RIYADH: As the Kingdom continued to accelerate its technological transformation during the Year of Artificial Intelligence 2026, the rapid expansion of digital payments was creating new opportunities — and challenges — for payment security.
Arab News spoke to Nitin Bhatnagar, regional director for India, South Asia and the Middle East at the PCI Security Standards Council, in Riyadh about the changes he had witnessed firsthand in the Kingdom.
“We are encouraged by the growing engagement we are seeing across Saudi Arabia’s payments ecosystem,” he told Arab News.
This included engagement with organizations such as the Payments deputyship (Saudi Payments previously), Saudi Central Bank, Saudi Investment Bank, STC solutions and Nearpay SoftPoS, which participate in the PCI SSC community and contribute regional perspectives to the global payment-security conversation.
With extensive experience in the region and a decade of work with Saudi Arabia, Bhatnagar had closely followed developments in the Kingdom’s banking cybersecurity sector.
The PCI Security Standards Council was formed in 2006 by five major payment brands: Visa Inc., Mastercard, American Express, Discover and JCB International.
Its global standards are evolving to counter threats including automated credential stuffing, deepfakes and AI-generated fraud targeting consumer financial data.
“We provide industry-driven, flexible and effective data security standards and programs to help businesses detect, mitigate and prevent cyber-attacks and breaches of payment environments. Global industry collaboration is critical to PCI SSC’s mission,” he said.
The themes highlighted at LEAP 2026, the Riyadh-hosted technology conference, remained central to Bhatnagar’s work. Discussions around cybersecurity and banking focused on securing core financial infrastructure, data residency and automating regulatory compliance amid rising AI-driven threats.
While more than $15 billion was reportedly pledged on the opening day of the four-day event, followed by approximately $2.5 billion on day two, Bhatnagar credited the Kingdom with investing heavily in tools aimed at strengthening security.
“We are celebrating 20 years of PCI anniversary this year and this gives us that opportunity to highlight the Kingdom of Saudi Arabia has been adopting the standards of PCI.”
The council had been working with regulators, banks, financial institutions and fintechs to educate them about the importance of adopting those standards.
As payments evolved, so too did the wider ecosystem. Bhatnagar pointed to homegrown companies such as Saudi fintech Nearpay as part of that transformation.
Founded in Saudi Arabia in 2020 by entrepreneurs Mohammad Aleban and Hamza Al-Farhan, Nearpay was created to rethink traditional payment infrastructure.
Consumer behavior had also changed significantly.
“Payments are becoming more software-driven, cloud-connected, API-enabled and embedded into everyday digital experiences. Mobile acceptance, e-commerce, wallets, third-party platforms and open ecosystems create enormous convenience, but they also move security boundaries.”
“How financial institutions utilize PCI DSS v4.0.1,” he said, “is to shift from a point-in-time compliance model to a culture of continuous security, thus driving proactive defense across digital payment infrastructure.”
Payment data security was another area undergoing rapid disruption.
“The PCI Mobile Payments on COTS standard is reshaping mobile commerce, enabling businesses to securely turn off-the-shelf smartphones into point-of-sale terminals while protecting data from sophisticated mobile malware,” he said.
While local innovators developed AI-driven defensive models, the technical foundation of this digital arms race continued to rely heavily on global compliance standards.
Although the payments industry had evolved, its core mission remained unchanged.
“The mission is to enhance global payment account data security, by developing standards and supporting services that drive education, awareness, and effective implementation by stakeholders.”
AI presented both opportunities and new security considerations for organizations.
“Payment security really is everyone’s responsibility,” he said.
“It does not fall to any single entity to secure the whole system. Every organization that stores, processes or transmits cardholder data must play a role,” he added.
“The payments landscape — as well as the related threats — change rapidly. Keeping the top industry players and payment innovators contributing to the ongoing evolution of PCI standards and programs is what ensures that the work we are doing remains relevant, timely and market-ready.”
Saudi Arabia’s scale also gave it an opportunity to contribute to the global payments-security conversation.
“Saudi Arabia has an opportunity to contribute from a position of real operating scale. SAMA reported that e-payments accounted for 85 percent of retail payments in 2025,” he said. “That means Saudi organizations are gaining practical experience with mobile-first consumers, APIs, fintech partnerships, digital identity and fast-moving payment services. Those experiences are valuable globally.”
“When businesses are protected, their customers are too,” he added.
For Bhatnagar, however, cybersecurity could not be viewed solely through the lens of technology. Organizations also needed to consider the people using and managing those systems.
“That can create a false sense of maturity. Security tools are essential, but they still depend on people to configure them, interpret alerts, write secure code, approve access, manage vendors and respond to incidents. Attackers also exploit human behavior,” he said.
For consumers, he recommended simple precautions.
“Keeping your personal data points and personal devices separate from your work devices is a tip I would recommend,” he said.
“And as a best practice, do not share any private information using public Wi-Fi. I am also talking about the attachments that comes in email — you probably should avoid clicking on those.”
The most resilient organizations, he said, invested in three key components: “technology, skills and culture.”
“I feel people in Saudi Arabia are more welcoming and ready to listen; they understand the aspects that we are trying to touch point on cybersecurity and the payment landscape,” he added.
