Saudi Arabia consumer protection and dispute resolution

Consumer and client remedies differ by route: payments, securities, privacy, and financial integrity use separate channels.

Protection channel map

Payment, securities, privacy, and financial-integrity issues do not share one channel. SAFIU is a financial-intelligence route, not ordinary consumer redress.

Protection architecture

SAMA payment rules provide the clearest public complaint-handling route for payment-service users. The operating obligation belongs first to the PSP or payment institution, with SAMA-supervised controls and dispute handling under the payment-services rulebook.

On the securities side, protection is structured through authorization, suitability, offer, disclosure, advertisement, custody, fund, SPE, and capital-market-institution controls under CMA rules.

Privacy issues use the PDPL, implementing regulation, and transfer framework. Financial-integrity issues are AML/CFT matters for sector supervisors and SAFIU routing, not ordinary consumer redress.

Protection matrix

Issue	Current route	Practical consequence
Payment-service complaint	PSP / SAMA-supervised payment route.	Complaint handling, response, records, and dispute handling under payment-services rules.
E-money safeguarding concern	SAMA PI / EMI route.	Segregation, safeguarding, reconciliation, and user-limit controls are central.
Open-banking consent or data access	SAMA open-banking route plus PDPL.	Consent, secure sharing, and personal-data rights must align.
Securities suitability or offer issue	CMA securities route.	Authorization, suitability, advertisement, disclosure, offer, custody, and CMI rules.
Privacy request or breach	PDPL / SDAIA route plus sector rules.	Data-subject rights, transfer rules, incident controls, and sector notice obligations.
Suspicious transaction or AML concern	SAFIU / SAMA / CMA financial-integrity route.	Financial-intelligence escalation, not ordinary customer complaint handling.
Native-crypto loss or failed exchange activity	No public local route identified.	2018 warning and absence of public local VASP route are material risk boundaries.