Customer discovery interviews, and how many are enough
B2B customer discovery interviews: the sample size the research converges on, why your segments change that number, and the questions that get honest answers.
Read
A signed contract with a Gulf bank is an intention until the central bank raises no objection. What SAMA and the CBUAE actually require, and when it hits your pipeline.
The hardest part of selling to a bank in the Gulf is that your buyer is not the final decision maker, and neither is their boss. A material outsourcing arrangement at a Saudi or Emirati bank needs the central bank to raise no objection before it starts. Until that letter exists, a signed contract is an intention.
Most vendors discover this between a verbal yes and a start date that keeps moving. The useful thing is that none of it is secret. Both regulators publish the rules their banks must follow, and reading them turns a mysterious stall into a calendar.
The Saudi Central Bank's Rules on Outsourcing require a bank to send proposals for material outsourcing to SAMA in writing before the arrangement starts, and the notice period in item 23 is at least 15 business days for domestic banks and 30 days for foreign ones. The Central Bank of the UAE is blunter still: article 8.1 of its Outsourcing Regulation for Banks says that before outsourcing any material activity, including to a related party, banks must obtain a prior notice of non objection from the Central Bank.
Read that as a scheduling fact rather than a legal one. The regulator clock starts only after the bank has finished its own work: procurement, risk, legal, and whatever committee signs the business case. Treat signature and start as separate events with weeks between them.
Article 8.2 of the UAE regulation states that the Central Bank will in general not permit the outsourcing of core banking activities and key management and control functions, and then lists them: senior management oversight, risk management, compliance, internal audit, and management of risk taking functions including credit, investment and treasury management.
That list kills a whole category of pitch. Software that supports a compliance team is fine. Software sold as the compliance function is not. The same holds for credit decisioning: the tool can inform, the bank must decide. If your deck says a model replaces a judgement on that list, you are asking a regulated buyer for something their regulator has said it will generally refuse.
This is where most cross border vendors lose. Article 6.1 requires that a UAE bank's Master System of Record, which includes all Confidential Data, is continuously maintained and stored within the UAE. Article 6.2 allows branches of foreign banks, with Central Bank approval, to meet it by keeping a copy updated at least daily inside the country. Article 6.3 then says customer Confidential Data must not be shared outside the UAE without Central Bank approval and prior written consent from the customer, plus a written acknowledgement from that customer that the data may be accessed under legal proceedings abroad.
Article 6.4 closes the obvious workaround: a bank must not enter an outsourcing agreement that shares Confidential Data with a provider domiciled in a jurisdiction that cannot safeguard it to the standard that would apply in the UAE. On the Saudi side, items 33 and 34 of the SAMA rules give the regulator unrestricted and timely access to outsourcing records, including data held at the provider's premises.
If your product runs in one region and you were planning to explain that this is fine, it is not a negotiation. It is a product requirement, and it usually means a local deployment or a local copy. For the technical side of that question, and who actually sets the rule in Saudi Arabia, Rivl's note on data residency requirements and where they come from is the clearest version we have read.
Item 18 of the SAMA rules requires a written and legally binding agreement covering at least sixteen items, among them scope, service levels, audit and monitoring, business continuity, termination, pricing, dispute resolution, liability, confidentiality, and access for SAMA and the bank's auditors. Item 21 says the contract should preferably name Saudi Arabia as the legal jurisdiction, which is a harder concession for a small vendor than it sounds and is better decided before a bid than during one.
Subcontracting is where deals quietly break. Item 19 requires the prior approval of the bank and a no objection from SAMA before material outsourcing is subcontracted. Article 5.6 on the UAE side requires the agreement to specify to what extent subcontracting is allowed and under which conditions, and article 5.5 says neither the provider nor any subcontractor may give another party access to Confidential Data without specific authorisation from the bank or the customer. Article 5.7 requires an explicit provision giving the Central Bank, and any agent it appoints, access to the provider, including the right to conduct on site visits if the Central Bank deems them necessary.
In practice your hosting provider, your support vendor and your analytics tool are all in scope and all need naming. A vendor who lists them unprompted looks like one who has done this before, and the list is the same every time, so build it once.
Item 16(d) requires the bank to have undertaken a due diligence review of the chosen provider covering financial, technical and ethical capabilities, and item 30(a) requires it to establish that the provider has the ability, capacity and authorisation to perform the function reliably and professionally. Nothing there is unusual. What catches people out is the rest of item 16: a selection or tender process, a documented business case, and consideration of the risk arising from multiple outsourcings to a single provider.
That last clause cuts against the land and expand instinct. Being the bank's supplier for four unrelated things is a concentration the bank has to justify, so a fifth proposal can lose to a worse competitor for reasons that have nothing to do with you. Item 17 adds that the award process must be free from any conflict of interest and that the bank must declare to SAMA any affiliation or relationship with the provider, which is the moment to volunteer that your head of sales used to work there.
Item 31 requires a separate contingency plan for each material outsourcing arrangement, and item 32 requires those plans to document alternative providers, or the procedure and timing for choosing one, and a procedure for bringing the function back in house.
Suppliers read this as a threat and should read it as a checklist item they can win. An exit plan with a documented data export, a stated format and a realistic timeline is something the bank's risk team needs and cannot get from most vendors. Offering it early makes the rest of the pack easier to believe, the same way selling to enterprises without case studies substitutes verifiable process for absent references.
| Stage | What actually gates it | What to have ready |
|---|---|---|
| First meetings | Nothing regulatory | A problem statement that avoids the article 8.2 list |
| Shortlist | Due diligence under items 16 and 30 | Financials, certifications, named subcontractors |
| Architecture review | Data location under articles 6.1 to 6.4 | A deployment option inside the country |
| Legal | The sixteen contract items, jurisdiction, audit access | Pre agreed positions on each, not first reactions |
| Regulator | 15 or 30 day notice, bank submits it | Patience. There is nothing to accelerate here |
| Go live | Contingency plan under items 31 and 32 | A written exit and data export procedure |
The shape is familiar from other regulated verticals. Selling to hospitals in the Middle East has the same structure with a different gatekeeper, product registration rather than an outsourcing notice, and selling software to government in MENA turns on a registration wall that comes before any conversation. Banking is the version where the gate arrives late, after you have already won on merit, which is why it surprises people.
Two things still decide it once the compliance work is done: who is in the room, a larger group at a bank than the one you have met and worth mapping like any B2B buying committee, and what procurement is measured on, which is set out in negotiating with procurement departments.
Two countries, not a region. Everything above is Saudi Arabia and the UAE, because those are the two rulebooks we read. Egypt, Qatar, Kuwait, Oman, Bahrain and Jordan each have their own banking regulator and their own outsourcing regime, and we have deliberately not generalised from two to all of them.
These are standing rules, not news. The SAMA rules are version 2.0 and the CBUAE regulation is Circular 14/2021, effective 31 May 2021. The reason to read them now is not that they changed this month. It is that most vendors selling into these banks have never opened either document, and the questions they keep getting asked come straight out of both.
Materiality is the bank's call. Nearly every obligation above bites on material outsourcing, and whether your particular contract counts is determined by the bank's own policy, not by you and not by this page. Ask early, because the answer changes your timeline by weeks.
This is not legal advice. Law firm commentary we read also points to a later CBUAE operational resilience regulation covering critical operations and third party oversight, but we could not confirm its text or effective date in the rulebook, so nothing here rests on it.
Send the stage it stalled at and which country the entity sits in. We will come back with what is likely gating it, the documents worth building before the next meeting, and a realistic date for go live.
Book a Free Consultation