M&A Due Diligence in Saudi Arabia (2026): Step‑by‑step Checklist for Foreign Buyers

M&A due diligence Saudi Arabia has entered a new phase, and foreign buyers who treat the process as a box‑ticking exercise now expose themselves to real transactional risk. A wave of reforms, the Companies Law issued by Royal Decree No. M/132 of 1443H (in force since early 2023), updated Ministry of Investment (MISA) practice, refined Capital Market Authority (CMA) disclosure rules, and merger‑control procedures under the Competition Law administered by the General Authority for Competition (GAC), has shaped the approval pathways, documentation standards, and reporting obligations that govern inbound acquisitions.

This article is a practical, procedural M&A checklist Saudi acquirers and their advisers can work through step by step, with named regulators, responsible parties, realistic timelines, required documents, indicative cost categories, and a focused summary of recent developments. It is written for corporate counsel, private equity and external M&A teams who need operational guidance rather than legal theory.

This article provides general guidance only and does not constitute legal advice. Approval triggers, filing thresholds and fees change; verify current requirements with Saudi‑licensed counsel and the relevant regulators before transacting.

Overview: Why M&A Due Diligence in Saudi Arabia Looks Different Now

The purpose of this guide is to give foreign acquirers a defensible, repeatable process for acquisition due diligence Saudi deals, one that aligns legal, financial and regulatory workstreams and anticipates where approvals will slow the timetable. The three practical takeaways are simple. First, regulatory screening must start on day one, not after commercial heads of terms are agreed, because MISA, CMA and GAC checkpoints can add weeks to closing. Second, documentation standards have tightened under the current Companies Law, so corporate housekeeping defects that were once tolerated now surface as closing conditions. Third, Saudization, Zakat and licensing compliance remain among the most common deal‑breakers and should be stress‑tested early.

Key Regulatory Reference Points

• Companies Law in force. The Companies Law (Royal Decree No. M/132 of 1443H), which replaced the prior 2015 regime, affects shareholder and board approval mechanics and reshapes how corporate consents are evidenced in diligence (see laws.boe.gov.sa).
• MISA process. Foreign investment licensing and sector screening is administered by the Ministry of Investment and remains mandatory for many inbound deals (misa.gov.sa).
• CMA market access. Disclosure and takeover rules for listed targets continue to evolve, widening foreign investor access (cma.org.sa).
• Merger control. GAC notification practice under the Competition Law and its Implementing Regulations is a standing feature of larger transactions (gac.gov.sa).

Eligibility: Who Can Buy and Basic Foreign Ownership Rules

Before any data room opens, confirm whether the buyer can lawfully acquire the target at all. Most inbound acquisitions by a foreign entity require a foreign investment licence from the Ministry of Investment (MISA). Where the target operates in a restricted or sensitive sector, MISA approval is required before ownership transfers, and the licence conditions may cap foreign ownership or impose a Saudi partner requirement. Confirming the buyer’s eligibility, the licence pathway and any ownership ceiling is the foundation of every M&A due diligence Saudi Arabia exercise, because it determines deal structure, pricing and the documents a target must produce.

Sector Screening and Restricted Activities

Certain activities are closed to foreign capital or subject to special conditions under MISA’s foreign investment framework. Check the activity codes on the target’s commercial registration against MISA’s current sector guidance to establish whether the acquisition is permitted, conditionally permitted, or restricted. This screening should run concurrently with the first corporate review so structuring decisions are not reversed later.

Economic Cities, Special Zones and Special Regimes

Special economic zones and designated regimes can offer distinct ownership and licensing rules. If the target sits inside such a zone, confirm which authority administers the zone and how share transfers and licence changes are approved there, as the standard MISA and Ministry of Commerce pathways may be modified.

Step‑by‑Step M&A Due Diligence Saudi Arabia Checklist

The core of any inbound transaction is a disciplined, sequenced checklist. The twelve steps below move from screening to closing, with workstreams running in parallel wherever possible to protect the timetable. Each step identifies the party typically responsible and an indicative duration; the consolidated Step/Who/Duration table follows. Treat these as a working template for your acquisition due diligence Saudi programme, adjusted to deal size and sector.

