Compliance & Security
Institutional-only participation, onboarding controls, and auditability - with an honest statement of our current regulatory status.
bad.loans is a B2B marketplace for distressed debt and non-performing loan (NPL) portfolios. The Platform facilitates portfolio listing, due diligence, and auction-based price discovery between institutional buyers and sellers.
The Platform does not process payments, hold client funds, operate escrow accounts, or provide banking services. Financial settlement of any transaction agreed through the Platform is executed directly between the counterparties through their own banking arrangements with appropriately licensed financial institutions.
bad.loans is not licensed by the Saudi Central Bank (SAMA). The licensing scope applicable to our activities in the Kingdom of Saudi Arabia is under review with Saudi counsel. The Platform is designed to align with the Anti-Money Laundering Law (Royal Decree No. M/31) and the Personal Data Protection Law (PDPL) enforced by the Saudi Authority for Data and Artificial Intelligence (SDAIA), and this page will be updated as our regulatory status evolves.
- AES-256-GCM encryption for personally identifiable information at rest
- bcrypt password hashing (12 rounds, no plaintext storage)
- Rate limiting on authentication, registration, and API endpoints
- Input sanitization against XSS, SQL injection, and null-byte attacks
- Role-based access control (Buyer, Seller, Admin) with admin approval gating
- Comprehensive audit logging with timestamps, user IDs, and IP addresses
- Institutional access screening with manual review and admin approval before marketplace access (a full KYC/AML verification programme is in development)
- Institutional-only participation
- Personal Data Protection Law (PDPL): consent records, self-service data export and erasure, encryption of personal data at rest
- Anti-Money Laundering Law (Royal Decree No. M/31): sanctions and eligibility representations at onboarding; a full verification programme is in development
- Shariah structure classification support for portfolio listings
- Data residency and cross-border transfer assessment in progress (current hosting region: EU / Dublin)
- GDPR: self-service data export (Art. 15/20) and account erasure (Art. 17), versioned consent records, records of processing (Art. 30)
- EU-region hosting for platform infrastructure
- Alignment roadmap for the EU credit servicers and purchasers framework (Directive (EU) 2021/2167)
- SEC & state compliance review framework
- Accredited investor verification
The Platform processes personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and, for EU/EEA and UK data subjects, the GDPR. Sensitive personally identifiable information is encrypted at rest using AES-256-GCM authenticated encryption. Passwords are hashed using bcrypt and are never stored in plaintext.
Users have the right to access, correct, delete, and port their personal data as provided under the PDPL and GDPR. Records we are required to keep under applicable law - such as audit trails and transaction evidence - are retained for the periods set out in our data retention policy and deleted or anonymized when no longer required.
For full details, see our Privacy Policy and Terms of Service.
bad.loans provides listing, due diligence, and auction-based price discovery. When an auction results in an agreed transaction, the transfer of funds and legal title is executed directly between the buyer and the seller under their transaction documentation, through banking institutions of their own choosing. The Platform is not a party to settlement, does not touch transaction funds, and does not operate escrow.
The Platform maintains audit trails of platform activity - bids, NDA execution, data room access, and auction outcomes - to support counterparties' own compliance, record-keeping, and dispute-resolution needs.