction of the Third Bridge over the Panama Canal – a US$400M Contract</li>\r\n</ul>|'),
(273352, 26349, 'ClientIP', '83.111.236.141'),
(273353, 26349, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273354, 26349, 'CurrentUserID', '5'),
(273355, 26349, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273356, 26350, 'PostID', '7913'),
(273357, 26350, 'PostType', 'lawyer'),
(273358, 26350, 'PostTitle', 'Monica Effio'),
(273359, 26350, 'PostStatus', 'publish'),
(273360, 26350, 'PostDate', '2018-07-24 08:17:59'),
(273361, 26350, 'PostUrl', 'http://www.tamimi.com/lawyer/monica-effio/'),
(273362, 26350, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7913&amp;action=edit'),
(273363, 26350, 'ClientIP', '83.111.236.141'),
(273364, 26350, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273365, 26350, 'CurrentUserID', '5'),
(273366, 26350, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273367, 26351, 'PostID', '4074'),
(273368, 26351, 'PostType', 'page'),
(273369, 26351, 'PostTitle', 'Lawyers'),
(273370, 26351, 'PostStatus', 'publish'),
(273371, 26351, 'PostDate', '2017-10-16 13:58:28'),
(273372, 26351, 'PostUrl', 'https://www.tamimi.com/our-firm/find-a-lawyer/'),
(273373, 26351, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=4074&amp;action=edit'),
(273374, 26351, 'ClientIP', '83.111.236.141'),
(273375, 26351, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273376, 26351, 'CurrentUserID', '5'),
(273377, 26351, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273378, 26352, 'PostID', '7913'),
(273379, 26352, 'PostType', 'lawyer'),
(273380, 26352, 'PostTitle', 'Monica Effio'),
(273381, 26352, 'PostStatus', 'publish'),
(273382, 26352, 'PostDate', '2018-07-24 08:17:59'),
(273383, 26352, 'PostUrl', 'https://www.tamimi.com/lawyer/monica-effio/'),
(273384, 26352, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7913&amp;action=edit'),
(273385, 26352, 'ClientIP', '83.111.236.141'),
(273386, 26352, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273387, 26352, 'CurrentUserID', '5'),
(273388, 26352, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273389, 26353, 'PostID', '7945'),
(273390, 26353, 'PostType', 'law_update_articles'),
(273391, 26353, 'PostTitle', 'From Stadion to E-Gaming in the UAE: A look at Stadiums'),
(273392, 26353, 'PostStatus', 'publish'),
(273393, 26353, 'PostDate', '2018-08-01 07:38:18'),
(273394, 26353, 'PostUrl', 'http://www.tamimi.com/law-update-articles/from-stadion-to-e-gaming-in-the-uae-a-look-at-stadiums/'),
(273395, 26353, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7945&amp;action=edit'),
(273396, 26353, 'ClientIP', '83.111.236.141'),
(273397, 26353, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273398, 26353, 'CurrentUserID', '5'),
(273399, 26353, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273400, 26354, 'PostID', '7945'),
(273401, 26354, 'PostType', 'law_update_articles'),
(273402, 26354, 'PostTitle', 'From Stadion to E-Gaming in the UAE: A look at Stadiums'),
(273403, 26354, 'PostStatus', 'publish'),
(273404, 26354, 'PostDate', '2018-08-01 07:38:18'),
(273405, 26354, 'PostUrl', 'http://www.tamimi.com/law-update-articles/from-stadion-to-e-gaming-in-the-uae-a-look-at-stadiums/'),
(273406, 26354, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7945&amp;action=edit'),
(273407, 26354, 'ClientIP', '83.111.236.141'),
(273408, 26354, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273409, 26354, 'CurrentUserID', '5'),
(273410, 26354, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273411, 26355, 'PostID', '7945'),
(273412, 26355, 'PostType', 'law_update_articles'),
(273413, 26355, 'PostTitle', 'From Stadion to E-Gaming in the UAE: A look at Stadiums'),
(273414, 26355, 'PostStatus', 'publish'),
(273415, 26355, 'PostDate', '2018-08-01 07:38:18'),
(273416, 26355, 'PostUrl', 'http://www.tamimi.com/law-update-articles/from-stadion-to-e-gaming-in-the-uae-a-look-at-stadiums/'),
(273417, 26355, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=7945&amp;action=edit'),
(273418, 26355, 'ClientIP', '83.111.236.141'),
(273419, 26355, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(273420, 26355, 'CurrentUserID', '5'),
(273421, 26355, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273422, 26356, 'PostID', '7960'),
(273423, 26356, 'PostType', 'law_update_articles'),
(273424, 26356, 'PostTitle', 'Guiding Charter for Family Owned Businesses in Saudi Arabia'),
(273425, 26356, 'PostStatus', 'publish'),
(273426, 26356, 'PostDate', '2018-08-01 07:32:04'),
(273427, 26356, 'PostUrl', 'https://www.tamimi.com/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
(273428, 26356, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7960&amp;action=edit'),
(273429, 26356, 'ClientIP', '86.98.5.18'),
(273430, 26356, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273431, 26356, 'CurrentUserID', '8'),
(273432, 26356, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273433, 26357, 'PostID', '7960'),
(273434, 26357, 'PostType', 'law_update_articles'),
(273435, 26357, 'PostTitle', 'Guiding Charter for Family Owned Businesses in Saudi Arabia'),
(273436, 26357, 'PostStatus', 'publish'),
(273437, 26357, 'PostDate', '2018-08-01 07:32:04'),
(273438, 26357, 'PostUrl', 'http://www.tamimi.com/law-update-articles/guiding-charter-for-family-owned-businesses-in-saudi-arabia/'),
(273439, 26357, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7960&amp;action=edit'),
(273440, 26357, 'ClientIP', '86.98.5.18'),
(273441, 26357, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273442, 26357, 'CurrentUserID', '8'),
(273443, 26357, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273444, 26358, 'AttachmentID', '7997'),
(273445, 26358, 'FileName', 'Screen-Shot-2018-07-31-at-5.23.26-PM.png'),
(273446, 26358, 'FilePath', '/home/tamimnew/public_html/wp-content/uploads/2018/07'),
(273447, 26358, 'ClientIP', '86.98.5.18'),
(273448, 26358, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273449, 26358, 'CurrentUserID', '8'),
(273450, 26358, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273451, 26359, 'AttachmentID', '8113'),
(273452, 26359, 'FileName', 'abc.jpg'),
(273453, 26359, 'FilePath', '/home/tamimnew/public_html/wp-content/uploads/2018/08'),
(273454, 26359, 'ClientIP', '86.98.5.18'),
(273455, 26359, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273456, 26359, 'CurrentUserID', '8'),
(273457, 26359, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273458, 26360, 'PostID', '7928'),
(273459, 26360, 'PostType', 'law-update'),
(273460, 26360, 'PostTitle', 'June - July 2018'),
(273461, 26360, 'PostStatus', 'publish'),
(273462, 26360, 'PostDate', '2018-08-01 07:30:03'),
(273463, 26360, 'PostUrl', 'https://www.tamimi.com/law-update/june-july-2018/'),
(273464, 26360, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7928&amp;action=edit'),
(273465, 26360, 'ClientIP', '86.98.5.18'),
(273466, 26360, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273467, 26360, 'CurrentUserID', '8'),
(273468, 26360, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273469, 26361, 'PostID', '7946'),
(273470, 26361, 'PostType', 'law_update_articles'),
(273471, 26361, 'PostTitle', 'Fintech, Blockchain and Sports in the Middle East'),
(273472, 26361, 'PostStatus', 'publish'),
(273473, 26361, 'PostDate', '2018-08-01 07:38:05'),
(273474, 26361, 'PostUrl', 'https://www.tamimi.com/law-update-articles/fintech-blockchain-and-sports-in-the-middle-east/'),
(273475, 26361, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7946&amp;action=edit'),
(273476, 26361, 'ClientIP', '86.98.5.18'),
(273477, 26361, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273478, 26361, 'CurrentUserID', '8'),
(273479, 26361, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273480, 26362, 'PostID', '7935'),
(273481, 26362, 'PostType', 'law_update_articles'),
(273482, 26362, 'PostTitle', 'Overhaul of the UAE Finance Companies Regulations'),
(273483, 26362, 'PostStatus', 'publish'),
(273484, 26362, 'PostDate', '2018-08-01 07:43:42'),
(273485, 26362, 'PostUrl', 'https://www.tamimi.com/law-update-articles/overhaul-of-the-uae-finance-companies-regulations/'),
(273486, 26362, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7935&amp;action=edit'),
(273487, 26362, 'ClientIP', '86.98.5.18'),
(273488, 26362, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273489, 26362, 'CurrentUserID', '8'),
(273490, 26362, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273491, 26363, 'PostID', '7935'),
(273492, 26363, 'PostType', 'law_update_articles'),
(273493, 26363, 'PostTitle', 'Overhaul of the UAE Finance Companies Regulations'),
(273494, 26363, 'PostStatus', 'publish'),
(273495, 26363, 'PostDate', '2018-08-01 07:43:42'),
(273496, 26363, 'PostUrl', 'http://www.tamimi.com/law-update-articles/overhaul-of-the-uae-finance-companies-regulations/'),
(273497, 26363, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7935&amp;action=edit'),
(273498, 26363, 'ClientIP', '86.98.5.18'),
(273499, 26363, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273500, 26363, 'CurrentUserID', '8'),
(273501, 26363, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273502, 26364, 'PostID', '7935'),
(273503, 26364, 'PostTitle', 'Overhaul of the UAE Finance Companies Regulations'),
(273504, 26364, 'PostStatus', 'publish'),
(273505, 26364, 'PostType', 'law_update_articles'),
(273506, 26364, 'PostDate', '2018-08-01 07:43:42'),
(273507, 26364, 'PostUrl', 'http://www.tamimi.com/law-update-articles/overhaul-of-the-uae-finance-companies-regulations/'),
(273508, 26364, 'MetaID', '223050'),
(273509, 26364, 'MetaKey', 'content'),
(273510, 26364, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-7994 size-full aligncenter\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/11.jpg\" alt=\"\" width=\"5472\" height=\"845\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Amongst the several new laws and regulations being introduced in the UAE, the UAE Central Bank (\"Central Bank\") has on10 May 2018 issued new Finance Company Regulations (\"Regulations\" or \"2018 Regulations\") which are to come into effect one month after its publication.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations replace the previous finance company regulations issued in 1996 and finance companies regulations for companies conducting business as per Islamic sharia’a principles issued in 2004 (\"Previous Regulations\") and aim at providing a detailed regulatory framework for Finance Companies to operate and develop within the UAE and also covers in its ambit the framework for protecting the customers of such Finance Companies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations consolidate the regulations for both Islamic finance and conventional finance companies (\"Finance Company/ies\") and incorporate certain significant changes including changes to capital requirements and corporate governance, to also be followed by existing Finance Companies. We have set out below certain noteworthy features of these Regulations and a comparative table on the key changes from the Previous Regulations on subject.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>License Application</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Pursuant to these Regulations, conducting financing activities in the UAE without a central bank license is prohibited. An application for such license must include the proposed scope of activities, a feasibility study illustrating the financial activities and products to be launched, estimated financial projections, risk factors, corporate structure, start-up costs, branches and a recruitment plan.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Another important requisite is for the applicant to provide an unconditional guarantee from a UAE Bank, in favour of the Central Bank for an amount equivalent to the minimum required paid-up capital. The License will be granted for a period of three years and may be renewable for the same period unless otherwise required by the Central Bank.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any changes to the ownership of the Finance Company of 5% or more will require prior approval from the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Cancelling or Revoking a License</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank has the discretion to approve or refuse the License application, but must notify applicants in writing with reasons in case there is a refusal. Licenses can also be amended, revoked or cancelled at the discretion of the Board. The Regulations set out instances when the license can be cancelled which include providing false/misleading information, risking interests of the potential customers, or if there is a bankruptcy order filed against the Finance Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If a Finance Company wishes to cease operations it must apply to the Central Bank at least six months in advance providing the reasons for such a cessation or suspension.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Regulations also provide for penalties that will be imposed if such company does not follow the provisions of the Regulations including adhering to the anti-money laundering policies laid down by the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Permitted Activities</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10.1 of the Regulation details out the types of activities that are permitted, which are:</p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Retail finance,</li>\r\n 	<li dir=\"LTR\">mortgage finance,</li>\r\n 	<li dir=\"LTR\">wholesale finance,</li>\r\n 	<li dir=\"LTR\">pre-paid cards, and</li>\r\n 	<li dir=\"LTR\">distribution of third party products.</li>\r\n</ol>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank can review and amend this list from time to time.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10 further sets out the do’s and dont’s in relation to the business of the Finance Company, certain key features are:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">it can extend loans only to ‘Juridicial Persons’ (defined under Article 93 of the UAE Civil Transactions Law) and individuals in the UAE. However, it is prohibited from accepting deposits or loans from individuals.</li>\r\n 	<li dir=\"LTR\">it may accept deposits only from Juridicial Persons, subject to certain conditions laid out under Article 10.4 and also borrow from UAE banks, and may even receive foreign funding provided that its risk has been adequately hedged. In doing so it must not exceed 25% of the sum of total amount of its debt capital.</li>\r\n 	<li dir=\"LTR\">it must obtain a no objection letter from the Central Bank in order to provide any new product line from within activities specified in its license.</li>\r\n 	<li dir=\"LTR\">it may only participate in the share capital of brokerage companies, money exchanges, UAE banks and other Finance Companies. Any such single participation cannot exceed 10% of its debt capital and the aggregate participation must not exceed 25% of the debt capital.</li>\r\n 	<li dir=\"LTR\">It must obtain approval from the Central Bank in order to issue bonds or sukuks. Such bonds and sukuks shall only be denominated in UAE dirhams or US Dollars.</li>\r\n 	<li dir=\"LTR\">it is prohibited from financing a borrower which is not an entity incorporated in the UAE or its free zones, or a UAE resident, or where the mortgaged assets are not in the UAE.</li>\r\n 	<li dir=\"LTR\">it is prohibited from entering into the business of money exchange.