RIYADH: As the Kingdom continued to accelerate its technological transformation during the Year of Artificial Intelligence 2026, the rapid expansion of digital payments was creating new opportunities \u2014 and challenges \u2014 for payment security.<\/p>\n
Arab News spoke to Nitin Bhatnagar, regional director for India, South Asia and the Middle East at the PCI Security Standards Council, in Riyadh about the changes he had witnessed firsthand in the Kingdom.<\/p>\n
\u201cWe are encouraged by the growing engagement we are seeing across Saudi Arabia\u2019s payments ecosystem,\u201d he told Arab News.<\/p>\n
This included engagement with organizations such as the Payments deputyship (Saudi Payments previously), Saudi Central Bank, Saudi Investment Bank, STC solutions and Nearpay SoftPoS, which participate in the PCI SSC community and contribute regional perspectives to the global payment-security conversation.<\/p>\n With extensive experience in the region and a decade of work with Saudi Arabia, Bhatnagar had closely followed developments in the Kingdom\u2019s banking cybersecurity sector.<\/p>\n The PCI Security Standards Council was formed in 2006 by five major payment brands: Visa Inc., Mastercard, American Express, Discover and JCB International.<\/p>\n Its global standards are evolving to counter threats including automated credential stuffing, deepfakes and AI-generated fraud targeting consumer financial data.<\/p>\n \u201cWe provide industry-driven, flexible and effective data security standards and programs to help businesses detect, mitigate and prevent cyber-attacks and breaches of payment environments. Global industry collaboration is critical to PCI SSC\u2019s mission,\u201d he said.<\/p>\n The themes highlighted at LEAP 2026, the Riyadh-hosted technology conference, remained central to Bhatnagar\u2019s work. Discussions around cybersecurity and banking focused on securing core financial infrastructure, data residency and automating regulatory compliance amid rising AI-driven threats.<\/p>\n While more than $15 billion was reportedly pledged on the opening day of the four-day event, followed by approximately $2.5 billion on day two, Bhatnagar credited the Kingdom with investing heavily in tools aimed at strengthening security.<\/p>\n \u201cWe are celebrating 20 years of PCI anniversary this year and this gives us that opportunity to highlight the Kingdom of Saudi Arabia has been adopting the standards of PCI.\u201d<\/p>\n The council had been working with regulators, banks, financial institutions and fintechs to educate them about the importance of adopting those standards.<\/p>\n As payments evolved, so too did the wider ecosystem. Bhatnagar pointed to homegrown companies such as Saudi fintech Nearpay as part of that transformation.<\/p>\n Founded in Saudi Arabia in 2020 by entrepreneurs Mohammad Aleban and Hamza Al-Farhan, Nearpay was created to rethink traditional payment infrastructure.<\/p>\n Consumer behavior had also changed significantly.<\/p>\n \u201cPayments are becoming more software-driven, cloud-connected, API-enabled and embedded into everyday digital experiences. Mobile acceptance, e-commerce, wallets, third-party platforms and open ecosystems create enormous convenience, but they also move security boundaries.\u201d<\/p>\n \u201cHow financial institutions utilize PCI DSS v4.0.1,\u201d he said, \u201cis to shift from a point-in-time compliance model to a culture of continuous security, thus driving proactive defense across digital payment infrastructure.\u201d<\/p>\n Payment data security was another area undergoing rapid disruption.<\/p>\n \u201cThe PCI Mobile Payments on COTS standard is reshaping mobile commerce, enabling businesses to securely turn off-the-shelf smartphones into point-of-sale terminals while protecting data from sophisticated mobile malware,\u201d he said.<\/p>\n While local innovators developed AI-driven defensive models, the technical foundation of this digital arms race continued to rely heavily on global compliance standards.<\/p>\n Although the payments industry had evolved, its core mission remained unchanged.<\/p>\n \u201cThe mission is to enhance global payment account data security, by developing standards and supporting services that drive education, awareness, and effective implementation by stakeholders.\u201d<\/p>\n AI presented both opportunities and new security considerations for organizations.<\/p>\n \u201cPayment security really is everyone\u2019s responsibility,\u201d he said.<\/p>\n \u201cIt does not fall to any single entity to secure the whole system. Every organization that stores, processes or transmits cardholder data must play a role,\u201d he added.<\/p>\n \u201cThe payments landscape \u2014 as well as the related threats \u2014 change rapidly. Keeping the top industry players and payment innovators contributing to the ongoing evolution of PCI standards and programs is what ensures that the work we are doing remains relevant, timely and market-ready.\u201d<\/p>\n Saudi Arabia\u2019s scale also gave it an opportunity to contribute to the global payments-security conversation.<\/p>\n \u201cSaudi Arabia has an opportunity to contribute from a position of real operating scale. SAMA reported that e-payments accounted for 85 percent of retail payments in 2025,\u201d he said. \u201cThat means Saudi organizations are gaining practical experience with mobile-first consumers, APIs, fintech partnerships, digital identity and fast-moving payment services. Those experiences are valuable globally.\u201d<\/p>\n \u201cWhen businesses are protected, their customers are too,\u201d he added.<\/p>\n For Bhatnagar, however, cybersecurity could not be viewed solely through the lens of technology. Organizations also needed to consider the people using and managing those systems.<\/p>\n \u201cThat can create a false sense of maturity. Security tools are essential, but they still depend on people to configure them, interpret alerts, write secure code, approve access, manage vendors and respond to incidents. Attackers also exploit human behavior,\u201d he said.<\/p>\n For consumers, he recommended simple precautions.<\/p>\n \u201cKeeping your personal data points and personal devices separate from your work devices is a tip I would recommend,\u201d he said.<\/p>\n \u201cAnd as a best practice, do not share any private information using public Wi-Fi. I am also talking about the attachments that comes in email \u2014 you probably should avoid clicking on those.\u201d<\/p>\n The most resilient organizations, he said, invested in three key components: \u201ctechnology, skills and culture.\u201d<\/p>\n \u201cI feel people in Saudi Arabia are more welcoming and ready to listen; they understand the aspects that we are trying to touch point on cybersecurity and the payment landscape,\u201d he added.<\/p>\n![\"\"\/](\"https:\/\/assets.maestronewsroom.com\/media\/30f6532d-717b-4366-9158-9c455299fcd9\/1789047248543-9505de1dd7c069f0.jpg\")
<\/figure>\n![\"The](\"https:\/\/assets.maestronewsroom.com\/media\/30f6532d-717b-4366-9158-9c455299fcd9\/1789086614505-932ef12f98422aaf.jpg\")