If your company is listed on the Saudi Exchange's Main Market, having a confidential way for people to report misconduct is not optional. The Saudi CMA's Corporate Governance Regulations require one, and a separate CMA regulation goes further, requiring a board approved policy that protects employees who report violations to the regulator itself.
Most boards know their audit committee has a role here. The harder question is whether your reporting arrangements would satisfy the specific articles the Capital Market Authority wrote, and whether they would work as intended when a concern is raised.
And the stakes are real. In 2025, board members and senior executives made up the single largest group of violators penalized by the capital market regulator. In May 2026, 11 board and audit committee members of a single listed company were fined around SAR 18 million over manipulated financial statements.
This guide walks through what the rules actually say, who they apply to, and what a reporting mechanism that holds up to scrutiny looks like in practice.
What is the Saudi CMA?
The Capital Market Authority of Saudi Arabia (CMA) is the Kingdom's capital market regulator, operating under the Capital Market Law (Royal Decree No. M/30, 1424H). Its remit covers the Saudi Exchange (Tadawul), the companies listed on it, and licensed capital market institutions such as brokers and asset managers.
For listed companies, the rulebook that matters most is the CMA's Corporate Governance Regulations . First issued in 2017 and amended in January 2023 to align with the new Companies Law (Royal Decree No. M/132), they set out the rules for boards, committees, internal control, stakeholder relations and disclosure.
Those rules are actively enforced. According to the CMA's 2025 Annual Report , the average time from detecting a suspected violation to closing the case within the CMA and taking appropriate action was 3.2 months.
What the CMA's corporate governance rules require on reporting misconduct
When it comes to reporting misconduct, two articles of the Corporate Governance Regulations do the heavy lifting, and both are mandatory for companies listed on the Main Market. Article 2(b) makes the regulations mandatory for Main Market companies except provisions expressly identified as guiding, and Articles 55 and 81 carry no such designation.
Article 55: the audit committee's confidential channel. The audit committee must set up arrangements that let employees confidentially raise concerns about inaccuracies in financial or other reports. Setting them up is only half the duty: the committee must also make sure the arrangements are put into action, through an adequate independent investigation of each issue and appropriate follow up.
Article 81: a board level reporting policy for stakeholders. Article 81 widens the lens. On the audit committee's proposal, the board must adopt policies and procedures that let stakeholders, including employees, submit complaints or report violations. The article names five elements:
- An easy way for stakeholders to report executive management conduct that breaks laws or rules, or that raises doubts about the financial statements or internal controls, followed by the necessary investigation.
- Confidential reporting, by enabling direct contact with an independent member of the audit committee or another specialized committee.
- A named employee responsible for receiving and handling reports.
- A dedicated telephone number or email address for complaints.
- The necessary protection for those who report.
Two details in Article 81 are easy to miss. It is not limited to employees, and it explicitly contemplates reports about executive management. That is why independence matters so much: a channel that routes every concern through the people it might implicate works against the direct, independent contact Article 81 provides for.
The regulations also make shortcomings visible. Under Article 87, the annual board report must disclose any penalty imposed by the CMA or another regulator, along with the results of the annual review of internal control effectiveness and the audit committee's opinion on it.
The CMA runs its own reporting channel, and your internal one should come first
Alongside these internal requirements, the CMA runs its own whistleblowing channel under the Regulation on the Reporting of Violations of the Capital Market Law , issued in December 2021 and in force since 2022. Reports can be made through the CMA's website, phone line, investor protection app, registered mail or in person.
For listed companies, three of its provisions stand out:
● A mandatory protection policy (Article 10). Since March 1, 2023, listed companies, capital market institutions, the Saudi Exchange, the Securities Depository Center (Edaa) and the Clearing Center must have a board approved internal policy protecting employees who report to the CMA. At minimum, it must prohibit disciplinary action or any loss of rights or benefits because of a report. This obligation is already in force: if your board has not yet adopted such a policy, it should do so now.
● Rewards (Article 7). The CMA may award a qualifying reporter up to 20% of the fines and financial penalties collected as a result of a report. Conditions apply: among them, the report must include the reporter's name and contact details, the reporter must be a natural person acting on their own initiative, the report must lead to a final decision, and the amount collected must exceed SAR 1 million.
● Confidentiality (Article 11). The reporter's identity and the information provided are treated as confidential by the CMA.