</li>\r\n 	<li dir=\"LTR\">it must not purchase immovable properties unless for its own use or specific approval for the same has been obtained from the Central Bank. This rule does not apply to Islamic Finance Companies (IFC). IFCs may own property including immovable property and goods as part of an underlying financing contract with a borrower.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Minimum Capital, Liquidity Requirements and Credit Exposure Restrictions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The minimum paid-up capital for a Finance Company is 150 million UAE Dirhams. UAE national ownership of the Finance Company must comprise at least 60% of total paid-up capital. Finance Companies must also allocate at least 10% of annual net profits to establishing a statutory reserve until the reserve equals 50% of its paid-up capital.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To withstand short-term liquidity stress, Finance Companies are required to hold an amount equivalent to 10% of their aggregate liabilities in liquid assets i.e. cash held in UAE bank, Certificates of deposit issued by the Central Bank held via a UAE bank, short term deposits with a UAE bank with maturity upto 30 days and UAE federal and local government bonds, which must not exceed 30% of the total liquid assets. For the purpose of calculating the 10% amount, a Finance Company may deduct from its aggregate liabilities, cash collateral, bank guarantees from UAE banks and sovereign guarantees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The credit exposure is considered ‘large’ if the value of such exposure to one borrower or group of related entities is 7% or more. The Regulations set out maximum exposure limits for different borrower types.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Organisational Structure, Composition and Policies of the Finance Company</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Founding shareholders - Founding shareholders must satisfy \"Fit and Proper\" criteria as defined by the Central Bank and their appointment must be in line with the Commercial Companies Law<strong>.</strong></li>\r\n 	<li dir=\"LTR\">Board of Directors - The board of directors of a Finance Company must have no fewer than five members. Atleast 60% of the board members of an IFC must have knowledge of the banking business or Islamic finance and banking business as the case may be. The Regulations provide for detailed selection processes and guidances in relation to the board of directors</li>\r\n 	<li dir=\"LTR\">Sharia’a Supervision Committee and other committees - An IFC must have a Sharia’a Supervision Committee, and its role must be laid out in the policies of the IFC. Finance Companies must also have a board committee and credit committee.</li>\r\n 	<li dir=\"LTR\">Senior Management – Finance Companies must comply with the ‘fit and proper‘ test set out by the Central Bank and must be professional who understands the business of finance and was experience of not less than 10 years in the field of finance. Person within the senior management cannot be a part of the board.</li>\r\n 	<li dir=\"LTR\">Corporate Governance - While the Regulations set out certain minimum requirements for corporate governance, Finance Companies are permitted to set out their own policies and framework for corporate governance (complying with the Regulations), however these must be approved by its board of directors and a copy of such policies must be provided to the Central Bank.</li>\r\n 	<li dir=\"LTR\">Internal Policies – the Regulations set out the requirements that need to be adhered to by Finance Companies and IFC with respect to its internal polices in relation to management, risk management, extension of credit, compliance, information technology, security, audit, remuneration, outsourcing, etc.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Other provisions</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Consumer Protection: the Name of the finance company must not include the words \"bank\", \"investment company\" or and other term which may mislead its customer. It must provide its customers with sufficient information regarding its products, etc. in order for them to be able to make an informed decision. The Finance Company must follow the Central Bank guidelines in relation to ‘Consumer Protection’.</li>\r\n 	<li dir=\"LTR\">Credit Reports - Every Finance Company must adhere to the credit reporting requirements of the Al Etihad Credit Bureau and other credit agencies to provide to and obtain information of the Borrower.</li>\r\n 	<li dir=\"LTR\">Accounting Standards - A Finance Company must implement all applicable International Accounting Standards/International Financial Reporting Standards and provide the Central Bank with two copies of signed audited financial statements, including external auditor reports, before 31st March every year. The Central Bank may require the Finance Company to appoint another auditor if the size and nature of the business of the Finance Company so requires.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Differences in the new Regulations from the Previous Regulations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The 2018 Regulations are far more detailed in the nature of investments permitted, liquidity requirements, organisational structure to be followed, investor guidance; we have set out below certain differences in the provisions between the Previous Regulations and 2018 Regulations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter wp-image-8113 \" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/abc.jpg\" alt=\"\" width=\"1071\" height=\"634\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations apply to all Finance Companies. Accordingly companies licensed prior to the date of the issuance of these Regulations need to comply with the 2018 Regulations and are given a period not exceeding 3 years from the publication to conform. However, the Central Bank may amend the requirement of compliance within 3 years if it deems the finance company to be substantially in compliance with these Regulations. All existing Finance Companies will require to provide the Central Bank with a detailed adjustment plan to comply with the articles of these Regulations.</p>\r\n<em>Al Tamimi &amp; Company’s Banking and Finance team regularly advises on the Finance Company Regulations. For further information please contact Mark Brown (m.brown@tamimi.com) or Maymoona Talib (m.talib@tamimi.com).</em>'),
(273511, 26364, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-7994 size-full aligncenter\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/11.jpg\" alt=\"\" width=\"5472\" height=\"845\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Amongst the several new laws and regulations being introduced in the UAE, the UAE Central Bank (\"Central Bank\") has on10 May 2018 issued new Finance Company Regulations (\"Regulations\" or \"2018 Regulations\") which are to come into effect one month after its publication.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations replace the previous finance company regulations issued in 1996 and finance companies regulations for companies conducting business as per Islamic sharia’a principles issued in 2004 (\"Previous Regulations\") and aim at providing a detailed regulatory framework for Finance Companies to operate and develop within the UAE and also covers in its ambit the framework for protecting the customers of such Finance Companies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations consolidate the regulations for both Islamic finance and conventional finance companies (\"Finance Company/ies\") and incorporate certain significant changes including changes to capital requirements and corporate governance, to also be followed by existing Finance Companies. We have set out below certain noteworthy features of these Regulations and a comparative table on the key changes from the Previous Regulations on subject.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>License Application</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Pursuant to these Regulations, conducting financing activities in the UAE without a central bank license is prohibited. An application for such license must include the proposed scope of activities, a feasibility study illustrating the financial activities and products to be launched, estimated financial projections, risk factors, corporate structure, start-up costs, branches and a recruitment plan.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Another important requisite is for the applicant to provide an unconditional guarantee from a UAE Bank, in favour of the Central Bank for an amount equivalent to the minimum required paid-up capital. The License will be granted for a period of three years and may be renewable for the same period unless otherwise required by the Central Bank.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any changes to the ownership of the Finance Company of 5% or more will require prior approval from the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Cancelling or Revoking a License</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank has the discretion to approve or refuse the License application, but must notify applicants in writing with reasons in case there is a refusal. Licenses can also be amended, revoked or cancelled at the discretion of the Board. The Regulations set out instances when the license can be cancelled which include providing false/misleading information, risking interests of the potential customers, or if there is a bankruptcy order filed against the Finance Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If a Finance Company wishes to cease operations it must apply to the Central Bank at least six months in advance providing the reasons for such a cessation or suspension.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Regulations also provide for penalties that will be imposed if such company does not follow the provisions of the Regulations including adhering to the anti-money laundering policies laid down by the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Permitted Activities</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10.1 of the Regulation details out the types of activities that are permitted, which are:</p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Retail finance,</li>\r\n 	<li dir=\"LTR\">mortgage finance,</li>\r\n 	<li dir=\"LTR\">wholesale finance,</li>\r\n 	<li dir=\"LTR\">pre-paid cards, and</li>\r\n 	<li dir=\"LTR\">distribution of third party products.</li>\r\n</ol>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank can review and amend this list from time to time.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10 further sets out the do’s and dont’s in relation to the business of the Finance Company, certain key features are:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">it can extend loans only to ‘Juridicial Persons’ (defined under Article 93 of the UAE Civil Transactions Law) and individuals in the UAE. However, it is prohibited from accepting deposits or loans from individuals.</li>\r\n 	<li dir=\"LTR\">it may accept deposits only from Juridicial Persons, subject to certain conditions laid out under Article 10.4 and also borrow from UAE banks, and may even receive foreign funding provided that its risk has been adequately hedged. In doing so it must not exceed 25% of the sum of total amount of its debt capital.</li>\r\n 	<li dir=\"LTR\">it must obtain a no objection letter from the Central Bank in order to provide any new product line from within activities specified in its license.</li>\r\n 	<li dir=\"LTR\">it may only participate in the share capital of brokerage companies, money exchanges, UAE banks and other Finance Companies. Any such single participation cannot exceed 10% of its debt capital and the aggregate participation must not exceed 25% of the debt capital.</li>\r\n 	<li dir=\"LTR\">It must obtain approval from the Central Bank in order to issue bonds or sukuks. Such bonds and sukuks shall only be denominated in UAE dirhams or US Dollars.</li>\r\n 	<li dir=\"LTR\">it is prohibited from financing a borrower which is not an entity incorporated in the UAE or its free zones, or a UAE resident, or where the mortgaged assets are not in the UAE.</li>\r\n 	<li dir=\"LTR\">it is prohibited from entering into the business of money exchange.</li>\r\n 	<li dir=\"LTR\">it must not purchase immovable properties unless for its own use or specific approval for the same has been obtained from the Central Bank. This rule does not apply to Islamic Finance Companies (IFC). IFCs may own property including immovable property and goods as part of an underlying financing contract with a borrower.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Minimum Capital, Liquidity Requirements and Credit Exposure Restrictions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The minimum paid-up capital for a Finance Company is 150 million UAE Dirhams. UAE national ownership of the Finance Company must comprise at least 60% of total paid-up capital. Finance Companies must also allocate at least 10% of annual net profits to establishing a statutory reserve until the reserve equals 50% of its paid-up capital.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To withstand short-term liquidity stress, Finance Companies are required to hold an amount equivalent to 10% of their aggregate liabilities in liquid assets i.e. cash held in UAE bank, Certificates of deposit issued by the Central Bank held via a UAE bank, short term deposits with a UAE bank with maturity upto 30 days and UAE federal and local government bonds, which must not exceed 30% of the total liquid assets. For the purpose of calculating the 10% amount, a Finance Company may deduct from its aggregate liabilities, cash collateral, bank guarantees from UAE banks and sovereign guarantees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The credit exposure is considered ‘large’ if the value of such exposure to one borrower or group of related entities is 7% or more. The Regulations set out maximum exposure limits for different borrower types.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Organisational Structure, Composition and Policies of the Finance Company</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Founding shareholders - Founding shareholders must satisfy \"Fit and Proper\" criteria as defined by the Central Bank and their appointment must be in line with the Commercial Companies Law<strong>.</strong></li>\r\n 	<li dir=\"LTR\">Board of Directors - The board of directors of a Finance Company must have no fewer than five members. Atleast 60% of the board members of an IFC must have knowledge of the banking business or Islamic finance and banking business as the case may be. The Regulations provide for detailed selection processes and guidances in relation to the board of directors</li>\r\n 	<li dir=\"LTR\">Sharia’a Supervision Committee and other committees - An IFC must have a Sharia’a Supervision Committee, and its role must be laid out in the policies of the IFC. Finance Companies must also have a board committee and credit committee.</li>\r\n 	<li dir=\"LTR\">Senior Management – Finance Companies must comply with the ‘fit and proper‘ test set out by the Central Bank and must be professional who understands the business of finance and was experience of not less than 10 years in the field of finance. Person within the senior management cannot be a part of the board.