SIMAH API Integration: Credit Bureau Queries for Saudi Fintech

If you are building a lending product in Saudi Arabia, you will query SIMAH on every loan application. There is no shortcut: SAMA's regulations require a credit bureau check before extending credit, and SIMAH is the only licensed bureau in the Kingdom. What the regulations do not hand you is a developer guide. This is that guide.

What SIMAH Actually Is

SIMAH (الشركة السعودية للمعلومات الائتمانية — Saudi Credit Information Company) is Saudi Arabia's sole licensed credit bureau, established in 2002 by nine Saudi banks and supervised by the Saudi Central Bank (SAMA). Its FINDATA network aggregates data from approximately 330 sources — banks, telecom providers, utility companies, and government agencies — to produce the credit reports that every Saudi lender is required to consult before extending financing.

For developers, this means a single authoritative data source for:

• Credit history — active and settled credit facilities, payment behavior across all Saudi lenders
• TAQEEM credit score — SIMAH's proprietary scoring model used by institutional lenders
• MOLIM consumer score — the individual-facing credit score visible to applicants via the Molim app
• Outstanding balances — the raw input for mandatory Debt Burden Ratio (DBR) calculation

The Access Gate: Membership, Not Open API

Unlike SAMA's open banking framework (which uses standard OAuth 2.0 flows with a developer signup), SIMAH is a members-only service gated at the institutional level.

The critical point: you cannot call SIMAH directly until your company holds a SAMA lending or open banking license. Early-stage fintechs building credit models must route through an aggregator partner who holds institutional SIMAH membership.

SIMAH Data Products You Will Use

Individual Credit Report (التقرير الائتماني)

The full credit report contains:

• All active credit facilities (loans, credit cards, BNPL lines)
• Settled facilities for the past 10 years
• Default and delinquency records with aging details
• Court judgments related to credit obligations
• Hard inquiry history (inquiries reduce the TAQEEM score)

TAQEEM Credit Score

SIMAH's proprietary three-digit score. The exact range and interpretation bands are disclosed to member institutions under the membership agreement — they are not publicly documented, unlike FICO or VantageScore in other markets.

Business Credit Reports (SIMAT)

For B2B lending and supplier credit decisions, SIMAT reports cover commercial entities:

• Commercial registration status and ownership
• Credit facilities held by the legal entity
• Payment behavior with banks and major suppliers

The DBR Calculation: Why Every Integration Starts Here

SAMA's Personal Finance Regulations cap the Debt Burden Ratio (DBR) at 33% of monthly salary for most consumer credit products (50% for mortgage). This is a hard compliance requirement — not a guideline. Every credit decision must include a DBR check, and SIMAH's credit report gives you the raw data to compute it.

interface DBRInput {
  monthlyNetIncome: number;          // From WPS or Qiwa income verification
  existingMonthlyObligations: number; // From SIMAH active facilities
  proposedInstalment: number;        // From your loan calculator
}
 
function calculateDBR(input: DBRInput): {
  dbr: number;
  approved: boolean;
  remainingCapacity: number;
} {
  const total = input.existingMonthlyObligations + input.proposedInstalment;
  const dbr = total / input.monthlyNetIncome;
  const maxObligations = input.monthlyNetIncome * 0.33;
  return {
    dbr,
    approved: dbr <= 0.33,
    remainingCapacity: maxObligations - input.existingMonthlyObligations,
  };
}

SIMAH gives you existingMonthlyObligations from the active facilities payload. The monthlyNetIncome comes from a separate upstream query — typically a WPS payroll check (see WPS payroll data reconciliation) or a Qiwa employment verification call (see Qiwa integration guide).

Production-proven sequence: Nafath identity verification → Qiwa employment and income check → SIMAH credit report → DBR calculation → internal credit model → decision and offer generation.

