The CMA’s Enforcement Escalation: A Wake-Up Call for Listed Company Governance in Saudi Arabia

The Capital Market Authority (“CMA”) has, within the span of two weeks during May and June 2026, issued three separate enforcement announcements targeting individuals within listed companies on the Saudi Exchange. The actions span conviction, collective compensation, and criminal referral to the Public Prosecution covering in a single fortnight the full arc of Saudi capital markets enforcement. For directors, audit committee members, financial managers, and external auditors operating in this market, the signal is unambiguous: personal accountability for the integrity of financial disclosures is no longer a theoretical risk. It is an active and immediate one.

 

1. The Regulatory Landscape: What the CMA Is Signaling

The three enforcement actions, published on 20 May, 21 May, and 2 June 2026 respectively, span three distinct stages of the Saudi enforcement pipeline. The first resulted in a final conviction decision issued by the Appeal Committee for the Resolution of Securities Disputes (“ACRSD”), imposing collective fines exceeding SAR 18 million on eleven individuals and banning them from working in CMA-supervised entities, following findings of financial statement manipulation across a four-year period in violation of Article 49(a) of the Capital Market Law (“CML”) and Article 7 of the Market Conduct Regulations. The second entered the compensation phase, with the Committee for the Resolution of Securities Disputes (“CRSD”) accepting a collective compensation claim filed by an affected investor against convicted board and audit committee members, opening a ninety-day window for other affected investors to join. The third and most consequential in terms of its breadth, saw the CMA refer seventeen suspects to the Public Prosecution following a forensic inspection, with suspects spanning current and former board members, executive management, financial managers, and members of the engagement team at the company’s former external auditor.

What makes this pattern significant is not any single action in isolation. It is the simultaneity, the diversity of enforcement stages represented, and the explicit invocation of both the CML and the Companies Law in the most recent referral. The CMA is not responding to isolated complaints. It operates a coordinated, multi-track enforcement programme and it uses the full range of tools available to it.

2. The Legal Framework: What the Law Requires

The three enforcement actions are grounded in an interlocking framework of Saudi capital markets and corporate legislation that places significant personal obligations on those who govern and audit listed companies.

Under Article 49(a) of the CML, reinforced by Article 7 of the Market Conduct Regulations, any person is prohibited from engaging, directly or indirectly, in any act, practice, or course of conduct that creates or is likely to create a false or misleading impression with respect to a security or the financial condition of an issuer. Critically, this prohibition is not limited to active falsification. It extends to the approval of financial statements known or constructively known to be inaccurate, the recognition of revenues whose collectability is materially doubtful, and the failure to record asset impairment losses that applicable accounting standards require to be recognised.

The Companies Law operates in parallel, imposing specific fiduciary obligations on board members in respect of financial oversight, internal controls, and the accuracy of market disclosures.

Under the Corporate Governance Regulations, audit committees of listed companies carry independent and non-delegable responsibility for the integrity of financial reporting and direct substantive engagement with external auditors. Audit committee membership, as the enforcement record now makes clear, is not a formal appointment. It is a source of active personal accountability.

3. Personal Liability: The Shift from Institution to Individual

The convictions in the first matter were not founded on evidence that the individuals concerned had personally fabricated financial data. The ACRSD’s findings rested on a broader basis: that the convicted individuals approved financial statements whilst knowing or having the means to know given their position and access to information, that the revenues being recognized carried a low probability of collection. This is the constructive knowledge standard in operation. It does not require proof of active deception. It requires only that a person in a position of governance responsibility either knew, or ought to have known, that the disclosures they were approved of did not reflect the company’s true financial position.

The second matter adds a further dimension: the role of external auditor qualifications. In that case, the company’s external auditor issued reservations in respect of the financial statements for three consecutive years. The board and audit committee nonetheless approved those statements without adequately resolving the basis for the auditor’s concerns. A qualified audit opinion is not a formality to be noted and set aside. It is a trigger for active inquiry, documented deliberation, and demonstrable resolution. The CMA’s enforcement decisions indicate that a board or audit committee member who approves accounts in the face of repeated external auditor qualifications, without adequate engagement with the substance of those qualifications, will find it difficult to sustain a defence of good faith before the ACRSD.

The third matter extends the liability perimeter further still. The inclusion of financial managers and members of the external audit engagement team within the scope of the criminal referral confirms that personal liability is not confined to those who hold board seats or committee appointments. It extends to any professional whether employed by the company or engaged as an external adviser whose work materially contributes to the integrity, or the compromise, of a listed company’s financial disclosures.

Taken together, the three matters establish a liability framework that is personal, broad in their reach, and applied with reference to what a person in a particular role ought to have known. Ignorance, passivity, and deference to management are no longer tenable postures for those who sit on boards, serve on audit committees, or sign off on the financial statements of Saudi listed companies.

4. Recommendations

For board members and audit committee members of listed companies:

  • Review financial reporting processes immediately. Conduct an immediate review of your company’s revenue recognition policies, asset impairment assessments, and the adequacy of the internal controls underpinning published financial statements. The enforcement record indicates that the CMA’s scrutiny is directed precisely at these areas.
  • Treat your audit committee role as substantive, not ceremonial. Saudi listed companies are already required under the Corporate Governance Regulations to maintain an audit committee. What the enforcement record now makes clear is that formal existence is not enough. Audit committee members must actively interrogate financial reporting assumptions, ensure they have access to independent financial expertise, and establish direct communication channels with external auditors outside of management’s presence. A committee that meets to approve rather than to question is not discharging its legal obligations.
  • Act on auditor reservations and document that you did. Where an external auditor issues a qualified opinion or reservation, the audit committee must investigate the substance of that concern, satisfy itself as to its resolution, and maintain contemporaneous records of that process. The enforcement record indicates that approving financial statements over repeated auditor reservations, without documented engagement, will not be treated as good faith reliance on management.
  • Ensure financial statements reflect true and accurate numbers. The personal liability demonstrated across these cases flows directly from financial statements that did not reflect the company’s true financial position. Board members and audit committee members should satisfy themselves, through independent enquiry where necessary, that the figures presented for approval accurately represent the company’s revenues, assets, and liabilities before approving any financial statements for publication.
Conclusion

The three enforcement actions of May and June 2026 are not a coincidence of timing. They are the visible output of a CMA operating with expanded investigative capacity, a willingness to pursue personal liability at every level of the corporate governance chain, and a clear institutional commitment to holding individuals, not merely companies, accountable for the integrity of Saudi capital market disclosures. For those who govern, audit, and invest in Saudi listed companies, the central question is no longer whether the regulator will act. It is whether the structures, processes, and professional advice currently in place are adequate to ensure that when it does, there is nothing to find.

