The Compliance Edition
Vol. 05 — For Legal, Finance & GRC
What every General Counsel, CFO and Head of GRC needs to know before they own the Saudi book — and the operating discipline that prevents nine in ten violations.
Direct answer. Saudi compliance for foreign employers in 2026 sits on six pillars: ZATCA (corporate tax, VAT, withholding, e-invoicing), GOSI (social insurance), MHRSD (labour law, Saudization), Mudad (wage protection), MISA (foreign-investment licence terms) and ZATCA-aligned anti-money-laundering. The Managing Director on the Commercial Registration carries personal liability across most of these. Run the four-cycle compliance loop with discipline and the risk is bounded; run it loosely and the consequences cascade — visa freeze, MD travel ban, banking restrictions.
01 · ZATCA
The Zakat, Tax and Customs Authority is the most active regulator on the foreign-employer beat in 2026.
Corporate Income Tax (CIT). 20% on the foreign-owned share of profits. RHQs enjoy a 30-year 0% rate on RHQ activities. Filed annually within 120 days of fiscal year-end.
VAT. 15% standard rate, monthly or quarterly filing depending on turnover. Reverse-charge applies to most cross-border services received.
Withholding Tax (WHT). 5% on services and 15% on management fees, royalties and certain payments to non-residents. Failure to withhold is recoverable from the Saudi paying entity.
E-invoicing (FATOORA). Mandatory for all VAT-registered entities. Phase 2 integration with ZATCA's central platform is the default for 2026 entrants. Non-compliant invoices are not deductible at the customer end — and the regulator sees both sides.
02 · GOSI and Mudad
GOSI funds the social insurance system. Mudad enforces the wage protection regime that proves the funding.
GOSI. All Saudi nationals are enrolled at 22% (employer 12% + employee 9% + occupational hazards 1%, of basic salary + housing). Non-Saudis enrolled at 2% occupational-hazards-only. Contributions filed monthly through the GOSI portal.
Mudad. Wage protection. Every employee — Saudi and expat — must be paid through the Mudad system to a Saudi bank account, in SAR. MHRSD reconciles Mudad payments against the contract terms registered on Qiwa. Mismatches and delays are visa- and Iqama-affecting events.
03 · Saudization
Nitaqat governs your right to issue visas. The Mudad and Qiwa data feeds prove it.
Nitaqat assigns each employer a band — Platinum, High Green, Mid Green, Low Green, Yellow, Red — based on the ratio of Saudi nationals in the workforce. The band is recalculated continuously from the live Qiwa headcount and Mudad wage protection feed.
Audit traps: ghost Saudi employees (Saudis on the books not actually working), wage levels below MHRSD thresholds (do not count toward the ratio), and contract types not eligible for Saudization counting. MHRSD audits these aggressively. Tamra's quarterly Saudization review surfaces exposures before MHRSD does.
04 · MD personal liability
Saudi Labor Law and ZATCA reach the Managing Director's freedom of movement.
The MD on the Commercial Registration is personally liable for unpaid corporate liabilities — wage protection violations, ZATCA assessments, GOSI arrears. Travel bans on MDs are a routine enforcement tool. The Jawazat will deny exit at the airport for an MD whose entity has open ZATCA or GOSI exposure.
Mitigation is structural: a Saudi MD on the CR (where the structure permits), live Mudad discipline, monthly ZATCA reconciliations, and quarterly compliance reviews. Tamra runs the cadence as a managed service for clients.
05 · Records, AML and bank-account discipline
Audit trails, source-of-funds, and the way banks enforce a regulator's risk appetite.
Document retention requirements: 10 years for contracts, payslips, ZATCA filings, GOSI returns. Records held outside the Kingdom must be reproducible to ZATCA on demand within statutory timelines.
AML and source-of-funds questions have intensified — particularly on executive accounts and Investor Visa anchor accounts. Saudi banks now request structured source-of-wealth documentation that mirrors private banking standards in Switzerland and Singapore. Plan the documentation pack before the move, not after the bank requests it.
Compliance in Saudi Arabia is not a department. It is a four-cycle rhythm — Mudad, GOSI, ZATCA, MHRSD — that you either run or get run by.
ZATCA's mandatory e-invoicing platform. Phase 2 requires real-time integration of every issued invoice with the central ZATCA system. Non-compliant invoices are not deductible at the customer end and trigger fines on the issuer.
Saudi Arabia's wage protection system. All employees must be paid through Mudad to a Saudi bank account in SAR. Mudad data feeds MHRSD's Saudization calculation and Qiwa's contract verification.
20% on the foreign-owned share of profits for non-GCC investors. RHQs licensed under the Regional Headquarters Programme enjoy 0% corporate income tax for 30 years on RHQ-qualifying activities.
Yes. The Jawazat can place an exit ban on an MD whose entity has open ZATCA, GOSI or wage-protection liabilities. Travel bans are routine enforcement and are lifted only when the underlying liability is settled.
Continuously. The Saudization ratio is computed from the live Qiwa headcount feed and the Mudad wage protection record. Falling a band freezes new visa applications and Iqama transfers immediately.
Yes. Tamra's compliance practice covers monthly Mudad and GOSI cycles, monthly/quarterly ZATCA filings, MHRSD interactions and quarterly Saudization reviews, with quarterly written board reporting.
Tamra runs a fixed-scope compliance review across ZATCA, GOSI, Mudad and Saudization — typically inside two weeks.
Talk to Tamra