The CMA’s Enforcement Escalation: A Wake-Up Call for Listed Company Governance in Saudi Arabia

The Capital Market Authority (“CMA”) has, within the span of two weeks during May and June 2026, issued three separate enforcement announcements targeting individuals within listed companies on the Saudi Exchange. The actions span conviction, collective compensation, and criminal referral to the Public Prosecution covering in a single fortnight the full arc of Saudi capital markets enforcement. For directors, audit committee members, financial managers, and external auditors operating in this market, the signal is unambiguous: personal accountability for the integrity of financial disclosures is no longer a theoretical risk. It is an active and immediate one.

 

1. The Regulatory Landscape: What the CMA Is Signaling

The three enforcement actions, published on 20 May, 21 May, and 2 June 2026 respectively, span three distinct stages of the Saudi enforcement pipeline. The first resulted in a final conviction decision issued by the Appeal Committee for the Resolution of Securities Disputes (“ACRSD”), imposing collective fines exceeding SAR 18 million on eleven individuals and banning them from working in CMA-supervised entities, following findings of financial statement manipulation across a four-year period in violation of Article 49(a) of the Capital Market Law (“CML”) and Article 7 of the Market Conduct Regulations. The second entered the compensation phase, with the Committee for the Resolution of Securities Disputes (“CRSD”) accepting a collective compensation claim filed by an affected investor against convicted board and audit committee members, opening a ninety-day window for other affected investors to join. The third and most consequential in terms of its breadth, saw the CMA refer seventeen suspects to the Public Prosecution following a forensic inspection, with suspects spanning current and former board members, executive management, financial managers, and members of the engagement team at the company’s former external auditor.

What makes this pattern significant is not any single action in isolation. It is the simultaneity, the diversity of enforcement stages represented, and the explicit invocation of both the CML and the Companies Law in the most recent referral. The CMA is not responding to isolated complaints. It operates a coordinated, multi-track enforcement programme and it uses the full range of tools available to it.

2. The Legal Framework: What the Law Requires

The three enforcement actions are grounded in an interlocking framework of Saudi capital markets and corporate legislation that places significant personal obligations on those who govern and audit listed companies.

Under Article 49(a) of the CML, reinforced by Article 7 of the Market Conduct Regulations, any person is prohibited from engaging, directly or indirectly, in any act, practice, or course of conduct that creates or is likely to create a false or misleading impression with respect to a security or the financial condition of an issuer. Critically, this prohibition is not limited to active falsification. It extends to the approval of financial statements known or constructively known to be inaccurate, the recognition of revenues whose collectability is materially doubtful, and the failure to record asset impairment losses that applicable accounting standards require to be recognised.

The Companies Law operates in parallel, imposing specific fiduciary obligations on board members in respect of financial oversight, internal controls, and the accuracy of market disclosures.

Under the Corporate Governance Regulations, audit committees of listed companies carry independent and non-delegable responsibility for the integrity of financial reporting and direct substantive engagement with external auditors. Audit committee membership, as the enforcement record now makes clear, is not a formal appointment. It is a source of active personal accountability.

3. Personal Liability: The Shift from Institution to Individual

The convictions in the first matter were not founded on evidence that the individuals concerned had personally fabricated financial data. The ACRSD’s findings rested on a broader basis: that the convicted individuals approved financial statements whilst knowing or having the means to know given their position and access to information, that the revenues being recognized carried a low probability of collection. This is the constructive knowledge standard in operation. It does not require proof of active deception. It requires only that a person in a position of governance responsibility either knew, or ought to have known, that the disclosures they were approved of did not reflect the company’s true financial position.

The second matter adds a further dimension: the role of external auditor qualifications. In that case, the company’s external auditor issued reservations in respect of the financial statements for three consecutive years. The board and audit committee nonetheless approved those statements without adequately resolving the basis for the auditor’s concerns. A qualified audit opinion is not a formality to be noted and set aside. It is a trigger for active inquiry, documented deliberation, and demonstrable resolution. The CMA’s enforcement decisions indicate that a board or audit committee member who approves accounts in the face of repeated external auditor qualifications, without adequate engagement with the substance of those qualifications, will find it difficult to sustain a defence of good faith before the ACRSD.