Esports Contracts: Protecting Teams, Players and Intellectual Property

Esports has emerged as a rapidly growing sector in Saudi Arabia, reflecting the Kingdom’s broader ambitions under Vision 2030 to develop its digital and entertainment economy. With professional teams, tournaments, streaming platforms and brand sponsorships now integral to the industry, the legal landscape surrounding esports has become increasingly complex. Central to this ecosystem are contracts that govern the relationships between teams, players, organisers, and other stakeholders. Properly structured agreements not only protect commercial interests but also ensure regulatory compliance and long-term sustainability.

 

Team and Player Agreements

Contracts between esports organisations and players are the foundation of professional engagement. These agreements establish the rights and obligations of each party, including remuneration, performance expectations, standards of behaviour, and dispute-resolution mechanisms. Legal considerations include ensuring that contracts comply with employment law or, where appropriate, independent contractor arrangements. Clearly drafted contracts help prevent disputes, protect teams’ operational interests, and secure players’ professional rights.

Intellectual Property Ownership

Intellectual property (IP) is a core asset in esports, encompassing team branding, game content, streaming footage, and proprietary digital assets. Teams and organisers must ensure that they hold the necessary IP rights and licenses to use game titles and related intellectual property, while also protecting their own branding and content. Agreements should clearly delineate ownership and usage rights, including rights in broadcasting, merchandising, sponsorship, and digital distribution. Protecting IP rights through contracts is critical for monetisation, long-term brand value, and resolving disputes over content ownership.

Sponsorship and Commercial Arrangements

Esports rely heavily on commercial partnerships, including sponsorships, endorsements, and merchandising. Contracts in this context must clearly define each party’s rights and responsibilities, including branding placement, advertising compliance, revenue sharing, and exclusivity provisions. Transparency and compliance with consumer protection and advertising regulations (such as Mawthooq) are essential. Well-structured commercial agreements mitigate risk, enhance credibility with partners, and enable sustainable monetisation strategies.

Media and Streaming Rights

The digital nature of esports makes media rights a central consideration in contracts. Agreements governing streaming, broadcasting, and content distribution must ensure compliance with national media regulations, content standards, and licensing requirements. This includes adherence to rules relating to online platforms, advertising, and public communications. The contractual frameworks should address licensing fees, revenue splits, territorial rights, and content usage restrictions, allowing esports organizations, players and teams to leverage their digital presence while avoiding regulatory violations.

Data Protection and Cybersecurity

Esports platforms increasingly need to account for data protection and cybersecurity considerations. Online platforms collect and process significant volumes of personal data from players, viewers, and users. Compliance with the Personal Data Protection Law (PDPL) is critical. Contracts must therefore allocate responsibility for data handling, consent management, and security measures to prevent breaches, maintain trust, and ensure regulatory compliance.

Dispute Resolution and Governing Law

Given the regional and international nature of esports, contracts should incorporate clear dispute resolution mechanisms. Arbitration or mediation clauses provide neutral and enforceable avenues for resolving conflicts, particularly where parties are based in different jurisdictions. The choice of governing law and jurisdiction must be carefully considered to balance enforceability with operational practicality. Effective dispute resolution frameworks preserve relationships, protect reputations, and ensure business continuity.

Esports contracts are central to the professionalisation and commercial success of the industry in Saudi Arabia. By carefully structuring agreements between teams, players, sponsors, and platforms, parties can protect intellectual property, ensure regulatory compliance, manage risks, and maximise commercial value. In an evolving sector driven by digital platforms, tournaments, and sponsorships, proactive legal planning is essential to support sustainable growth and safeguard the interests of all stakeholders.

 

Ways to Object to Judgments under the Law of Procedure Before Sharia Courts

Ways to Object to Judgments under the Law of Procedure Before Sharia Courts

In Saudi Arabia’s Sharia-based judicial system, judgments are intended to bring certainty. Yet the pursuit of justice does not end with the issuance of a decision. The Law of Procedure Before Sharia Courts recognises that errors, procedural failures and exceptional circumstances can arise, and it provides litigants with carefully regulated mechanisms to challenge judgments where fairness demands correction.

 

These objection pathways are not procedural formalities. They are critical legal safeguards that ensure judgments remain aligned with Sharia principles, statutory requirements, and due process. Knowing how to use them and when is often decisive.

The Three Routes of Objection

The law provides three distinct methods for objecting to judgments: appeal, petition for reconsideration, and cassation. Each serves a specific legal function, operates under strict conditions, and is governed by mandatory time limits.

Appeal: Revisiting the Case in Full

An appeal is the principal route for challenging judgments issued by courts of first instance. It allows a higher court to re-examine the case in its entirety, including the facts and the trial court’s legal reasoning. Crucially, an appeal must be filed within 30 days of the judgment’s issuance. This deadline is strictly applied. Once it passes, the judgment generally becomes final and enforceable, regardless of its commercial or personal impact. Appeals, therefore, demand immediate action and careful procedural execution.

Petition for Reconsideration: An Exceptional Safeguard

A petition for reconsideration is an extraordinary remedy, available only in limited and clearly defined circumstances. It is not a second appeal, nor a mechanism to revisit unfavourable outcomes without cause.

Under Article 200, reconsideration may be sought where the judgment was founded on forged documents or testimony later declared perjurious, where decisive documents emerge that could not previously be produced, or where fraud by the opposing party materially influenced the judgment. It also applies where the court awarded relief beyond the parties’ claims, issued contradictory reasoning, ruled in absentia, or rendered judgment against a party who was not properly represented. The filing period is 30 days from the date the petitioner becomes aware of the relevant ground, not from the date of judgment. This knowledge-based trigger underscores the exceptional nature of this remedy and the importance of evidentiary precision.