</li>\r\n 	<li dir=\"LTR\">Corporate Governance - While the Regulations set out certain minimum requirements for corporate governance, Finance Companies are permitted to set out their own policies and framework for corporate governance (complying with the Regulations), however these must be approved by its board of directors and a copy of such policies must be provided to the Central Bank.</li>\r\n 	<li dir=\"LTR\">Internal Policies – the Regulations set out the requirements that need to be adhered to by Finance Companies and IFC with respect to its internal polices in relation to management, risk management, extension of credit, compliance, information technology, security, audit, remuneration, outsourcing, etc.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Other provisions</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Consumer Protection: the Name of the finance company must not include the words \"bank\", \"investment company\" or and other term which may mislead its customer. It must provide its customers with sufficient information regarding its products, etc. in order for them to be able to make an informed decision. The Finance Company must follow the Central Bank guidelines in relation to ‘Consumer Protection’.</li>\r\n 	<li dir=\"LTR\">Credit Reports - Every Finance Company must adhere to the credit reporting requirements of the Al Etihad Credit Bureau and other credit agencies to provide to and obtain information of the Borrower.</li>\r\n 	<li dir=\"LTR\">Accounting Standards - A Finance Company must implement all applicable International Accounting Standards/International Financial Reporting Standards and provide the Central Bank with two copies of signed audited financial statements, including external auditor reports, before 31st March every year. The Central Bank may require the Finance Company to appoint another auditor if the size and nature of the business of the Finance Company so requires.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Differences in the new Regulations from the Previous Regulations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The 2018 Regulations are far more detailed in the nature of investments permitted, liquidity requirements, organisational structure to be followed, investor guidance; we have set out below certain differences in the provisions between the Previous Regulations and 2018 Regulations.</p>\r\n &nbsp;<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-7997 size-large aligncenter\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/Screen-Shot-2018-07-31-at-5.23.26-PM-1024x947.png\" alt=\"\" width=\"640\" height=\"592\" /></p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">These Regulations apply to all Finance Companies. Accordingly companies licensed prior to the date of the issuance of these Regulations need to comply with the 2018 Regulations and are given a period not exceeding 3 years from the publication to conform. However, the Central Bank may amend the requirement of compliance within 3 years if it deems the finance company to be substantially in compliance with these Regulations. All existing Finance Companies will require to provide the Central Bank with a detailed adjustment plan to comply with the articles of these Regulations.</p>\r\n<em>Al Tamimi &amp; Company’s Banking and Finance team regularly advises on the Finance Company Regulations. For further information please contact Mark Brown (m.brown@tamimi.com) or Maymoona Talib (m.talib@tamimi.com).</em>'),
(273512, 26364, 'MetaLink', 'content'),
(273513, 26364, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7935&amp;action=edit');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(273514, 26364, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-7994 size-full aligncenter\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/11.jpg\" alt=\"\" width=\"5472\" height=\"845\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Amongst the several new laws and regulations being introduced in the UAE, the UAE Central Bank (\"Central Bank\") has on10 May 2018 issued new Finance Company Regulations (\"Regulations\" or \"2018 Regulations\") which are to come into effect one month after its publication.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations replace the previous finance company regulations issued in 1996 and finance companies regulations for companies conducting business as per Islamic sharia’a principles issued in 2004 (\"Previous Regulations\") and aim at providing a detailed regulatory framework for Finance Companies to operate and develop within the UAE and also covers in its ambit the framework for protecting the customers of such Finance Companies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations consolidate the regulations for both Islamic finance and conventional finance companies (\"Finance Company/ies\") and incorporate certain significant changes including changes to capital requirements and corporate governance, to also be followed by existing Finance Companies. We have set out below certain noteworthy features of these Regulations and a comparative table on the key changes from the Previous Regulations on subject.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>License Application</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Pursuant to these Regulations, conducting financing activities in the UAE without a central bank license is prohibited. An application for such license must include the proposed scope of activities, a feasibility study illustrating the financial activities and products to be launched, estimated financial projections, risk factors, corporate structure, start-up costs, branches and a recruitment plan.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Another important requisite is for the applicant to provide an unconditional guarantee from a UAE Bank, in favour of the Central Bank for an amount equivalent to the minimum required paid-up capital. The License will be granted for a period of three years and may be renewable for the same period unless otherwise required by the Central Bank.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any changes to the ownership of the Finance Company of 5% or more will require prior approval from the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Cancelling or Revoking a License</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank has the discretion to approve or refuse the License application, but must notify applicants in writing with reasons in case there is a refusal. Licenses can also be amended, revoked or cancelled at the discretion of the Board. The Regulations set out instances when the license can be cancelled which include providing false/misleading information, risking interests of the potential customers, or if there is a bankruptcy order filed against the Finance Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If a Finance Company wishes to cease operations it must apply to the Central Bank at least six months in advance providing the reasons for such a cessation or suspension.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Regulations also provide for penalties that will be imposed if such company does not follow the provisions of the Regulations including adhering to the anti-money laundering policies laid down by the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Permitted Activities</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10.1 of the Regulation details out the types of activities that are permitted, which are:</p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Retail finance,</li>\r\n 	<li dir=\"LTR\">mortgage finance,</li>\r\n 	<li dir=\"LTR\">wholesale finance,</li>\r\n 	<li dir=\"LTR\">pre-paid cards, and</li>\r\n 	<li dir=\"LTR\">distribution of third party products.</li>\r\n</ol>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank can review and amend this list from time to time.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10 further sets out the do’s and dont’s in relation to the business of the Finance Company, certain key features are:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">it can extend loans only to ‘Juridicial Persons’ (defined under Article 93 of the UAE Civil Transactions Law) and individuals in the UAE. However, it is prohibited from accepting deposits or loans from individuals.</li>\r\n 	<li dir=\"LTR\">it may accept deposits only from Juridicial Persons, subject to certain conditions laid out under Article 10.4 and also borrow from UAE banks, and may even receive foreign funding provided that its risk has been adequately hedged. In doing so it must not exceed 25% of the sum of total amount of its debt capital.</li>\r\n 	<li dir=\"LTR\">it must obtain a no objection letter from the Central Bank in order to provide any new product line from within activities specified in its license.</li>\r\n 	<li dir=\"LTR\">it may only participate in the share capital of brokerage companies, money exchanges, UAE banks and other Finance Companies. Any such single participation cannot exceed 10% of its debt capital and the aggregate participation must not exceed 25% of the debt capital.</li>\r\n 	<li dir=\"LTR\">It must obtain approval from the Central Bank in order to issue bonds or sukuks. Such bonds and sukuks shall only be denominated in UAE dirhams or US Dollars.</li>\r\n 	<li dir=\"LTR\">it is prohibited from financing a borrower which is not an entity incorporated in the UAE or its free zones, or a UAE resident, or where the mortgaged assets are not in the UAE.</li>\r\n 	<li dir=\"LTR\">it is prohibited from entering into the business of money exchange.</li>\r\n 	<li dir=\"LTR\">it must not purchase immovable properties unless for its own use or specific approval for the same has been obtained from the Central Bank. This rule does not apply to Islamic Finance Companies (IFC). IFCs may own property including immovable property and goods as part of an underlying financing contract with a borrower.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Minimum Capital, Liquidity Requirements and Credit Exposure Restrictions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The minimum paid-up capital for a Finance Company is 150 million UAE Dirhams. UAE national ownership of the Finance Company must comprise at least 60% of total paid-up capital. Finance Companies must also allocate at least 10% of annual net profits to establishing a statutory reserve until the reserve equals 50% of its paid-up capital.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To withstand short-term liquidity stress, Finance Companies are required to hold an amount equivalent to 10% of their aggregate liabilities in liquid assets i.e. cash held in UAE bank, Certificates of deposit issued by the Central Bank held via a UAE bank, short term deposits with a UAE bank with maturity upto 30 days and UAE federal and local government bonds, which must not exceed 30% of the total liquid assets. For the purpose of calculating the 10% amount, a Finance Company may deduct from its aggregate liabilities, cash collateral, bank guarantees from UAE banks and sovereign guarantees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The credit exposure is considered ‘large’ if the value of such exposure to one borrower or group of related entities is 7% or more. The Regulations set out maximum exposure limits for different borrower types.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Organisational Structure, Composition and Policies of the Finance Company</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Founding shareholders - Founding shareholders must satisfy \"Fit and Proper\" criteria as defined by the Central Bank and their appointment must be in line with the Commercial Companies Law<strong>.</strong></li>\r\n 	<li dir=\"LTR\">Board of Directors - The board of directors of a Finance Company must have no fewer than five members. Atleast 60% of the board members of an IFC must have knowledge of the banking business or Islamic finance and banking business as the case may be. The Regulations provide for detailed selection processes and guidances in relation to the board of directors</li>\r\n 	<li dir=\"LTR\">Sharia’a Supervision Committee and other committees - An IFC must have a Sharia’a Supervision Committee, and its role must be laid out in the policies of the IFC. Finance Companies must also have a board committee and credit committee.</li>\r\n 	<li dir=\"LTR\">Senior Management – Finance Companies must comply with the ‘fit and proper‘ test set out by the Central Bank and must be professional who understands the business of finance and was experience of not less than 10 years in the field of finance. Person within the senior management cannot be a part of the board.</li>\r\n 	<li dir=\"LTR\">Corporate Governance - While the Regulations set out certain minimum requirements for corporate governance, Finance Companies are permitted to set out their own policies and framework for corporate governance (complying with the Regulations), however these must be approved by its board of directors and a copy of such policies must be provided to the Central Bank.</li>\r\n 	<li dir=\"LTR\">Internal Policies – the Regulations set out the requirements that need to be adhered to by Finance Companies and IFC with respect to its internal polices in relation to management, risk management, extension of credit, compliance, information technology, security, audit, remuneration, outsourcing, etc.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Other provisions</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Consumer Protection: the Name of the finance company must not include the words \"bank\", \"investment company\" or and other term which may mislead its customer. It must provide its customers with sufficient information regarding its products, etc. in order for them to be able to make an informed decision. The Finance Company must follow the Central Bank guidelines in relation to ‘Consumer Protection’.</li>\r\n 	<li dir=\"LTR\">Credit Reports - Every Finance Company must adhere to the credit reporting requirements of the Al Etihad Credit Bureau and other credit agencies to provide to and obtain information of the Borrower.</li>\r\n 	<li dir=\"LTR\">Accounting Standards - A Finance Company must implement all applicable International Accounting Standards/International Financial Reporting Standards and provide the Central Bank with two copies of signed audited financial statements, including external auditor reports, before 31st March every year. The Central Bank may require the Finance Company to appoint another auditor if the size and nature of the business of the Finance Company so requires.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Differences in the new Regulations from the Previous Regulations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The 2018 Regulations are far more detailed in the nature of investments permitted, liquidity requirements, organisational structure to be followed, investor guidance; we have set out below certain differences in the provisions between the Previous Regulations and 2018 Regulations.