Target architecture and RFP for a new lending platform in Saudi Arabia

The situation

A new Saudi finance company was building toward its SAMA licence with an SME-first lending product, and a consumer product folded into the same RFP response. It had partner-led distribution lined up, e-commerce aggregators, payment gateways, anchor buyers, and an addressable market big enough to matter. What it did not have yet was a licence, a scorecard, a vendor, or a written answer to the question every serious systems integrator would ask in the first meeting: what, exactly, are we building.

Before a company like this signs a vendor, it needs to know its own mind. Ten separate capability areas, from the lending core to fraud and compliance to collections, all have to fit together as one system, not ten separate procurement decisions made by ten different people under deadline pressure.

What we built

This was architecture and advisory work, not a software build, and we were explicit about that split from the first call. Over the engagement we produced an interactive map of the full lending journey, apply, verify, underwrite, contract, fund, service, with the conditional branches that change by borrower channel, risk signal, and repayment method. We built a lending decision model with the credit logic kept deliberately separate from the Saudi regulatory checks it has to satisfy, covering SAMA's third-party reliance rules, responsible-lending principles, and the open-banking distinction between account information and payment initiation.

We mapped the platform's external integration landscape: identity, payments, open banking, the credit bureau, and government and guarantee systems. Then we reviewed the client's own draft RFP line by line, more than once, because the first version is never the version you send to vendors.

Where it stands

This engagement is in progress as of September 2026. We are not going to describe a licence application, a go-live, or a vendor award that has not happened, and we are not going to attach a made-up performance number to work whose entire value is that it happens before the software exists. The honest measure of this engagement is coverage: all ten solution elements scoped, the full six-stage lending journey modeled with its branches, and a decision model exercised against 480 combinations of inputs, which tells you the model does not break under variety, not that 480 loans have been approved. Nobody has been approved for anything yet. That is the point of doing this work before the licence, not after.

What we would do differently

This engagement is still in progress, so a full retrospective would be premature. The honest lesson we can state today: regulatory mapping touches nearly every one of the ten workstreams, and scoping it as its own workstream from the outset, rather than as part of the architecture review, would have made the sequencing cleaner. We will have more to say once the RFP evaluation and award recommendation are complete.