Cassation: Protecting Legal Integrity

Cassation represents the highest level of judicial review and is brought before the Supreme Court. Its role is not to reassess facts, but to safeguard legal correctness and procedural integrity. Pursuant to Article 193, cassation may be pursued where a judgment violates Sharia principles or applicable laws, where the court was improperly constituted, lacked jurisdiction, or where the case was incorrectly characterised in law. Cassation ensures consistency across the judiciary and reinforces the proper application of legal principles throughout the Kingdom.

Precision Is Not Optional

Each objection route is tightly regulated. Choosing the wrong mechanism, relying on unsupported grounds, or missing a statutory deadline can permanently foreclose the right to challenge a judgment.

As Saudi Arabia continues to strengthen judicial efficiency and procedural discipline, the courts’ tolerance for procedural missteps is narrowing. A successful objection today requires not only strong legal grounds, but also strategic clarity and meticulous compliance.

M&A in Entertainment: Structuring Film, Media and Talent Deals

M&A in Entertainment Structuring Film, Media & Talent Deals

The media and entertainment industry in Saudi Arabia is experiencing unprecedented growth, driven by strategic public investment, the rise of creative sectors under Vision 2030, and increasing demand for high-quality local and international content. Mergers and acquisitions (M&A) in film, media and talent management have become central to this growth, enabling companies to scale, access intellectual property, and acquire specialised expertise. The rise of digital platforms has significantly influenced entertainment M&A as seen in Saudi Research & Media Group (SRMG)’s acquisition of a 51% stake in Thmanyah in 2021 and the Public Investment Fund (PIF)’s MBC Group in 2025. However, the legal and commercial complexities inherent in entertainment transactions require careful structuring to protect value, manage risk and comply with regulatory frameworks.

 

Deal Structuring and Legal Considerations

Structuring M&A transactions in the entertainment sector involves multiple layers of legal considerations. Acquisitions may involve content libraries, production companies, distribution channels, or talent agencies. Each asset class brings unique challenges related to ownership rights, licensing, intellectual property, and contractual obligations. Legal advisors play a crucial role in conducting thorough due diligence, identifying encumbrances, and clarifying rights to reproduce, distribute and monetise creative works. Understanding the chain of rights for content, including film scores, scripts, software, and digital media, is essential to avoid disputes and ensure smooth post-acquisition integration.

Intellectual Property and Licensing

Intellectual property (IP) is often the most valuable asset in entertainment M&A. Film, television, music, and digital content are all protected under copyright, while trademarks and branding assets carry substantial commercial value. Deal structures must carefully allocate IP ownership, licensing rights, and royalties to reflect both existing agreements and post-transaction strategies. Contracts may also need to address adaptation rights, sequel or spin-off projects, and territorial exclusivity, particularly for international co-productions or streaming distribution deals. Protecting these rights while enabling flexible commercial exploitation is critical for long-term success.

Talent and Employment Agreements

M&A transactions frequently involve the transfer of talent contracts or management rights. Film actors, directors, musicians, and other creative professionals may be subject to existing employment, consultancy, or exclusivity agreements that need to be reviewed and integrated into the new entity. Structuring deals with clarity on remuneration, residuals, performance obligations, and termination rights is crucial. Legal frameworks must also address regulatory compliance related to employment contracts, labour law, and work permits, particularly for expatriate talent engaged in Saudi-based productions.

Regulatory Compliance

Entertainment M&A is subject to a broad regulatory landscape. Transactions must comply with corporate law, competition regulations, media licensing requirements, and foreign investment rules. For example, acquiring a production company or digital platform may require approvals from the Ministry of Culture, the General Authority of Media Regulation, the General Authority for Competition or other sector-specific authorities. Transaction structures should account for these approvals to avoid delays and ensure the enforceability of agreements. Anti-money laundering and disclosure obligations also play an important role in cross-border deals, as they require transparency in ownership and financial reporting.

Financial Structuring and Risk Management

Financial considerations are central to deal structuring in entertainment M&A. Valuation of content libraries, distribution channels, and talent contracts requires specialist expertise, given the intangible and time-sensitive nature of these assets. Deal terms may include earn-outs, royalty participation, or performance-based compensation to align incentives between sellers and buyers. Structuring the transaction to allocate risk, mitigate potential liabilities, and protect contingent revenues is essential to safeguard both financial and operational interests.

Digital Transformation and Distribution Models

Streaming services, social media channels, and digital distribution networks introduce new commercial models and licensing considerations. Transactions involving digital assets require careful legal drafting to address platform rights, monetisation models, data protection compliance, and cross-border content distribution. Ensuring that contracts reflect evolving technologies and audience engagement strategies is critical for sustaining competitive advantage.

M&A activity in Saudi Arabia’s entertainment sector presents both significant opportunities and legal challenges. Structuring transactions effectively requires a comprehensive understanding of intellectual property, talent agreements, regulatory obligations, financial mechanisms, and digital distribution models. By adopting a proactive, integrated legal approach, stakeholders can maximise the commercial potential of film, media, and talent deals while minimising risks and ensuring compliance with Saudi Arabia’s evolving entertainment and media landscape.

Digital Streaming in KSA: Compliance for Global Platforms

Digital Streaming in KSA Compliance for Global Platforms

Digital streaming has become a central component of global media consumption, with international platforms delivering on-demand video, audio, and interactive content to millions of users. In the Kingdom of Saudi Arabia, this trend has been accompanied by significant changes to the legal and regulatory framework governing digital streaming services.

 

As the country strengthens its digital economy and aligns its media regulations with broader national development goals, both local and international streaming platforms must navigate a complex compliance landscape to operate effectively and lawfully within the Kingdom.

At the forefront of regulatory change is the Regulations for Providing Digital Content Platform Services (the “Regulations”), issued by the Communications, Space and Technology Commission (CST). These Regulations came into force on 1 January 2024 and define the legal obligations for a wide range of digital content platforms, including streaming services that deliver video and audio over the internet. The Regulations apply to both local and foreign operators that provide services to users in Saudi Arabia and require such service providers to obtain a licence, register, or submit a notification, depending on the nature and scale of their operations. Failure to comply with these requirements may result in enforcement action by the CST such as issuing warning notices, suspending or canceling the issued licenses.

