KSA Company Compliance Obligations: What Finance Teams Should Track in the First 90 Days

Executive summary

• A Saudi company can be legally set up but still lack a controlled compliance workflow.
• The first 90 days should define which obligations apply, who owns them, which portals matter, and what evidence is ready.
• Finance should use this period to run an “audit before the audit”: checking whether tax, payroll, labour, entity, and reporting records are complete before deadlines or reviews arrive.
• Kudwa helps finance teams keep company, tax, payroll, cash, reporting, and entity context visible in one place, with AI-assisted reminders and finance-ready visibility across the systems they already use.

A new Saudi company can complete setup, open a bank account, issue invoices, hire employees, and start operating before anyone has one clear view of compliance.

The accountant may be handling ZATCA. HR may be watching GOSI, Mudad, and Qiwa. The founder may be tracking commercial registration and licence items. An external advisor may know whether Zakat, corporate income tax, VAT, or MISA requirements apply.

Each owner may be doing their part. The finance problem starts when nobody can answer one simple question: are we ready if someone asks for proof?

That is where KSA company compliance obligations need to become a finance control process, not only a legal setup checklist. In the first 90 days, finance should not wait for a filing deadline, audit request, portal issue, or advisor follow-up to discover what is missing. It should build the control view early.

Why the first 90 days create risk

The first 90 days are risky because compliance starts before the company has a mature operating rhythm. The business may still be finalizing vendors, hiring employees, setting up accounting, choosing payroll tools, connecting bank accounts, and assigning internal owners.

At the same time, KSA obligations can sit across several systems and authorities. ZATCA covers tax and e-invoicing. GOSI relates to social insurance. Mudad supports wage protection. Qiwa is central to labour and establishment management. Nitaqat affects Saudization classification. Foreign-owned businesses may also have MISA registration or update requirements.

The issue is not only missing a deadline. The issue is fragmented ownership and fragmented evidence. Finance may know that a VAT return is coming, but not whether invoice data is ready. HR may know payroll was paid, but finance may not have clean payroll cost allocation. The company may have a Qiwa or Mudad status item, but no one has connected it to cash planning, reporting, or monthly review.

That is why finance should build a simple readiness view early: what applies, who owns it, what evidence exists, what is missing, and what needs follow-up.

Which KSA obligations may apply

Not every Saudi company has the same compliance profile. The right starting point is to identify the company type, ownership structure, VAT status, employee base, sector, fiscal year-end, and whether the business is locally owned or foreign-owned.

The main areas finance should check include:

ZATCA registration and tax profile.
Finance should confirm whether the company is subject to Zakat, corporate income tax, or both, depending on ownership and tax profile. The team should also track the fiscal year-end, annual return timing, advisor ownership, and supporting schedules.

VAT.
If the business is VAT-registered, finance needs to know the filing frequency, tax period, invoice readiness, return owner, and payment process. VAT should not be reviewed only at filing time; it depends on clean sales, purchases, credit notes, and tax coding during the month.

E-invoicing / Fatoora.
KSA e-invoicing is already in force, with Phase 2 integration rolling out in waves. Finance should know whether the company is already integrated, waiting for a ZATCA wave notice, or relying on an accounting or ERP setup that still needs validation.

GOSI.
If the company has employees, GOSI-related data should be part of the monthly payroll control process. Finance needs visibility into payroll cost, employer contributions, employee changes, and whether payroll records align with reporting.

Mudad / wage protection.
Wage protection is not only an HR portal issue. It affects payroll timing, cash planning, employee records, bank payments, and evidence that salaries were paid correctly.

Qiwa and labour compliance.
Qiwa matters for establishment management, work-related services, contracts, permits, and compliance status. Finance should know who reviews it and whether any issue could affect hiring, payroll, operations, or forecast assumptions.

Nitaqat / Saudization.
Nitaqat classification depends on the company’s workforce profile and activity. It should be reviewed when hiring plans change, not only when a problem appears.

MISA items for foreign-owned companies.
Foreign-owned businesses may need to track MISA registration, annual updates, licence conditions, and investor data changes. These should be assigned clearly between legal, the founder, advisor, and finance.