None of this makes internal reporting less important. If anything, it makes it more important. A trusted internal channel gives your audit committee the chance to hear about a problem first, investigate it properly and put it right, rather than learning about it from the regulator. Employees use internal channels when they believe reports will be taken seriously and that they will be protected, and that belief is built through exactly the arrangements Articles 55 and 81 require.
These CMA rules also sit alongside Saudi Arabia's wider whistleblower protection law , approved in February 2024, which applies beyond the capital market.
What enforcement looks like
So where do the CMA's penalties actually land? Its 2025 figures, reported by Argaam from the authority's annual report, break down like this:
| Violator category (2025) | Violators penalized |
| Board members and senior executives | 108 |
| Investors | 97 |
| Capital market institutions and registered persons | 44 |
| Listed companies | 6 |
| Total | 255 |
In total, fines and financial penalties imposed that year came to about SAR 179.1 million. Of that, SAR 138.9 million related to violations of the Market Conduct Regulations, the rules covering manipulation and misleading statements.
One recent case shows how this reaches the boardroom. In May 2026, the CMA announced a final ruling against 11 board and audit committee members of Middle East Healthcare Company (Saudi German Health). They were found to have inflated revenues by recognizing about SAR 358 million despite knowing collection was unlikely, across financial statements from 2018 to 2021. Fines totaled around SAR 18 million, alongside bans of six months to one year from working at CMA supervised entities.
Two details make the case especially relevant here. The first is timing: the CMA referred the case to the Public Prosecution in March 2024, more than five years after the first affected financial year closed, and long gaps between misconduct and discovery are exactly what a trusted internal reporting channel is meant to shorten. The second is who was involved. The convicted included members of the audit committee, the body that Article 55 charges with setting up confidential reporting arrangements and making sure they are put into action. The ruling concerned inflated revenue, not the reporting arrangements, but it is a strong reason to design routing so a concern can always reach someone who is not implicated, rather than relying on a single fixed recipient.
Who these rules apply to
How these obligations apply depends on where your organization sits in the Saudi capital market.
| Organization | CGR Articles 55 and 81 | Reporting of Violations Regulation, Article 10 |
| Main Market (Tadawul) listed company | Mandatory | Mandatory protection policy |
| Parallel Market (Nomu) listed company | Guidance only, per CGR Article 2(c) | Mandatory protection policy. The CMA defines a listed company as one listed on either the Main Market or the Parallel Market |
| Capital market institution (broker, asset manager, etc.) | Not directly applicable | Mandatory protection policy |
| Unlisted company planning an IPO | Applies once listed | Applies once listed |
Two further points are worth keeping in mind. First, CGR Article 2(d) confirms that rules from other supervisory authorities continue to apply alongside the CMA's. A listed bank must also meet the Saudi Central Bank's requirements, covered in our guide to SAMA whistleblowing rules , and a listed insurer answers to the Insurance Authority as well. Public sector bodies, and companies in which the state owns at least 25% of the capital, also fall under a separate authority, Nazaha .
Second, timing matters for companies heading toward a listing. Building the reporting mechanism before the IPO is far easier than retrofitting it afterwards. Nomu companies are in a similar position, since guidance today can become a requirement if they move to the Main Market.
A practical checklist for a CMA ready reporting mechanism
The regulations tell you what must exist, but they say less about how to make it work. The checklist below sets each item next to what good practice looks like, so you can test your current setup against it.
| What you need | Where it comes from | What good looks like in practice |
| A confidential channel for employees | CGR Article 55 | Available around the clock, in the languages your workforce speaks, with an anonymous option so fear of exposure is not a barrier |
| A reporting route open to all stakeholders | CGR Article 81(1) | Suppliers, customers and contractors can report too, not only staff |
| Direct access to an independent audit committee member | CGR Article 81(2) | Reports about executives can bypass executive management entirely |
| A named person receiving reports | CGR Article 81(3) | Clear ownership, with a backup when that person is conflicted |
| A dedicated, easy to reach reporting channel | CGR Article 81(4) | A clearly publicized channel stakeholders can reach easily, with secure web or app options that are easier to protect and to audit |
| Independent investigation and follow up | CGR Article 55 | Every report logged, assigned, investigated and closed, with a record the audit committee can review |
| Protection from retaliation | CGR Article 81(5); Reporting Regulation Article 10 | A written, board approved policy that also covers employees who report directly to the CMA |
| Evidence to support the internal control review | CGR Article 87(10) | Case volumes, categories and outcomes the audit committee can draw on when forming its opinion on internal control, which the board report must include |
Of these, the last two rows matter most once something goes wrong. A hotline number and a policy document show intent, but it is a documented record of how each report was received, investigated and followed up that shows the arrangements were actually put into action, as Article 55 requires.
