The Saudi National Cybersecurity Authority has introduced a new incentive program offering rewards for individuals who report cybercrimes. Whistleblowers can receive up to SR50,000 or 1% of the imposed fine, whichever is higher.
A special three-member committee has been formed within the authority to review submitted reports, assess eligibility for rewards, and determine the appropriate amount in line with existing regulations.
Rewards will apply to violations such as unauthorized cybersecurity activities, breaches of licensing terms, and non-compliance with national cybersecurity policies, frameworks, and standards.
The Saudi National Cybersecurity Authority’s draft regulation introduces rewards of up to SR50,000 or 1% of fines for reporting proven cyber violations. Offenses include refusing to provide requested information, misleading the authority, dealing in unlicensed cybersecurity devices or services, and obstructing inspectors. Rewards are granted only if the report decisively helps confirm the violation through a final ruling or after the appeal period ends.
To qualify for the reward, the whistleblower must not be an employee of the authority or a close relative, spouse, or in-law of one. The reported violation should be new — not previously submitted or rewarded by the authority. Additionally, if the whistleblower is a public employee or holds an equivalent position, reporting such violations must fall outside their official duties. The whistleblower is also required to maintain confidentiality and not share any details about the report.
