Built, run and tested from the inside.

New SAMA ERM regulations for finance companies required a formal, enterprise-wide framework within a fixed deadline.

Designed the ERM framework and risk taxonomy across credit, market, operational, technology, sovereign and liquidity risk, anchored in a master ERM policy with its risk appetite statement. Building on that foundation, authored and implemented the organisation-wide risk registers, the Technology Risk Policy and the Stress Testing Policy, with corporate risk metrics, dashboards and escalation protocols, and directed liquidity stress testing, buffers and contingency funding.

SAMA examination confirmed full compliance ahead of the 2020 regulatory deadline.

Central bank regulations required dedicated GRC and Cybersecurity committees with clear mandates and oversight.

Wrote the foundational Cybersecurity and GRC policies and both committee charters in line with SAMA requirements, secured their approval from the Board, and put the committees into operation: membership, agendas, reporting lines and escalation. Chaired both committees as Head of ERM, served on the Board Risk and Audit Committees, and acted as interim Chief Internal Auditor for six months.

Satisfactory outcomes across multiple central bank inspections, with technology risk oversight integrated across all business lines.

The pandemic disrupted operations, customers and staff at once, demanding a single, coordinated risk response.

Headed the enterprise-wide COVID-19 Operational Risk Task Force from March 2020 to May 2021, alongside the Head of ERM role. Ran the command and control function, directing business continuity and strategic repositioning as the focal point across all functions. At the request of the Executive Committee and the Board, forecast how the business would move through the crisis over time: a swoosh-shaped path, with a decline to a defined trough followed by a gradual recovery to pre-COVID levels.

Actual performance tracked the forecast closely, with around 90% alignment to the predicted timing of both the decline and the recovery.

Credit decisions were driven by scoring models: automated decision systems with direct impact on customers and portfolio quality.

Validated scoring models against collections and performance data, recalibrated attributes, variables and weights, and implemented revised scorecards. Defined the risk metrics, impact assessment and ongoing monitoring that kept the models under governance.

BankMed: credit decision quality up 30–40%, delinquencies down 55%, provisions down 20%. Banque Saudi Fransi: bad debt down 60%, acceptance up 39%.

A new consumer finance joint venture with SOFINCO had to be established and operating across Saudi Arabia, with risk governance in place from day one.

Built and launched the US$27M joint venture across all Saudi regions and served as interim CRO during establishment. Earlier, led the bank's participation in establishing the Saudi Credit Bureau in 2003, as the first bank to provide and test bureau data.

Joint venture operational nationwide within one year.