Saudi Arabia

The Companies Law of Saudi Arabia (Nizam Al-Sharikat) represents the unified legislation governing all aspects of the corporate life cycle in the Kingdom and provides a basis for economic diversification in accordance with Saudi Vision 2030. Introduced through Royal Decree No. M/132 and effective since June 30, 2022, the Law is regulated by the Ministry of Commerce as regards unlisted companies and by the Capital Market Authority (CMA) for listed firms. The regulation significantly streamlines the business environment by introducing five corporate types, including the versatile Simplified Joint Stock Company (SJSC) aimed at promoting entrepreneurship and venture capital. The legislation significantly decreases the amount of bureaucracy through such provisions as the possibility to incorporate online, liberalized corporate name restrictions, clear statutory definitions of the directors' duties of care and loyalty, and shareholder agreements. In compliance with the Implementing Amendments of April 2026, the regulation is further developed by increasing transparency of Ultimate Beneficial Owners (UBO) and fine-tuning the regulation of related party transactions, removal from boards, and interim profit distributions.

The Saudi Arabia Personal Data Protection Law (PDPL) is the leading legislation of its kind in the Kingdom of Saudi Arabia that addresses the processing and management of personal data by both private and public entities. Passed into law under the Royal Decree No. M/19, the law brings the Kingdom in line with international standards on privacy, like GDPR, through Saudi Vision 2030. Regulated and enforced by the Saudi Data and AI Authority (SDAIA), the PDPL is an extraterritorial legislation that covers any organization around the world that processes the data of people who reside in the Kingdom of Saudi Arabia. Under the law, the residents of the Kingdom have a right to access, modify, or destroy their data, while the enterprises in the Kingdom must obtain consent of the data subjects, restrict data collection, report a breach within 72 hours, and conduct a thorough risk assessment for any transfer of data outside the Kingdom. Failure to comply with the framework attracts an administrative fine of up to SAR 5,000,000 and a jail term of up to two years for any unauthorized release of sensitive data.

The Saudi Arabia Anti-Money Laundering Law is the key legislation that seeks to protect the financial system of the kingdom through the criminalization of money laundering, asset tracing, and terrorism financing. The act is enacted through Royal Decree No. M/20. Under the new law, the Saudi Arabia Financial Investigation Unit (SAFIU) under the Presidency of State Security is the lead body responsible for handling suspicious transaction reports (STRs), whereas SAMA and CMA oversee compliance among corporate organizations. There are stringent requirements, including a ten-year period of retaining transaction records and Customer Due Diligence (CDD). The law has since been amended in April 2026 through Royal Decree No. D/223 to extend jurisdiction to include regulations on e-wallets, wider powers of courts to seize suspicious properties, and severe deportation for foreign perpetrators to ensure FATF compliance.