The third matter extends the liability perimeter further still. The inclusion of financial managers and members of the external audit engagement team within the scope of the criminal referral confirms that personal liability is not confined to those who hold board seats or committee appointments. It extends to any professional whether employed by the company or engaged as an external adviser whose work materially contributes to the integrity, or the compromise, of a listed company’s financial disclosures.

Taken together, the three matters establish a liability framework that is personal, broad in their reach, and applied with reference to what a person in a particular role ought to have known. Ignorance, passivity, and deference to management are no longer tenable postures for those who sit on boards, serve on audit committees, or sign off on the financial statements of Saudi listed companies.

4. Recommendations

For board members and audit committee members of listed companies:

  • Review financial reporting processes immediately. Conduct an immediate review of your company’s revenue recognition policies, asset impairment assessments, and the adequacy of the internal controls underpinning published financial statements. The enforcement record indicates that the CMA’s scrutiny is directed precisely at these areas.
  • Treat your audit committee role as substantive, not ceremonial. Saudi listed companies are already required under the Corporate Governance Regulations to maintain an audit committee. What the enforcement record now makes clear is that formal existence is not enough. Audit committee members must actively interrogate financial reporting assumptions, ensure they have access to independent financial expertise, and establish direct communication channels with external auditors outside of management’s presence. A committee that meets to approve rather than to question is not discharging its legal obligations.
  • Act on auditor reservations and document that you did. Where an external auditor issues a qualified opinion or reservation, the audit committee must investigate the substance of that concern, satisfy itself as to its resolution, and maintain contemporaneous records of that process. The enforcement record indicates that approving financial statements over repeated auditor reservations, without documented engagement, will not be treated as good faith reliance on management.
  • Ensure financial statements reflect true and accurate numbers. The personal liability demonstrated across these cases flows directly from financial statements that did not reflect the company’s true financial position. Board members and audit committee members should satisfy themselves, through independent enquiry where necessary, that the figures presented for approval accurately represent the company’s revenues, assets, and liabilities before approving any financial statements for publication.
Conclusion

The three enforcement actions of May and June 2026 are not a coincidence of timing. They are the visible output of a CMA operating with expanded investigative capacity, a willingness to pursue personal liability at every level of the corporate governance chain, and a clear institutional commitment to holding individuals, not merely companies, accountable for the integrity of Saudi capital market disclosures. For those who govern, audit, and invest in Saudi listed companies, the central question is no longer whether the regulator will act. It is whether the structures, processes, and professional advice currently in place are adequate to ensure that when it does, there is nothing to find.

Saudi Arabia Opens a New Lane for Institutional Fund Investment: What the CMA’s Simplified Investment Fund Framework Means for You

Saudi Arabia Opens a New Lane for Institutional Fund Investment

The Saudi Capital Market Authority has taken a notable step in reshaping the Kingdom’s investment landscape. On 2 March 2026, the CMA’s Board issued the Instructions of Simplified Investment Funds (the Instructions), a self-contained regulatory regime designed to sit alongside, rather than within, the existing Investment Funds Regulations.

 

For institutional market participants, private equity sponsors, venture capital managers, family offices, and sophisticated asset managers, this development deserves careful attention.

A Purpose-Built Framework

It would be a mistake to read the Instructions as merely a lighter version of the existing rules. They are better understood as a purpose-built channel, designed specifically to serve institutional deal flow that does not require the full apparatus of retail-facing fund regulation.

The Instructions govern the registration, management, and operation of Simplified Investment Funds from the ground up. Where a provision of the existing Investment Funds Regulations is meant to apply, the Instructions say so explicitly. Otherwise, the new regime stands on its own terms.

