One regulatory mandate, many framework citations.

What it is

An obligation is a regulator-issued mandate: a single discrete thing the bank must do. SAMA expresses the same mandate in many places: ITGF cites it from a governance angle, CSF from a cyber angle, CRFR from a resilience angle. In the prototype era those citations were treated as independent controls, with the bank silently duplicating evidence to satisfy each.

MARSAD lifts the obligation up as a first-class entity. Each regulator clause becomes one row in the obligation catalogue; the framework controls that cite it become links to that row. The dedup payoff is immediate: evidence attached to the obligation satisfies every framework that cites it.

Why it matters

Saudi banks running against the full SAMA stack (ITGF, CSF, CRFR, BCM, Counter-Fraud, Outsourcing) sit on 743 framework controls. Tracked control by control, the evidence pack swells, the auditor reads near-identical paragraphs under different control IDs, and the bank carries an audit burden shaped by how the frameworks are numbered rather than by what the regulator actually mandated.

MARSAD folds those 743 controls onto 135 distinct obligations, each gathering the controls that state one requirement. Evidence attaches at the obligation, so it scales with what the regulator mandated, not with how many controls cite it, and the citation trail back to every control stays intact.

The dedup payoff

The catalogue surfaces three headline metrics, the numbers a regulator demo opens on:

At full SAMA loading, 743 controls fold onto 135 obligations: each obligation gathers five to six controls on average. On top of that sit cross-framework equivalences: where two frameworks state the same mandate, the Marsad Engine proposes the pair, an operator confirms it, and the confirmed link becomes navigable in both directions. Both numbers are live figures in the product, not marketing claims.

How MARSAD builds the catalogue

Obligations are extractor-managed; there is no admin write surface. The extraction is idempotent, so the catalogue rebuilds cleanly whenever the control catalogues change:

• Group. Walk every control in every loaded SAMA framework and group by the framework's own subdomain structure. Each subdomain becomes one obligation with a stable natural id, so rebuilds never churn identities.
• Link. Insert a join row from every cited control to its obligation. All 743 controls stay navigable from the 135 obligations they implement.
• Summarise. The Marsad Engine rolls each obligation's control text into one distinguishing requirement statement, so the catalogue reads as what the regulator wants rather than as templated headings.
• Deduplicate across frameworks. The Engine retrieves candidate equivalents in other frameworks and proposes them with a confidence and a rationale. An operator confirms or rejects; only confirmed pairs become links. Suggestions that cite sources which don't exist are dropped and reported, never silently kept.
• Surface. The per-entity obligations panel exposes each clause with its implementing controls, their live assessment status, the remediating CAPs, and the confirmed cross-framework equivalents.

Regulator perspective vs framework perspective

The catalogue gives the bank two complementary lenses on the same underlying truth:

• Regulator perspective. Each obligation is one discrete thing the regulator mandated. “How does the bank handle the cyber security committee mandate?” answered once, with one piece of evidence, regardless of how many frameworks cite it.
• Framework perspective. Each framework keeps its own control IDs, control text, and assessment loop. Auditors who arrive carrying a specific framework (ITGF auditor, CSF auditor) get a clean per-framework view via the existing framework assessment surface, where every cited control still reads as a first-class control on its parent framework.

The obligations catalogue sits next to those framework surfaces, not in place of them. The bank can switch between “show me by mandate” and “show me by framework” depending on who's asking.

What customers see

• An Obligations catalogue view under Resilience: paginated, filterable by jurisdiction, citation prefix, and free-text search. Each row carries a linked-control count chip so multi-framework-cited obligations are visible at a glance.
• A per-obligation detail drawer: full body text plus every framework control that cites it, grouped by framework code (ITGF / CSF / CRFR / BCM / Counter-Fraud / Outsourcing).
• A dedup-payoff banner above the list: live counts of total obligations, total citations, distinct frameworks cited, multi-framework obligations, average citations per obligation, and the maximum.