</p>\r\n &nbsp;<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-7997 size-large aligncenter\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/Screen-Shot-2018-07-31-at-5.23.26-PM-1024x947.png\" alt=\"\" width=\"640\" height=\"592\" /></p>\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">These Regulations apply to all Finance Companies. Accordingly companies licensed prior to the date of the issuance of these Regulations need to comply with the 2018 Regulations and are given a period not exceeding 3 years from the publication to conform. However, the Central Bank may amend the requirement of compliance within 3 years if it deems the finance company to be substantially in compliance with these Regulations. All existing Finance Companies will require to provide the Central Bank with a detailed adjustment plan to comply with the articles of these Regulations.</p>\r\n<em>Al Tamimi &amp; Company’s Banking and Finance team regularly advises on the Finance Company Regulations. For further information please contact Mark Brown (m.brown@tamimi.com) or Maymoona Talib (m.talib@tamimi.com).</em>|<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-7994 size-full aligncenter\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/11.jpg\" alt=\"\" width=\"5472\" height=\"845\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Amongst the several new laws and regulations being introduced in the UAE, the UAE Central Bank (\"Central Bank\") has on10 May 2018 issued new Finance Company Regulations (\"Regulations\" or \"2018 Regulations\") which are to come into effect one month after its publication.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations replace the previous finance company regulations issued in 1996 and finance companies regulations for companies conducting business as per Islamic sharia’a principles issued in 2004 (\"Previous Regulations\") and aim at providing a detailed regulatory framework for Finance Companies to operate and develop within the UAE and also covers in its ambit the framework for protecting the customers of such Finance Companies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations consolidate the regulations for both Islamic finance and conventional finance companies (\"Finance Company/ies\") and incorporate certain significant changes including changes to capital requirements and corporate governance, to also be followed by existing Finance Companies. We have set out below certain noteworthy features of these Regulations and a comparative table on the key changes from the Previous Regulations on subject.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>License Application</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Pursuant to these Regulations, conducting financing activities in the UAE without a central bank license is prohibited. An application for such license must include the proposed scope of activities, a feasibility study illustrating the financial activities and products to be launched, estimated financial projections, risk factors, corporate structure, start-up costs, branches and a recruitment plan.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Another important requisite is for the applicant to provide an unconditional guarantee from a UAE Bank, in favour of the Central Bank for an amount equivalent to the minimum required paid-up capital. The License will be granted for a period of three years and may be renewable for the same period unless otherwise required by the Central Bank.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any changes to the ownership of the Finance Company of 5% or more will require prior approval from the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Cancelling or Revoking a License</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank has the discretion to approve or refuse the License application, but must notify applicants in writing with reasons in case there is a refusal. Licenses can also be amended, revoked or cancelled at the discretion of the Board. The Regulations set out instances when the license can be cancelled which include providing false/misleading information, risking interests of the potential customers, or if there is a bankruptcy order filed against the Finance Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If a Finance Company wishes to cease operations it must apply to the Central Bank at least six months in advance providing the reasons for such a cessation or suspension.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Regulations also provide for penalties that will be imposed if such company does not follow the provisions of the Regulations including adhering to the anti-money laundering policies laid down by the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Permitted Activities</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10.1 of the Regulation details out the types of activities that are permitted, which are:</p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Retail finance,</li>\r\n 	<li dir=\"LTR\">mortgage finance,</li>\r\n 	<li dir=\"LTR\">wholesale finance,</li>\r\n 	<li dir=\"LTR\">pre-paid cards, and</li>\r\n 	<li dir=\"LTR\">distribution of third party products.</li>\r\n</ol>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank can review and amend this list from time to time.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10 further sets out the do’s and dont’s in relation to the business of the Finance Company, certain key features are:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">it can extend loans only to ‘Juridicial Persons’ (defined under Article 93 of the UAE Civil Transactions Law) and individuals in the UAE. However, it is prohibited from accepting deposits or loans from individuals.</li>\r\n 	<li dir=\"LTR\">it may accept deposits only from Juridicial Persons, subject to certain conditions laid out under Article 10.4 and also borrow from UAE banks, and may even receive foreign funding provided that its risk has been adequately hedged. In doing so it must not exceed 25% of the sum of total amount of its debt capital.</li>\r\n 	<li dir=\"LTR\">it must obtain a no objection letter from the Central Bank in order to provide any new product line from within activities specified in its license.</li>\r\n 	<li dir=\"LTR\">it may only participate in the share capital of brokerage companies, money exchanges, UAE banks and other Finance Companies. Any such single participation cannot exceed 10% of its debt capital and the aggregate participation must not exceed 25% of the debt capital.</li>\r\n 	<li dir=\"LTR\">It must obtain approval from the Central Bank in order to issue bonds or sukuks. Such bonds and sukuks shall only be denominated in UAE dirhams or US Dollars.</li>\r\n 	<li dir=\"LTR\">it is prohibited from financing a borrower which is not an entity incorporated in the UAE or its free zones, or a UAE resident, or where the mortgaged assets are not in the UAE.</li>\r\n 	<li dir=\"LTR\">it is prohibited from entering into the business of money exchange.</li>\r\n 	<li dir=\"LTR\">it must not purchase immovable properties unless for its own use or specific approval for the same has been obtained from the Central Bank. This rule does not apply to Islamic Finance Companies (IFC). IFCs may own property including immovable property and goods as part of an underlying financing contract with a borrower.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Minimum Capital, Liquidity Requirements and Credit Exposure Restrictions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The minimum paid-up capital for a Finance Company is 150 million UAE Dirhams. UAE national ownership of the Finance Company must comprise at least 60% of total paid-up capital. Finance Companies must also allocate at least 10% of annual net profits to establishing a statutory reserve until the reserve equals 50% of its paid-up capital.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To withstand short-term liquidity stress, Finance Companies are required to hold an amount equivalent to 10% of their aggregate liabilities in liquid assets i.e. cash held in UAE bank, Certificates of deposit issued by the Central Bank held via a UAE bank, short term deposits with a UAE bank with maturity upto 30 days and UAE federal and local government bonds, which must not exceed 30% of the total liquid assets. For the purpose of calculating the 10% amount, a Finance Company may deduct from its aggregate liabilities, cash collateral, bank guarantees from UAE banks and sovereign guarantees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The credit exposure is considered ‘large’ if the value of such exposure to one borrower or group of related entities is 7% or more. The Regulations set out maximum exposure limits for different borrower types.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Organisational Structure, Composition and Policies of the Finance Company</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Founding shareholders - Founding shareholders must satisfy \"Fit and Proper\" criteria as defined by the Central Bank and their appointment must be in line with the Commercial Companies Law<strong>.</strong></li>\r\n 	<li dir=\"LTR\">Board of Directors - The board of directors of a Finance Company must have no fewer than five members. Atleast 60% of the board members of an IFC must have knowledge of the banking business or Islamic finance and banking business as the case may be. The Regulations provide for detailed selection processes and guidances in relation to the board of directors</li>\r\n 	<li dir=\"LTR\">Sharia’a Supervision Committee and other committees - An IFC must have a Sharia’a Supervision Committee, and its role must be laid out in the policies of the IFC. Finance Companies must also have a board committee and credit committee.</li>\r\n 	<li dir=\"LTR\">Senior Management – Finance Companies must comply with the ‘fit and proper‘ test set out by the Central Bank and must be professional who understands the business of finance and was experience of not less than 10 years in the field of finance. Person within the senior management cannot be a part of the board.</li>\r\n 	<li dir=\"LTR\">Corporate Governance - While the Regulations set out certain minimum requirements for corporate governance, Finance Companies are permitted to set out their own policies and framework for corporate governance (complying with the Regulations), however these must be approved by its board of directors and a copy of such policies must be provided to the Central Bank.</li>\r\n 	<li dir=\"LTR\">Internal Policies – the Regulations set out the requirements that need to be adhered to by Finance Companies and IFC with respect to its internal polices in relation to management, risk management, extension of credit, compliance, information technology, security, audit, remuneration, outsourcing, etc.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Other provisions</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Consumer Protection: the Name of the finance company must not include the words \"bank\", \"investment company\" or and other term which may mislead its customer. It must provide its customers with sufficient information regarding its products, etc. in order for them to be able to make an informed decision. The Finance Company must follow the Central Bank guidelines in relation to ‘Consumer Protection’.</li>\r\n 	<li dir=\"LTR\">Credit Reports - Every Finance Company must adhere to the credit reporting requirements of the Al Etihad Credit Bureau and other credit agencies to provide to and obtain information of the Borrower.</li>\r\n 	<li dir=\"LTR\">Accounting Standards - A Finance Company must implement all applicable International Accounting Standards/International Financial Reporting Standards and provide the Central Bank with two copies of signed audited financial statements, including external auditor reports, before 31st March every year. The Central Bank may require the Finance Company to appoint another auditor if the size and nature of the business of the Finance Company so requires.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Differences in the new Regulations from the Previous Regulations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The 2018 Regulations are far more detailed in the nature of investments permitted, liquidity requirements, organisational structure to be followed, investor guidance; we have set out below certain differences in the provisions between the Previous Regulations and 2018 Regulations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter wp-image-8113 \" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/abc.jpg\" alt=\"\" width=\"1071\" height=\"634\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations apply to all Finance Companies. Accordingly companies licensed prior to the date of the issuance of these Regulations need to comply with the 2018 Regulations and are given a period not exceeding 3 years from the publication to conform. However, the Central Bank may amend the requirement of compliance within 3 years if it deems the finance company to be substantially in compliance with these Regulations. All existing Finance Companies will require to provide the Central Bank with a detailed adjustment plan to comply with the articles of these Regulations.</p>\r\n<em>Al Tamimi &amp; Company’s Banking and Finance team regularly advises on the Finance Company Regulations. For further information please contact Mark Brown (m.brown@tamimi.com) or Maymoona Talib (m.talib@tamimi.com).</em>'),
(273515, 26364, 'ClientIP', '86.98.5.18'),
(273516, 26364, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273517, 26364, 'CurrentUserID', '8'),
(273518, 26364, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273519, 26365, 'PostID', '7935'),
(273520, 26365, 'PostType', 'law_update_articles'),
(273521, 26365, 'PostTitle', 'Overhaul of the UAE Finance Companies Regulations'),
(273522, 26365, 'PostStatus', 'publish'),
(273523, 26365, 'PostDate', '2018-08-01 07:43:42'),
(273524, 26365, 'PostUrl', 'http://www.tamimi.com/law-update-articles/overhaul-of-the-uae-finance-companies-regulations/'),
(273525, 26365, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7935&amp;action=edit'),
(273526, 26365, 'ClientIP', '86.98.5.18'),
(273527, 26365, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273528, 26365, 'CurrentUserID', '8'),
(273529, 26365, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273530, 26366, 'PostID', '7935'),
(273531, 26366, 'PostType', 'law_update_articles'),
(273532, 26366, 'PostTitle', 'Overhaul of the UAE Finance Companies Regulations'),
(273533, 26366, 'PostStatus', 'publish'),
(273534, 26366, 'PostDate', '2018-08-01 07:43:42'),
(273535, 26366, 'PostUrl', 'https://www.tamimi.com/law-update-articles/overhaul-of-the-uae-finance-companies-regulations/'),
(273536, 26366, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7935&amp;action=edit'),
(273537, 26366, 'ClientIP', '86.98.5.18'),
(273538, 26366, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273539, 26366, 'CurrentUserID', '8'),
(273540, 26366, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273541, 26367, 'PostID', '7935'),
(273542, 26367, 'PostType', 'law_update_articles'),
(273543, 26367, 'PostTitle', 'Overhaul of the UAE Finance Companies Regulations'),
(273544, 26367, 'PostStatus', 'publish'),
(273545, 26367, 'PostDate', '2018-08-01 07:43:42'),
(273546, 26367, 'PostUrl', 'http://www.tamimi.com/law-update-articles/overhaul-of-the-uae-finance-companies-regulations/'),
(273547, 26367, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7935&amp;action=edit'),
