CLOUD DATA GOVERNANCE AND REGULATORY COMPLIANCE FOR ERP–FINTECH ECOSYSTEMS IN SAUDI ARABIA: ALIGNING SAMA, ZATCA, VAT AND IFRS REQUIREMENTS UNDER VISION 2030
DOI:
https://doi.org/10.18623/rvd.v23.8203Keywords:
Cloud Data Governance, ERP–fintech Ecosystems, Regulatory Compliance, SAMA, ZATCA, Value-added Tax, IFRS, Saudi Vision 2030Abstract
Saudi Arabia’s ERP and fintech landscape is becoming a shared transaction environment in which accounting entries, payment instructions, customer data, tax invoices and regulatory evidence move across cloud platforms in near real time. This review examines how cloud data governance can reconcile that speed with Saudi Central Bank oversight, Zakat, Tax and Customs Authority requirements, value added tax controls and evolving financial reporting obligations. A structured integrative review of scholarly research and official instruments published from 2020 to 2025 was undertaken. Evidence was coded across governance, data architecture, cybersecurity, tax determination, financial reporting, third-party risk and assurance. The synthesis shows that compliance cannot be achieved through separate checklists owned by finance, tax, information technology and risk functions. It requires a unified control architecture in which regulatory obligations are translated into canonical data definitions, automated validation rules, accountable workflows and durable evidence. The proposed framework combines a governed data layer, a machine-readable policy layer, preventive and detective controls, and an assurance layer that preserves lineage from source transaction to filing or disclosure. It also distinguishes stable master-data controls from rapidly changing regulatory rules, allowing ERP and fintech services to evolve without weakening auditability. The review identifies four implementation priorities: assigning decision rights for shared data; engineering tax and reporting requirements into transaction design; governing cloud and API dependencies as extensions of the regulated enterprise; and operating continuous compliance through metrics, testing and controlled change. The resulting model supports Vision 2030 by treating trusted financial data as infrastructure for digital growth rather than as a reporting by-product.
References
1. Al-Hattami, H.M. and Almaqtari, F.A. (2023) ‘What determines digital accounting systems’ continuance intention? An empirical investigation in SMEs’, Humanities and Social Sciences Communications, 10, 914. https://doi.org/10.1057/s41599-023-02332-3.
2. Al-Okaily, M., Alghazzawi, R., Alkhwaldi, A.F. and Al-Okaily, A. (2023) ‘The effect of digital accounting systems on the decision-making quality in the banking industry sector: a mediated-moderated model’, Global Knowledge, Memory and Communication, 72(8/9), pp. 882–901. https://doi.org/10.1108/GKMC-01-2022-0015.
3. Benfeldt, O., Persson, J.S. and Madsen, S. (2020) ‘Data governance as a collective action problem’, Information Systems Frontiers, 22(2), pp. 299–313. https://doi.org/10.1007/s10796-019-09923-z.
4. Cao, L., Yang, Q. and Yu, P.S. (2021) ‘Data science and AI in FinTech: an overview’, International Journal of Data Science and Analytics, 12(2), pp. 81–99. https://doi.org/10.1007/s41060-021-00278-w.
5. Lutfi, A. (2022) ‘Understanding the intention to adopt cloud-based accounting information system in Jordanian SMEs’, International Journal of Digital Accounting Research, 22, pp. 47–70. https://doi.org/10.4192/1577-8517-v22_2.
6. Morshed, A. and Khrais, L.T. (2025) ‘Cybersecurity in digital accounting systems: challenges and solutions in the Arab Gulf region’, Journal of Risk and Financial Management, 18(1), 41. https://doi.org/10.3390/jrfm18010041.
7. Mujalli, A., Wani, M.J.G., Almgrashi, A., Khormi, T. and Qahtani, M. (2024) ‘Investigating the factors affecting the adoption of cloud accounting in Saudi Arabia’s small and medium-sized enterprises’, Journal of Open Innovation: Technology, Market, and Complexity, 10(2), 100314. https://doi.org/10.1016/j.joitmc.2024.100314.
8. Saleh, I., Marei, Y., Ayoush, M. and Abu Afifa, M.M. (2022) ‘Big Data analytics and financial reporting quality: qualitative evidence from Canada’, Journal of Financial Reporting and Accounting, 21(1), pp. 83–104. https://doi.org/10.1108/JFRA-12-2021-0489.
