Regulatory Compliance in Saudi Arabia: Frameworks, Governance, and Implementation A Systematic Review of the Post-Vision 2030 Regulatory Environment (2017–2025)
Keywords:
Aml/Cft, Anti-Corruption, Corporate Governance, Cybersecurity, Data Protection, Regulatory Compliance, SaudiArabia, Tax Compliance, Vision 2030Abstract
This systematic review provides a picture of the Saudi regulatory compliance environment after Vision 2030 (2017–2025), combining official regulatory instruments and peer-reviewed empirical literature. The review examines changes in the compliance governance landscape and proposes a comprehensive compliance governance framework for Saudi organizations. The study uses a systematic qualitative content analysis coupled with regulatory mapping across six compliance domains: financial regulation and anti-money laundering; corporate governance and disclosure; data protection; cybersecurity; anti-corruption; and taxation. After a structured search in Google Scholar, Scopus, Web of Science, HeinOnline, Westlaw, and official regulatory databases (SAMA, CMA, SDAIA, NCA, ZATCA, Nazaha), 50 sources have been selected using explicit criteria: peer-reviewed articles and official regulatory documents/legal frameworks published between 2017 and 2025; non-academic commentary; and obsolete pre-2017 instruments were excluded. The results demonstrate a clear evolution from fragmented and sanction-oriented regulatory environment to consolidated and risk-based system, characterized by specialized regulators, codified rulebook, digital compliance infrastructure, and harmonization with international standards set by Basel, FATF, G20, and OECD. Moreover, the review highlights implementation issues including regulatory fragmentation, insufficient compliance capacity, disproportional impact on small and medium-sized enterprises, and inconsistency of enforcement. Based on the results of the systematic review, the paper proposes an Integrated Compliance Governance Framework (ICGF) consisting of four pillars: regulatory intelligence; risk-based control environment; integrity culture and accountability; and technology-enabled assurance with a phased implementation roadmap. This review is the first comprehensive systematic effort to outline the post-Vision 2030 Saudi compliance architecture and provides a useful tool for regulators and organizational leadership.
References
Abdullah, S. B. (2026). Cloud security challenges in Saudi e-commerce platforms under Vision 2030. Journal of Computer Science and Technology Studies, 8(2). https://alkindipublisher.com/index.php/jcsts/article/view/12867
Aladwani, A. (2026). A comparative study of responses to corruption in the Gulf: National efforts of Kuwait, Saudi Arabia and UAE [Doctoral dissertation, Brunel University London]. Brunel University Research Archive. https://bura.brunel.ac.uk/handle/2438/33012
Alamri, M. A., & Alshekmubarak, I. A. (2023). Corporate governance and business ethics in Saudi Arabia listed banks: an accountability perspective. Journal of Accounting Research, Organization and Economics, 6(1). https://jurnal.usk.ac.id/JAROE/article/view/34774
Aldhafiri, Y. F. (2026). Coercive transformation: vision 2030 as a pressure field and organizational dynamics of coercive digital change in Saudi Arabian public sector. Journal of Intelligent Decision Making and Information Systems, 3(4). https://www.jidmis.org/index.php/jid
Alofi, M. G. (2017). Organizational culture in the telecommunication industry of Saudi Arabia: With emphasis on wasta [Doctoral dissertation, Durham University]. Durham E-Theses. https://etheses.dur.ac.uk/
Alqahtani, A. S. H. (2020). Accounting disclosure and corporate governance mechanisms in Kingdom of Saudi Arabia [Doctoral dissertation, Victoria University]. VU Research Repository. https://vuir.vu.edu.au/
Al Salman, H. H. H. (2026). The role of disclosure and transparency in developing integrity in the Saudi public sector. Acta Innovations, 46. https://actainnovations.com/index.php
Alsulaiman, L. A., & Alrodhan, W. A. (2014). The status of information privacy in Saudi Arabia. Computer and Information Science, 7(3).
Altawyan, A. A. (2020). The significance of emphasizing anti-corruption rules: whistleblowing for a better economic environment in Saudi Arabia towards Saudi Vision 2030. Arab Law Quarterly, 34(1), 74–85.