1. Initial screening and data room setup. Agree an NDA, scope the review across legal, tax, finance, IP, employment and environment, and establish a structured virtual data room with an indexed document request list.
2. Regulatory and sectoral screening. Map every approval trigger, MISA licensing, CMA disclosure obligations for listed targets, GAC merger notification, and any sector regulator, before commercial terms harden.
3. Corporate and capitalisation review. Examine the articles of association, shareholder registers, shareholders’ agreements, historic capital increases and board minutes to confirm clean title to the shares and valid corporate authority under the current Companies Law.
4. Financial and tax diligence. Review several years of audited financials, management accounts, debt schedules, VAT filings and Zakat assessments to surface historic liabilities and off‑balance‑sheet exposure.
5. Contracts and counterparties. Read material customer, supplier, loan, lease, distribution and agency contracts for change‑of‑control clauses, termination rights and consent requirements that the deal may trigger.
6. Employment and Saudization compliance. Verify employment contracts, GOSI (social insurance) filings and the target’s Nitaqat (Saudization) banding, since non‑compliance can restrict government services and expose the buyer post‑closing.
7. Real estate and title. Confirm title deeds, usufruct arrangements and lease registrations, and whether property interests transfer cleanly on a share or asset basis.
8. Licensing and permits. Verify every activity, municipal and sectoral licence the business relies on, their validity, and whether a change of control requires re‑issuance or notification.
9. IP, data protection and cybersecurity. Confirm ownership and registration of trademarks and other IP, review software licences and source‑code arrangements, and assess compliance with the Personal Data Protection Law and applicable cybersecurity requirements.
10. Litigation and enforcement risks. Identify pending claims, judgments, arbitration and enforcement notices that could crystallise as liabilities or impede transfer.
11. Environmental and health & safety. Where the target has industrial or physical operations, review environmental permits, inspection reports and any remediation obligations.
12. Closing conditions, escrow and post‑closing covenants. Translate diligence findings into conditions precedent, price adjustments, escrow retentions, warranties and post‑closing covenants, and sequence the regulatory filings needed to complete.

A thorough M&A due diligence Saudi Arabia process holds these workstreams together so that regulatory, financial and legal findings feed directly into the sale and purchase agreement rather than emerging after signing.

MISA: Foreign Investment Licensing Checks

Confirm the target’s existing MISA position and whether the proposed acquisition requires a new or amended foreign investment licence. In restricted sectors MISA approval must be obtained before ownership changes hands; build this into the conditions precedent and the timetable (misa.gov.sa).

CMA: Listed Target Disclosure and Takeover Checks

Where the target is listed, CMA rules govern disclosure of price‑sensitive information and the conduct of acquisitions above specified share thresholds. CMA due diligence must confirm prior disclosures were made correctly and that the proposed transaction complies with the Merger and Acquisition Regulations and market‑conduct rules (cma.org.sa).

GAC: Merger Control Screening

Assess early whether the transaction meets GAC’s economic concentration notification thresholds under the Competition Law and its Implementing Regulations. If it does, notification and clearance are required before completion, and the review period must be factored into the critical path (gac.gov.sa).

Tadawul and Ministry of Commerce Checks

For listed entities, Saudi Exchange (Tadawul) rules affect how share transfers are executed (saudiexchange.sa). For all companies, the commercial registration held with the Ministry of Commerce must be verified and, after closing, updated to reflect the new ownership (mc.gov.sa).

Step / Who / Duration Timeline

Required Documents: A Due Diligence Checklist Saudi Arabia Buyers Can Use

A well‑structured document request list is the backbone of the data room and the fastest way to surface defects. The table below sets out the core categories, example documents and the party who typically produces them. Issue this list at step one so the target’s advisers can populate the data room while regulatory screening runs in parallel. Use it as the first draft of your due diligence checklist Saudi Arabia request, then expand it for sector‑specific permits and contracts.

Timeline and Deadlines

A straightforward domestic share deal with no merger‑control or sector issues can complete diligence in roughly six to ten weeks if the data room is well prepared. Cross‑border transactions requiring foreign investment licensing and regulatory clearances run longer. The decisive variable is approvals: a MISA licence amendment, a CMA process for a listed target, or a GAC merger clearance can each add several weeks to the critical path, and these are often sequential rather than wholly parallel.

Manage this by splitting the programme into parallel tracks, legal, financial and regulatory, and by commissioning regulatory screening at the outset so filings can be prepared while diligence continues. Escrow and closing mechanics, including payment flows and CR updates, typically add further time after the signing. Build contingency into the long‑stop date and keep conditions precedent realistic against regulator wait times.

Costs and Fees

Transaction costs fall into two groups: regulator filing fees, which are generally administrative but vary by filing type and deal size, and professional adviser fees, which scale with complexity. The ranges below are indicative estimates only and do not represent official figures; confirm current regulator fee schedules directly before budgeting.

Exact regulator filing fees change; always verify against the official MISA, CMA and GAC fee pages before relying on any figures.

Recent Developments Buyers Should Factor In

The most consequential reform is the Companies Law issued by Royal Decree No. M/132 of 1443H, published through the official legislative process and available on the Bureau of Experts portal (laws.boe.gov.sa). It reshapes board and shareholder approval mechanics, affects how corporate consents are documented, and reinforces the evidentiary bar for demonstrating valid authority behind historic corporate acts. In diligence terms this means corporate housekeeping, properly minuted board decisions, correctly recorded capital increases, compliant shareholder resolutions, carries significant weight, and gaps are increasingly treated as conditions to be remedied before closing.