9. Tawfik, O.I., Durrah, O., Hussainey, K. and Elmaasrawy, H.E. (2022) ‘Factors influencing the implementation of cloud accounting: evidence from small and medium enterprises in Oman’, Journal of Science and Technology Policy Management, 14(5), pp. 859–884. https://doi.org/10.1108/JSTPM-08-2021-0114.
10. Verhoef, P.C., Broekhuizen, T., Bart, Y., Bhattacharya, A., Dong, J.Q., Fabian, N. and Haenlein, M. (2021) ‘Digital transformation: a multidisciplinary reflection and research agenda’, Journal of Business Research, 122, pp. 889–901. https://doi.org/10.1016/j.jbusres.2019.09.022.
11. Saudi Central Bank (2020) Outsourcing requirements for regulated institutions. Riyadh: Saudi Central Bank Rulebook, 24 February.
12. Saudi Central Bank (2021) Information Technology Governance Framework. Circular No. 43028139, 4 November. Riyadh: Saudi Central Bank.
13. Saudi Central Bank (2022) Open Banking Framework. Riyadh: Saudi Central Bank.
14. Saudi Central Bank (2023) Compliance with the Updated Personal Data Protection Law and its Implementing Regulations. Riyadh: Saudi Central Bank Rulebook.
15. Zakat, Tax and Customs Authority (2020) Implementing Regulations of the Value Added Tax Law, as amended by Resolution No. 7-2-20 dated 5 April 2020. Riyadh: ZATCA.
16. Zakat, Tax and Customs Authority (2021) Controls, Requirements, Technical Specifications and Procedural Rules for Implementing the E-Invoicing Regulation. Riyadh: ZATCA.
17. Zakat, Tax and Customs Authority (2022) Electronic Invoice XML Implementation Standard. Riyadh: ZATCA, 24 June.
18. Zakat, Tax and Customs Authority (2023) Detailed Guideline for E-Invoicing, Version 2. Riyadh: ZATCA, 2 May.
19. Zakat, Tax and Customs Authority (2024) Amendments to the Implementing Regulation of Value Added Tax: Taxpayer Guideline. Riyadh: ZATCA, 19 November.
20. Saudi Data and Artificial Intelligence Authority (2021) Personal Data Protection Law. Royal Decree No. M/19, 16 September. Riyadh: SDAIA.
21. National Data Management Office (2021) Data Management and Personal Data Protection Standards. Riyadh: SDAIA–NDMO.
22. Saudi Data and Artificial Intelligence Authority (2023a) Implementing Regulations of the Personal Data Protection Law. Riyadh: SDAIA.
23. Saudi Data and Artificial Intelligence Authority (2023b) Regulation on Personal Data Transfer Outside the Kingdom. Riyadh: SDAIA.
24. National Cybersecurity Authority (2020) Cloud Cybersecurity Controls (CCC–1:2020). Riyadh: NCA.
25. National Cybersecurity Authority (2024) Cloud Cybersecurity Controls (CCC–2:2024). Riyadh: NCA.
26. Communications, Space and Technology Commission (2023) Cloud Computing Service Provisioning Regulations, Version 4. Decision No. 506/1445. Riyadh: CST.
27. IFRS Foundation (2020) Classification of Liabilities as Current or Non-current: Amendments to IAS 1. London: IFRS Foundation.
28. IFRS Foundation (2021) Definition of Accounting Estimates: Amendments to IAS 8. London: IFRS Foundation.
29. IFRS Foundation (2023) Supplier Finance Arrangements: Amendments to IAS 7 and IFRS 7. London: IFRS Foundation.
30. IFRS Foundation (2024) IFRS 18 Presentation and Disclosure in Financial Statements. London: IFRS Foundation.
Downloads
Published
How to Cite
Issue
Section
License
I (we) submit this article which is original and unpublished, of my (our) own authorship, to the evaluation of the Veredas do Direito Journal, and agree that the related copyrights will become exclusive property of the Journal, being prohibited any partial or total copy in any other part or other printed or online communication vehicle dissociated from the Veredas do Direito Journal, without the necessary and prior authorization that should be requested in writing to Editor in Chief. I (we) also declare that there is no conflict of interest between the articles theme, the author (s) and enterprises, institutions or individuals.
I (we) recognize that the Veredas do Direito Journal is licensed under a CREATIVE COMMONS LICENSE.
Licença Creative Commons Attribution 3.0
