eKYC in Saudi Arabia: Where AML Screening Fits

Most digital onboarding in Saudi Arabia now runs through eKYC. The customer verifies their identity online, often through a national digital identity service, and the account can be ready in minutes. Compared with collecting paper copies at a branch, it is faster, cheaper, and harder to fake.

It also creates a common gap. The identity is verified, the account opens, and nobody asked whether that verified person appears on a sanctions list, a PEP database, or in adverse media. eKYC answers one question very well. AML screening answers a different one.

What eKYC gives you

A good eKYC flow returns a verified identity: full legal name, date of birth, nationality, national ID or iqama number, and often an address. Because the data comes from an authoritative source rather than from what the customer typed, it is reliable.

That reliability is exactly what makes it useful for screening. The single biggest cause of noisy screening results is weak input: a nickname, a shortened name, a missing birth date. eKYC fixes the input problem before screening starts.

What eKYC does not tell you

eKYC confirms that the person is real and is who they claim to be. It does not tell you:

• whether they are subject to UN, US, EU, UK, or domestic sanctions
• whether they hold, or are closely related to someone who holds, a prominent public position
• whether credible news links them to financial crime
• whether any of that changed after they opened the account

These are screening questions, and they need a screening step.

Where to put the screening call

Screen right after eKYC returns the verified identity and before the account is activated. At that point you have the best possible data, and the customer is still in the flow, so a clean result adds no visible delay.

Send the full name exactly as returned by eKYC, with the date of birth and nationality. Do not re-type or shorten it. For Arabic names, send the Arabic form and any Latin spelling you hold; good screening matches across both scripts.

Then let the result decide the next step:

• AUTO_CLEAR: activate the account. No extra screen, no waiting room.
• REVIEW: hold activation and open a case. The analyst compares the verified identity with the listed record. With a confirmed birth date and nationality, most of these close in minutes.
• CONFIRMED: keep the account held and escalate to compliance.

Store the screening ID on the customer record next to the eKYC reference. They are two different checks with two different references, and you will need both when someone asks why an account was held.

Re-screening after onboarding

Sanctions and PEP lists change constantly. A customer who was clear on the day of onboarding can be listed next month. eKYC will not catch that, because the identity has not changed. Ongoing screening against list updates will.

Keep the same customer ID for life so a match found during re-screening lands on the same customer record and the same case history as the onboarding check.

Business customers

For companies, verify the commercial registration and then screen the company name and every beneficial owner. A verified registration does not mean the company or its owners are clear. Our guide to beneficial ownership checks covers the owner side.

A quick check of your own flow

• Does screening run on the eKYC-verified name, or on what the customer typed?
• Do you send date of birth and nationality on every screening call?
• Is activation held on REVIEW, or does the account open anyway?
• Are existing customers re-screened when lists change?

Naiza screens the verified identity against 1,100+ global sanctions, PEP, and watchlist sources in one call, matches Arabic and Latin spellings, and re-screens customers automatically when lists update. The AML screening API page shows the request and response, and KYC vs AML screening explains the split between the two checks.