Beneficial ownership in Saudi Arabia: the 2025 rules in plain words

Key takeaways

• The Ministry of Commerce's Beneficial Owner Rules took effect on 4 January 2026. Minister of Commerce Decision No. (99) of 26 November 2025 issued them, and they replaced the first rules from 2025 [1][2][3].
• They apply to every company under the Companies Law, except joint stock companies listed on the market [1].
• A beneficial owner is always a natural person. Three tests apply in order: 25% or more of the capital, directly or indirectly; effective control by other means; and, as a last resort, the director, a board member or the chairman [1].
• A company keeps a register, files any change within 15 days and confirms its data every year [1].
• A CMA-licensed firm still verifies the beneficial owners of every company client itself [5][7].

The short answer

Every company under the Companies Law must know its beneficial owners, record them and report them to the Ministry of Commerce [1]. A beneficial owner is a person, never a company. The first test is ownership: 25% or more of the capital, held directly or through other companies. If no one passes it, or there is doubt, the test is control by other means. If that finds no one, the director, a board member or the chairman counts as the beneficial owner [1]. For a CMA-licensed firm, the company's filing is a starting point, not the end of its own checks [5][7].

The rules and their dates

The Minister of Commerce issued the Beneficial Owner Rules by Decision No. (99) dated 05/06/1447 AH, which is 26 November 2025 [1][2]. They were published in Umm Al-Qura on 5 December 2025 and took effect 30 days later, on 4 January 2026 [1][3]. They are issued under Article 274 of the Companies Law [1].

They replace the first rules, Ministerial Decision No. (235) dated 13/8/1446 AH, which took effect on 3 April 2025 [1][4].

Who the rules cover

The rules apply to companies subject to the Companies Law. Joint stock companies listed on the market are outside them [1].

A subsidiary of a listed company that is itself subject to beneficial-owner disclosure does not disclose its beneficial owners. It must give the Ministry evidence of this exemption [1].

The first rules also exempted state-owned companies and companies in bankruptcy [4]. The new rules do not name them, and BCLP reads the exemptions as now limited to subsidiaries of listed companies [3].

A partner or shareholder who acts for someone else, as a nominee, must declare that person to the company within 15 days [1].

The three tests

Article 4 of the rules sets three tests. They apply in order. Each test applies only when the one before it finds no one, or leaves doubt [1].

1. Ownership. A natural person who owns at least 25% of the company's capital, directly or indirectly, is a beneficial owner [1].
2. Control. If no one reaches 25%, or there is doubt that the person who does is the real beneficial owner, the test is control. The beneficial owner is any natural person who has ultimate effective control over the company by any means other than owning capital, directly or indirectly [1].
3. The fallback. If neither test finds anyone, the company's director, a member of its board or its chairman, as applicable, is the beneficial owner [1].

Two points matter in practice. Exactly 25% counts, because the rules say "at least" 25% [1]. And voting rights and the power to appoint the leadership, separate tests in the first rules [4], now fall under the control test [1].

Counting indirect ownership

The rules say "directly or indirectly" but do not say how to count holdings through other companies. The Ministry is to publish a guiding manual on how companies identify their beneficial owners [1].

For CMA-licensed firms, the CMA's supervisory guidance on beneficial ownership gives a method [5]:

• Multiply down each chain. A person who owns 50% of a company that owns 100% of the client holds 50% of the client indirectly (100% × 50%) [5].
• Add every holding of the same person. Direct and indirect holdings are added together. Holdings that are below 25% on their own can pass 25% together. The guidance's own example reaches 26% this way [5].

Here is a worked example with made-up names and numbers. It follows the CMA's method.

In the example, Holding Co. owns 60% of the client. Person A owns 60% of Holding Co., so A holds 36% of the client (60% × 60%) and is a beneficial owner. Person B owns 20% of the client directly and 40% of Holding Co., so B's indirect holding is 24% (40% × 60%). Neither part reaches 25% on its own, but together B holds 44% and is a beneficial owner too. Person C owns 20% directly and nothing else, so C does not pass the ownership test. C can still be a beneficial owner through control. Holding Co. itself is never the answer: a company in the chain is looked through to the people behind it.