(273548, 26367, 'ClientIP', '86.98.5.18'),
(273549, 26367, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273550, 26367, 'CurrentUserID', '8'),
(273551, 26367, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273552, 26368, 'PostID', '7935'),
(273553, 26368, 'PostTitle', 'Overhaul of the UAE Finance Companies Regulations'),
(273554, 26368, 'PostStatus', 'publish'),
(273555, 26368, 'PostType', 'law_update_articles'),
(273556, 26368, 'PostDate', '2018-08-01 07:43:42'),
(273557, 26368, 'PostUrl', 'http://www.tamimi.com/law-update-articles/overhaul-of-the-uae-finance-companies-regulations/'),
(273558, 26368, 'MetaID', '223050'),
(273559, 26368, 'MetaKey', 'content'),
(273560, 26368, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-7994 size-full aligncenter\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/11.jpg\" alt=\"\" width=\"5472\" height=\"845\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Amongst the several new laws and regulations being introduced in the UAE, the UAE Central Bank (\"Central Bank\") has on10 May 2018 issued new Finance Company Regulations (\"Regulations\" or \"2018 Regulations\") which are to come into effect one month after its publication.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations replace the previous finance company regulations issued in 1996 and finance companies regulations for companies conducting business as per Islamic sharia’a principles issued in 2004 (\"Previous Regulations\") and aim at providing a detailed regulatory framework for Finance Companies to operate and develop within the UAE and also covers in its ambit the framework for protecting the customers of such Finance Companies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations consolidate the regulations for both Islamic finance and conventional finance companies (\"Finance Company/ies\") and incorporate certain significant changes including changes to capital requirements and corporate governance, to also be followed by existing Finance Companies. We have set out below certain noteworthy features of these Regulations and a comparative table on the key changes from the Previous Regulations on subject.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>License Application</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Pursuant to these Regulations, conducting financing activities in the UAE without a central bank license is prohibited. An application for such license must include the proposed scope of activities, a feasibility study illustrating the financial activities and products to be launched, estimated financial projections, risk factors, corporate structure, start-up costs, branches and a recruitment plan.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Another important requisite is for the applicant to provide an unconditional guarantee from a UAE Bank, in favour of the Central Bank for an amount equivalent to the minimum required paid-up capital. The License will be granted for a period of three years and may be renewable for the same period unless otherwise required by the Central Bank.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any changes to the ownership of the Finance Company of 5% or more will require prior approval from the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Cancelling or Revoking a License</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank has the discretion to approve or refuse the License application, but must notify applicants in writing with reasons in case there is a refusal. Licenses can also be amended, revoked or cancelled at the discretion of the Board. The Regulations set out instances when the license can be cancelled which include providing false/misleading information, risking interests of the potential customers, or if there is a bankruptcy order filed against the Finance Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If a Finance Company wishes to cease operations it must apply to the Central Bank at least six months in advance providing the reasons for such a cessation or suspension.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Regulations also provide for penalties that will be imposed if such company does not follow the provisions of the Regulations including adhering to the anti-money laundering policies laid down by the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Permitted Activities</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10.1 of the Regulation details out the types of activities that are permitted, which are:</p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Retail finance,</li>\r\n 	<li dir=\"LTR\">mortgage finance,</li>\r\n 	<li dir=\"LTR\">wholesale finance,</li>\r\n 	<li dir=\"LTR\">pre-paid cards, and</li>\r\n 	<li dir=\"LTR\">distribution of third party products.</li>\r\n</ol>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank can review and amend this list from time to time.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10 further sets out the do’s and dont’s in relation to the business of the Finance Company, certain key features are:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">it can extend loans only to ‘Juridicial Persons’ (defined under Article 93 of the UAE Civil Transactions Law) and individuals in the UAE. However, it is prohibited from accepting deposits or loans from individuals.</li>\r\n 	<li dir=\"LTR\">it may accept deposits only from Juridicial Persons, subject to certain conditions laid out under Article 10.4 and also borrow from UAE banks, and may even receive foreign funding provided that its risk has been adequately hedged. In doing so it must not exceed 25% of the sum of total amount of its debt capital.</li>\r\n 	<li dir=\"LTR\">it must obtain a no objection letter from the Central Bank in order to provide any new product line from within activities specified in its license.</li>\r\n 	<li dir=\"LTR\">it may only participate in the share capital of brokerage companies, money exchanges, UAE banks and other Finance Companies. Any such single participation cannot exceed 10% of its debt capital and the aggregate participation must not exceed 25% of the debt capital.</li>\r\n 	<li dir=\"LTR\">It must obtain approval from the Central Bank in order to issue bonds or sukuks. Such bonds and sukuks shall only be denominated in UAE dirhams or US Dollars.</li>\r\n 	<li dir=\"LTR\">it is prohibited from financing a borrower which is not an entity incorporated in the UAE or its free zones, or a UAE resident, or where the mortgaged assets are not in the UAE.</li>\r\n 	<li dir=\"LTR\">it is prohibited from entering into the business of money exchange.</li>\r\n 	<li dir=\"LTR\">it must not purchase immovable properties unless for its own use or specific approval for the same has been obtained from the Central Bank. This rule does not apply to Islamic Finance Companies (IFC). IFCs may own property including immovable property and goods as part of an underlying financing contract with a borrower.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Minimum Capital, Liquidity Requirements and Credit Exposure Restrictions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The minimum paid-up capital for a Finance Company is 150 million UAE Dirhams. UAE national ownership of the Finance Company must comprise at least 60% of total paid-up capital. Finance Companies must also allocate at least 10% of annual net profits to establishing a statutory reserve until the reserve equals 50% of its paid-up capital.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To withstand short-term liquidity stress, Finance Companies are required to hold an amount equivalent to 10% of their aggregate liabilities in liquid assets i.e. cash held in UAE bank, Certificates of deposit issued by the Central Bank held via a UAE bank, short term deposits with a UAE bank with maturity upto 30 days and UAE federal and local government bonds, which must not exceed 30% of the total liquid assets. For the purpose of calculating the 10% amount, a Finance Company may deduct from its aggregate liabilities, cash collateral, bank guarantees from UAE banks and sovereign guarantees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The credit exposure is considered ‘large’ if the value of such exposure to one borrower or group of related entities is 7% or more. The Regulations set out maximum exposure limits for different borrower types.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Organisational Structure, Composition and Policies of the Finance Company</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Founding shareholders - Founding shareholders must satisfy \"Fit and Proper\" criteria as defined by the Central Bank and their appointment must be in line with the Commercial Companies Law<strong>.</strong></li>\r\n 	<li dir=\"LTR\">Board of Directors - The board of directors of a Finance Company must have no fewer than five members. Atleast 60% of the board members of an IFC must have knowledge of the banking business or Islamic finance and banking business as the case may be. The Regulations provide for detailed selection processes and guidances in relation to the board of directors</li>\r\n 	<li dir=\"LTR\">Sharia’a Supervision Committee and other committees - An IFC must have a Sharia’a Supervision Committee, and its role must be laid out in the policies of the IFC. Finance Companies must also have a board committee and credit committee.</li>\r\n 	<li dir=\"LTR\">Senior Management – Finance Companies must comply with the ‘fit and proper‘ test set out by the Central Bank and must be professional who understands the business of finance and was experience of not less than 10 years in the field of finance. Person within the senior management cannot be a part of the board.</li>\r\n 	<li dir=\"LTR\">Corporate Governance - While the Regulations set out certain minimum requirements for corporate governance, Finance Companies are permitted to set out their own policies and framework for corporate governance (complying with the Regulations), however these must be approved by its board of directors and a copy of such policies must be provided to the Central Bank.</li>\r\n 	<li dir=\"LTR\">Internal Policies – the Regulations set out the requirements that need to be adhered to by Finance Companies and IFC with respect to its internal polices in relation to management, risk management, extension of credit, compliance, information technology, security, audit, remuneration, outsourcing, etc.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Other provisions</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Consumer Protection: the Name of the finance company must not include the words \"bank\", \"investment company\" or and other term which may mislead its customer. It must provide its customers with sufficient information regarding its products, etc. in order for them to be able to make an informed decision. The Finance Company must follow the Central Bank guidelines in relation to ‘Consumer Protection’.</li>\r\n 	<li dir=\"LTR\">Credit Reports - Every Finance Company must adhere to the credit reporting requirements of the Al Etihad Credit Bureau and other credit agencies to provide to and obtain information of the Borrower.</li>\r\n 	<li dir=\"LTR\">Accounting Standards - A Finance Company must implement all applicable International Accounting Standards/International Financial Reporting Standards and provide the Central Bank with two copies of signed audited financial statements, including external auditor reports, before 31st March every year. The Central Bank may require the Finance Company to appoint another auditor if the size and nature of the business of the Finance Company so requires.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Differences in the new Regulations from the Previous Regulations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The 2018 Regulations are far more detailed in the nature of investments permitted, liquidity requirements, organisational structure to be followed, investor guidance; we have set out below certain differences in the provisions between the Previous Regulations and 2018 Regulations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter wp-image-8113 \" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/abc.jpg\" alt=\"\" width=\"1071\" height=\"634\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations apply to all Finance Companies. Accordingly companies licensed prior to the date of the issuance of these Regulations need to comply with the 2018 Regulations and are given a period not exceeding 3 years from the publication to conform. However, the Central Bank may amend the requirement of compliance within 3 years if it deems the finance company to be substantially in compliance with these Regulations. All existing Finance Companies will require to provide the Central Bank with a detailed adjustment plan to comply with the articles of these Regulations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Banking and Finance team regularly advises on the Finance Company Regulations. For further information please contact Mark Brown (m.brown@tamimi.com) or Maymoona Talib (m.talib@tamimi.com).</em></p>');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(273561, 26368, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-7994 size-full aligncenter\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/11.jpg\" alt=\"\" width=\"5472\" height=\"845\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Amongst the several new laws and regulations being introduced in the UAE, the UAE Central Bank (\"Central Bank\") has on10 May 2018 issued new Finance Company Regulations (\"Regulations\" or \"2018 Regulations\") which are to come into effect one month after its publication.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations replace the previous finance company regulations issued in 1996 and finance companies regulations for companies conducting business as per Islamic sharia’a principles issued in 2004 (\"Previous Regulations\") and aim at providing a detailed regulatory framework for Finance Companies to operate and develop within the UAE and also covers in its ambit the framework for protecting the customers of such Finance Companies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations consolidate the regulations for both Islamic finance and conventional finance companies (\"Finance Company/ies\") and incorporate certain significant changes including changes to capital requirements and corporate governance, to also be followed by existing Finance Companies. We have set out below certain noteworthy features of these Regulations and a comparative table on the key changes from the Previous Regulations on subject.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>License Application</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Pursuant to these Regulations, conducting financing activities in the UAE without a central bank license is prohibited. An application for such license must include the proposed scope of activities, a feasibility study illustrating the financial activities and products to be launched, estimated financial projections, risk factors, corporate structure, start-up costs, branches and a recruitment plan.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Another important requisite is for the applicant to provide an unconditional guarantee from a UAE Bank, in favour of the Central Bank for an amount equivalent to the minimum required paid-up capital. The License will be granted for a period of three years and may be renewable for the same period unless otherwise required by the Central Bank.