Shariah-Compliant Digital Banking in KSA: What Every CFO at a Financial Institution Need to Know

In 2024, Saudi Arabia crossed SAR 4.5 trillion in banking assets – a year ahead of SAMA’s own target. At the same time, the Kingdom licensed its first fully digital, Shariah-compliant bank.

Those two things are not a coincidence. Saudi Arabia is not building a digital banking future and figuring out the Shariah side later. It is building both, simultaneously, by design.

For CFOs at KSA financial institutions, that creates a specific kind of pressure. Not the abstract, compliance-team kind. The kind that shows up in capital allocation, technology procurement, fintech partnerships, and whether your institution’s digital strategy is built on solid ground — or commercially optimistic assumptions.

This article covers what that means in practice.

What Shariah compliance means for financial architecture?

SAMA’s FinTech Strategy targets 525 fintech companies by 2030 – up from 82 in 2020.

The Open Banking Framework is in live rollout. D360 Bank, KSA’s first fully digital Islamic bank, launched in 2024. And the regulatory sandbox is graduating digital lenders, payment platforms, and Islamic wealth tools into real markets.

The result is a financial system where digital channels are expanding fast, and Shariah governance is non-negotiable.

Managing that intersection is increasingly a CFO-level responsibility, whether the role is formally structured in that way.

What does Shariah compliance actually mean for a CFO’s balance sheet?

Here is the honest version:

• Revenue is structured differently. Your institution does not earn interest. It earns profit from asset ownership, leasing, or trade through instruments like Murabaha, Ijarah, and Sukuk. That changes how income is recognised, how risk is priced, and how your P&L is built.
• Liquidity management has its own rules. You cannot park cash in interest-bearing instruments overnight. Islamic treasury platforms and Wakala-based arrangements exist for this, but they require specific infrastructure and counterparty relationships.
• Capital markets work differently, too. Sukuk, asset-backed certificates that function similarly to bonds but without the debt structure are your primary issuance instrument. The economics are comparable to conventional bonds, but the legal and accounting of treatment is not.
• New digital products need compliance review from day one. AI-generated pricing, automated lending structures, and BNPL products all carry specific compliance risks. If a product introduces contractual ambiguity or looks speculative in structure, your Shariah committee will push back. Better to find that out in design than in launch.

“The CFO dimension of Shariah compliance is not theological. It is structural. It determines how your institution earns money, manages cash, accesses capital, and builds new products. That is the lens worth keeping.”

How is technology changing the compliance picture for Islamic banks in KSA?

Three technologies are reshaping Shariah-compliant digital banking right now. Each carries a governance dimension that finance leaders need to engage with directly.

• Blockchain: On paper, blockchain is a near-perfect fit for Islamic finance. Its transparent, immutable record-keeping aligns naturally with the sector’s emphasis on traceability and asset-backed transactions.
• In practice, it is already moving. SABB has piloted blockchain-based Islamic trade finance. Saudi Arabia joined the BIS mBridge Project in 2024 – a live, multi-currency cross-border settlement system. And tokenized sukuk, where blockchain enables digital issuance of asset-backed certificates, are no longer theoretical across the GCC.

• Artificial Intelligence: AI offers real efficiency gains: automated compliance screening, real-time Shariah audit trails, algorithmic portfolio filtering for retail and wealth clients.
• The accountability question, however, is unresolved. When an AI system approves a product as Shariah-compliant and it later turns out it is not, who is liable?
• Institutionally and regulatorily, the answer must be the Shariah board. AI should assist and accelerate that review, not replace it. CFOs evaluating AI compliance tools need to be clear on this distinction when building the governance model.

• Open Banking: SAMA’s Open Banking Framework is an active rollout, with live customer integrations already being tested. As fintechs gain access to bank data and infrastructure through APIs, each integration also becomes a compliance integration.
• A fintech partner with immature Shariah governance does not keep that risk on its own side of the connection. It travels through the API into your institution. Most current due diligence frameworks are not set up to catch this.

What should CFOs know about SAMA’s regulatory framework?

Saudi Arabia does not have a single national Shariah authority for financial institutions. Each bank maintains its own Shariah committee, appointed with SAMA’s approval. SAMA monitors compliance and approves appointments but does not issue religious rulings. The governance responsibility sits within your institution, not with the regulator.

Beyond Shariah governance, the regulatory environment has expanded significantly in recent years:

• Cybersecurity Framework: Executive and board-level accountability for cyber resilience is now explicitly required, not IT-level delegation.
• Personal Data Protection Law: Governs how customer data flows across all digital platforms.
• Basel III: Applies in full. Digital transformation that changes your risk-weighted asset profile needs corresponding capital assessment.
• Finance Companies Control Law: Board members and senior executives can be held personally liable for regulatory breaches.

One area worth watching closely: Central Bank Digital Currency (CBDC). Saudi Arabia’s active participation in the BIS mBridge Project, now at minimum viable product stage, points to a real shift in how cross-border and interbank settlement will work.

A Shariah-compliant CBDC would have material implications for treasury liquidity, correspondent banking, and interbank costs. The institutions doing scenario planning now will adapt faster when it arrives.

What are the biggest risks CFOs face in Shariah-compliant digital banking in KSA?

Three risk areas come up consistently in conversations with finance leaders at KSA institutions.

1. Compliance errors that scale fast: In a manual environment, a mis-structured product is caught at the Shariah review gate. In a digital environment, it replicates thousands of customers before anyone notices. The risk is not one bad contract, it is systemic. Shariah review needs to be embedded in product development, not applied at the end.
2. Technology that was never built for Islamic finance: Most enterprise banking software was not designed with Islamic accounting structures in mind. Mudarabah pool management, Ijarah lifecycle tracking, and AAOIFI-standard reporting are either absent or expensive to add. CFOs who discover this after procurement have already absorbed the cost. The question to ask before signing is: does this platform support Islamic finance natively, or will we be customizing?
3. Fintech partners with strong technology but weak governance: As SAMA’s sandbox graduates more fintechs into live markets, partnership opportunities will multiply. The risk is a fintech with impressive capabilities and no functioning Shariah governance framework. That combination looks attractive in a pitch deck and becomes a liability in practice.

Three priorities worth putting on the CFO agenda

• Make compliance part of product design, not a final checkpoint. Institutions where the CFO and Shariah board work as design partners, not sequentially, launch faster and with fewer reversals. The earlier compliance requirements are built in, the less disruptive they are.
• Shariah-compatibility is a procurement criterion, not a post-implementation task. When evaluating core banking platforms, AI tools, or open banking integrations, ask whether they support Islamic finance natively. The cost difference between a compliant platform and a customised-to-comply platform is rarely visible in the proposal stage.
• Fintech due diligence needs a governance track, not just a technology track. Technical capability and Shariah governance maturity are two separate assessments. Both matter. Institutions that treat them as one are carrying risk they have not priced.

The Bottom Line

Saudi Arabia is executing one of the most ambitious financial digitalization programmes in the world on an entirely Islamic foundation.

That is not a constraint. It is the architecture. And it is increasingly the CFO’s responsibility to make sure that architecture holds as the digital layer grows faster.

The institutions that get this right are not the ones treating Shariah compliance and digital transformation as parallel workstreams. They are the ones that have understood, at the finance leadership level, that the two are the same brief.

Frequently Asked Questions