Saudi Arabia SA

The D1 exposure of Saudi Arabia this cycle is defined by architecture rather than incident. Three sequential OFAC designation actions in the eighteen-month baseline window trace a single financial-infrastructure target rather than three unrelated events: a Houthi-linked cryptocurrency-wallet network in April 2025, involving eight Tron-network USDT wallets and Russia-based facilitators, moving close to one billion dollars with roughly two hundred million dollars cashed out to mainstream exchanges including exposure to the OFAC-sanctioned exchange Garantex; a petroleum-smuggling and sanctions-evasion network in July 2025, built around UAE-registered petroleum trading firms and exchange houses tied to Ansarallah; and a shipping and currency-exchange network in January 2026, centred on Albarraq Shipping Co and Yemen-based exchange and transfer companies. Read as architecture, this sequence demonstrates sustained rather than one-off enforcement tempo by the United States against Houthi financial infrastructure operating in the Red Sea and Yemen security environment immediately bordering Saudi Arabia, with Saudi Arabia positioned as the principal regional security target of an Iran-backed evasion and laundering network rather than as an enabling jurisdiction for it.

Running in parallel is a more equivocal signal: the FATF technical-compliance trajectory of Saudi Arabia itself. Under ongoing MENAFATF enhanced follow-up from the 2018 Mutual Evaluation, Recommendations 6 and 7, covering targeted financial sanctions, were upgraded from partially compliant to largely compliant, an improvement directly relevant to the capacity of the jurisdiction to screen and freeze assets connected to the Houthi networks described above. Concurrently, however, Recommendations 18 and 21, covering internal controls and tipping-off and confidentiality obligations, were downgraded from compliant to largely compliant. The net technical-compliance position stands at 17 of 40 Recommendations compliant, 21 largely compliant, and 2 partially compliant. Saudi Arabia has been a full FATF member since June 2019 and remains outside the FATF grey and black lists as of the most recent plenary updates; the enhanced follow-up standing of the jurisdiction is a distinct status from grey-listing and should not be conflated with it.

The mixed technical-compliance trajectory carries an important caveat for architecture-level assessment: technical-compliance re-ratings, including the R.6 and R.7 upgrades, should not be read as evidence of improved AML and CFT effectiveness. The Saudi Arabian Financial Intelligence Unit carried an approximately 30 percent STR-processing backlog at the time of the 2018 Mutual Evaluation and demonstrated limited use of targeted financial sanctions to disrupt terrorist-financing support beyond the Kingdom; neither deficiency has been independently re-tested since 2018, and the concurrent R.18 and R.21 downgrade underscores that the technical-compliance trajectory is not unambiguously positive.

Sanctions-regime divergence adds a further structural layer. The December 2025 update by the European Commission to the EU high-risk third-country AML and CFT list, adding Bolivia and the British Virgin Islands and delisting six other jurisdictions, left Saudi Arabia off the list entirely, consistent with its continued non-listing and its absence from the FATF grey list, and confirming convergence between the EU high-risk-third-country list and the UK Money Laundering Regulations advisory list on the status of Saudi Arabia specifically. That convergence sits alongside a separate and unresolved divergence: the United States, under Global Magnitsky authority in 2021, and the United Kingdom in 2020 each sanctioned approximately 17 to 20 Saudi nationals over the killing of Jamal Khashoggi, while the European Union adopted no equivalent designations despite establishing its own global human-rights sanctions regime in 2020. No delisting or convergence event on this point has been identified in the current window.

Structurally, this domain illustrates the enablement-as-signal principle in an inverse register: rather than evaluating whether Saudi Arabia enables evasion, the material question this cycle is whether its financial perimeter is adequately defended against externally directed evasion activity. The sustained OFAC tempo, read against the mixed technical-compliance trajectory and the untested SAFIU effectiveness gap, suggests a defended perimeter under active external pressure rather than a fully settled one.

Outlook

The next MENAFATF enhanced follow-up report carries an indicative onsite window of November 2026 under the FATF assessments calendar, a date explicitly flagged as provisional and subject to adjustment; any further technical-compliance movement should be read against the persistent effectiveness-testing gap rather than as a freestanding improvement signal. The Houthi-network designation cadence maintained by OFAC has proceeded roughly every three to six months across the current window, and a further action within that cadence, whether targeting additional crypto-wallet infrastructure, petroleum-trading fronts, or shipping and exchange entities, would be consistent with the established pattern rather than a surprise. The unresolved EU and US-UK divergence on Khashoggi-related designations remains a standing watch item for any future EU adoption of parallel human-rights sanctions or any US or UK review of existing designees.