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any changes to the ownership of the Finance Company of 5% or more will require prior approval from the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Cancelling or Revoking a License</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank has the discretion to approve or refuse the License application, but must notify applicants in writing with reasons in case there is a refusal. Licenses can also be amended, revoked or cancelled at the discretion of the Board. The Regulations set out instances when the license can be cancelled which include providing false/misleading information, risking interests of the potential customers, or if there is a bankruptcy order filed against the Finance Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If a Finance Company wishes to cease operations it must apply to the Central Bank at least six months in advance providing the reasons for such a cessation or suspension.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Regulations also provide for penalties that will be imposed if such company does not follow the provisions of the Regulations including adhering to the anti-money laundering policies laid down by the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Permitted Activities</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10.1 of the Regulation details out the types of activities that are permitted, which are:</p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Retail finance,</li>\r\n 	<li dir=\"LTR\">mortgage finance,</li>\r\n 	<li dir=\"LTR\">wholesale finance,</li>\r\n 	<li dir=\"LTR\">pre-paid cards, and</li>\r\n 	<li dir=\"LTR\">distribution of third party products.</li>\r\n</ol>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank can review and amend this list from time to time.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10 further sets out the do’s and dont’s in relation to the business of the Finance Company, certain key features are:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">it can extend loans only to ‘Juridicial Persons’ (defined under Article 93 of the UAE Civil Transactions Law) and individuals in the UAE. However, it is prohibited from accepting deposits or loans from individuals.</li>\r\n 	<li dir=\"LTR\">it may accept deposits only from Juridicial Persons, subject to certain conditions laid out under Article 10.4 and also borrow from UAE banks, and may even receive foreign funding provided that its risk has been adequately hedged. In doing so it must not exceed 25% of the sum of total amount of its debt capital.</li>\r\n 	<li dir=\"LTR\">it must obtain a no objection letter from the Central Bank in order to provide any new product line from within activities specified in its license.</li>\r\n 	<li dir=\"LTR\">it may only participate in the share capital of brokerage companies, money exchanges, UAE banks and other Finance Companies. Any such single participation cannot exceed 10% of its debt capital and the aggregate participation must not exceed 25% of the debt capital.</li>\r\n 	<li dir=\"LTR\">It must obtain approval from the Central Bank in order to issue bonds or sukuks. Such bonds and sukuks shall only be denominated in UAE dirhams or US Dollars.</li>\r\n 	<li dir=\"LTR\">it is prohibited from financing a borrower which is not an entity incorporated in the UAE or its free zones, or a UAE resident, or where the mortgaged assets are not in the UAE.</li>\r\n 	<li dir=\"LTR\">it is prohibited from entering into the business of money exchange.</li>\r\n 	<li dir=\"LTR\">it must not purchase immovable properties unless for its own use or specific approval for the same has been obtained from the Central Bank. This rule does not apply to Islamic Finance Companies (IFC). IFCs may own property including immovable property and goods as part of an underlying financing contract with a borrower.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Minimum Capital, Liquidity Requirements and Credit Exposure Restrictions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The minimum paid-up capital for a Finance Company is 150 million UAE Dirhams. UAE national ownership of the Finance Company must comprise at least 60% of total paid-up capital. Finance Companies must also allocate at least 10% of annual net profits to establishing a statutory reserve until the reserve equals 50% of its paid-up capital.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To withstand short-term liquidity stress, Finance Companies are required to hold an amount equivalent to 10% of their aggregate liabilities in liquid assets i.e. cash held in UAE bank, Certificates of deposit issued by the Central Bank held via a UAE bank, short term deposits with a UAE bank with maturity upto 30 days and UAE federal and local government bonds, which must not exceed 30% of the total liquid assets. For the purpose of calculating the 10% amount, a Finance Company may deduct from its aggregate liabilities, cash collateral, bank guarantees from UAE banks and sovereign guarantees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The credit exposure is considered ‘large’ if the value of such exposure to one borrower or group of related entities is 7% or more. The Regulations set out maximum exposure limits for different borrower types.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Organisational Structure, Composition and Policies of the Finance Company</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Founding shareholders - Founding shareholders must satisfy \"Fit and Proper\" criteria as defined by the Central Bank and their appointment must be in line with the Commercial Companies Law<strong>.</strong></li>\r\n 	<li dir=\"LTR\">Board of Directors - The board of directors of a Finance Company must have no fewer than five members. Atleast 60% of the board members of an IFC must have knowledge of the banking business or Islamic finance and banking business as the case may be. The Regulations provide for detailed selection processes and guidances in relation to the board of directors</li>\r\n 	<li dir=\"LTR\">Sharia’a Supervision Committee and other committees - An IFC must have a Sharia’a Supervision Committee, and its role must be laid out in the policies of the IFC. Finance Companies must also have a board committee and credit committee.</li>\r\n 	<li dir=\"LTR\">Senior Management – Finance Companies must comply with the ‘fit and proper‘ test set out by the Central Bank and must be professional who understands the business of finance and was experience of not less than 10 years in the field of finance. Person within the senior management cannot be a part of the board.</li>\r\n 	<li dir=\"LTR\">Corporate Governance - While the Regulations set out certain minimum requirements for corporate governance, Finance Companies are permitted to set out their own policies and framework for corporate governance (complying with the Regulations), however these must be approved by its board of directors and a copy of such policies must be provided to the Central Bank.</li>\r\n 	<li dir=\"LTR\">Internal Policies – the Regulations set out the requirements that need to be adhered to by Finance Companies and IFC with respect to its internal polices in relation to management, risk management, extension of credit, compliance, information technology, security, audit, remuneration, outsourcing, etc.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Other provisions</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Consumer Protection: the Name of the finance company must not include the words \"bank\", \"investment company\" or and other term which may mislead its customer. It must provide its customers with sufficient information regarding its products, etc. in order for them to be able to make an informed decision. The Finance Company must follow the Central Bank guidelines in relation to ‘Consumer Protection’.</li>\r\n 	<li dir=\"LTR\">Credit Reports - Every Finance Company must adhere to the credit reporting requirements of the Al Etihad Credit Bureau and other credit agencies to provide to and obtain information of the Borrower.</li>\r\n 	<li dir=\"LTR\">Accounting Standards - A Finance Company must implement all applicable International Accounting Standards/International Financial Reporting Standards and provide the Central Bank with two copies of signed audited financial statements, including external auditor reports, before 31st March every year. The Central Bank may require the Finance Company to appoint another auditor if the size and nature of the business of the Finance Company so requires.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Differences in the new Regulations from the Previous Regulations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The 2018 Regulations are far more detailed in the nature of investments permitted, liquidity requirements, organisational structure to be followed, investor guidance; we have set out below certain differences in the provisions between the Previous Regulations and 2018 Regulations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter wp-image-8113 \" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/abc.jpg\" alt=\"\" width=\"1071\" height=\"634\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations apply to all Finance Companies. Accordingly companies licensed prior to the date of the issuance of these Regulations need to comply with the 2018 Regulations and are given a period not exceeding 3 years from the publication to conform. However, the Central Bank may amend the requirement of compliance within 3 years if it deems the finance company to be substantially in compliance with these Regulations. All existing Finance Companies will require to provide the Central Bank with a detailed adjustment plan to comply with the articles of these Regulations.</p>\r\n<em>Al Tamimi &amp; Company’s Banking and Finance team regularly advises on the Finance Company Regulations. For further information please contact Mark Brown (m.brown@tamimi.com) or Maymoona Talib (m.talib@tamimi.com).</em>'),
(273562, 26368, 'MetaLink', 'content'),
(273563, 26368, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7935&amp;action=edit'),
(273564, 26368, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-7994 size-full aligncenter\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/11.jpg\" alt=\"\" width=\"5472\" height=\"845\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Amongst the several new laws and regulations being introduced in the UAE, the UAE Central Bank (\"Central Bank\") has on10 May 2018 issued new Finance Company Regulations (\"Regulations\" or \"2018 Regulations\") which are to come into effect one month after its publication.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations replace the previous finance company regulations issued in 1996 and finance companies regulations for companies conducting business as per Islamic sharia’a principles issued in 2004 (\"Previous Regulations\") and aim at providing a detailed regulatory framework for Finance Companies to operate and develop within the UAE and also covers in its ambit the framework for protecting the customers of such Finance Companies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations consolidate the regulations for both Islamic finance and conventional finance companies (\"Finance Company/ies\") and incorporate certain significant changes including changes to capital requirements and corporate governance, to also be followed by existing Finance Companies. We have set out below certain noteworthy features of these Regulations and a comparative table on the key changes from the Previous Regulations on subject.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>License Application</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Pursuant to these Regulations, conducting financing activities in the UAE without a central bank license is prohibited. An application for such license must include the proposed scope of activities, a feasibility study illustrating the financial activities and products to be launched, estimated financial projections, risk factors, corporate structure, start-up costs, branches and a recruitment plan.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Another important requisite is for the applicant to provide an unconditional guarantee from a UAE Bank, in favour of the Central Bank for an amount equivalent to the minimum required paid-up capital. The License will be granted for a period of three years and may be renewable for the same period unless otherwise required by the Central Bank.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any changes to the ownership of the Finance Company of 5% or more will require prior approval from the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Cancelling or Revoking a License</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank has the discretion to approve or refuse the License application, but must notify applicants in writing with reasons in case there is a refusal. Licenses can also be amended, revoked or cancelled at the discretion of the Board. The Regulations set out instances when the license can be cancelled which include providing false/misleading information, risking interests of the potential customers, or if there is a bankruptcy order filed against the Finance Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If a Finance Company wishes to cease operations it must apply to the Central Bank at least six months in advance providing the reasons for such a cessation or suspension.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Regulations also provide for penalties that will be imposed if such company does not follow the provisions of the Regulations including adhering to the anti-money laundering policies laid down by the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Permitted Activities</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10.1 of the Regulation details out the types of activities that are permitted, which are:</p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Retail finance,</li>\r\n 	<li dir=\"LTR\">mortgage finance,</li>\r\n 	<li dir=\"LTR\">wholesale finance,</li>\r\n 	<li dir=\"LTR\">pre-paid cards, and</li>\r\n 	<li dir=\"LTR\">distribution of third party products.</li>\r\n</ol>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank can review and amend this list from time to time.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10 further sets out the do’s and dont’s in relation to the business of the Finance Company, certain key features are:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">it can extend loans only to ‘Juridicial Persons’ (defined under Article 93 of the UAE Civil Transactions Law) and individuals in the UAE. However, it is prohibited from accepting deposits or loans from individuals.</li>\r\n 	<li dir=\"LTR\">it may accept deposits only from Juridicial Persons, subject to certain conditions laid out under Article 10.4 and also borrow from UAE banks, and may even receive foreign funding provided that its risk has been adequately hedged. In doing so it must not exceed 25% of the sum of total amount of its debt capital.