Who Can Manage and Who Can Invest

Fund managers operating under the Instructions must hold a CMA licence covering either investment management and fund operation, or investment management alone. One important qualification: managers licensed solely for investment management, without fund operation authority, cannot use this framework for real estate funds or for funds that invest in real estate assets.

On the investor side, the Instructions draw a clear line. Units may only be offered through private placement to institutional clients. Secondary market transfers are similarly restricted to that same category. The CMA retains discretion to approve offerings to other investor classes on request, though additional conditions will apply.

Faster to Market: The Notification Model

Perhaps the most commercially significant change is the move away from a pre-approval process. Under the existing Investment Funds Regulations, the CMA was required to review an offering application within 15 days of a fund’s ability to proceed. That requirement is gone.

In its place, fund managers must notify the CMA in writing before the intended offering date, submit a signed declaration in the prescribed form, attach the fund’s Terms and Conditions and offering documents, and pay the applicable registration fee. The process is leaner, but it is not without risk.

The CMA expressly reserves the right to raise objections after notification. Fund managers who wish to reduce that exposure can seek the CMA’s non-objection in advance, preserving the speed advantage of the new regime while building in a degree of regulatory comfort before launch. How the CMA administers this post-notification review in practice will be one of the key areas to watch as the framework beds in.

Custody: The General Rule and Its Exceptions

As a baseline, fund managers must appoint one or more custodians based in the Kingdom under a written agreement, and the custodians must be institutions licensed by the CMA to carry out custody activities. The custodian cannot be the fund manager, a sub-fund manager, or an affiliate of either.

Two exceptions are worth flagging:

  • Where a Simplified Investment Fund is structured as a Special Purpose Entity, the requirement to appoint a custodian falls away entirely. This will be particularly relevant for deal-by-deal or project-specific structures that are common in private markets.
  • Where the fund is a feeder fund, the prohibition on a custodian’s affiliation with the fund manager is relaxed, provided that the conditions set out in Article 25 of the Investment Funds Regulations are met.
Flexibility in Fund Documentation

The Instructions introduce meaningful flexibility in the structure of a fund’s Terms and Conditions. Rather than mandating conformity with prescribed annexes as the Investment Funds Regulations do, the Instructions identify the categories of information that must be covered: offering period, target capital, investment strategy and objectives, fee arrangements, and risk disclosures. How that information is presented is, within those parameters, a matter for the manager.

This shift allows Terms and Conditions to be tailored more directly to the fund’s strategy and investor base, without requiring structural conformity to a template designed for a broader universe of funds.

Manager Duties and Delegation

The Instructions preserve a clear accountability framework. Fund managers owe their duties to unitholders and remain liable for losses arising from fraud, wilful negligence, misconduct, or default. Core responsibilities, including accurate disclosure, asset valuation, risk management, and compliance monitoring, cannot be transferred away.

Delegation is permitted for operational functions. Sub-fund managers, fund operators, and distributors may be appointed, subject to the conditions in the Instructions. Foreign sub-fund managers may be engaged to manage investments held outside the Kingdom, provided that the regulatory standards of their home jurisdiction are at least equivalent to the CMA’s own.

Operational Obligations

Books and records must be retained for a minimum of ten years, or longer where they relate to pending proceedings. Annual financial statements are required, prepared in accordance with standards approved by the Saudi Organization for Chartered and Professional Accountants and audited by a CMA-registered auditor who meets applicable independence requirements.

Our Assessment

The Instructions represent a considered effort by the CMA to create a more agile, institutionally oriented pathway within Saudi Arabia’s capital markets. For fund managers who have found the existing regime better suited to retail fund structures, this is a genuine development, not a marginal one.

That said, the framework raises practical questions that will take time to resolve. The notification model’s interaction with the CMA’s post-launch objection right, the eligibility of specialist strategies such as private credit and direct lending, and the precise scope of the SPE custodian exemption are all areas where market participants will want clarity before committing to structures that rely on the new regime.

We are advising clients across the fund formation, private equity, and capital markets space on what the Instructions mean for their strategies. If you would like to discuss how this framework applies to your specific situation, please reach out to our team.

