At the end of June 2026 Saudi Arabia\u2019s Capital Market Authority announced that more than 20,000 investors would be compensated for losses from a market-manipulation case, following a final decision by the Appeal Committee for the Resolution of Securities Disputes. The compensation is the part worth noticing. A fine punishes the wrongdoer. Compensation to twenty thousand investors is the regulator turning a conduct failure into a public, quantified restitution process, and it is the clearest possible signal that market-conduct enforcement in the Gulf now reaches all the way through to investor harm.
For any firm operating in a Gulf capital market, that changes the stakes around a familiar set of controls. Market abuse is not only a fine risk sitting with the manipulator. Once harm is proven and compensation follows, every firm in the chain that touched the trading has a question to answer: could you show that your surveillance, your escalation and your restricted-list controls were operating? The answer is only as good as the evidence behind it, and evidence is exactly what a policy binder does not provide.
The rule is long-standing, the enforcement is sharpening
Saudi Arabia\u2019s Capital Market Law has long prohibited acts that create a false or misleading impression of the market, price or value of a security, under Article 49, and provides for compensating persons harmed by violations, under Article 60, through the Committee for the Resolution of Securities Disputes. This action does not introduce a new rule. It shows the compensation mechanism being used at scale, and in 2024 alone the CMA reported over SAR 389 million in compensation to more than 900 beneficiaries across the cases it handled.
The market-conduct controls a firm is expected to operate form a chain, from watching the market to holding the evidence. Each link does a job, and each has to leave a record. The view below runs through them, what each control does, the record it must leave, and why that record counts once abuse is proven. Tap any control.
The market-conduct control chain
Tap a control for what it does, the record it must leave, and why that record counts
Read down the third row of each control and the pattern is plain. When a violation becomes a compensation process, the firms around it are judged on evidence: whether surveillance ran, whether alerts were triaged and escalated, whether restricted lists were current. A firm that did the right things but cannot show it is in nearly the same position as one that did not. The record is the control, as far as a regulator or a dispute committee is concerned.
It is worth being precise about why compensation changes the picture more than a fine does. A fine is bilateral: the regulator and the wrongdoer, settled and closed. Compensation to thousands of investors is public, quantified and drawn out, and it invites scrutiny of everyone whose systems touched the affected trading. A firm that cannot show its surveillance and escalation operated during the relevant period is exposed not only to the regulator, but to the affected investors and their advisers reading the same published record. The evidence stops being an internal comfort and becomes the firm’s position in a process it did not choose.
What a market-conduct evidence layer holds
The controls themselves are not new to any serious capital-market firm. What the compensation era raises is the standard of proof that they operated. That is a software job, and a specific one: the layer that captures the surveillance, triage, escalation and restricted-list activity as an ordered, defensible record. It is the same evidence discipline that DIFC conduct supervision now applies to personal account dealing, extended to the wider market-conduct picture.
Surveillance and alert triage
Surveillance activity and the reasoning behind each alert closed or escalated captured as a record, so the firm can show it was watching and how it judged what it saw.
Escalation workflow
A defined escalation path with the decision and its timing recorded, so a credible suspicion has a documented route rather than an ad-hoc one that is hard to reconstruct.
Restricted and insider lists
Versioned insider and restricted lists bound to the trades and approvals they governed, so the firm can show conflicts and sensitive information were controlled before dealing, not after.
Case and evidence packs
Surveillance, triage, escalation and list data pulled into one ordered evidence pack, so the record stands up when a regulator, a court or a compensation process asks for it.
| Control | Policy-led | Evidence-led |
|---|---|---|
| Surveillance | A monitoring system exists | A record of what ran and the alerts it raised |
| Alert triage | Alerts are reviewed | Each decision reasoned, dated and attributed |
| Escalation | There is a procedure | Proof the path was followed and when |
| Restricted lists | A list is maintained | Versioned and bound to the trades it governed |
| A dispute | Produces assurances | Produces an ordered evidence pack |
A fine tests the wrongdoer. Compensation to twenty thousand investors tests everyone around the trade. The question it asks each firm is simple: can you show your controls were operating? The evidence is the only answer that counts.