Where a whistleblowing platform fits
Taken together, these articles ask for five things: confidentiality, independence, investigation, follow up and protection. For compliance, legal and audit teams, the practical question is which setup delivers those outcomes reliably and leaves a record that proves it.
iVoiceUp was built to help organizations across the Middle East turn these requirements into a working process through a whistleblowing platform . Here is how it maps against the checklist above:
- Confidential, accessible reporting. Employees and external stakeholders can report anonymously through secure web, mobile, and voice channels, with voice pitch modification available for added privacy. The platform is English and Arabic ready and structured for multilingual rollouts. See anonymous reporting .
- Two way anonymous follow up. A follow up chat lets investigators request additional details anonymously, without the reporter's identity being exposed.
- Configurable case routing. Cases can be routed automatically by category, region, or entity, with configurable routing rules, access levels and investigator permissions, giving companies the flexibility to direct sensitive categories to the appropriate independent reviewer.
- Case management with an audit trail. Every case moves through defined stages from intake to closure, with role based access for HR, Compliance, Legal, and Audit teams, and a complete, timestamped audit trail. See case management .
- Evidence and investigation records. Investigators can attach documents, images, or audio files, track a timeline of key dates and progress automatically, and keep private, investigator only notes throughout the case.
If you are reviewing your arrangements against the Saudi CMA's rules, see how iVoiceUp supports compliance teams , legal teams and audit and risk teams , or book a demo to walk through your current setup.
Frequently asked questions
Is a whistleblowing channel mandatory for Saudi listed companies?
Yes, for the Main Market. Articles 55 and 81 of the CMA's Corporate Governance Regulations require a confidential reporting mechanism overseen by the audit committee and a board approved reporting policy for stakeholders. For Nomu companies these articles are guidance, but the employee protection policy under Article 10 of the Reporting of Violations Regulation still applies, because the CMA's definition of a listed company covers both markets.
Does the CMA require anonymous reporting?
The regulations require confidential reporting, not specifically anonymous reporting. In practice, offering an anonymous option lowers the barrier for employees who fear being identified, which makes the channel more likely to be used.
Can employees report directly to the CMA instead of internally?
Yes. The CMA accepts reports through its website, phone line, investor protection app, mail and in person. Listed companies must have a board approved policy prohibiting retaliation against employees who report to the CMA, and qualifying reports can earn a reward of up to 20% of collected penalties.
Who is responsible for the reporting mechanism?
The audit committee sets up and oversees the confidential channel under Article 55 and proposes the reporting policy. The board adopts that policy under Article 81 and remains responsible for internal control overall.
How does corporate governance in Saudi Arabia differ for unlisted companies?
The CMA's Corporate Governance Regulations apply to listed joint stock companies. Unlisted companies fall under the Companies Law, and governance guidance for them from the Ministry of Commerce is largely voluntary, according to ECGI . Sector regulators such as the Saudi Central Bank may impose their own requirements regardless of listing status. For how governance expectations compare across the wider region, see our look at governance in the Gulf .
Sources
- Capital Market Authority, Corporate Governance Regulations , English translation, as amended by Resolution 8-5-2023 (Articles 2, 52, 55, 81, 87)
- Capital Market Authority, Regulation on the Reporting of Violations of the Capital Market Law , Resolution 2- 135-2021 (Articles 2, 5, 7, 10, 11)
- Capital Market Authority, Glossary of Defined Terms Used in the Regulations and Rules of the CMA (2025)
- Capital Market Authority, The CMA Issues its 2025 Annual Report , June 8, 2026
- Argaam, CMA imposes SAR 179.1M fines on 255 violators in 2025 , June 15, 2026
- Capital Market Authority, Conviction of board and audit committee members of Saudi German Health , May 21, 2026
- European Corporate Governance Institute, Corporate Governance in Saudi Arabia
- iVoiceUp, Platform , Anonymous Reporting and Case Management pages
This article is for general information and is not legal advice. Check the current versions of the regulations on the CMA website and take advice on your company's specific obligations.
