The Companies Law issued by Royal Decree No. M/132 dated 1/12/1443H has raised the bar of obligations owed by companies operating in the Kingdom and by their managers. The law, which replaced the Companies Law issued by Royal Decree No. M/3 dated 28/1/1437H and took effect one hundred and eighty days after its publication in the Official Gazette, does more than organise company forms: it lays down a complete annual compliance cycle. Mandatory assembly meetings, financial statements and reports on fixed deadlines, external audit, deposit and shareholder-access duties, and then a full chapter on violations and penalties in which fines reach five million riyals and imprisonment three years for the gravest offences. This article maps that compliance cycle as it looks in practice for a board or a manager who wants to stay on the safe side of the law, from our office in Kuwait and in cooperation with our partners in Saudi Arabia.
The annual compliance cycle: assemblies and financial statements
The compliance year starts with the ordinary general assembly. Under Article 87, the ordinary general assembly of a joint stock company is competent for all matters relating to the company except those reserved to the extraordinary assembly, in particular: electing and removing board members; appointing one or more auditors, fixing their fees, reappointing and removing them; reviewing and discussing the board's report; reviewing and discussing the financial statements; discussing the auditor's report, if any, and deciding on it; deciding on the board's proposals for distributing dividends; and forming reserves. The annual ordinary general assembly meets at least once during the six months following the end of the financial year under Article 88, and further ordinary assemblies may be called whenever needed.
Parallel to this sits a strict documentary obligation: at the end of every financial year the board must prepare the financial statements and a report on the company's activity and financial position including the proposed method of distributing profits, place these documents at the auditor's disposal, if any, at least forty-five days before the date set for the annual assembly, and have them signed by the chairman of the board, the chief executive and the chief financial officer, if any, with copies deposited at the company's head office at the shareholders' disposal (Article 121). The chairman then provides the shareholders with them and deposits them under Article 122. Missing these deadlines is not a formal slip: it is a gateway to liability over the reports presented to partners and assemblies.
Day-to-day governance: what falls on the manager and the board
The law holds managers and board members accountable on two levels. The first is civil: the company may bring a liability action against them for breach of the law or of the memorandum or articles of association, or for errors, negligence or shortcomings in performing their work that cause the company damage (Article 29). The second is criminal: any manager, officer, board member, auditor or liquidator who deliberately records false or misleading data in the financial statements or in reports presented to partners or assemblies, or who uses the company's funds, his powers or his votes against its interests to achieve personal ends or favouritism, faces up to three years' imprisonment and a fine of five million riyals, or either penalty (Article 260). Article 261 punishes less grave offences with up to one year's imprisonment and a fine of up to one million riyals, or either, among them an auditor's failure to notify the company, through the organs or persons responsible for its management, of violations he discovers in the course of his work that appear to him to be criminal.
Governance of a vacant office in the limited liability company
The rules do not tolerate administrative vacuum: if a limited liability company has a single manager and the office falls vacant, the partners must appoint a new manager within fifteen days of learning of the vacancy, and the company's auditor, if any, or any partner may call the general assembly to meet and appoint a new manager. Neglecting this deadline leaves the company without a lawful representative and exposes its acts to challenge.
Electronic governance: procedures at a distance
The new law corrected an important rule for practical compliance: any of the procedures provided for in the law or the regulations may be electronic under paragraph 2 of Article 277, including filing applications to incorporate companies or amend their memoranda or articles, registration and publication procedures at the Commercial Register, signing incorporation applications, documents and company records, and depositing financial statements, among other procedures, while the regulations set the controls for using modern technology in notification, convocation of partner and shareholder meetings, and participation in deliberations and voting. This makes it easier for foreign groups to run the compliance of their Saudi entities remotely, while responsibility for the accuracy of what is filed electronically remains with the filer.
Registration, publication and continuous updating: compliance does not end at incorporation
Many companies treat Commercial Register recording as a one-off incorporation step, while the law makes it a continuing obligation. Every amendment of the memorandum or articles, and every change in management, capital or form, requires completing the registration and publication procedures, which the law permits to be completed electronically under paragraph 2 of Article 277. The failure here does not stop at an administrative violation: outdated register data reflects on the accuracy of what the company presents to authorities and counterparties, and becomes an avenue of accountability at the first dispute, transaction or financing request that reveals the gap between reality and the record.
The impact of non-compliance on transactions and financing
In mergers, acquisitions and financing rounds, compliance deadlines turn from internal obligations into pricing elements and closing conditions. Financial statements not deposited or not signed under Articles 121 and 122, assemblies not held within their six-month window, and management offices left vacant beyond the statutory period all surface in due diligence and open negotiation over warranties, indemnities or deferred closing. Worse, inaccurate reports presented to partners and assemblies can move from a commercial observation to a grave offence punishable by three years' imprisonment and a five-million-riyal fine under Article 260 where intent is established. Our advice is to remediate the compliance file before any transaction is announced, not during it.
