SAMA, CBUAE & DFSA: Comparing Compliance Training Requirements Across the GCC

Why "one compliance course" doesn't work across the GCC

Most banks operating across Saudi Arabia, the UAE, and the DIFC treat regulatory training as a single, generic annual module: AML basics, a data-protection slide deck, a quiz at the end. It satisfies nobody. SAMA, CBUAE, and DFSA each publish their own expectations for who gets trained, how often, and what evidence an examiner can pull on request, and the gaps between them are exactly where audit findings come from.

SAMA (Saudi Central Bank)

SAMA's Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) rules require role-based training for staff handling customer onboarding, transaction monitoring, and correspondent banking, with refresher cycles typically annual for frontline staff and more frequent for compliance officers. SAMA examiners expect training records tied to individual employees, not just attendance logs for a department, and they expect the content to reflect SAMA's own typology updates, not a generic FATF deck.

CBUAE (Central Bank of the UAE)

The CBUAE's AML/CFT framework, aligned to Federal Decree-Law No. 20 of 2018 and its executive regulations, places heavier emphasis on Enhanced Due Diligence (EDD) training for staff handling Politically Exposed Persons (PEPs) and correspondent relationships, and on sanctions-screening competency given the UAE's federal sanctions list obligations. CBUAE inspections have increasingly asked for evidence that training content changed year over year in response to the National Risk Assessment, not just that a course was delivered.

DFSA (Dubai Financial Services Authority)

Operating under DIFC common law rather than UAE federal civil law, the DFSA's AML module (part of its AML, CTF and Sanctions Rulebook) requires firms to conduct a training needs analysis and keep records demonstrating that training was tailored to each employee's actual risk exposure, board members included. A generic all-staff module, even a good one, does not satisfy this requirement on its own; DFSA examiners look for role differentiation.

Building one program that satisfies all three

The firms that pass GCC-wide compliance reviews cleanly tend to structure training the same way regardless of jurisdiction:

• A shared core module covering AML/CFT fundamentals, sanctions screening, and data protection, mapped explicitly to each regulator's rulebook citation.
• Role-based tracks for frontline, compliance, and executive audiences, so a teller and a Head of Compliance are never sitting through the same content.
• Jurisdiction-specific addenda that layer in SAMA, CBUAE, or DFSA-specific typologies and reporting obligations on top of the shared core.
• Individual, timestamped completion records that an examiner can pull for any single employee, not a department-wide attendance sheet.

This is the same Executive / Practitioner / Technical structure Grism Technologies uses across every practice area, applied here to regulatory content instead of a technical skill. It's how one training investment holds up under three different regulators without needing three different vendors.