KYC in Saudi Arabia: SAMA Requirements & Company Verification Guide 2026
KYC requirements in Saudi Arabia: SAMA AML/CFT framework, CR number verification, Qiyas & Maroof platforms, and due diligence for Saudi entities.
Saudi Arabia is undergoing a profound economic transformation under Vision 2030, the strategic framework launched by Crown Prince Mohammed bin Salman to reduce the country's dependence on oil and diversify its economy. This transformation is driving unprecedented levels of foreign direct investment, new business registrations, and cross-border financial activity — making Saudi Arabia an increasingly important market for international companies and financial institutions.
For compliance teams, working with Saudi entities requires understanding a regulatory framework that is distinct from European or US norms, built around the Saudi Central Bank (SAMA), the Ministry of Commerce, and an evolving set of AML/CFT regulations that have been significantly strengthened in recent years.
This guide provides a practical KYC reference for Saudi Arabian companies: the regulatory framework, how to identify and verify a Saudi entity, the specific risks to assess, and the platforms available for verification.
The Saudi Arabian Regulatory Framework
Saudi Arabia's AML/CFT regime is built around several key institutions and laws:
Saudi Central Bank (SAMA — Saudi Arabian Monetary Authority): SAMA is the primary regulator for banks, insurance companies, and financial institutions operating in Saudi Arabia. It issues AML/CFT guidelines and supervisory expectations for licensed entities.
Anti-Money Laundering Law (Royal Decree No. M/31 of 2003, updated 2014): The foundational AML legislation. It defines money laundering offenses, requires customer due diligence for financial institutions, mandates suspicious transaction reporting, and establishes the Saudi Financial Intelligence Unit (SAFIU).
Counter-Terrorism Financing Law: Complements the AML law with specific provisions for terrorism financing.
FATF Membership: Saudi Arabia is a FATF member (admitted in 2019) and subject to mutual evaluation reviews. Its most recent FATF mutual evaluation (2018) identified areas for improvement, and the country has made significant reforms since then.
Capital Market Authority (CMA): Regulates capital markets activities, including listed companies and investment funds.
Ministry of Commerce (MoC): Maintains the Commercial Register and is responsible for company registration and licensing.
General Authority of Zakat, Tax and Customs (ZATCA): Manages tax compliance and customs, replacing the former GAZT.
Saudi Company Types
Saudi Arabia offers several corporate structures for domestic and foreign investors:
Limited Liability Company (LLC — Sharikah Dhat Mas'uliyyah Mahdudah): The most common form for foreign investors. Requires a minimum of two shareholders. Since 2021, 100% foreign ownership is permitted in most sectors, subject to licensing from the Ministry of Investment (MISA).
Joint Stock Company (JSC — Sharikah Musahamah): Used for larger enterprises and required for certain regulated sectors. Can be publicly listed on Tadawul (Saudi Exchange).
Branch of a Foreign Company: A branch registered in Saudi Arabia but legally part of the parent company. The parent company bears unlimited liability for the branch's obligations.
General Partnership and Limited Partnership: Less common structures used primarily in professional services.
Special Economic Zone (SEZ) companies: Saudi Arabia launched Special Economic Zones in 2021-2022 (including the King Abdullah Economic City). Companies in SEZs may benefit from special regulatory and tax arrangements.
Professional Companies: Used for licensed professions (law firms, accounting firms, medical practices).
The CR Number: Primary Identifier for Saudi Entities
The Commercial Registration (CR) number is the primary identifier for all Saudi companies registered with the Ministry of Commerce. It is the Saudi equivalent of a company registration number or SIREN number in France.
The CR number is a 10-digit number. It encodes the year and region of registration. Every legitimate Saudi company conducting commercial activities must have a valid CR number.
What the CR number tells you: - The company's registered legal name in Arabic (and often transliteration) - The date of registration and expiry (CRs must be renewed periodically) - The company's legal form (LLC, JSC, branch, etc.) - The CR status (active, expired, suspended) - The company's registered activities (as defined in the Saudi business activity classification) - The registered address
The CR is the starting point for any KYB on a Saudi entity. Verification can be performed through the Ministry of Commerce's online portal (mc.gov.sa) or through the Maroof platform.
Maroof and Qiyas: Official Verification Platforms
Saudi Arabia has developed two key platforms relevant to KYB verification:
Maroof (maroof.com.sa): The Saudi government's official platform for verifying commercial entities. Maroof provides: - CR number verification - Business name and legal form confirmation - Business activity classification - CR status and validity Maroof is publicly accessible and provides real-time verification against Ministry of Commerce data.
Qiyas: A platform for verifying professional qualifications and licenses in Saudi Arabia. Relevant for verifying licensed professionals (accountants, lawyers, engineers) associated with the entity.
Saudi Business Center (businesscenter.gov.sa): The government's digital platform for business registration and licensing. Also provides verification services.
SAMA's Check: For regulated financial entities (banks, insurance companies, finance companies), SAMA maintains a public register of licensed entities that should be consulted to verify that a financial institution is legitimately licensed.
Saudi-Specific KYC Risks
PEP exposure: Saudi Arabia is governed by a monarchy with extensive royal family involvement in government and the economy. The Al Saud family has thousands of members, many of whom hold or have held government positions. PEP screening for Saudi individuals requires particular care and robust PEP databases that cover Saudi royals and senior government officials.
Beneficial ownership opacity: Despite reforms, beneficial ownership disclosure in Saudi Arabia is less transparent than in most EU jurisdictions. LLC shareholder information is included in the CR but may not always be current. Enhanced due diligence is appropriate to verify ownership through multiple sources.
Sector restrictions: Some sectors in Saudi Arabia remain restricted or require specific licensing even post-Vision 2030 reforms. Verify that the company's stated activities match its licensed activities and that any required MISA approval for foreign ownership is in place.
Government-linked entities: A significant portion of the Saudi economy involves government-linked entities (GLEs) — companies in which Saudi Aramco, PIF (Public Investment Fund), or other state entities have ownership stakes. These entities are not inherently high-risk but require understanding of the government ownership structure.
Cash and hawala activity: Saudi Arabia has historically had significant informal financial activity including hawala networks. For B2B contexts, watch for clients whose stated business is inconsistent with typical formal financial flows.