Saudi Arabia

The Companies Law of Saudi Arabia (Nizam Al-Sharikat) represents the unified legislation governing all aspects of the corporate life cycle in the Kingdom and provides a basis for economic diversification in accordance with Saudi Vision 2030. Introduced through Royal Decree No. M/132 and effective since June 30, 2022, the Law is regulated by the Ministry of Commerce as regards unlisted companies and by the Capital Market Authority (CMA) for listed firms. The regulation significantly streamlines the business environment by introducing five corporate types, including the versatile Simplified Joint Stock Company (SJSC) aimed at promoting entrepreneurship and venture capital. The legislation significantly decreases the amount of bureaucracy through such provisions as the possibility to incorporate online, liberalized corporate name restrictions, clear statutory definitions of the directors' duties of care and loyalty, and shareholder agreements. In compliance with the Implementing Amendments of April 2026, the regulation is further developed by increasing transparency of Ultimate Beneficial Owners (UBO) and fine-tuning the regulation of related party transactions, removal from boards, and interim profit distributions.

The Saudi Arabia Personal Data Protection Law (PDPL) is the leading legislation of its kind in the Kingdom of Saudi Arabia that addresses the processing and management of personal data by both private and public entities. Passed into law under the Royal Decree No. M/19, the law brings the Kingdom in line with international standards on privacy, like GDPR, through Saudi Vision 2030. Regulated and enforced by the Saudi Data and AI Authority (SDAIA), the PDPL is an extraterritorial legislation that covers any organization around the world that processes the data of people who reside in the Kingdom of Saudi Arabia. Under the law, the residents of the Kingdom have a right to access, modify, or destroy their data, while the enterprises in the Kingdom must obtain consent of the data subjects, restrict data collection, report a breach within 72 hours, and conduct a thorough risk assessment for any transfer of data outside the Kingdom. Failure to comply with the framework attracts an administrative fine of up to SAR 5,000,000 and a jail term of up to two years for any unauthorized release of sensitive data.

The Saudi Arabia Anti-Money Laundering Law is the key legislation that seeks to protect the financial system of the kingdom through the criminalization of money laundering, asset tracing, and terrorism financing. The act is enacted through Royal Decree No. M/20. Under the new law, the Saudi Arabia Financial Investigation Unit (SAFIU) under the Presidency of State Security is the lead body responsible for handling suspicious transaction reports (STRs), whereas SAMA and CMA oversee compliance among corporate organizations. There are stringent requirements, including a ten-year period of retaining transaction records and Customer Due Diligence (CDD). The law has since been amended in April 2026 through Royal Decree No. D/223 to extend jurisdiction to include regulations on e-wallets, wider powers of courts to seize suspicious properties, and severe deportation for foreign perpetrators to ensure FATF compliance.

The SAMA Cyber Security Framework (CSF) is a regulatory requirement mandated by the Saudi Arabian Monetary Authority (SAMA), released on May 24, 2017, to mandate strong cyber resilience within the financial sector in the Kingdom. The framework mandates that all commercial banks, fintech companies, and insurance companies regulated under SAMA must attain at least Maturity Level 3 through 96 controls in four domains, namely, leadership, risk management, technology operations, and third-party security. As per the recent updates to the framework, the SAMA CSF has evolved from assertion-based compliance to stringent assurance-based compliance, giving significant emphasis to supply chain security, senior management oversight, and alignment with NCA regulations.

The Capital Market Law (CML) constitutes the fundamental legislative basis for regulating the Saudi Arabian public capital markets and securities trading and was promulgated on July 31, 2003, through Royal Decree Number (M/30). The legislation established the Capital Market Authority (CMA), the only independent authority responsible for market oversight, market protection, and regulation of the Saudi Stock Exchange (Tadawul). Through a groundbreaking amendment to the CML on February 1, 2026, the regulatory framework fully updated market access by abolishing the QFI system and permitting all classes of foreign non-resident institutional and individual investors to invest directly in the Main and Parallel Markets.

The Banking Control Law, issued by Royal Decree M/5 in 1966 and implemented by the Saudi Arabian Monetary Agency (SAMA), forms the main legal basis for the regulation of the country's commercial banking system. The law requires that national banks be organized as local joint-stock companies with the cash capital of at least SAR 2.5 million and regulates foreign banks' branches very strictly. In order to ensure stability and liquidity, it requires high financial ratios, limiting a bank's liability for deposits to 15 times its capital and reserves, requiring a statutory deposit reserve of at least 15% with SAMA, and limiting single borrower's liabilities to 25% of the capital structure of the bank. In addition, the law prevents any conflict of interest and risk by absolutely prohibiting insider loans to board members and forbidding banks from conducting their business in retail or wholesale trade. With an extensive scope of regulatory power, the law gives SAMA broad rights to inspect banks, require transaction transparency, and impose strict punishments on violators.