As a non-EEA third country, Saudi Arabia sits outside the direct supervisory perimeter of the EU AML Package. The beneficial-ownership and corporate-transparency developments directly relevant to this jurisdiction this cycle are domestic and capital-market-driven rather than EU-instrument-driven: the removal by the Capital Market Authority of the five-hundred-million-dollar assets-under-management qualification threshold for foreign portfolio investors, effective January 2026, materially increases cross-border capital inflows and correspondingly raises the beneficial-ownership and corporate-transparency stakes for custodians and brokers conducting AML gatekeeping on inbound investment. That liberalization proceeds against an unresolved structural gap: no centralized, FATF Recommendation 24-compliant public beneficial-ownership register comparable to the Persons of Significant Control register in the United Kingdom or the Beneficial Ownership Registers Interconnection System in the European Union has been confirmed for Saudi Arabia. A Ministry of Commerce digital registry exists, but its beneficial-ownership depth and public accessibility remain unverified, an evidentiary gap rather than a substantive finding of register absence.

Globally, the EU AML Package sets the structural direction for beneficial-ownership and corporate-transparency supervision, and it is worth stating as standing architecture even though it does not directly bind Saudi Arabia. The package comprises three distinct instruments: the AML Regulation, Regulation (EU) 2024/1624, which is directly applicable across member states without national transposition; the sixth AML Directive, transposed individually by each member state; and the AMLA Regulation, Regulation (EU) 2024/1620, which establishes the Anti-Money Laundering Authority and shifts supervision from a purely national model toward a hybrid EU-level regime through the direct and indirect supervisory perimeter of AMLA over cross-border obliged entities. For Saudi Arabia, this architecture is relevant only indirectly: through the EU high-risk-third-country mechanism, on which Saudi Arabia is not currently listed following the December 2025 update under Delegated Regulations (EU) 2026/46 and (EU) 2026/83, and through the EU-branch and subsidiary operations of Saudi-headquartered banks, whose EU entities would fall under future direct or indirect AMLA supervision regardless of the home-jurisdiction status of the parent. Sixth AML Directive transposition tracking is accordingly not applicable to Saudi Arabia itself.

The most persistent structural-transparency question in this domain concerns state-linked investment vehicles rather than the general corporate registry. The Public Investment Fund has separately demonstrated a capacity to resist foreign discovery on beneficial-ownership and financial-flow questions: it invoked sovereign immunity in US litigation connected to the LIV Golf and PGA Tour merger and received a rebuke from a US Senate panel in January 2024 for obstructing that inquiry. While that rebuke predates the current window, the 2026 withdrawal of LIV Golf funding by the Fund is an in-window development that keeps this a live pattern rather than a purely historical one, renewing scrutiny of the investment-vehicle transparency of the Fund at the same moment that capital-market liberalization is widening the pool of foreign capital flowing into Saudi markets.

This beneficial-ownership-depth gap is tracked as a standing evidentiary limitation: a direct primary-source citation confirming beneficial-ownership field completeness in the Ministry of Commerce registry would resolve it, but no such citation has been identified this cycle. Until it is, the beneficial-ownership-register question functions as an open structural exposure rather than a documented control gap, a distinction load-bearing for the AML gatekeeping obligations that customer due-diligence requirements under FATF Recommendation 24 place on obliged entities handling Saudi corporate and fund-structure counterparties. The active-scheme inventory separately catalogues sovereign wealth fund opacity and immunity structuring as a distinct scheme pattern, though no red-flag indicators have yet been catalogued for it, reflecting the nascent state of monitoring for sovereign-vehicle opacity as a distinct typology relative to the better-developed corporate beneficial-ownership typology.

Outlook

Continued foreign-ownership liberalization by the Capital Market Authority is anticipated through the remainder of 2026 under Vision 2030 capital-market objectives; each further rule change increases the practical urgency of the beneficial-ownership-register question without, on current evidence, resolving it. Any Ministry of Commerce registry transparency reform, or further discovery or disclosure litigation involving the Public Investment Fund, would be the most consequential near-term developments for this domain. Absent either, the structural gap between rising cross-border capital access and unconfirmed beneficial-ownership depth is likely to persist as a standing rather than resolving feature of the D2 profile of Saudi Arabia.

