The regulatory requirements register is a single table that answers two questions for every obligation: what does the law require of me, and how do I prove I did it?
1 How do you inventory what applies to you?
Activity
What does the organisation actually do?
Entity
Its legal form and its licences
Regulators
Who supervises you and issues instructions?
Counterparties
Contracts, clients and financiers with their requirements
These four sources yield the list of applicable requirements
Among the most common compliance areas touching most organisations in the Kingdom:
- Zakat and tax: registration, returns, e-invoicing and book keeping.
- Labour law: contracts, wages, working hours, safety and end-of-service entitlements.
- Social insurance: registration, contributions and keeping employee data current.
- Personal data protection: processing data on a lawful basis, protecting it, and honouring data subjects’ rights.
- Anti-money laundering: for the entities subject to it — covered in detail in Lesson 4.
- Licences and commercial registration: renewing on time and keeping activities and addresses updated.
- Sector requirements: whatever the authority supervising your particular activity issues.
Important note
This is a general, indicative list. What applies to your organisation specifically depends on its activity, size and sector, and is determined by referring to the texts of the laws in force and their official sources.
2 From text to control
A legal text does not execute itself. Each article is broken down into one or more practical requirements, and every requirement gets an owner, a procedure, a frequency, and evidence to be retained.
| Requirement | Owner | Frequency | Evidence |
|---|---|---|---|
| File the return on time | CFO | Periodic, per filing period | The retained filing acknowledgement |
| A signed employment contract for every employee | HR | On every hire | A copy of the contract in the employee file |
| Renew the licence before it expires | Administration | Annual | The new licence |
| Data backups and restore testing | IT | Monthly | The restore test report |
| Train staff on the policies | Compliance + HR | Annual | Attendance sheet and assessment |
The evidence rule
In compliance: what has no evidence did not happen. Training with no attendance sheet, a review with no report, an approval with no signature — none of it counts when you are examined.
3 The obligations calendar
Turn the deadline-bearing requirements into an annual calendar holding every due item, its date, its owner and an advance alert. This calendar alone prevents the single most common violation among small organisations: missing a deadline.
| Obligation | Frequency | Advance alert | Owner / backup |
|---|---|---|---|
| Periodic return | Per the statutory period | 14 days | Senior accountant / CFO |
| Social insurance contributions | Monthly | 7 days | HR / Finance |
| Commercial registration renewal | Annual | 30 days | Administration / CEO |
| Policy review | Annual | 45 days | Compliance / the board |
Note the backup column: most delays happen when the single responsible person is away.
4 Tracking regulatory updates
- Official sources only: the regulators’ own platforms and websites, not what circulates in group chats.
- A named owner who reviews developments periodically and documents what they find.
- Impact analysis: what changes for us? A policy? A system? A form? Training?
- An implementation plan with lead time before the new requirement takes effect, not after.
- Update the register and the calendar as soon as the change is approved.
Lesson summary
- Inventorying requirements starts from the activity, the entity, the supervising authorities and the contracts.
- Every requirement is broken down into a procedure, an owner, a frequency and retained evidence.
- What has no evidence does not count as compliance when you are examined.
- An obligations calendar with alerts and a backup for every task prevents the most common violations.
- Tracking updates from official sources is a documented, recurring task.
5 Test your understanding
Three quick questions
Pick the answer you believe is correct and you will see the result immediately.
1. Staff were trained on the policy, but with no attendance sheet and no retained material. On examination:
Compliance is proven with documented evidence: an attendance sheet, material, an assessment and a date.
2. What is the best source for learning about a regulatory update?
Unofficial channels may alert you, but you rely on the official text and its effective date.
3. What is the purpose of the “backup” column in the obligations calendar?
The backup prevents an obligation stalling because one person is absent; it does not remove the primary owner’s accountability.