Under the CST’s Regulations, operators of satellite pay television and Internet Protocol Television (IPTV) services must obtain a licence to offer these services within Saudi Arabia. Licences are typically valid for ten (10) years and are subject to application and annual fees. For over‑the‑top video (OTT) platforms, audio‑on‑demand services and internet radio platforms with a significant user base in the Kingdom, registration with the CST is required instead of a full licence. Smaller platforms and certain categories of services such as social media platforms and E-sports participation platforms, are subject to a simpler notification requirement, where the provider submits key corporate and operational information to the regulator, whereas online gaming platforms do not require any licenses, registrations or notifications with CST; however, providers must nevertheless be in compliance with the regulations. Across all categories, the appointment of a Platform Liaison Officer (PLO) is mandatory, serving as the primary point of contact between the platform and the CST.

These regulatory obligations are designed to ensure transparency, accountability and quality of service in the digital content sector. By requiring formal registration and licensing, the framework encourages providers to establish clear operational structures, maintain audited financial records and sustain ongoing communication with the regulators. For global streaming platforms, this often involves determining whether an existing user base in Saudi Arabia exceeds thresholds that trigger regulatory requirements and, if so, whether to establish a local commercial presence or comply from abroad under the applicable registration regime.

In addition to licensing and registration duties, digital streaming platforms must ensure compliance with broader content rules enforced under the Audiovisual Media Law (2018) and related content regulation guidelines. These regulatory instruments require that media content, including that delivered through digital streaming services, respect Saudi cultural and social norms and comply with Shari’ah principles. Prohibited content includes material that is offensive to public morals, promotes illegal activity, or undermines public order. The General Authority for Media Regulation (GAMR or Gmedia) oversees these standards, and providers must ensure that their content moderation practices align with the Kingdom’s regulatory expectations.

Furthermore, data protection and consumer rights are additional compliance considerations for streaming platforms. Although Saudi Arabia’s Personal Data Protection Law (PDPL) primarily focuses on the handling of personal data by commercial entities, streaming services that collect, process, or store user data within the Kingdom must adhere to the law’s provisions on data privacy, consent, and security. Platforms operating in multiple jurisdictions must carefully design cross‑border data-transfer mechanisms and user-consent frameworks to reconcile global operational practices with domestic legal expectations.

Operational compliance also extends to advertising and content moderation. Streaming services that incorporate advertising must ensure that advertising content complies with national standards and does not violate cultural norms or consumer protection rules. Content moderation policies should address issues such as inaccurate information, harmful material, and age‑restricted content, and include mechanisms to remove or block prohibited material when identified by users or regulators.

As Saudi Arabia continues to refine its regulatory regime for digital media, platforms must remain vigilant to legislative changes and evolving enforcement practices. For example, consultations on a new consolidated Media Law have included proposals for expanded content moderation and licensing obligations that could further affect digital streaming operations. Staying abreast of these developments and proactively engaging with regulatory authorities can help global platforms manage compliance risks and secure sustainable access to one of the Middle East’s fastest‑growing digital media markets.

Digital streaming platforms operating in the Kingdom of Saudi Arabia face a multifaceted compliance landscape. This encompasses licensing and registration under the CST’s digital content platform regulations, adherence to cultural and content standards enforced by Gmedia, data protection obligations under the PDPL and advertising and moderation requirements aligned with national values. Understanding and fulfilling these legal obligations is critical for global platforms seeking to serve Saudi audiences lawfully and effectively in a dynamic regulatory environment.

 

 

 

 

 

 

The CST Layer: The Data Protection Obligations Saudi Fintechs Are Quietly Overlooking

Fintech compliance teams have, understandably, organised their data protection efforts around the Personal Data Protection Law (PDPL). But for many fintechs in the Kingdom, the PDPL is the floor not the ceiling. A second, less-discussed layer of obligations sits above it, administered by the Communications, Space and Technology Commission (CST), and it is regularly missed.

 

The PDPL is the baseline

The PDPL and its Implementing Regulations are the baseline data protection framework in Saudi Arabia, and they apply to fintech companies as they do to any other controller or processor handling personal data. Most fintechs have, sensibly, built their privacy programmes around this regime. The issue is that the PDPL is sector-agnostic. It does not, on its own, capture the technological, digital infrastructure and information security obligations that the Kingdom’s communications and IT regulator imposes on a defined population of providers, a population that increasingly includes fintech businesses.

Are you a CST “Service Provider”?

The starting point is a single threshold question under the Telecommunication and Information Technology Act: does the fintech provide telecommunications, information technology or related services, including digital content platforms, to the public? If the answer is yes, the CST regime is engaged, and a parallel set of obligations applies on top of the PDPL. If no, the PDPL continues to apply on its own. In our experience, fintechs offering customer-facing digital platforms, app-based services, embedded financial products or technology-enabled service layers should treat this question with care and document the analysis. Self-assessing oneself out of scope without a defensible record is not a strategy.

What the CST layer actually requires

The CST framework operates through two complementary instruments: the General Principles for Personal Data Protection (RC04) and the Procedures of Launching Services or Products Based on Customers’ Personal Data (CST Procedures). Together, they impose obligations of two distinct kinds.

Standing obligations

Every in-scope Service Provider must establish and resource an independent function with clear roles and responsibilities for the protection of customer personal data. It must develop and maintain a comprehensive privacy programme, covering policies, procedures, documentation, implementation and enforcement, and submit that programme to the CST for approval, with periodic reporting on its effectiveness. Cross-border processing requires the CST’s prior written approval, which is a meaningfully higher bar than the PDPL’s transfer regime alone.

Transactional obligations

Where the Service Provider intends to share personal data, or to launch or modify a product or service that relies on the processing of personal data, a specific launch pathway is triggered. The Service Provider must first verify whether a Privacy Impact Assessment (PIA) is required. If not, the verification must be submitted to the CST at least five business days before launch. If yes, the PIA itself must be submitted at least twenty-one business days before launch, and the launch may not proceed until the CST has reviewed it and where additional information is requested, has expressly accepted that information. A narrow carve-out applies to processing within the Service Provider’s own systems for the sole purpose of delivering services to a specific customer; it does not displace the standing obligations.