The national risk assessment maintained by Saudi authorities continues to identify banks, money remitters, and dealers in precious metals and stones as the highest money-laundering-risk sectors, a sector-risk designation carried over from the 2018 Mutual Evaluation and not independently re-verified since. The dealers-in-precious-metals-and-stones and remittance channel is structurally consistent with documented Gulf gold-trade laundering typologies, in which cash-intensive precious-metals and jewellery transactions are layered through regional gold-trade corridors, though the current cycle produced no new primary-source confirmation of active exploitation of this channel specific to Saudi Arabia. The persistent question for this domain is not whether the risk designation is correct, but whether supervisory intensity has kept pace with it: no comparable English-language public AML and CFT enforcement-penalty register, of the kind published by FinCEN or OFAC, has been identified for SAMA or the Capital Market Authority. This is an evidentiary gap rather than a substantive finding of weak enforcement, and it should be tracked as a sourcing-thinness limitation constraining independent verification of domestic supervisory intensity rather than as an indicator of enablement by omission.

Separately from the financial-sector risk picture, Nazaha, the Oversight and Anti-Corruption Authority of Saudi Arabia, continues periodic rounds of arrests of public officials for bribery, embezzlement, and money laundering, a pattern corroborated across multiple reports over time even though specific in-window arrest-round dates were not individually confirmed this cycle. This enforcement continuity sits within a jurisdiction whose overall enforcement-versus-enablement balance is assessed as mixed: sustained sanctions-enforcement tempo against externally directed Houthi financial networks, an enforcement signal, coexists with unresolved beneficial-ownership-register and crypto-supervision gaps, enablement-adjacent capacity deficits, and with the absence of a public domestic enforcement-penalty register, a transparency deficit rather than a demonstrated enablement finding. None of these gaps, individually or together, currently supports a finding that Saudi Arabia functions as a permissive enabler jurisdiction in the manner associated with professional-services hubs facilitating opaque corporate structuring; rather, they constitute an under-verified domestic supervisory picture layered onto a legal AML framework assessed as robust in design.

The professional-facilitator dimension of this domain, in the classic sense of lawyers, accountants, and company-formation agents enabling opaque structuring for foreign clients, produced no new material development this cycle; the standing D3 picture remains anchored in the DPMS and remittance sector-risk designation and the Nazaha enforcement pattern rather than in any newly identified facilitator network.

The active-scheme inventory for this jurisdiction catalogues the DPMS and money-remitter trade-based laundering exposure as a distinct scheme, with a red-flag indicator centred on cash-intensive precious-metals and jewellery transactions layered through Gulf gold-trade corridors, observable principally through transaction-monitoring channels rather than at onboarding. This scheme-level cataloguing gives the sector-risk designation an operational anchor for compliance functions handling trade-finance, retail, and money-service-business counterparties in or connected to the Saudi market, even though independent verification of current exploitation levels remains constrained by the same enforcement-disclosure gap described above.

Applying the F3 enabler-jurisdiction filter requires distinguishing capacity from choice: the AML legal framework of Saudi Arabia is assessed as robust in design, and the absence of a granular enforcement register more plausibly reflects an institutional disclosure-practice gap than a deliberate policy choice to shield sector activity from scrutiny. This distinction matters for cross-monitor routing: a capacity gap invites a different remediation path, and a different confidence framing, than a deliberate enablement choice would. This domain also intersects with the F1 state-capture filter only at the margin: enforcement continuity through Nazaha suggests active, ongoing anti-corruption institutional function rather than institutional capture protecting illicit flows, though the absence of a public enforcement-penalty register limits how confidently that inference can be extended to the financial-sector supervisory function specifically.

Outlook

The most consequential near-term development for this domain would be any move toward a public enforcement-penalty disclosure practice by SAMA or the Capital Market Authority, which would materially improve the evidentiary basis for assessing domestic supervisory intensity independent of the self-characterization of the national risk assessment. Absent that, continued periodic Nazaha enforcement rounds are the expected baseline, and the DPMS and remittance sector-risk designation is likely to remain the standing reference point for this domain until a fresh effectiveness-focused evaluation, of the kind flagged as an outstanding gap in this assessment cycle, becomes available.

Houthi war-economy financing directed at the security perimeter of Saudi Arabia is diversifying rather than simply continuing. The established revenue channel is illicit petroleum smuggling, sustained by a UAE-registered network of petroleum trading firms and exchange houses that OFAC designated in July 2025 under SDGT authority as linked to Ansarallah, and reinforced by the January 2026 OFAC designation of Houthi shipping and currency-exchange entities, including Albarraq Shipping Co and Yemen-based exchange and transfer companies. This petroleum-smuggling architecture has been assessed as sustaining an illicit oil-revenue stream that supports missile and drone attacks affecting Saudi territory and Red Sea shipping lanes, positioning the Houthi financial apparatus as a persistent conflict-finance threat directed at the border and maritime security of Saudi Arabia itself rather than at a third state.