Integration Architecture for SAMA-Licensed Lenders

Once your SIMAH membership credentials are issued, the integration follows a standard REST pattern:

interface SimahCreditRequest {
  nationalId: string;      // Saudi National ID or Iqama for expats
  memberCode: string;      // Your SIMAH institutional member code
  requestType: "INDIVIDUAL" | "BUSINESS";
  consentToken: string;    // Customer consent reference (SAMA mandatory)
}
 
interface CreditFacility {
  facilityType: string;
  lenderName: string;
  outstandingBalance: number;
  monthlyInstalment: number;
  paymentStatus: "CURRENT" | "DELINQUENT" | "DEFAULTED";
  openedAt: string;
}
 
interface SimahCreditResponse {
  reportId: string;
  customerId: string;
  creditScore: number | null;
  activeFacilities: CreditFacility[];
  settledFacilities: CreditFacility[];
  totalOutstandingBalance: number;
  monthlyObligations: number;
  defaultRecords: DefaultRecord[];
  inquiries: Inquiry[];
  generatedAt: string;
}

Authentication uses certificate-based mutual TLS (mTLS) for the direct SIMAH API — certificates are issued during the SIMAH onboarding process after membership is approved. Aggregator paths typically layer OAuth 2.0 on top, aligned with SAMA's open banking security framework that came into effect in March 2026.

Error Handling That Bites in Production

Credit-Invisible Customers

SIMAH returns a "no record" response for individuals with no credit history — common for recent graduates, Saudi women newly entering the workforce, and recent immigrants on Iqama. This is not an error. It means the customer is credit-invisible.

async function querySimah(
  request: SimahCreditRequest
): Promise<SimahCreditResponse | null> {
  const response = await simahClient.getCreditReport(request);
 
  if (response.status === "NO_RECORD") {
    // Credit-invisible: route to thin-file scoring or alternative data model
    return null;
  }
 
  if (response.status === "CONSENT_REQUIRED") {
    // Customer consent not active — cannot proceed; re-initiate consent flow
    throw new ConsentRequiredError(request.nationalId);
  }
 
  return response.data;
}

Your lending policy must address thin-file applicants explicitly. Denying without explanation or routing them incorrectly creates both a customer experience problem and a potential SAMA fair-lending concern.

Consent Is Not Optional

SAMA requires explicit, logged customer consent before every credit bureau query. The SIMAH API enforces this through a consent token. Missing this step is a regulatory violation — SAMA can audit member access logs and revoke bureau access for non-compliance.

Retry and Idempotency

SIMAH production availability follows government service SLAs, not fintech cloud SLAs. Build a retry layer with exponential backoff, and store each reportId so you never re-query SIMAH for a decision that already ran. Unnecessary inquiries decrease the applicant's TAQEEM score.

The Pre-License Path: Aggregators

If your SAMA license is still in progress, you can develop and test your credit model via licensed intermediaries:

• Elm / Wathq — the government data broker network; some SIMAH products are accessible through their authenticated service catalog alongside commercial registration and labor data
• HES LoanBox / Lendsqr — loan origination platforms that bundle SIMAH queries into their lending SDK, ideal for testing credit policy logic before you go live
• SAMA-licensed AIS providers — account information service providers operating under the March 2026 open banking licensing framework who can surface credit-related data flows

Aggregator access carries a cost premium, but it lets you ship and validate a working credit model — including real DBR calculations on test applicants — before your license clears.

What You Must Read Before You Build

SIMAH does not publish a developer portal. The API schemas, test credentials, and TAQEEM model documentation are issued only after signing the membership agreement. Before that stage, the three documents worth reading are:

1. Credit Information Law (Royal Decree M/37) — defines what members can query, store, and share
2. SAMA Personal Finance Regulations — DBR limits, consent requirements, and adverse action notice obligations
3. SAMA Open Banking Framework (2026) — OAuth 2.0, consent flows, and API security standards that now apply to bureau-adjacent data queries

Connecting the Compliance Stack

SIMAH sits in the middle of a broader data stack. An integration that works in isolation rarely works in production if upstream identity and income verification are not wired in:

• Income verification → Qiwa employment and income data integration
• Salary proof → WPS payroll data reconciliation
• B2B lending compliance → ZATCA e-invoicing integration guide

If you are scoping a Saudi lending product and need a technical assessment of the full integration stack — how many systems are involved, what the SIMAH membership timeline realistically looks like, and where the failure modes are — reach out to us. We have built this stack before.