</li>\r\n 	<li dir=\"LTR\">it must obtain a no objection letter from the Central Bank in order to provide any new product line from within activities specified in its license.</li>\r\n 	<li dir=\"LTR\">it may only participate in the share capital of brokerage companies, money exchanges, UAE banks and other Finance Companies. Any such single participation cannot exceed 10% of its debt capital and the aggregate participation must not exceed 25% of the debt capital.</li>\r\n 	<li dir=\"LTR\">It must obtain approval from the Central Bank in order to issue bonds or sukuks. Such bonds and sukuks shall only be denominated in UAE dirhams or US Dollars.</li>\r\n 	<li dir=\"LTR\">it is prohibited from financing a borrower which is not an entity incorporated in the UAE or its free zones, or a UAE resident, or where the mortgaged assets are not in the UAE.</li>\r\n 	<li dir=\"LTR\">it is prohibited from entering into the business of money exchange.</li>\r\n 	<li dir=\"LTR\">it must not purchase immovable properties unless for its own use or specific approval for the same has been obtained from the Central Bank. This rule does not apply to Islamic Finance Companies (IFC). IFCs may own property including immovable property and goods as part of an underlying financing contract with a borrower.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Minimum Capital, Liquidity Requirements and Credit Exposure Restrictions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The minimum paid-up capital for a Finance Company is 150 million UAE Dirhams. UAE national ownership of the Finance Company must comprise at least 60% of total paid-up capital. Finance Companies must also allocate at least 10% of annual net profits to establishing a statutory reserve until the reserve equals 50% of its paid-up capital.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To withstand short-term liquidity stress, Finance Companies are required to hold an amount equivalent to 10% of their aggregate liabilities in liquid assets i.e. cash held in UAE bank, Certificates of deposit issued by the Central Bank held via a UAE bank, short term deposits with a UAE bank with maturity upto 30 days and UAE federal and local government bonds, which must not exceed 30% of the total liquid assets. For the purpose of calculating the 10% amount, a Finance Company may deduct from its aggregate liabilities, cash collateral, bank guarantees from UAE banks and sovereign guarantees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The credit exposure is considered ‘large’ if the value of such exposure to one borrower or group of related entities is 7% or more. The Regulations set out maximum exposure limits for different borrower types.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Organisational Structure, Composition and Policies of the Finance Company</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Founding shareholders - Founding shareholders must satisfy \"Fit and Proper\" criteria as defined by the Central Bank and their appointment must be in line with the Commercial Companies Law<strong>.</strong></li>\r\n 	<li dir=\"LTR\">Board of Directors - The board of directors of a Finance Company must have no fewer than five members. Atleast 60% of the board members of an IFC must have knowledge of the banking business or Islamic finance and banking business as the case may be. The Regulations provide for detailed selection processes and guidances in relation to the board of directors</li>\r\n 	<li dir=\"LTR\">Sharia’a Supervision Committee and other committees - An IFC must have a Sharia’a Supervision Committee, and its role must be laid out in the policies of the IFC. Finance Companies must also have a board committee and credit committee.</li>\r\n 	<li dir=\"LTR\">Senior Management – Finance Companies must comply with the ‘fit and proper‘ test set out by the Central Bank and must be professional who understands the business of finance and was experience of not less than 10 years in the field of finance. Person within the senior management cannot be a part of the board.</li>\r\n 	<li dir=\"LTR\">Corporate Governance - While the Regulations set out certain minimum requirements for corporate governance, Finance Companies are permitted to set out their own policies and framework for corporate governance (complying with the Regulations), however these must be approved by its board of directors and a copy of such policies must be provided to the Central Bank.</li>\r\n 	<li dir=\"LTR\">Internal Policies – the Regulations set out the requirements that need to be adhered to by Finance Companies and IFC with respect to its internal polices in relation to management, risk management, extension of credit, compliance, information technology, security, audit, remuneration, outsourcing, etc.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Other provisions</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Consumer Protection: the Name of the finance company must not include the words \"bank\", \"investment company\" or and other term which may mislead its customer. It must provide its customers with sufficient information regarding its products, etc. in order for them to be able to make an informed decision. The Finance Company must follow the Central Bank guidelines in relation to ‘Consumer Protection’.</li>\r\n 	<li dir=\"LTR\">Credit Reports - Every Finance Company must adhere to the credit reporting requirements of the Al Etihad Credit Bureau and other credit agencies to provide to and obtain information of the Borrower.</li>\r\n 	<li dir=\"LTR\">Accounting Standards - A Finance Company must implement all applicable International Accounting Standards/International Financial Reporting Standards and provide the Central Bank with two copies of signed audited financial statements, including external auditor reports, before 31st March every year. The Central Bank may require the Finance Company to appoint another auditor if the size and nature of the business of the Finance Company so requires.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Differences in the new Regulations from the Previous Regulations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The 2018 Regulations are far more detailed in the nature of investments permitted, liquidity requirements, organisational structure to be followed, investor guidance; we have set out below certain differences in the provisions between the Previous Regulations and 2018 Regulations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter wp-image-8113 \" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/abc.jpg\" alt=\"\" width=\"1071\" height=\"634\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations apply to all Finance Companies. Accordingly companies licensed prior to the date of the issuance of these Regulations need to comply with the 2018 Regulations and are given a period not exceeding 3 years from the publication to conform. However, the Central Bank may amend the requirement of compliance within 3 years if it deems the finance company to be substantially in compliance with these Regulations. All existing Finance Companies will require to provide the Central Bank with a detailed adjustment plan to comply with the articles of these Regulations.</p>\r\n<em>Al Tamimi &amp; Company’s Banking and Finance team regularly advises on the Finance Company Regulations. For further information please contact Mark Brown (m.brown@tamimi.com) or Maymoona Talib (m.talib@tamimi.com).</em>|<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-7994 size-full aligncenter\" src=\"http://www.tamimi.com/wp-content/uploads/2018/07/11.jpg\" alt=\"\" width=\"5472\" height=\"845\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Amongst the several new laws and regulations being introduced in the UAE, the UAE Central Bank (\"Central Bank\") has on10 May 2018 issued new Finance Company Regulations (\"Regulations\" or \"2018 Regulations\") which are to come into effect one month after its publication.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations replace the previous finance company regulations issued in 1996 and finance companies regulations for companies conducting business as per Islamic sharia’a principles issued in 2004 (\"Previous Regulations\") and aim at providing a detailed regulatory framework for Finance Companies to operate and develop within the UAE and also covers in its ambit the framework for protecting the customers of such Finance Companies.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations consolidate the regulations for both Islamic finance and conventional finance companies (\"Finance Company/ies\") and incorporate certain significant changes including changes to capital requirements and corporate governance, to also be followed by existing Finance Companies. We have set out below certain noteworthy features of these Regulations and a comparative table on the key changes from the Previous Regulations on subject.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>License Application</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Pursuant to these Regulations, conducting financing activities in the UAE without a central bank license is prohibited. An application for such license must include the proposed scope of activities, a feasibility study illustrating the financial activities and products to be launched, estimated financial projections, risk factors, corporate structure, start-up costs, branches and a recruitment plan.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Another important requisite is for the applicant to provide an unconditional guarantee from a UAE Bank, in favour of the Central Bank for an amount equivalent to the minimum required paid-up capital. The License will be granted for a period of three years and may be renewable for the same period unless otherwise required by the Central Bank.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Any changes to the ownership of the Finance Company of 5% or more will require prior approval from the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Cancelling or Revoking a License</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank has the discretion to approve or refuse the License application, but must notify applicants in writing with reasons in case there is a refusal. Licenses can also be amended, revoked or cancelled at the discretion of the Board. The Regulations set out instances when the license can be cancelled which include providing false/misleading information, risking interests of the potential customers, or if there is a bankruptcy order filed against the Finance Company.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If a Finance Company wishes to cease operations it must apply to the Central Bank at least six months in advance providing the reasons for such a cessation or suspension.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The Regulations also provide for penalties that will be imposed if such company does not follow the provisions of the Regulations including adhering to the anti-money laundering policies laid down by the Central Bank.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Permitted Activities</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10.1 of the Regulation details out the types of activities that are permitted, which are:</p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Retail finance,</li>\r\n 	<li dir=\"LTR\">mortgage finance,</li>\r\n 	<li dir=\"LTR\">wholesale finance,</li>\r\n 	<li dir=\"LTR\">pre-paid cards, and</li>\r\n 	<li dir=\"LTR\">distribution of third party products.</li>\r\n</ol>\r\n<p dir=\"LTR\" align=\"LEFT\">The Central Bank can review and amend this list from time to time.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Article 10 further sets out the do’s and dont’s in relation to the business of the Finance Company, certain key features are:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">it can extend loans only to ‘Juridicial Persons’ (defined under Article 93 of the UAE Civil Transactions Law) and individuals in the UAE. However, it is prohibited from accepting deposits or loans from individuals.</li>\r\n 	<li dir=\"LTR\">it may accept deposits only from Juridicial Persons, subject to certain conditions laid out under Article 10.4 and also borrow from UAE banks, and may even receive foreign funding provided that its risk has been adequately hedged. In doing so it must not exceed 25% of the sum of total amount of its debt capital.</li>\r\n 	<li dir=\"LTR\">it must obtain a no objection letter from the Central Bank in order to provide any new product line from within activities specified in its license.</li>\r\n 	<li dir=\"LTR\">it may only participate in the share capital of brokerage companies, money exchanges, UAE banks and other Finance Companies. Any such single participation cannot exceed 10% of its debt capital and the aggregate participation must not exceed 25% of the debt capital.</li>\r\n 	<li dir=\"LTR\">It must obtain approval from the Central Bank in order to issue bonds or sukuks. Such bonds and sukuks shall only be denominated in UAE dirhams or US Dollars.</li>\r\n 	<li dir=\"LTR\">it is prohibited from financing a borrower which is not an entity incorporated in the UAE or its free zones, or a UAE resident, or where the mortgaged assets are not in the UAE.</li>\r\n 	<li dir=\"LTR\">it is prohibited from entering into the business of money exchange.</li>\r\n 	<li dir=\"LTR\">it must not purchase immovable properties unless for its own use or specific approval for the same has been obtained from the Central Bank. This rule does not apply to Islamic Finance Companies (IFC). IFCs may own property including immovable property and goods as part of an underlying financing contract with a borrower.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Minimum Capital, Liquidity Requirements and Credit Exposure Restrictions</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The minimum paid-up capital for a Finance Company is 150 million UAE Dirhams. UAE national ownership of the Finance Company must comprise at least 60% of total paid-up capital. Finance Companies must also allocate at least 10% of annual net profits to establishing a statutory reserve until the reserve equals 50% of its paid-up capital.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To withstand short-term liquidity stress, Finance Companies are required to hold an amount equivalent to 10% of their aggregate liabilities in liquid assets i.e. cash held in UAE bank, Certificates of deposit issued by the Central Bank held via a UAE bank, short term deposits with a UAE bank with maturity upto 30 days and UAE federal and local government bonds, which must not exceed 30% of the total liquid assets. For the purpose of calculating the 10% amount, a Finance Company may deduct from its aggregate liabilities, cash collateral, bank guarantees from UAE banks and sovereign guarantees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The credit exposure is considered ‘large’ if the value of such exposure to one borrower or group of related entities is 7% or more. The Regulations set out maximum exposure limits for different borrower types.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Organisational Structure, Composition and Policies of the Finance Company</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Founding shareholders - Founding shareholders must satisfy \"Fit and Proper\" criteria as defined by the Central Bank and their appointment must be in line with the Commercial Companies Law<strong>.