A clear word on what we build. We build software. We are not a licensed securities firm, a compliance consultant, or a legal adviser, and we do not run market surveillance for a market, decide whether conduct was abusive, or handle claims or compensation. Those belong to firms\u2019 own compliance functions, their advisers, the exchange and the regulator. We build the internal evidence layer that helps a firm show its own market-conduct controls operated. This is not exchange-grade or regulator-grade market monitoring, and it is not a substitute for either.
Questions firms are asking
The CMA announced that more than 20,000 investors would be compensated for losses arising from a market-manipulation case, following a final decision by the Appeal Committee for the Resolution of Securities Disputes and a compensation process through the securities disputes committee. The underlying violation concerned conduct prohibited by the Capital Market Law. The specifics of the trading are a matter for the official record, which is the authoritative source; this piece addresses the control lesson, not the case detail.
A fine falls on the wrongdoer. A compensation process reaches wider, and puts every firm around the trading in the position of having to show its controls operated. That raises the standard of proof on surveillance, triage, escalation and restricted lists from having a procedure to being able to evidence it worked, which is precisely what an evidence layer captures.
No. We are an independent software engineering company. We are not a licensed securities firm, a compliance consultant, or a legal adviser, and we are not affiliated with or endorsed by the CMA or any authority. We do not decide whether conduct was abusive, run surveillance for a market, or handle claims or compensation. We build the internal evidence layer for a firm\u2019s own market-conduct controls. For the obligations and any dispute, rely on the applicable law and qualified advice.
No, and it is important to be clear. Exchange-level and regulator-grade market monitoring is specialist infrastructure that watches an entire market, and we do not build that. What we build sits inside a single firm: the record that its own surveillance, triage, escalation and restricted-list controls operated and can be evidenced. It complements a firm\u2019s surveillance tools rather than replacing market-wide monitoring.
They are the same discipline on adjacent controls. Personal account dealing governs how staff trade for themselves; market-conduct controls govern how the firm watches the market it operates in. Both turn on restricted lists, escalation and a defensible record, and both are moving from policy to evidence under Gulf regulators. A firm building one often has the foundations for the other.
The case is Saudi, but the pattern is regional. Market-conduct rules prohibiting manipulation, and mechanisms to address investor harm, exist across Gulf capital markets, and the direction of travel toward evidence-based supervision is shared. The control chain and the evidence layer are the same wherever a firm has to show its market-conduct controls operated; the specific law and forum differ by market.
Compensation is the sharpest end of market-conduct enforcement, because it makes the failure public, quantified and shared. The firms that come through such a process well are the ones that can produce the record: surveillance that ran, alerts that were triaged and escalated, restricted lists that were current. That record does not build itself out of policies. It is captured, as the controls operate, by a system designed to hold it, and that is ordinary software work done against an expectation the Gulf\u2019s regulators are now enforcing to the investor.
References to the Saudi Capital Market Authority, the Capital Market Law including Articles 49 and 60, the Market Conduct Regulations, the securities disputes committees, and the June 2026 investor-compensation announcement are descriptive of publicly available frameworks and publications as reported at the time of writing. Figures, including the number of investors to be compensated and the SAR 389 million reported for 2024, are drawn from public reporting and official announcements, are point-in-time, and represent no specific named firm. BY BANKS is an independent software engineering company; we design and build software and hand it over. We are not a licensed securities firm, a compliance consultant, a legal adviser, an exchange-grade surveillance provider, or affiliated with or endorsed by the CMA or any authority. On any engagement, the firm owns its market-conduct, compliance, and regulatory decisions and responsibility for their implications. This article is not legal, compliance, or regulatory advice; readers should obtain qualified advice for their specific circumstances and rely on the applicable law and official sources for current requirements. Public sources used in this piece are listed on our Sources and Data page.
Ready to Build Something?
If this resonated, let's talk about how we can apply these ideas to your business.
Start a Conversation