Anti-Bribery and AML Compliance in Saudi Arabia: Building the Programme

How Saudi anti-bribery and anti-money laundering rules apply to a foreign-owned company, and the stages of a compliance programme that holds up under scrutiny.

Saudi Arabia's Anti-Bribery Law criminalises bribery of public officials and, since amendments, bribery in the private sector, and the Oversight and Anti-Corruption Authority (Nazaha) investigates corruption actively. The Anti-Money Laundering Law of 2017 sets obligations for financial institutions and designated non-financial businesses, with the Saudi Financial Intelligence Unit receiving suspicious transaction reports. A foreign-owned company also carries its home-country rules, so the programme has to satisfy both.

Before stage one

Start by locating the risk. For most foreign companies it sits in three places: dealings with government entities for licences, permits and contracts; third parties such as agents, consultants and government relations providers who act on the company's behalf; and payment flows that are unusual for the business. A programme built around these points is more useful than a generic policy manual.

• A list of government touchpoints: licences, inspections, customs, tenders.
• A register of agents, consultants and intermediaries and how they are paid.
• The group anti-bribery and AML policies, and the home-country laws they respond to.
• Whether the Saudi entity is itself a regulated or designated business under the AML Law, for example in real estate brokerage or precious metals.
• A named compliance owner in the Kingdom with authority to stop a transaction.

Stage 1: Risk assessment

Assess where bribery and money laundering could arise in the Saudi business, by activity, counterparty and payment type. Consider facilitation payments, gifts and hospitality around government interactions, commissions to intermediaries and cash transactions.

• Deliverable: A written risk assessment with ranked risks.
• Owner: Compliance owner with management.
• Approval gate: Board or senior management reviews and accepts the assessment.

Stage 2: Local policy and controls

Adapt group policies to Saudi law: a clear prohibition of bribery in public and private dealings, rules on gifts and hospitality with approval limits, and a ban on payments to officials to speed up routine services. Translate key policies into Arabic for local staff.

• Deliverable: Saudi-specific policies approved and published.
• Owner: Compliance with legal.
• Approval gate: Policies reviewed by a Saudi-licensed lawyer.

Stage 3: Third-party due diligence

Screen agents, consultants, distributors and joint venture partners before engaging them: ownership, links to officials, reputation, and whether their fees match the services. Include anti-bribery clauses, audit rights and termination rights in contracts.

• Deliverable: Due diligence files and compliant contract clauses.
• Owner: Procurement with compliance.
• Approval gate: No intermediary paid before due diligence is signed off.

Stage 4: Payment controls

Require documentation and approval for payments to intermediaries, unusual payment routes and cash. Payments to accounts in third countries or in the names of individuals should trigger review.

• Deliverable: Payment approval rules configured in finance systems.
• Owner: Finance manager.
• Approval gate: Exceptions reported to the compliance owner monthly.

Stage 5: AML obligations where applicable

If the Saudi entity is a designated business, apply customer due diligence, beneficial ownership checks, record keeping, sanctions screening and reporting of suspicious transactions to the Financial Intelligence Unit, following the supervisor's rules for the sector.

• Deliverable: AML procedures and a reporting channel.
• Owner: Designated compliance officer.
• Approval gate: Procedures confirmed against the sector supervisor's guidance.

Stage 6: Training and reporting channels

Train staff who deal with officials and third parties, in Arabic and English, and provide a confidential channel to report concerns. Nazaha also runs public reporting channels, and whistleblower protections exist under Saudi law.

• Deliverable: Training records and a published reporting channel.
• Owner: HR and compliance.
• Approval gate: All high-risk roles trained before they deal with officials.

Stage 7: Monitoring and response

Test controls through periodic reviews of payments, gifts registers and intermediary files, investigate reported concerns and decide on self-reporting with legal advice when a problem is found.

• Deliverable: Annual compliance review and investigation log.
• Owner: Compliance owner.
• Approval gate: Findings reported to the board with actions and owners.

Handovers between stages

The weakest point is the handover from the commercial team, which wants a licence or contract quickly, to finance, which pays the consultant who promised it. If finance pays without asking what the fee is for, the company has outsourced its bribery risk. Every intermediary payment should carry a description of the service delivered.

How you know it is finished

The programme is working when risks are assessed, Saudi-specific policies are in place and understood, intermediaries are screened and contracted properly, payment controls catch exceptions, AML obligations are met where they apply, and concerns are investigated. Because penalties are severe and enforcement active, have a Saudi-licensed lawyer review the programme and any incident.

Domira works with foreign investors on the property side of entering Saudi Arabia: finding land or premises, due diligence, design, construction and asset management. For licensing, tax and legal steps, work with a licensed adviser; we coordinate with yours so the property decision fits the structure you choose.