The Capital Market Authority (CMA) is Saudi Arabia’s independent securities regulator, established in 2003 under the Capital Market Law. Its Corporate Governance Regulations set the mandatory governance standard for companies listed on the Saudi Exchange — and increasingly serve as the benchmark investors and lenders expect of private firms too.
The mandatory committees
Every listed company must form the required board committees — Audit, Nomination & Remuneration, and Risk Management — each with a charter that does not contradict the regulations. The audit committee gets particular scrutiny: it must be entirely non-executive, with a majority of independent members and appropriate financial expertise.
Board & independence
The board must include a prescribed number of independent and non-executive directors, and the company must adopt a corporate governance code alongside its committee charters. This is where the CMA framework meets the governance and delegation-of-authority work — structure, roles and authorities made explicit.
Governance treated as a formality is the single most common CMA finding.
Disclosure & conduct
Listed companies must publish audited quarterly and annual financial statements, disclose material events promptly, control related-party transactions, and maintain conflict-of-interest policies — all aimed at protecting shareholders, especially minority ones. Many requirements run on a comply-or-explain basis, pushing companies toward best practice beyond the minimum.
Check your CMA position — free.
Assess your governance against CMA requirements in the free compliance register, alongside PDPL, NCA, SAMA and ZATCA.
Open the register