Why this matters in practice

The practical consequence is straightforward. A fintech that has built a high-quality PDPL compliance programme can still be materially non-compliant with the CST layer, most often by failing to obtain prior approval for its privacy programme, by processing personal data outside the Kingdom without CST written approval, or by launching a new product or feature that relies on personal data without working through the CST Procedures launch pathway. None of these gaps are theoretical. Each is identifiable in a typical fintech operating model.

If your fintech is a CST Service Provider, your PDPL programme is necessary but not sufficient. The CST framework adds an independent function, a regulator-approved privacy programme, prior written approval for cross-border processing, and a defined pre-launch pathway for new and modified products. The flowchart overleaf maps the regime end-to-end. Part II will examine the parallel obligations imposed by SAMA, and how the SAMA, CST and PDPL regimes interact.

What to do now
  • Run, and document, the Service Provider threshold analysis.
  • Confirm whether your privacy programme has been approved by the CST and whether your reporting cadence is current.
  • Identify every cross-border processing flow and confirm CST written approval is in place.

PIF’s 2026–2030 Strategy: From Acceleration to Value Realization

PIF’s 2026–2030 Strategy

On 15 April 2026, the Board of Directors of the Public Investment Fund (PIF), chaired by His Royal Highness Prince Mohammed bin Salman bin Abdulaziz Al Saud, Crown Prince, Prime Minister and Chairman of the Board, approved PIF’s 2026–2030 strategy. The new strategy represents the next phase of PIF’s long-term plan and a deliberate evolution from a period of rapid growth and capital deployment into one defined by value realization, investment efficiency, and deeper private-sector partnership. For businesses, investors, and professional advisors operating across the Kingdom and the wider region, the strategy sets out a clearer map of where PIF intends to concentrate capital, build national champions, and invite external participation over the next five years.

 

A strategy built on a strong five-year base

The 2026–2030 strategy builds directly on the achievements of PIF’s 2021–2025 cycle, during which the Fund materially repositioned itself as a driver of domestic economic transformation rather than simply a custodian of sovereign wealth. Over that period, PIF invested approximately SAR 750 billion (around USD 199 billion) in new domestic projects, representing roughly 70% of its total investments, and grew its assets under management from USD 150 billion in 2015 to more than USD 900 billion. The Fund also contributed more than USD 243 billion to real non-oil GDP between 2021 and 2024, equivalent to around 10% of Saudi Arabia’s total non-oil GDP in 2024 and delivered an annualized total shareholder return of more than 7% since 2017.

PIF now holds investment-grade credit ratings from each of the three major global rating agencies, including an Aa3 rating with a stable outlook from Moody’s and an A+ rating with a stable outlook from Fitch, making it one of a small number of sovereign wealth funds with that distinction. That financial and institutional foundation is important context for the new strategy: the question being addressed is no longer whether the Kingdom can mobilize capital at scale, but how that capital is converted into sustained, commercially credible value.

Three portfolios, one mandate

Under the 2026–2030 strategy, PIF’s investments are structured into three distinct portfolios, each with a defined strategic role. The Fund’s mandate itself remains unchanged: to drive the economic transformation of Saudi Arabia and to generate sustainable financial returns.

Vision Portfolio

The Vision Portfolio is the engine of PIF’s domestic transformation agenda. It is designed to deepen integration across the Kingdom’s priority strategic sectors, maximize value across PIF portfolio companies, and sustain the growth of the local economy. Practically, the Vision Portfolio consolidates PIF’s existing 13 strategic sectors into six fully integrated economic ecosystems. It also creates new entry points for the domestic private sector to participate as investors, partners, and suppliers, while attracting international co-investors and operators.

Strategic Portfolio

The Strategic Portfolio focuses on actively managing PIF’s core national assets, optimizing returns from those holdings, and supporting selected portfolio companies in their journey to become global champions. It is the portfolio through which PIF expects to convert long-standing strategic positions into internationally scalable businesses capable of attracting both domestic and foreign capital.

Financial Portfolio

The Financial Portfolio is constructed to deliver sustainable, long-term risk-adjusted returns through diversified global investments. It is intended to strengthen PIF’s position as a global investor, reinforce portfolio resilience, and secure a durable funding base that underwrites PIF’s continued domestic investment firepower.

The six ecosystems at the heart of the Vision Portfolio

The Vision Portfolio’s six ecosystems represent a significant organizational shift. Rather than managing investments as a portfolio of discrete sector bets, PIF is explicitly designing these ecosystems to interconnect, so that demand generated in one vertical is captured by suppliers, operators, and infrastructure within another. The aim is to build competitive depth in the domestic economy and reduce reliance on imports and external providers in the sectors that matter most to Vision 2030.

 

From builder to architect: the shift in PIF’s posture

The most consequential feature of the 2026–2030 strategy is not a new sector or a new target, but a change in PIF’s role. The 2021–2025 cycle was defined by PIF acting as the primary buyer of record across entire value chains, underwriting demand and absorbing risk while domestic and international capacity was built. In the next five years, PIF is repositioning itself as the architect of those ecosystems, with the private sector expected to take on a materially larger share of capital deployment, execution, and operating risk.

Three features of the new strategy signal that shift. First, PIF has committed to structuring its portfolio around efficiency, value realization, and disciplined capital allocation, rather than growth for its own sake. Second, the Vision Portfolio is explicitly designed to unlock new opportunities for private-sector participation as investor, partner, and supplier. Third, PIF is expanding its international footprint, with subsidiary offices in North America, Europe, and Asia intended to deepen ties in priority markets and attract inbound capital, talent, and technology into the Kingdom.

For private-sector participants, whether Saudi national champions, regional groups, or international entrants, the implication is that the competitive advantage in the 2026–2030 cycle will increasingly accrue to those who can deploy capital, operate at scale, and integrate into PIF-backed ecosystems on genuinely commercial terms, rather than those seeking to sell into sovereign-backed demand.