Commercial registration, municipal, and sector licence items.
Some obligations depend on the company’s activity and location. Finance should keep these in the calendar even if legal or operations owns the renewal.

The “audit before the audit” view finance should build

The first 90 days should create a readiness view that finance can check at any point.

This does not mean Kudwa replaces an auditor, tax advisor, HR team, or legal owner. It means finance should be able to see whether the company is prepared before a deadline, review, filing, or audit request arrives.

A useful readiness view should show:

• which obligations apply
• who owns each obligation
• which portal or authority is involved
• what evidence exists
• what evidence is missing
• what deadline or review date is coming
• what has changed since last month
• what needs finance, HR, legal, founder, or advisor follow-up

This is where Kudwa can sit closer to the workflow. Finance teams can use Kudwa to keep company, payroll, tax, cash, entity, and reporting context visible across connected systems and files. Instead of checking scattered portals, inboxes, spreadsheets, and bank records manually every time, finance can work from one controlled view of what is ready, what needs review, and what still needs cleanup.

Kudwa also helps by making reminders part of the operating rhythm. The point is not to wait until a deadline is close. The point is to surface what needs attention early, so finance can prepare before the audit, filing, or management question arrives.

First 90-day checklist for finance

In the first 90 days, finance should create a basic compliance control view.

Start with the company profile. Confirm the legal entity, ownership structure, fiscal year-end, VAT status, employee count, activity, sector, and whether the company is foreign-owned.

Then map the main portals. At minimum, the team should know who has access to ZATCA, GOSI, Mudad, Qiwa, MISA if relevant, and commercial registration or licence portals.

Next, assign an owner for each obligation. The owner may be finance, HR, legal, founder, PRO, or external advisor. What matters is that no obligation is left as “someone is handling it.”

Finance should also define evidence location. Returns, payment confirmations, payroll files, portal screenshots, GOSI records, wage protection files, licence documents, advisor submissions, and bank payment records should not sit across personal inboxes.

Finally, set a review rhythm. Finance should look ahead 30, 60, and 90 days and ask: what is due, what changed, what evidence is missing, which item needs cleanup, and which owner needs follow-up?

Who should own each obligation

Finance should not become the owner of every KSA compliance task. That creates a different problem. Instead, finance should make ownership visible and make readiness review repeatable.

Tax and VAT may sit with finance and the tax advisor. Payroll, GOSI, Mudad, and Qiwa may sit with HR, with finance reviewing the cost, payment, and reporting impact. Nitaqat may sit between HR, management, and operations. MISA and licence items may sit with legal, founder, or PRO support. ZATCA e-invoicing may require finance, accounting, and system ownership together.

The useful finance role is coordination and visibility. Finance needs to know which obligations affect cash, reporting, payroll, tax, or entity status. It also needs to know whether the company has the evidence needed to prove that the obligation was handled.

Where Kudwa fits

Kudwa does not manage KSA compliance filings or replace tax, legal, HR, PRO, or audit advisors.

Its role is to help finance teams manage the layer around those obligations: the data, evidence, reminders, ownership, payments, reporting impact, and entity context. That matters when obligations are spread across ZATCA, payroll tools, bank records, accounting systems, spreadsheets, HR systems, advisors, and operating files.

With Kudwa, finance can move from scattered compliance follow-up to a clearer readiness process. The team can see which data is in place, what still needs cleanup, which owner needs to act, and how compliance-related items affect reporting, cash, payroll, and management visibility.

The practical value is simple: when a filing, audit request, or management question arrives, finance should not start by searching through inboxes and spreadsheets. It should already have the control view.

Practical takeaway

KSA compliance should not be treated as a list that only gets checked near deadlines. For a new Saudi company, the first 90 days should create the operating rhythm: what applies, who owns it, where the evidence lives, what needs cleanup, and when finance reviews it.

The goal is not to turn finance into the legal department. The goal is to help finance run an audit before the audit, so ZATCA, VAT, e-invoicing, payroll, labour, Nitaqat, MISA, and licence obligations are visible before they become urgent.

Use the KSA Compliance Calendar to track fixed deadlines, recurring obligations, company-specific compliance items, owner status, evidence, and AI-assisted reminders in one place.

‍