By Tasawar Ulhaq, Founder, Incorporated. 12+ years of GCC market entry, on the ground in Riyadh. · Last updated: July 2026
Key Facts
| Compliance Lens | Typical Range / Position |
|---|---|
| Coverage model | A single compliance calendar per entity, plus event-driven work: renewals, amendments, audits, inspections. |
| High-impact risks | Lapsed CR or trade licence, missed GOSI or VAT deadlines, and portal access lost when a key employee leaves. |
| Operating cadence | We track weekly and report to the client monthly. Anything urgent gets flagged the day we see it. |
| Best fit | Foreign-owned entities in KSA and the UAE without a full-time in-country compliance hire. |
Compliance is an Operating System, Not a Reminder
Here is what we have learned running compliance for foreign-owned entities in Riyadh and Dubai: the filings themselves are rarely hard. What hurts companies is that every deadline lives in a different portal, under a different login, often tied to one employee's government ID. Renewal dates do not email you. The first sign of trouble is usually a bank transfer that will not go through or a work permit that will not issue. Our job is to know your dates before they matter and to hold the evidence for every filing in one place. See our Saudi guides on accounting software, anti-bribery compliance, commercial agency law, corporate banking, and profit repatriation.
Reduce penalties
Avoid renewals lapses, filing delays, and silent non-compliance risks.
Protect operations
Maintain “good standing” so banking, visas, and contracting stay smooth.
Stay audit-ready
Centralize filings and evidence with an executive-level dashboard approach.
Built for founders, CFOs, and operators who need predictable execution and clear accountability.
What Our Compliance Services Cover
Four workstreams, one calendar. We deliberately keep corporate renewals, government relations, HR and tax under one roof because in practice they block each other. You cannot renew a work permit if the CR has lapsed, and you cannot fix the CR quickly if nobody holds the portal credentials. Splitting these across three vendors is how deadlines get dropped.
Renewals & Amendments
- CR and trade licence renewals, started 60 days out, never in the final week
- Corporate changes: shareholders, managers, activities, addresses
- Amendment sequencing so the bank, MISA and the Ministry of Commerce stay aligned
- Every certificate and receipt archived the day it is issued
Government Relations (GRO/PRO)
- Portal work done under controlled, documented access, not shared passwords
- Chasing stuck applications, which is half the real job
- Document submissions and attestation tracking end to end
- Someone on the ground who answers when a ministry asks a question
HR & Immigration Compliance
- Iqama and visa renewals tracked from 90 days before expiry
- Qiwa, GOSI and Mudad kept consistent with the actual payroll
- Employment contracts registered, not just signed
- Onboarding runs that do not stall on a missing medical or insurance step
Tax & VAT Coordination
- VAT registrations and filing deadlines managed with ZATCA and the FTA
- Inputs collected from your bookkeeper on a fixed monthly rhythm
- Evidence packs ready before an audit letter arrives, not after
- Specialist tax advisers brought in for rulings and disputes when needed
Compliance in Saudi Arabia
A foreign-owned Saudi entity answers to at least six government platforms, and they talk to each other more than people expect. Let GOSI drift out of line with Qiwa and your Saudization band drops, which blocks new work permits. Let the CR lapse and the bank freezes outgoing payments the same week. The pattern in every rescue job we have taken on is the same: nobody owned the calendar.
Typical Saudi compliance touchpoints
- CR renewal and amendments with the Ministry of Commerce, plus chamber membership
- MISA registration renewal for foreign-owned entities
- Iqama renewals through Muqeem, tracked well before expiry because dependents' renewals follow the sponsor's
- Qiwa contract registration and Saudization (Nitaqat) band monitoring
- GOSI wage files kept consistent with contracts, since mismatches surface during inspections
- ZATCA VAT filings, monthly or quarterly depending on turnover, and Zakat or income tax returns
Our position on this is simple. In Saudi Arabia the compliance calendar is the company. We keep one calendar per entity, reconcile it against the portals monthly, and start every renewal 60 days early because government processing time is the one variable nobody controls.
Compliance in Dubai
Dubai is lighter than Saudi Arabia day to day, but it punishes neglect just as hard. The trade licence, the immigration establishment card and the office lease renew on separate dates, and each one can block the others. Corporate tax changed the game too: since registration became mandatory, we have seen companies collect AED 10,000 penalties simply for registering late with the FTA.
Typical Dubai compliance touchpoints
- Trade licence renewal, which needs a valid lease (Ejari on mainland) before it will process
- Immigration card and visa renewals for every sponsored employee
- Corporate tax registration and the 9% return, due nine months after the financial year ends
- VAT filings at 5% for registered entities
- Amendments for shareholders, managers, activities and office moves
- Bank KYC refreshes, which arrive on the bank's schedule, not yours
Free zone or mainland changes who you file with, not whether you file. We run both on the same calendar model we use in Riyadh, and we keep the licence, lease and immigration dates deliberately staggered so one late document never takes down all three.
Retainers & engagement models
We work on retainer because compliance is a rhythm, not a project. One-off fixes are how companies end up calling us twice. Three tiers, and we will tell you honestly which one you need. A two-person entity does not need Scale & Governance.
Essentials
For small entities that mainly need the dates watched and renewals filed on time.
- Full renewals calendar, built from your actual registrations
- Deadline tracking with early warnings
- Renewal execution as dates fall due
Operations
For trading entities with staff, where portals and amendments need hands-on work every month.
- Portal execution across Qiwa, GOSI, ZATCA and their UAE equivalents
- Corporate amendments run end to end
- Monthly status report your CFO can forward to the board
Scale & Governance
For groups holding several entities across KSA and the UAE with real audit exposure.
- Consolidated multi-entity calendar and evidence packs
- HR and payroll compliance kept audit-ready
- Priority handling when something urgent lands
Need a tailored compliance retainer?
We will map your structure, platforms, renewals, and HR dependencies into a clear compliance calendar and execution plan.
Request a Retainer ProposalGCC connectivity & global expertise
Most of our clients hold more than one GCC entity, typically a Saudi LLC and a UAE company in the same group. The regimes look similar from a distance and behave differently up close: Saudi Arabia files VAT with ZATCA at 15%, the UAE with the FTA at 5%, and the wage protection, Saudization and corporate tax rules do not map onto each other at all. We standardise the process across entities, one calendar format, one evidence structure, one monthly report, while keeping the country-specific work with people who actually do it in that country.
How we deliver
- One compliance calendar per entity, reconciled against the portals monthly
- Evidence packs assembled at filing time, so an audit letter never starts a scramble
- A named owner for every deadline, on our side and yours
- Renewals started 60 days early as standard practice
FAQs
Do you support multi-entity structures? v
Yes, and it is most of what we do. The usual setup is a Saudi LLC plus one or two UAE entities in the same group. Each entity gets its own calendar, and the group gets one consolidated monthly report so the CFO is not chasing three different contacts for status.
Can you coordinate tax and VAT? v
We manage the registrations, the filing deadlines and the evidence, and we make sure your bookkeeper delivers inputs on a fixed rhythm. For technical tax questions, rulings or disputes, we bring in specialist advisers rather than pretending to be a tax firm. That honesty has saved clients real money.
What is needed to start? v
Your CR or trade licence, your current registrations, and portal access or the name of whoever holds it. Within the first two weeks we audit what exists, flag anything already overdue (there usually is something), and hand you the compliance calendar we will run from that point on.
Stay compliant. Stay operational.
Send us your CR or trade licence and we will tell you, usually within a week, what is current, what is drifting and what needs fixing now. No obligation on the review. Most clients stay because the calendar simply works.