What is the robo-advisory service the CMA regulated?

It is a service in which a licensed financial institution manages a client's investments through algorithms and technology tools under predefined strategies. The CMA board approved its framework in March 2026, requiring control systems, periodic testing before clients get access, and disclosure of the role and risks of the algorithms.

Do the CMA's conditions apply to my company if it is not a financial firm?

Legally they apply only to licensed institutions offering the service. But the logic of testing before launch, written rules, disclosure and a named owner fits any business that lets software set a price, apply a discount or reply to a customer.

Which automatic rule in my system should I review first?

The one that directly touches money or customers and where a mistake is hard to spot quickly, such as pricing rules, automatic discounts, credit limits and automated replies to customers.

Should I tell customers they are talking to an automated assistant?

Clear disclosure of the machine's role is what the CMA requires for robo-advisory services, and it is good practice in any sector. Tell the customer plainly and give them an easy route to a human.

The CMA Won't Let an Algorithm Serve a Client Until It Is Tested and Has a Named Owner

TASI is among the most searched terms in Saudi Arabia today, as the market holds its first session after the National Day holiday. What the price screen doesn't show is how many orders no human typed: the chairman of the Capital Market Authority has said algorithmic trading accounts for about a quarter of traded volumes in the Saudi market, and digital trading for more than 90% of them.

That is why the regulator writes clear rules for any algorithm that makes decisions about other people's money. Those rules are useful to you even if you have never bought a share, because your business almost certainly runs software that decides on its behalf every day, with no equivalent conditions at all.

What the CMA requires of algorithms

In March 2026 the CMA board approved a regulatory framework for robo-advisory services, where a licensed institution manages a client's investments through algorithms and technology tools under predefined strategies. According to Argaam's report, the institution must:

Maintain control systems and procedures that ensure the reliability and efficiency of its algorithms and technology tools.
Run periodic testing to verify their effectiveness, at least 10 days before clients get access.
Notify the CMA of its strategies in advance, explaining how portfolios are built, how assets are selected, and the allocation and rebalancing rules.
Disclose on its platform the role of the algorithms, the mechanisms used and the associated risks, in a fair, clear, accurate and non-misleading way.
Register the IT officer responsible for managing and monitoring the technology systems behind the service.

Notice the logic: test before the client sees anything, write the rules so a third party can follow them, say plainly that a machine is deciding, and put a named person behind the outcome.

Your business runs algorithms too, just without the conditions

Algorithms are not only for investment funds. Any rule in your software that makes a decision without a human is, in practice, an algorithm:

A pricing rule that changes the price by quantity, branch or customer.
An automatic discount that fires under certain conditions in your online store.
A credit limit that approves or rejects a purchase on account.
A purchase order raised automatically when stock falls below a threshold.
An AI assistant answering customers on WhatsApp or your website.
Automatic deduction calculations in payroll.

The difference is that no regulator catches a mistake in these rules before go-live. The customer catches it first: an invoice at the wrong price, a discount applied twice to one order, an automated reply that promised something you don't offer.

Four controls to borrow from the CMA

1. Test before the customer sees it. Every new rule, and every change to an existing one, runs first in a test environment on realistic data, together with the edge cases: zero quantity, a customer with no history, two discounts on the same product, an order in the last minute of a promotion. A gap between passing the test and going live gives you time to see what you missed.

2. Write the rule so a non-programmer can read it. The CMA asks for the strategy and its criteria to be explained. Ask the same of your team or vendor: what the rule's inputs are, where its limits sit, and when it does not apply. A rule your sales manager can't read is a rule nobody can review.

3. Disclose when a machine is dealing with the customer. If a chat reply is automated, say so clearly and offer an easy route to a human. Customers accept machines; they don't accept discovering later that they were negotiating with a program.

4. Name one person for every rule. Not a department and not the vendor, but a specific name who watches the rule's results, gets the alert when it drifts, and has the authority to switch it off immediately. We would add one thing of our own: every rule that touches money gets a hard upper limit and an off switch that doesn't need a developer.

The Origami view

We read the CMA's rules as the distilled experience of a sector that paid for hasty automation before anyone else did. Other sectors in Saudi Arabia are heading the same way, especially as AI assistants move into customer service, sales and procurement. A business that builds these habits now stays ahead of whatever regulation comes next instead of scrambling to catch up.

In the systems we build, every automatic rule that touches price, money or a customer reply is treated as its own component, with tests, a change log, an owner and an off switch. That doesn't slow the work down. It turns changing a rule in a busy season into a safe decision rather than a gamble.

The takeaway: one step this week

List everything your software decides without a human, and pick one rule that directly touches money or a customer. Then ask four questions:

When was it last tested, and against which cases?
Can a non-technical person explain what it does?
Does the customer know a machine made the decision?
Who switches it off if it goes wrong, and how long does that take?

If two of those have no clear answer, that rule is the first one to review.

The CMA Won't Let an Algorithm Serve a Client Until It Is Tested and Has a Named Owner