CLOUD DATA GOVERNANCE AND REGULATORY COMPLIANCE FOR ERP–FINTECH ECOSYSTEMS IN SAUDI ARABIA: ALIGNING SAMA, ZATCA, VAT AND IFRS REQUIREMENTS UNDER VISION 2030
TL;DR
The proposed framework combines a governed data layer, a machine-readable policy layer, preventive and detective controls, and an assurance layer that preserves lineage from source transaction to filing or disclosure, allowing ERP and fintech services to evolve without weakening auditability.
Abstract
Saudi Arabia’s ERP and fintech landscape is becoming a shared transaction environment in which accounting entries, payment instructions, customer data, tax invoices and regulatory evidence move across cloud platforms in near real time. This review examines how cloud data governance can reconcile that speed with Saudi Central Bank oversight, Zakat, Tax and Customs Authority requirements, value added tax controls and evolving financial reporting obligations. A structured integrative review of scholarly research and official instruments published from 2020 to 2025 was undertaken. Evidence was coded across governance, data architecture, cybersecurity, tax determination, financial reporting, third-party risk and assurance. The synthesis shows that compliance cannot be achieved through separate checklists owned by finance, tax, information technology and risk functions. It requires a unified control architecture in which regulatory obligations are translated into canonical data definitions, automated validation rules, accountable workflows and durable evidence. The proposed framework combines a governed data layer, a machine-readable policy layer, preventive and detective controls, and an assurance layer that preserves lineage from source transaction to filing or disclosure. It also distinguishes stable master-data controls from rapidly changing regulatory rules, allowing ERP and fintech services to evolve without weakening auditability. The review identifies four implementation priorities: assigning decision rights for shared data; engineering tax and reporting requirements into transaction design; governing cloud and API dependencies as extensions of the regulated enterprise; and operating continuous compliance through metrics, testing and controlled change. The resulting model supports Vision 2030 by treating trusted financial data as infrastructure for digital growth rather than as a reporting by-product.