The liability of the liquidator and the auditor
Those who conduct the post-decision phase are not immune. Article 260 names the liquidator expressly among those punishable for the grave offences, as it names the auditor. At the less grave level, an auditor who does not notify the company, through the organs or persons responsible for its management, of violations he discovers in the course of his work that appear to him to be criminal is punished with up to one year's imprisonment and a fine of up to one million riyals, or either, under Article 261. The practical rule is that the auditor is not a neutral witness over the statements but a party in the chain of responsibility, and his appointment, the scope of his mandate and the duration of his engagement are among the ordinary general assembly's own competences under Article 87.
Alternative sanctions and doubled penalties for repeat offences
Enforcement is not confined to prison and fines. The judicial authority may, in addition to the two penalties or instead of them, impose alternative sanctions: warning the person concerned, obliging him to take the steps necessary to avoid the offence or corrective steps to remedy its effects, obliging him to stop or refrain from the work that is the subject of the case, and barring him from membership of the board of a listed joint stock company (Article 264). In fixing the penalty, the gravity, circumstances, concomitants and effects of the offence are considered, and penalties are doubled on recidivism: an offender is a repeat offender if he commits the same offence for which a final judgment or decision of conviction was issued within three years (Article 263). The Public Prosecution is competent to investigate and prosecute the offences under Articles 260 and 261 (Article 265).
The enforcement triangle: the competent court, the violations committee and the securities committee
Article 266 distributes jurisdiction: the competent court hears and decides all civil and criminal claims and disputes arising from applying the law and the regulations and imposes the prescribed sanctions, except for joint stock companies listed on the capital market, where the Committee for the Resolution of Securities Disputes hears appeals from the Authority's decisions and all related claims and disputes. Alongside them, a committee is formed in the Ministry by decision of the Minister to consider violations (Article 267). The practical result is that a compliance file can move on three fronts at once: administrative, civil and criminal.
The annual compliance checklist we apply
From our office in Kuwait and in cooperation with our partners in Saudi Arabia, we review with our clients a complete compliance cycle: the assemblies calendar and the six-month and forty-five-day deadlines; the soundness of the board or management composition and the filling of vacancies; the signature chain of the financial statements, their deposit and their availability to shareholders; the appointment of the auditor and the scope of his mandate; voting minutes and the handling of conflicts of interest; the recording of amendments in the Commercial Register; and the criminal exposure of any inaccurate data or reports before they are filed. If your company is reviewing its compliance position under the new law, the team at Hind Bin Al Sheikh & Partners can help you build a documented compliance cycle that stands before the court, the committee and the prosecution together.
See also: our corporate and commercial law services in Saudi Arabia, company formation in Saudi Arabia for foreign investors and dispute resolution in Saudi Arabia.
Frequently asked questions
When must the annual ordinary general assembly be held?
At least once during the six months following the end of the company's financial year, and further ordinary general assemblies may be called whenever needed.
What is the deadline for delivering the financial statements to the auditor?
The financial statements and the activity and financial-position report must be placed at the auditor's disposal, if any, at least forty-five days before the date set for the annual ordinary general assembly, signed by the chairman of the board, the chief executive and the chief financial officer, if any.
Is a manager personally punished for false data in the financial statements?
Yes. Deliberately recording false or misleading data in the financial statements or in reports presented to partners or assemblies, or omitting a material fact to present the financial position untruthfully, is among the grave offences punishable by up to three years' imprisonment and a fine of five million riyals, or either.
Can company procedures be completed electronically?
Yes. The law permits incorporation and amendment applications, registration and publication, signing, the deposit of financial statements and other procedures to be electronic under paragraph 2 of Article 277, and the regulations govern electronic notification, deliberation and voting.
Who may bring the liability action against the manager or board members?
The company, by a decision of its partners, assembly or shareholders; and one or more partners or shareholders holding five percent of the capital may bring it if the company does not, provided the manager or board members are notified of the intention to sue at least fourteen days in advance and the action serves the company's interest, rests on a valid basis and is brought in good faith. A partner or shareholder also has his personal action where he suffers special damage.
What is the penalty for repeating a violation?
The prescribed penalties are doubled on recidivism, and an offender is treated as a repeat offender if he commits the same offence for which a final judgment or decision of conviction was issued within three years.
Do the sanctions extend to the liquidator and the auditor?
Yes. The law names the liquidator and the auditor expressly among the categories punishable for the grave offences, and an auditor who fails to notify the company, through the organs or persons responsible for its management, of violations he discovers in his work that appear criminal faces up to one year's imprisonment and a fine of up to one million riyals, or either.
What is the effect of neglecting to update the company's Commercial Register data?
Beyond being a violation, it opens accountability whenever a dispute or transaction reveals a gap between reality and the record; the law permits registration, publication and amendment procedures to be completed electronically, which removes any practical excuse for delay.