The new development this cycle is the emergence of a second channel. Following the collapse of the Assad-era Captagon production base in Syria, Yemeni authorities allege that the Houthi movement is increasingly turning to narcotics trafficking, routed through Saudi Arabia and Gulf states and concealed within commercial and agricultural cargo shipments, to finance military operations. This allegation derives from a single tier-2 source category and has not been independently corroborated by a second source category this cycle, though it is pattern-consistent with documented regional trafficking-route shifts following the collapse of the Syrian production base, and it compounds an already-substantial petroleum-smuggling revenue base rather than replacing it.

Applying the F4 conflict-finance filter source-channel-deployment trace clarifies the structure of both channels. The source, in each case, is illicit commodity or narcotics revenue generated substantially outside formal Saudi jurisdiction, in Houthi-controlled territory or through regional trafficking networks. The channel runs, for the petroleum stream, through petroleum-trading firms and exchange-house structures registered in third jurisdictions including the UAE, and for the emerging narcotics stream, through trade-finance and corporate fronts using commercial and agricultural cargo documentation as cover. The deployment, in both cases, is military: financing missile, drone, and broader Ansarallah operational capability directed, in significant part, at Saudi territory and its Red Sea shipping lanes. This is a domain in which Saudi Arabia functions exclusively as a target jurisdiction of conflict-finance flows rather than as a source or an enabling transit point, consistent with the broader D1 finding that the principal exposure of Saudi Arabia in the Houthi-network architecture is as a security target rather than as a facilitator of it.

The active-scheme inventory catalogues the Captagon and narcotics-trafficking channel as a distinct scheme from the established petroleum-smuggling channel, with a red-flag indicator centred on narcotics concealed within commercial and agricultural cargo shipments layered through legitimate-looking trade fronts, observable principally through trade-documentation review rather than transaction monitoring alone. This gives trade-finance and corporate-sector compliance functions handling Gulf agricultural or commercial trade counterparties a concrete, if still single-source, indicator to weigh alongside the better-established petroleum-smuggling typology, for which screening obligations already attach under Executive Order 13224 and SDGT authority for banks and payment companies with exposure to the designated entities.

This domain also illustrates the three-pillar balance principle in practice. Both revenue channels are properly read as counter-terrorist-financing rather than conventional AML signal: the deployment purpose is explicitly military and operational, not personal enrichment, and the F4 filter accordingly routes this material toward CTF-specific screening and SAR-trigger logic rather than generic AML transaction-monitoring frameworks, even where the underlying typologies, trade-based layering and cargo-document fraud, resemble conventional trade-based money-laundering patterns.

Outlook

The trajectory in this domain is assessed as deteriorating rather than stable, reflecting the addition of a narcotics-trafficking revenue channel to an already-established petroleum-smuggling base rather than any change in the underlying petroleum-smuggling picture itself. Corroboration of the Captagon-trafficking allegation from a second source category, whether regional law-enforcement reporting, a UN Panel of Experts finding, or additional investigative-journalism reporting, would be the most consequential near-term development for confirming or narrowing the materiality of this channel. Absent that corroboration, the narcotics-trafficking channel should continue to be treated as an assessed rather than high-confidence addition to the Houthi war-economy financing picture, and continued OFAC designation activity against petroleum-smuggling and shipping infrastructure remains the more probable near-term development given the established three-to-six-month designation cadence observed across this window.

The own crypto-asset regulatory posture of Saudi Arabia, not global standard-setting activity, is the primary subject matter for the D5 profile of this jurisdiction. The November 2025 thematic review by the Financial Stability Board grouped Saudi Arabia with China among six jurisdictions maintaining a cryptoasset-activity prohibition, a classification that, read at face value, would place Saudi Arabia among the most restrictive crypto regimes globally. Independent legal analysis corroborated this cycle indicates that characterization overstates the actual scope of the restriction: the restriction applies to banks and other regulated financial institutions facilitating crypto transactions, not to individual ownership or peer-to-peer use, a materially narrower posture than the prohibition model applied in China. This distinction matters directly for firms assessing Saudi counterparty and market exposure: a bank-facing restriction leaves individual and offshore-routed crypto activity outside supervisory visibility, a different risk profile than a blanket ban would present, and one more consistent with a capacity gap in retail-level supervision than with a deliberate policy of comprehensive prohibition.

That formal restriction coexists with active innovation at the regulator level. SAMA and the Capital Market Authority continued to advance tokenization initiatives, central bank digital currency pilots, and scoped DeFi-adjacent innovation through 2025, a structural D5 and D6 crossover in which formal restriction on bank-facilitated crypto activity runs in parallel with regulator-led digital-asset infrastructure development. No licensed local virtual-asset service provider or centralized-exchange framework currently exists in Saudi Arabia, meaning that the gap between the bank-facing restriction and rapid informal or offshore adoption is not currently closed by any domestic licensing regime.