Amubarak, W. (2020). Gaps in expectations with regards to the role of independent directors: Evidence from Saudi Arabia [Doctoral dissertation, Middlesex University]. Middlesex University Research Repository. https://repository.mdx.ac.uk/
Alm, J., Gerbrands, P., & Kirchler, E. (2022). Using “responsive regulation” to reduce tax base erosion. Regulation & Governance, 16(1), 36–53. https://doi.org/10.1111/rego.12359
Ayres, I., & Braithwaite, J. (1992). Responsive regulation: Transcending the deregulation debate. Oxford University Press.
Blanchard, C. M., & Prados, A. B. (2007). Saudi Arabia: Terrorist financing issues (CRS Report for Congress). Congressional Research Service.
Carr, I., & Jago, R. (2014). Corruption, money laundering, secrecy, and social responsibility of banks. In B. Rider (Ed.), Fighting financial crime in the global economic crisis (pp. 158–181). Routledge.
Gerged, A. M., & Agwili, A. (2020). The influence of corporate governance on firm value and profitability: a study of Saudi Arabia’s financial and non-financial listed companies. International Journal of Business Governance and Ethics, 14(2), 144–165.
Hartner, M., Rechberger, S., Kirchler, E., & Schabmann, A. (2008). Procedural fairness and tax compliance. Economic Analysis and Policy, 38(1), 137–152. https://doi.org/10.1016/S0313-5926(08)50010-5
Hsieh, H.-F., & Shannon, S. E. (2005). Three approaches to qualitative content analysis. Qualitative Health Research, 15(9), 1277–1288. https://doi.org/10.1177/1049732305276687
Khan, A. A., Alsufyani, A., Alsufyani, N., & Mohamed, M. A. (2025). BAML: a decentralized approach to secure, privacy-preserving financial compliance for enhancing anti-money laundering with blockchain hyperledger and federated learning. Peer-to-Peer Networking and Applications, 18(5), Article 270. https://doi.org/10.1007/s12083-025-02086-6
Kingdom of Saudi Arabia. (2016). Vision 2030: Kingdom of Saudi Arabia.
Mascini, P., & Van Wijk, E. (2009). Responsive regulation at the Dutch Food and Consumer Product Safety Authority: an empirical test of assumptions about the theory. Regulation & Governance, 3(1), 27–47.
Morgan Lewis. (2024, September 12). Saudi Arabia Personal Data Protection Law: Transition period ends September 14. https://www.morganlewis.com/pubs/2024/09/saudi-arabia-personal-data-protection-law-transition-period-ends-september-14
National Cyber Security Authority. (2018). Essential cybersecurity controls (ECC).
National Cyber Security Authority. (2019). Critical systems cybersecurity controls (CSCC).
Saudi Central Bank. (2023a). Rules for opening an account.
Saudi Central Bank. (2023b). The guide on anti-money laundering and counter terrorism financing (AML/CTF).
Saudi Data & Artificial Intelligence Authority. (2023). Personal Data Protection Law and its implementing regulations. https://sdaia.gov.sa/en/
Tyler, T. R. (2018). Psychology and deterrence of corporate crime. In M. L. Benson, D. P. Farrington, & H. J. Smith (Eds.), Research handbook on corporate crime and financial misconduct. Edward Elgar.
Tyler, T. R., & Fagan, J. (2008). Legitimacy and cooperation: why do people help the police fight crime in their communities? Ohio State Journal of Criminal Law, 6(1), 231–275.
Tyler, T. R., & Lind, E. A. (1992). A relational model of authority in groups. Advances in Experimental Social Psychology, 25, 115–191.
Unger, B. (2020). Enhancing anti-money laundering policy. Policy Department for Economic, Scientific and Quality of Life Policies, European Parliament.
Zakat, Tax and Customs Authority. (2023). E-invoicing: Roll-out phases.
Zakat, Tax and Customs Authority. (n.d.-a). Taxation violation fines. Retrieved August 31, 2026, from https://zatca.gov.sa/en/RulesRegulations/VAT/Pages/Penalties.aspx
Zakat, Tax and Customs Authority. (n.d.-b). ZATCA releases the violations and fines related to e-invoicing. Retrieved August 31, 2026, from https://zatca.gov.sa/en/MediaCenter/News/Pages/E-invoicing-Violations-Fines.aspx
Zerban, A. M. (2017). Enron of Saudi Arabia: corporate accounting and auditing failures. Open Journal of Accounting, 6(4), 105–127. https://www.scirp.net/journal/paperinformation?paperid=80434