Alongside the Companies Law, MISA continues to refine its foreign investment licensing practice, the CMA has continued to widen and clarify foreign investor access and disclosure expectations for listed companies, and the Saudi Exchange framework affecting share transfers in listed entities has developed. Taken together, these developments make an up‑to‑date M&A due diligence Saudi Arabia methodology essential: checklists built on older practice risk missing current approval triggers and documentation standards.

Practical Implications for Buyers

Buyers should expect rigorous scrutiny of the chain of corporate authority, confirm that the target’s resolutions and board processes comply with the current Companies Law, and re‑test which filings require board, shareholder or regulator sign‑off. Where the target is listed, confirm CMA disclosure compliance has kept pace with the applicable rules. Treat the regulatory‑change analysis as a live workstream, not a one‑off, because regulator guidance continues to be issued.

Common Pitfalls and Red Flags

Across inbound deals, the same issues recur. Spotting them early is the difference between a managed negotiation and a collapsed transaction.

• Undisclosed related‑party dealings. Transactions with shareholders or affiliates that distort the accounts or lack proper authorisation.
• Unregistered charges or security. Encumbrances over assets or shares that were never properly recorded.
• Change‑of‑control restrictions. Contracts, licences or financing that terminate or require consent on a change of ownership.
• Unresolved Zakat and tax liabilities. Open ZATCA assessments or disputed filings that become the buyer’s problem post‑closing.
• Saudization non‑compliance. A weak Nitaqat band that restricts government services and visa processing.
• Licensing gaps. Activities being carried on without the correct municipal or sectoral licence.
• IP ownership uncertainty. Key trademarks or software not registered to, or properly assigned to, the target.
• Unremedied environmental liabilities. Outstanding permit breaches or remediation obligations.
• Material litigation or arbitration. Claims capable of materially affecting value or operations.
• Shareholder disputes. Unresolved disagreements that cloud title to the shares being sold.

How to Mitigate Each Risk

Convert findings into contractual protection: specific indemnities for identified Zakat, tax and litigation exposures; conditions precedent requiring charge releases and third‑party consents; warranties on IP ownership and licence validity; and escrow retentions pegged to the most uncertain liabilities. For Saudization, require the target to confirm or improve its Nitaqat banding before completion. Where authority gaps exist under the Companies Law, obtain fresh, compliant resolutions ratifying prior acts.

Post‑Closing Short Checklist

Closing is not the finish line. Immediately after completion, update the share register, file the commercial registration (CR) change with the Ministry of Commerce to record the new ownership, and make any required MISA and CMA notifications. Notify employees where the law or contracts require it, implement the new corporate governance and board composition, and register the foreign ownership change where applicable.

Typical Post‑Closing Regulator Notices and Timeframes

CR updates at the Ministry of Commerce should be actioned promptly after closing to keep the public record accurate (mc.gov.sa). Where a MISA licence condition or a CMA disclosure obligation is triggered by the change of control, make those filings within the timeframes set by each regulator. Build a post‑closing filing calendar during diligence so nothing is missed in the handover.

Comparison: Asset Deal vs Share Deal

Structure drives both the diligence scope and the regulatory consequences. A share purchase preserves corporate continuity but inherits historic liabilities; an asset purchase can be cleaner but requires individual transfers and re‑registrations.

Recommended Timeline Checklist

• Weeks 0–4. Sign NDA, open the data room, issue the document request list, and begin regulatory and corporate screening in parallel.
• Weeks 4–8. Complete financial, tax, contract, employment, property and IP review; prepare MISA/CMA/GAC filings as required.
• Pre‑closing. Finalise conditions precedent, obtain third‑party consents and regulatory clearances, and agree escrow and warranties.
• Closing. Execute transfer documents, settle consideration, and update the share register.
• Post‑closing. File CR changes with the Ministry of Commerce, make MISA/CMA notifications, and implement governance changes.

Conclusion

Executed well, M&A due diligence Saudi Arabia is not merely a risk‑discovery exercise but the engine that shapes structure, price and deal certainty. The current reforms raise the standard for corporate authority, documentation and regulatory engagement, so foreign buyers should start regulatory screening on day one, hold legal, financial and regulatory tracks in parallel, and convert every finding into contractual protection. Before committing to any inbound acquisition, engage Saudi‑licensed counsel to validate approval triggers and filing requirements against current regulator guidance.

Sources

1. Ministry of Investment (MISA)
2. Capital Market Authority (CMA)
3. General Authority for Competition (GAC)
4. Saudi Exchange (Tadawul)
5. Bureau of Experts at the Council of Ministers, Saudi Laws
6. Ministry of Commerce
7. Zakat, Tax and Customs Authority (ZATCA)