Governance, transparency, and institutional excellence

The strategy elevates governance and institutional standards to a strategic objective. PIF has signalled that the next phase will apply the highest standards of governance, transparency, and institutional discipline across its portfolio companies, alongside advanced use of data and artificial intelligence in investment decision-making. For portfolio companies, this is likely to translate into more structured performance management, clearer reporting standards, and sharper scrutiny of capital efficiency. For advisors and service providers, it indicates sustained demand for audit, assurance, tax, legal, and transaction advisory services that can support investment-grade institutional requirements across an increasingly complex portfolio.

Implications for the market

The 2026–2030 strategy is best understood as a maturity milestone. The Kingdom has, in less than a decade, built the architecture of a diversified non-oil economy; the task now is to operate that architecture commercially, attract complementary private capital, and convert domestic scale into global competitiveness. Several implications follow for participants across the ecosystem.

  • Capital allocators can expect a growing pipeline of structured co-investment opportunities across the six ecosystems, supported by PIF’s Private Sector Forum and an expanding suite of partnership vehicles.
  • Operating companies and international entrants will find the clearest entry points in sectors aligned with the six ecosystems, notably advanced manufacturing, logistics, clean energy, tourism, urban development, and NEOM-related verticals.
  • Portfolio companies will need to demonstrate measurable contributions to non-oil GDP, export capability, and commercial returns, rather than relying solely on the scale of deployment.
  • Professional services firms, across audit, tax, legal, and strategic advisory, will play an increasingly central role in supporting the governance, transaction execution, and cross-border structuring that the next phase of the strategy demands.
Outlook

PIF’s 2026–2030 strategy sets a measured but ambitious course. It preserves the Fund’s unique mandate, consolidates the foundations laid during the 2021–2025 cycle, and signals a deliberate transition toward a more efficient, private-sector-led model of growth. For the Kingdom, the strategy strengthens the link between national transformation ambitions and credible, commercially disciplined delivery. For the market, it clarifies where capital, expertise, and partnership are most likely to be rewarded over the coming five years. And for institutions operating across the GCC, including professional advisors supporting inbound investors, national champions, and portfolio companies, it reinforces that the next phase of Saudi Arabia’s transformation will be defined less by the pace of deployment and more by the quality of execution.

Priority, Perfection, and the Discipline of Registration

Priority, Perfection, and the Discipline of Registration

Saudi Arabia’s secured transactions framework rests on a principle that is both precise and unforgiving against third parties, priority follows perfection, and where perfection is achieved through registration, the date of registration, not the date on which the underlying agreement was signed, determines rank.

 

This is not a uniquely Saudi position. Many mature credit markets operate on the same logic, treating the act of filing or registration as the moment at which a security interest becomes enforceable against the world, regardless of when the parties first committed to paper. What distinguishes a well-functioning secured lending regime is not the existence of this rule, but the rigour with which it is applied and the extent to which practitioners internalise its consequences.

Article 19 of the Moveable Property Security Law gives this principle statutory expression. It permits multiple security interests to be created over the same collateral and establishes a transparent hierarchy for resolving conflicts between them. The hierarchy is straightforward in design but demanding in practice. A perfected interest prevails over an unperfected one. Where multiple interests have been perfected by registration, rank is determined by the order in which registration occurred. Where multiple interests have been perfected by possession, the order of possession controls. Only where all competing interests remain unperfected does the law fall back on the order of execution.

The practical implication is one that lenders and their counsel cannot afford to treat as theoretical. A creditor who signs first but registers second may find itself subordinated to a party who moved more quickly through the administrative process. In facilities where the same asset base supports multiple tranches of debt, the stakes of this sequencing are material.

Registration as a Transactional Condition

Framing registration as a post-closing administrative step is a misconception that carries real risk. A security package may be carefully negotiated, comprehensively documented, and commercially sound in every respect and yet, until the relevant interest is registered, the lender’s priority position is not secured. It is contingent. The security exists between the parties but does not bind third parties or establish rank.

These reframing matters: registration should be treated as a condition, whether precedent or subsequent. The transaction is not complete, from a priority perspective, until perfection has been achieved.

Who Bears the Burden, and Why It Matters

Responsibility for effecting registration typically falls on the borrower. As the party granting the security and the one with direct access to the relevant assets and records, the borrower is generally best placed to carry out the required filings. This allocation is standard and, in straightforward transactions, functions well.

In practice, however, many lenders choose not to rely on it. Where the timing and accuracy of registration directly determine the lender’s rank, and where a filing made a day late or with a technical deficiency could cost the lender its priority, delegating the process entirely to the borrower introduces a risk that is difficult to justify on commercial grounds. Prudent lenders frequently elect to oversee registration themselves, or to take direct control of the process, precisely because the consequences of error are not recoverable through subsequent negotiation.

The principle underlying this approach is simple. Priority, once lost to a faster-moving creditor, cannot be restored by agreement between the original parties. It requires the consent of the intervening creditor, which is rarely forthcoming on favourable terms. Prevention is the only reliable remedy.

For those structuring secured transactions in Saudi Arabia, execute carefully, register immediately, and treat registration with the same discipline you bring to the documentation itself.

Governance Liability and Indirect Terrorism Financing: Key Takeaways from the Lafarge Case

Governance Liability and Indirect Terrorism Financing

For boards and senior decision-makers operating in complex or high-risk environments, the Lafarge case offers a clear and uncomfortable message, governance failures do not remain commercial problems for long. This article examines the principal liability lessons through a Saudi legal and regulatory lens.

 

In recent years, Lafarge, one of the world’s largest cement manufacturers, became the subject of significant criminal proceedings in multiple jurisdictions following the operation of a cement facility in northern Syria during the Syrian conflict. The company completed construction of a plant in Jalabiya in 2010, at a reported cost of approximately USD 680 million. When the conflict intensified in 2011, and armed groups gained control of surrounding territories, most multinational companies withdrew from the region. Lafarge did not.