The clearest illustration of the risk this supervisory gap presents comes from outside the domestic retail market of Saudi Arabia but directly within its security environment: the April 2025 OFAC designation of a Houthi-linked cryptocurrency-wallet network showed close to one billion dollars in Tron-network USDT flows tied to Russia-based facilitators, with roughly two hundred million dollars cashed out to mainstream exchanges, including exposure to the OFAC-sanctioned exchange Garantex, reportedly used to procure Russian-origin commodities and weapons and to launder proceeds connected to stolen Ukrainian grain. While this network is not itself a Saudi-domiciled scheme, its operation in the Red Sea and Yemen security environment immediately bordering Saudi Arabia demonstrates the cash-out capability that unlicensed, offshore-routed crypto infrastructure can provide to sanctioned actors operating near a jurisdiction whose own domestic crypto-asset supervision remains narrower in practice than its headline classification suggests.

The active-scheme inventory catalogues this Houthi crypto-financial network with two red-flag indicators of direct relevance to crypto-asset operators and money-service businesses: high-volume Tron-network USDT wallet transfers linked to sanctioned facilitators and cashed out via mainstream exchanges and OTC brokers, an on-chain-observable indicator; and money-service businesses operating under legitimate-looking cover providing cash-out channels for sanctions-evasion proceeds, an onboarding-observable indicator. Both indicators are directly relevant to virtual-asset-service-provider and correspondent-banking due diligence for counterparties with exposure to the Gulf and Red Sea corridor, independent of the domestic licensing status of Saudi Arabia.

This domain also functions as a live illustration of the three-pillar balance principle: the CTF-relevant Houthi crypto-wallet flow and the AML and CFT structural question of bank-facing restriction versus individual-level supervision sit alongside a CPF-relevant consideration, namely whether the parallel SAMA CBDC development could, if not carefully sequenced with VASP licensing, itself become a channel requiring proliferation-financing-aware design choices. No CPF-specific finding was identified this cycle, but the structural trajectory of this domain, formal restriction, informal growth, and regulator-led innovation proceeding in parallel, warrants continued three-pillar attention rather than an AML-only or CTF-only read.

Outlook

The most consequential near-term development for this domain would be any move from the current bank-facing restriction toward a licensed virtual-asset service provider or crypto-asset service provider regime, which would extend registration and travel-rule-type obligations to a currently unregulated segment and narrow the gap between formal restriction and informal adoption growth. Continued CBDC pilot maturation by SAMA is a parallel watch item, relevant less for its direct AML and CFT content than for what it signals about the pace of Saudi digital-asset infrastructure development relative to the pace of retail-level crypto-asset supervision. Absent a shift toward licensing, the coexistence of formal bank-facing restriction and unsupervised individual or offshore activity is likely to remain the defining structural feature of the D5 profile of Saudi Arabia.

No material RegTech, supervisory-technology, or AI-compliance-technology development specific to Saudi Arabia was identified this cycle; this domain is recorded as a quiet baseline row rather than omitted, consistent with the honesty-over-coverage principle that an absence of signal is itself worth stating plainly rather than papering over with unrelated material. The one adjacent point of note is that the continued advancement by SAMA of tokenization and central bank digital currency pilots, discussed under the crypto and digital-assets domain, represents parallel regulator-level technology development that could, in a future cycle, generate D6-relevant supervisory-technology or active-defence signal, for example around transaction-monitoring integration for a future licensed virtual-asset framework. No such signal materialized this cycle, and the severity of this domain is accordingly assessed as monitored rather than elevated. This quiet status should not be conflated with an absence of compliance-technology activity generally; rather, it reflects that the research and interpretation pipeline for this cycle did not surface any English-language, source-verifiable development meeting the material-change threshold for this specific domain in this specific jurisdiction. Future cycles will continue to monitor for supervisory guidance on AI-enabled transaction monitoring, sanctions-screening technology procurement, or active-defence initiatives originating from SAMA, the Capital Market Authority, or Nazaha.

Outlook

The next material D6 development for this jurisdiction is more likely to emerge alongside any move toward a licensed virtual-asset service provider framework, discussed under the crypto and digital-assets domain, than as a standalone RegTech or supervisory-guidance announcement. Absent such a shift, this domain is expected to remain quiet, and its baseline should be read as reflecting a genuine absence of identified signal rather than a coverage gap.