</strong></li>\r\n 	<li dir=\"LTR\">Board of Directors - The board of directors of a Finance Company must have no fewer than five members. Atleast 60% of the board members of an IFC must have knowledge of the banking business or Islamic finance and banking business as the case may be. The Regulations provide for detailed selection processes and guidances in relation to the board of directors</li>\r\n 	<li dir=\"LTR\">Sharia’a Supervision Committee and other committees - An IFC must have a Sharia’a Supervision Committee, and its role must be laid out in the policies of the IFC. Finance Companies must also have a board committee and credit committee.</li>\r\n 	<li dir=\"LTR\">Senior Management – Finance Companies must comply with the ‘fit and proper‘ test set out by the Central Bank and must be professional who understands the business of finance and was experience of not less than 10 years in the field of finance. Person within the senior management cannot be a part of the board.</li>\r\n 	<li dir=\"LTR\">Corporate Governance - While the Regulations set out certain minimum requirements for corporate governance, Finance Companies are permitted to set out their own policies and framework for corporate governance (complying with the Regulations), however these must be approved by its board of directors and a copy of such policies must be provided to the Central Bank.</li>\r\n 	<li dir=\"LTR\">Internal Policies – the Regulations set out the requirements that need to be adhered to by Finance Companies and IFC with respect to its internal polices in relation to management, risk management, extension of credit, compliance, information technology, security, audit, remuneration, outsourcing, etc.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Other provisions</strong></p>\r\n\r\n<ol>\r\n 	<li dir=\"LTR\">Consumer Protection: the Name of the finance company must not include the words \"bank\", \"investment company\" or and other term which may mislead its customer. It must provide its customers with sufficient information regarding its products, etc. in order for them to be able to make an informed decision. The Finance Company must follow the Central Bank guidelines in relation to ‘Consumer Protection’.</li>\r\n 	<li dir=\"LTR\">Credit Reports - Every Finance Company must adhere to the credit reporting requirements of the Al Etihad Credit Bureau and other credit agencies to provide to and obtain information of the Borrower.</li>\r\n 	<li dir=\"LTR\">Accounting Standards - A Finance Company must implement all applicable International Accounting Standards/International Financial Reporting Standards and provide the Central Bank with two copies of signed audited financial statements, including external auditor reports, before 31st March every year. The Central Bank may require the Finance Company to appoint another auditor if the size and nature of the business of the Finance Company so requires.</li>\r\n</ol>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Differences in the new Regulations from the Previous Regulations</strong></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The 2018 Regulations are far more detailed in the nature of investments permitted, liquidity requirements, organisational structure to be followed, investor guidance; we have set out below certain differences in the provisions between the Previous Regulations and 2018 Regulations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter wp-image-8113 \" src=\"http://www.tamimi.com/wp-content/uploads/2018/08/abc.jpg\" alt=\"\" width=\"1071\" height=\"634\" /></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">These Regulations apply to all Finance Companies. Accordingly companies licensed prior to the date of the issuance of these Regulations need to comply with the 2018 Regulations and are given a period not exceeding 3 years from the publication to conform. However, the Central Bank may amend the requirement of compliance within 3 years if it deems the finance company to be substantially in compliance with these Regulations. All existing Finance Companies will require to provide the Central Bank with a detailed adjustment plan to comply with the articles of these Regulations.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Al Tamimi &amp; Company’s Banking and Finance team regularly advises on the Finance Company Regulations. For further information please contact Mark Brown (m.brown@tamimi.com) or Maymoona Talib (m.talib@tamimi.com).</em></p>'),
(273565, 26368, 'ClientIP', '86.98.5.18'),
(273566, 26368, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273567, 26368, 'CurrentUserID', '8'),
(273568, 26368, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273633, 26375, 'ClientIP', '86.98.5.18'),
(273634, 26375, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273635, 26375, 'CurrentUserID', '8'),
(273636, 26375, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273637, 26376, 'PostID', '7946'),
(273638, 26376, 'PostType', 'law_update_articles'),
(273639, 26376, 'PostTitle', 'Fintech, Blockchain and Sports in the Middle East'),
(273640, 26376, 'PostStatus', 'publish'),
(273641, 26376, 'PostDate', '2018-08-01 07:38:05'),
(273642, 26376, 'PostUrl', 'http://www.tamimi.com/law-update-articles/fintech-blockchain-and-sports-in-the-middle-east/'),
(273643, 26376, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7946&amp;action=edit'),
(273644, 26376, 'ClientIP', '86.98.5.18'),
(273645, 26376, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273646, 26376, 'CurrentUserID', '8'),
(273647, 26376, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273648, 26377, 'PostID', '7946'),
(273649, 26377, 'PostType', 'law_update_articles'),
(273650, 26377, 'PostTitle', 'Fintech, Blockchain and Sports in the Middle East'),
(273651, 26377, 'PostStatus', 'publish'),
(273652, 26377, 'PostDate', '2018-08-01 07:38:05'),
(273653, 26377, 'PostUrl', 'https://www.tamimi.com/law-update-articles/fintech-blockchain-and-sports-in-the-middle-east/'),
(273654, 26377, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7946&amp;action=edit'),
(273655, 26377, 'ClientIP', '86.98.5.18'),
(273656, 26377, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273657, 26377, 'CurrentUserID', '8'),
(273658, 26377, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273659, 26378, 'PostID', '5'),
(273660, 26378, 'PostType', 'page'),
(273661, 26378, 'PostTitle', 'Home'),
(273662, 26378, 'PostStatus', 'publish'),
(273663, 26378, 'PostDate', '2017-09-06 07:15:00'),
(273664, 26378, 'PostUrl', 'https://www.tamimi.com/'),
(273665, 26378, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=5&amp;action=edit'),
(273666, 26378, 'ClientIP', '86.98.5.18'),
(273667, 26378, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273668, 26378, 'CurrentUserID', '8'),
(273669, 26378, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273670, 26379, 'PostID', '965'),
(273671, 26379, 'PostType', 'page'),
(273672, 26379, 'PostTitle', 'Law Update'),
(273673, 26379, 'PostStatus', 'publish'),
(273674, 26379, 'PostDate', '2017-09-28 12:15:43'),
(273675, 26379, 'PostUrl', 'https://www.tamimi.com/law-updates/'),
(273676, 26379, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=965&amp;action=edit'),
(273677, 26379, 'ClientIP', '86.98.5.18'),
(273678, 26379, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273679, 26379, 'CurrentUserID', '8'),
(273680, 26379, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(273681, 26380, 'PostID', '7928'),
(273682, 26380, 'PostType', 'law-update'),
(273683, 26380, 'PostTitle', 'June - July 2018'),
(273684, 26380, 'PostStatus', 'publish'),
(273685, 26380, 'PostDate', '2018-08-01 07:30:03'),
(273686, 26380, 'PostUrl', 'https://www.tamimi.com/law-update/june-july-2018/'),
(273687, 26380, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=7928&amp;action=edit'),
(273688, 26380, 'ClientIP', '86.98.5.18'),
(273689, 26380, 'UserAgent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'),
(273690, 26380, 'CurrentUserID', '8'),
(273691, 26380, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(274451, 26464, 'PostStatus', 'publish'),
(274452, 26464, 'PostType', 'practice'),
(274453, 26464, 'PostDate', '2017-09-27 10:16:55'),
(274454, 26464, 'PostUrl', 'http://www.tamimi.com/practice/commercial/'),
(274455, 26464, 'MetaID', '69312'),
(274456, 26464, 'MetaKey', 'related_pages_26_page'),
(274457, 26464, 'MetaValueNew', '7344'),
(274458, 26464, 'MetaValueOld', '1229'),
(274459, 26464, 'MetaLink', 'related_pages_26_page'),
(274460, 26464, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=627&amp;action=edit'),
(274461, 26464, 'ReportText', '1229|7344'),
(274462, 26464, 'ClientIP', '83.111.236.141'),
(274463, 26464, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(274464, 26464, 'CurrentUserID', '5'),
(274465, 26464, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(274466, 26465, 'PostID', '627'),
(274467, 26465, 'PostTitle', 'Commercial'),
(274468, 26465, 'PostStatus', 'publish'),
(274469, 26465, 'PostType', 'practice'),
(274470, 26465, 'PostDate', '2017-09-27 10:16:55'),
(274471, 26465, 'PostUrl', 'http://www.tamimi.com/practice/commercial/'),
(274472, 26465, 'MetaID', '69314'),
(274473, 26465, 'MetaKey', 'related_pages_27_page'),
(274474, 26465, 'MetaValueNew', '721'),
(274475, 26465, 'MetaValueOld', '7344'),
(274476, 26465, 'MetaLink', 'related_pages_27_page'),
(274477, 26465, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=627&amp;action=edit'),
(274478, 26465, 'ReportText', '7344|721'),
(274479, 26465, 'ClientIP', '83.111.236.141'),
(274480, 26465, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(274481, 26465, 'CurrentUserID', '5'),
(274482, 26465, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(274483, 26466, 'PostID', '627'),
(274484, 26466, 'PostTitle', 'Commercial'),
(274485, 26466, 'PostStatus', 'publish'),
(274486, 26466, 'PostType', 'practice'),
(274487, 26466, 'PostDate', '2017-09-27 10:16:55'),
(274488, 26466, 'PostUrl', 'http://www.tamimi.com/practice/commercial/'),
(274489, 26466, 'MetaID', '69316'),
(274490, 26466, 'MetaKey', 'related_pages_28_page'),
(274491, 26466, 'MetaValueNew', '896'),
(274492, 26466, 'MetaValueOld', '721'),
(274493, 26466, 'MetaLink', 'related_pages_28_page'),
(274494, 26466, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=627&amp;action=edit'),
(274495, 26466, 'ReportText', '721|896'),
(274496, 26466, 'ClientIP', '83.111.236.141'),
(274497, 26466, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(274498, 26466, 'CurrentUserID', '5'),
(274499, 26466, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(274500, 26467, 'PostID', '627'),
(274501, 26467, 'PostTitle', 'Commercial'),
(274502, 26467, 'PostStatus', 'publish'),
(274503, 26467, 'PostType', 'practice'),
(274504, 26467, 'PostDate', '2017-09-27 10:16:55'),
(274505, 26467, 'PostUrl', 'http://www.tamimi.com/practice/commercial/'),
(274506, 26467, 'MetaID', '69318'),
(274507, 26467, 'MetaKey', 'related_pages_29_page'),
(274508, 26467, 'MetaValueNew', '562'),
(274509, 26467, 'MetaValueOld', '896'),
(274510, 26467, 'MetaLink', 'related_pages_29_page'),
(274511, 26467, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=627&amp;action=edit'),
(274512, 26467, 'ReportText', '896|562'),
(274513, 26467, 'ClientIP', '83.111.236.141'),
(274514, 26467, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(274515, 26467, 'CurrentUserID', '5'),
(274516, 26467, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(274517, 26468, 'PostID', '627'),
(274518, 26468, 'PostTitle', 'Commercial'),
(274519, 26468, 'PostStatus', 'publish'),
(274520, 26468, 'PostType', 'practice'),
(274521, 26468, 'PostDate', '2017-09-27 10:16:55'),
(274522, 26468, 'PostUrl', 'http://www.tamimi.com/practice/commercial/'),
(274523, 26468, 'MetaID', '196385'),
(274524, 26468, 'MetaKey', 'related_pages_30_page'),
(274525, 26468, 'MetaValueNew', '907'),
(274526, 26468, 'MetaValueOld', '562'),
(274527, 26468, 'MetaLink', 'related_pages_30_page'),
(274528, 26468, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=627&amp;action=edit'),
(274529, 26468, 'ReportText', '562|907'),
(274530, 26468, 'ClientIP', '83.111.236.141'),
(274531, 26468, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(274532, 26468, 'CurrentUserID', '5'),
(274533, 26468, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(274534, 26469, 'PostID', '627'),
(274535, 26469, 'PostTitle', 'Commercial'),
(274536, 26469, 'PostStatus', 'publish'),
(274537, 26469, 'PostType', 'practice'),
(274538, 26469, 'PostDate', '2017-09-27 10:16:55'),
(274539, 26469, 'PostUrl', 'http://www.tamimi.com/practice/commercial/'),
(274540, 26469, 'MetaID', '31123'),
(274541, 26469, 'MetaKey', 'related_pages'),
(274542, 26469, 'MetaValueNew', '31'),
(274543, 26469, 'MetaValueOld', '32'),
(274544, 26469, 'MetaLink', 'related_pages'),
(274545, 26469, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=627&amp;action=edit'),
(274546, 26469, 'ReportText', '32|31'),
(274547, 26469, 'ClientIP', '83.111.236.141'),
(274548, 26469, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(274549, 26469, 'CurrentUserID', '5'),
(274550, 26469, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(274551, 26470, 'PostID', '627'),
(274552, 26470, 'PostType', 'practice'),
(274553, 26470, 'PostTitle', 'Commercial'),
(274554, 26470, 'PostStatus', 'publish'),
(274555, 26470, 'PostDate', '2017-09-27 10:16:55'),
(274556, 26470, 'PostUrl', 'http://www.tamimi.com/practice/commercial/'),
(274557, 26470, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=627&amp;action=edit'),
(274558, 26470, 'ClientIP', '83.111.236.141'),
(274559, 26470, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(274560, 26470, 'CurrentUserID', '5'),
(274561, 26470, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(274562, 26471, 'PostID', '1472'),
(274563, 26471, 'PostType', 'locations'),
(274564, 26471, 'PostTitle', 'Saudi Arabia'),
(274565, 26471, 'PostStatus', 'publish'),
(274566, 26471, 'PostDate', '2017-10-05 13:37:17'),
(274567, 26471, 'PostUrl', 'http://www.tamimi.com/locations/saudi-arabia/'),
(274568, 26471, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=1472&amp;action=edit'),
(274569, 26471, 'ClientIP', '83.111.236.141'),
(274570, 26471, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(274571, 26471, 'CurrentUserID', '5'),
(274572, 26471, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(274573, 26472, 'PostID', '607'),
(274574, 26472, 'PostType', 'lawyer'),
(274575, 26472, 'PostTitle', 'Raj Pahuja'),
(274576, 26472, 'PostStatus', 'publish'),
(274577, 26472, 'PostDate', '2017-09-27 09:19:17'),
(274578, 26472, 'PostUrl', 'http://www.tamimi.com/lawyer/raj-pahuja/'),
(274579, 26472, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=607&amp;action=edit'),
(274580, 26472, 'ClientIP', '83.111.236.141'),
(274581, 26472, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
(274582, 26472, 'CurrentUserID', '5'),
(274583, 26472, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(274584, 26473, 'PostID', '607'),
(274585, 26473, 'PostType', 'lawyer'),
(274586, 26473, 'PostTitle', 'Raj Pahuja'),
(274587, 26473, 'PostStatus', 'draft'),
(274588, 26473, 'PostDate', '2017-09-27 09:19:17'),
(274589, 26473, 'PostUrl', 'http://www.tamimi.com/?post_type=lawyer&p=607'),
(274590, 26473, 'OldStatus', 'publish'),
(274591, 26473, 'NewStatus', 'draft'),
(274592, 26473, 'EditorLinkPost', 'http://www.tamimi.com/wp-admin/post.php?post=607&amp;action=edit'),
(274593, 26473, 'ClientIP', '83.111.236.141');