Investigations later established that the company had authorized payments of approximately EUR 5.6 million to armed factions, including ISIS and Jabhat al-Nusra, through intermediaries. These payments were framed internally as necessary to maintain operational continuity. They were later characterized by prosecutors as material financial support to designated terrorist organizations

The legal consequences were substantial. In the United States, Lafarge entered a guilty plea and agreed to pay approximately USD 778 million in criminal penalties and forfeiture. In France, the company and several former senior executives faced criminal prosecution. The former Chief Executive Officer was sentenced to six years’ imprisonment; other senior figures received custodial sentences ranging from approximately 18 months to seven years. Critically, courts focused not only on the payments themselves, but on the internal decision-making structures that allowed operations to continue as risk escalated.

For boards and senior executives operating in or through complex markets, the Lafarge case is not a foreign cautionary tale. Its lessons are directly applicable under Saudi law.

MANAGEMENT LIABILITY UNDER SAUDI COMPANIES LAW

Under the Saudi Companies Law, directors and managers may be held personally liable for damages arising from violations of law, breaches of company bylaws, misuse of authority, or negligent management. This liability is not limited to deliberate misconduct. Failure to exercise reasonable care, properly assess emerging risks, or implement appropriate safeguards may itself give rise to personal exposure.

The key governance question that courts in the Lafarge proceedings kept returning to was not whether risk existed. It was whether leadership responded appropriately when warning signs began to emerge. That framing maps directly onto the standards applicable to directors and managers under Saudi law.

Joint Liability and the Record of Dissent

Where multiple directors participate in decisions that result in violations of law or mismanagement, Saudi law recognizes that liability may attach jointly to all members who approved or failed to object to those decisions. This principle applies with particular force where risk escalates gradually. In such circumstances, responsibility rarely rests with a single individual. It arises from a series of collective decisions that allow an organization to continue operating under increasingly uncertain conditions. One of the most critical protections available to a director under Saudi law is the formal recording of dissent. A director who disagrees with a proposed course of action must ensure that the objection is clearly documented in the board minutes. Failure to do so risks liability being attributed collectively, regardless of any private reservations expressed outside formal proceedings.

The Lafarge judgments reflect precisely this dynamic. Courts did not focus solely on the individuals who authorized individual payments. They examined the broader leadership structures that allowed continued engagement in a high-risk environment without sufficient escalation, challenge, or intervention.

Liability After Leaving Office

One of the most underestimated exposures under Saudi corporate law is the continuation of liability after an individual leaves office. Under Articles 29 and 30 of the Saudi Companies Law, directors and managers remain accountable for decisions made during their tenure, even after their resignation or replacement. Liability claims may generally be brought within 5 years from the end of the financial year in which the wrongful act occurred, or from the date of termination of the appointment, whichever is later. In cases involving fraud or forgery, limitation periods may extend further.

Resignation does not extinguish responsibility for past conduct. Decisions made during periods of elevated operational risk, particularly those involving reliance on third-party intermediaries or regulatory exposure, may remain legally reviewable long after roles and responsibilities have changed.

TERRORISM FINANCING EXPOSURE UNDER SAUDI LAW

The Lafarge case raises a dimension of risk that goes beyond the governance and corporate liability framework. It sits squarely within the scope of terrorism financing law, and the Saudi legal framework in this area is both broad and robust.

Under Saudi anti-terrorism legislation, terrorism financing is not limited to deliberate or knowing support for unlawful groups. It encompasses a wide range of conduct involving the provision of funds, assets, or other economic resources, whether directly or indirectly, to designated or prohibited entities. Transactions that appear operational in nature, payments for transportation, security, local logistics, or supply chain continuity, may later be interpreted as unlawful financing if the recipient is linked to prohibited entities or if appropriate due diligence was not conducted.

Direct and Indirect Financing Risk

Saudi anti-terrorism legislation adopts a broad definition of terrorism financing that includes provision through intermediaries, contractors, or agents. Indirect financing is not treated as a lesser category of exposure. Where funds ultimately benefit prohibited actors, responsibility may extend to the original decision-makers who authorized the transactions, regardless of the layers of commercial relationship through which those funds passed.

This creates a heightened compliance obligation for companies operating in complex or high-risk environments. The question is not simply who received payment, but how funds were ultimately used, and whether the organization conducted meaningful due diligence before authorizing the transaction and continued to monitor its counterparty relationships thereafter.

Corporate Criminal Liability

Saudi law expressly recognizes corporate criminal liability in terrorism financing matters. Under Article 49 of the Law on Combating Terrorism Crimes and Financing (Royal Decree No. M/21 dated 12/02/1439H), a legal entity may be held liable where a terrorism financing offence is committed by its owners, directors, managers, representatives, or agents in its name or for its benefit.

Sanctions available against corporate entities include financial penalties, suspension of activities, closure of relevant premises, liquidation of the entity, appointment of a judicial custodian, and publication of the judgment. Corporate structure does not provide a shield. Where leadership decisions permit unlawful financial flows or where oversight of third-party relationships is inadequate, the organization itself is exposed.

GOVERNANCE AS A LEGAL OBLIGATION, NOT A BEST PRACTICE

One of the most important lessons from the Lafarge proceedings is that legal exposure rarely begins with a single unlawful act. It develops gradually through governance failures that allow risk to accumulate without decisive intervention. In Lafarge’s case, the escalation from commercial pressure to criminal liability unfolded over an extended period during which warning signs were present, discussions occurred, and decisions to continue operating were repeatedly taken.

Saudi corporate governance expectations have developed considerably in recent years. Boards and senior management are expected not only to review performance metrics but to identify emerging legal risks and respond with appropriate caution. The standard is proactive oversight, not reactive response.

Board minutes, internal memoranda, and escalation records frequently determine how leadership decisions are interpreted under legal scrutiny. In the absence of documented deliberation, decision-making may appear careless even where genuine concerns were discussed informally. The governance record matters, both as a protective mechanism for directors who exercised appropriate judgment and as evidence in proceedings where they did not.