Saudi Arabia’s CMA Glossary: Clarifying Capital Market Terms and Implications for Businesses

Saudi Arabia’s CMA Glossary

Saudi Arabia’s Capital Market Authority (CMA) has published an official glossary of terms used in its regulatory framework. This glossary serves as an authoritative reference for terminology employed across Saudi capital market rules and regulations. While it does not create new obligations or amend existing laws, it plays a significant role in enhancing clarity, consistency, and transparency for issuers, investors and market intermediaries.

 

Purpose and Significance of the CMA Glossary

The primary purpose of the glossary is to standardise the interpretation of key terms used in CMA regulations. Technical terms such as securities, offering, issuer and continuing obligations are now clearly defined within an official legal context. This standardisation reduces the risk of misinterpretation and ensures that all parties involved in securities transactions operate with a shared understanding.

By providing clear definitions, the glossary supports regulatory coherence across various CMA regulations. It strengthens investor confidence by ensuring that the meaning of critical terms is consistent in offering documents, disclosure statements, and legal agreements. The glossary also provides guidance for legal practitioners, advisors, and corporate entities when structuring deals or drafting official documents.

Implications for Businesses in Saudi Arabia

Although the glossary does not impose new legal obligations, it has practical implications for businesses operating in Saudi Arabia. Companies issuing securities or engaging in capital market activities can now reference the glossary to ensure that their documentation aligns with CMA terminology. This helps reduce compliance risks and prevents misunderstandings that could result in regulatory scrutiny.

Legal and financial advisory firms will need to update templates, contracts, and prospectuses in line with the glossary definitions. Similarly, audit firms, valuation experts, and fund managers will benefit from clear definitions when assessing the classification of assets, securities, or transactions. Overall, the glossary reinforces good governance, transparency, and consistency in the Kingdom’s capital market practices.

Implications for International Investors and Market Participants

For global investors and foreign issuers, the glossary provides an essential reference point when engaging with Saudi capital markets. Understanding official definitions ensures that cross-border transactions, investment structures and compliance measures are properly aligned with CMA expectations.

International asset managers, investment banks, and intermediaries can use the glossary to improve accuracy in legal documents and reduce the risk of misinterpretation. The availability of a standardised reference also facilitates due diligence, helps assess investment risks and supports better decision making for global capital market participants seeking exposure to Saudi Arabia.

Limitations of the CMA Glossary

It is important to recognise that the glossary does not, by itself, change existing rules, create new rights, or impose new obligations. It does not alter investment regulations, ownership limits, licensing requirements, or reporting standards. Investors and businesses must continue to comply with the underlying CMA regulations, laws and relevant statutory requirements.

The glossary functions as a supportive tool rather than a reform measure. Its value lies in providing clarity and consistency in interpreting terms that appear in offering rules, disclosure regulations, and continuing obligations. Legal and business professionals should therefore use the glossary in conjunction with the full body of CMA regulations and relevant legislation.

Strategic Takeaways for Market Participants

Despite its limitations, the glossary has practical strategic value. Saudi companies should integrate the glossary definitions into their internal compliance frameworks and legal documentation. This ensures alignment with CMA terminology and reduces the likelihood of regulatory misinterpretation.

Advisory firms, auditors, underwriters and investment managers can leverage the glossary to standardise documents, strengthen governance practices and streamline regulatory processes. Foreign investors and international participants should use the glossary as a reference tool to enhance clarity in cross-border transactions and capital market operations in Saudi Arabia.

Overall, the glossary contributes to the development of a transparent, predictable, and professional market environment, supporting the broader objectives of the Kingdom’s Vision 2030 to attract investment and diversify the economy.

The CMA glossary represents a meaningful step towards clarity and standardisation in Saudi Arabia’s capital market regulations. While it does not create new rules, it ensures that all stakeholders operate with a shared understanding of key regulatory terms. For domestic businesses, it improves compliance and governance practices. For international investors and global market participants, it provides a reference point that supports accurate interpretation and effective engagement with Saudi capital markets.