PCI DSS Compliance in the UAE and Saudi Arabia: CBUAE, SAMA, and QSA Paths

UAE — CBUAE Article 18 (Card Schemes only)

Source: Central Bank of the UAE Rulebook, Article (18): Card Schemes, Circular C 15/2021 (effective 6/6/2021, in force). rulebook.centralbank.ae — Article 18.

Information Security paragraphs:

• ¶20. A Card Scheme shall apply and meet at a minimum the Payment Card Industry Data Security Standard (‘PCI DSS’) and UAE Information Assurance Standards, as may be amended from time to time.
• ¶21. A compliance report regarding the Card Scheme’s adherence to those standards shall be presented to the Board at least annually and transmitted to the Central Bank.
• ¶22. In the case of a Data Breach, the Card Scheme shall notify the Central Bank without undue delay and not later than 72 hours after becoming aware of the breach.

Scope caveat: These duties bind licensed Card Schemes. Merchants and PSPs still follow acquirer/brand PCI validation; scheme-level Article 18 obligations do not erase merchant or SP SAQ/ROC requirements.

Saudi Arabia — SAMA Cyber Security Framework v1.0

Document: SAMA Cyber Security Framework Version 1.0, May 2017 (Rulebook applicability entry dated 24/5/2017, in force). PDF: SAMA Rulebook store (SAMA_EN_3837_VER1).

§1.4 Applicability (bank vs non-bank split): All domains apply to the banking sector. For other financial institutions, exceptions apply - including exclusion of sub-domain 3.2.3. However, if the organization stores, processes, or transmits cardholder data or deals with SWIFT services, then the PCI standard and/or SWIFT Customer Security Controls Framework should be implemented.

§3.2.3 Compliance with (inter)national industry standards (applies to banks / where the domain is in scope): Member Organizations should comply with mandatory industry standards, with control considerations listing PCI-DSS, EMV, and SWIFT CSCF (March 2017 edition referenced in the framework).

Framework language is SAMA control-consideration style (“should comply / should be implemented”) - not “PCI SSC certification.”

Saudi Arabia — Payments Implementing Regulations, Article 35

Document: Implementing Regulations of the Payments and Payment Services Law, Article 35 (SAMA Rulebook). Licensees must adhere to relevant approved technical standards of the Payment System of which they are members (or that otherwise apply), and any other technical standards relevant for payment-transaction execution (including the Payment Card Industry – Data Security Standards as may be applicable and amended).

“As may be applicable” is not a blanket statement that every licensee is PCI Level 1. Confirm licence type, CHD flows, and acquirer/brand validation path.

Practical Dual-Market Path

• Map CHD flows and decide merchant vs service-provider role
• Keep regulator citations (CBUAE / SAMA) in the program library separately from SAQ/ROC evidence packs
• Use a PCI SSC-listed QSA/ASV; regional delivery into UAE and KSA is common
• Companion product pages: Saudi merchants and GCC overview

How CyberSilo Helps

• Shared evidence across PCI, ISO, and regional frameworks in CSA
• ThreatHawk for detection and IR timelines (including breach-notification readiness)
• Gap scans for UAE and KSA merchants and payment firms

Frequently Asked Questions

Is mada a separate standard from PCI?

Scheme and national rules can stack on PCI. Confirm current mada/acquirer documentation for your channel; do not assume a SAMA CSF mapping alone satisfies brand validation.

Does the CBUAE 72-hour notice replace brand notification?

No. Meet both regulator (where Article 18 applies to you as a Card Scheme) and brand/acquirer compromise timelines.

Are all SAMA Member Organizations required to be PCI Level 1?

No. Banks have 3.2.3 in scope; other FIs follow the §1.4 exception unless they handle CHD (or SWIFT). Payment licensees follow Article 35 as applicable, plus brand/acquirer rules.

Related PCI Resources

Saudi merchants · GCC PCI · Pakistan · PCI vs ISO · Certification myth · Fines