What the company must do

Article 5 of the rules sets the company's duties [1]:

• At incorporation. The application to set up a company includes its beneficial-owner data [1].
• Companies that already existed. They disclose their beneficial owners by their first annual confirmation date after the rules took effect [1].
• Get and verify the data. Obtain sufficient, accurate and current data, and verify it with risk-based measures and documents from a reliable, independent source [1].
• Keep a register. Keep a beneficial-owner register with supporting documents at the head office in the Kingdom, and record every change [1].
• File changes within 15 days. Send the Ministry any change within 15 days, with the reasons [1]. Filings go through the company's Saudi Business Center account [3].
• Confirm every year. Confirm the data once a year. The due date is one year from the company's registration in the Commercial Register, and the confirmation can be sent up to 30 days early [1].
• Answer financial institutions. Give the data, on request, to the financial institutions and designated non-financial businesses and professions that serve the company [1].

For each beneficial owner, the data includes the full name, nationality, date and place of birth, ID or passport details, address and contact details. It also records which test applies, with the nature and extent of the ownership or control [1]. The Ministry notifies each person declared in its register by phone or email [1].

Failures can lead to penalties under the Companies Law. The rules themselves set no amounts [2].

What a CMA-licensed firm checks

A company's filing does not replace a licensed firm's own due diligence. Before taking on a client or doing any securities business with or for it, a CMA-licensed firm must comply with the Anti-Money Laundering Law and its Implementing Regulation [6][8]. The regulation requires the firm to identify each client's beneficial owners and take reasonable measures to verify them, so that it is satisfied it knows who they are [7]. For a company client, the firm must also understand its ownership and control structure [7].

The 25% threshold reaches CMA firms through the Implementing Regulation of the Anti-Money Laundering Law, which the CMA's guidance quotes [5][7]. It uses the same three steps: ownership of 25% or more, then control by other means, then the senior managing official [7].

In practice, the firm:

• Asks for the register. The rules oblige the company to give its beneficial-owner data to a financial institution on request [1].
• Checks it against independent documents. The CMA's Investment Accounts Instructions give a guidance list of documents for a Saudi company's account, including the commercial register, the articles of association and a list of the directors and senior managers [8]. The CMA's beneficial ownership guidance asks for more sources as the structure gets more complex, such as shareholder and nominee agreements [5].
• Recalculates indirect holdings. It multiplies down each chain and adds each person's holdings [5].
• Checks who acts for the client. It checks that anyone acting for the client, such as an authorised signatory, has the authority to do so, and identifies and verifies that person [7][8].
• Verifies on time. It verifies the client and the beneficial owners before or during the start of the relationship. If it cannot complete due diligence, it does not open the account, or it ends an existing relationship, and it considers a suspicious transaction report [7].
• Keeps the data current. It reviews its records to keep them current, especially for higher-risk clients [5][7]. It asks clients to update their information on any change, on expiry or at the end of a period the firm sets by risk, whichever comes first, and it reviews the need to update at least once every five years [6][8]. It keeps due diligence records for at least ten years after the relationship ends [7].

How AIN covers each point

AIN is Dal's compliance platform. As described on getdal.sa, it maps to each point like this:

• The company record. Enter a Unified Number (700), and AIN fetches the business record from Wathq, Saudi Arabia's local registry, and verifies it in real time. Every Saudi legal entity type is covered.
• The tests. AIN detects UBOs by 25% ownership and by effective control. A person who controls the company without 25% ownership is still detected.
• Indirect ownership. The ownership structure unfolds through nested entities automatically, and effective ownership is calculated for each node.
• Screening. Every detected UBO is screened like any client, against 2,700+ watchlists, Nafith, Makken and adverse media. Their risk folds into the client's score.
• Keeping it current. KYB expiry management sends renewal alerts before records go stale.

Some duties stay with your people in any system: judging control when no one reaches 25%, checking documents against the register, and deciding when a gap needs a report.

To see how AIN traces a client's ownership, Book a Demo at getdal.sa.