PRACTICAL TAKEAWAYS FOR BOARDS AND SENIOR MANAGEMENT

The Lafarge case demonstrates that exposure does not necessarily arise from deliberate support for unlawful actors. It arises from operational decisions taken under commercial pressure that gradually evolve into legally significant risk. Companies operating in complex or cross-border environments should consider the following governance priorities:

  • Establish formal risk escalation thresholds, supported by legal review, that require reassessment when operational, regulatory, or geopolitical conditions change materially.
  • Strengthen compliance oversight of contractors, intermediaries, and third-party relationships through periodic legal due diligence and risk-based monitoring, including monitoring of how funds are ultimately deployed.
  • Document board deliberations and dissent. Legal advisors should be engaged in reviewing decisions with regulatory or reputational implications, not consulted only after operational decisions have been made.
  • Reassess ongoing operations when risk indicators evolve, particularly where external developments may affect regulatory compliance or expose the company to sanctions or prohibited dealings.
  • Integrate legal and compliance functions into strategic decision-making from the outset, rather than treating them as a sign-off mechanism at the end of the process.
  • Operate on the assumption that major operational decisions may be reviewed retrospectively. Legal advice and risk analysis should be documented as a matter of course, not assembled after the fact.

These measures do not eliminate risk entirely. However, organizations that engage legal advisors proactively, rather than reactively, are significantly better positioned to withstand regulatory scrutiny, manage emerging exposure, and respond effectively if enforcement action arises.

Legal Challenges and Innovations in Automotive Supply Chain Management

Legal Challenges and Innovations in Automotive Supply Chain Management

Automotive supply chain management has become one of the most legally complex areas of modern industrial operations. As global production networks extend across multiple jurisdictions, legal frameworks struggle to keep pace with commercial realities shaped by geopolitical shifts, digital transformation, sustainability requirements, and changing consumer expectations. Manufacturers, parts suppliers, logistics providers and distributors must navigate a range of legal challenges that affect how vehicles and components are sourced, produced, transported and sold. At the same time, innovations in contractual design, compliance systems and supply chain technology are helping businesses manage risk, meet legal obligations, and build resilient operations for the future.

 

One of the core legal challenges in automotive supply chains relates to contract governance and risk allocation. Traditional supply agreements are increasingly tested by volatility in material costs, fluctuations in shipping capacity, and unpredictable disruptions such as plant closures or regulatory changes. As a result, businesses are revising standard contractual provisions to provide greater clarity on responsibility for delays, shortages, and variations in production conditions. Well-drafted clauses on price adjustment, delivery obligations, and rights in the event of non-performance are now fundamental to sustainable supply chain relationships. Legal advisors focus on ensuring that contractual terms allocate risk in a way that balances commercial fairness with enforceability in courts or arbitration.

Regulatory compliance is another significant legal focus. Automotive products must meet safety, environmental, data protection, and trade standards set by authorities in the regions where they are sold. Differences between regulatory regimes in Europe, North America and Asia create compliance burdens for multinational manufacturers and their suppliers. For example, legal requirements on chemical components, emissions testing, and recycling obligations vary by jurisdiction and evolve frequently. To avoid penalties, recalls, and reputational damage, businesses are developing comprehensive compliance programmes that span internal audits, third-party monitoring, and advanced reporting systems. Legal teams play a vital role in tracking regulatory updates and integrating them into operational practices.

Trade and tariff issues add another layer of complexity. The automotive industry depends heavily on cross-border trade for parts and components. Changes in free trade agreements, tariff schedules, and customs procedures can materially affect cost structures and supply decisions. Legal specialists advise on preferential trade regimes, rules of origin, and customs classifications to optimise duty savings while ensuring compliance with international law. They also provide guidance on compliance with export controls and sanctions regimes, particularly when suppliers operate in regions affected by geopolitical tensions or evolving regulatory scrutiny.

Intellectual property law is increasingly important as the automotive sector embraces digitalisation. Modern vehicles incorporate advanced software systems, connectivity features and data processing capabilities. Collaborations with software developers and technology partners raise questions about ownership of intellectual property, licensing terms and protection against unauthorised use. Clear legal frameworks are necessary to safeguard proprietary innovations while enabling ecosystem collaboration. Agreements must address confidentiality, data rights and rights in inventions to support innovation and protect commercial interests.

Sustainability and environmental regulation have emerged as major drivers of legal change in automotive supply chain management. Governments and regulatory authorities are imposing standards on carbon emissions, resource efficiency, and waste management, requiring companies to reconfigure their supply chains to meet environmental goals. Legal teams support compliance with environmental due diligence obligations, extended producer responsibility frameworks and carbon reporting requirements. In parallel, contractual mechanisms that incentivise environmental performance among suppliers are becoming more common, reflecting the industry’s focus on sustainable sourcing and green procurement practices.

Another area where legal innovation is intersecting with supply chain management is digitalisation. Technologies such as blockchain, Internet of Things tracking, automated contract platforms, and predictive analytics provide greater visibility and operational control over supply chains. These tools raise legal issues concerning data protection, cybersecurity and jurisdictional control of information flows. Organisations must establish robust legal frameworks to govern data ownership, consent mechanisms, cross-border data transfers and liability for automated decision-making. Legal teams work closely with technology and operations functions to create governance structures that support both innovation and compliance.

Dispute resolution remains a critical legal challenge in automotive supply chains, particularly given the international nature of supplier networks and the potential for disagreements over quality, delivery or payment terms. Many organisations prefer alternative dispute resolution mechanisms such as arbitration or mediation, which offer neutrality and enforceability across jurisdictions. Effective dispute resolution provisions in contracts can preserve commercial relationships and provide structured pathways to resolve disagreements, minimising disruption to operations.

In response to these multifaceted challenges, the industry is developing innovative legal and commercial solutions. Standardised contracting templates, digital contract management systems and collaborative compliance platforms are gaining traction as tools to streamline legal processes and reduce friction. Cross-functional risk committees and integrated compliance frameworks help organisations identify and address legal issues earlier in the supply chain planning process. By embracing legal innovation, automotive companies are better equipped to manage risk, strengthen supply chain resilience and capitalise on opportunities in a rapidly changing global market.

Automotive supply chain management presents a broad spectrum of legal challenges that require careful navigation. From contract governance and regulatory compliance to intellectual property protection, trade issues, sustainability obligations, digital transformation and dispute resolution, effective legal strategies are central to operational success. By adopting innovative legal practices and technology-enabled solutions, businesses can enhance supply chain agility, protect value and build competitive advantage in a dynamic global environment.