Maroof & Saudi E-Commerce Law Master Manual 2026
The definitive statutory operations guide to digital commerce, online store verification, and consumer protection in the Kingdom of Saudi Arabia. Master Commercial Registration vs. Freelance Document pathways, Saudi Business Center (SBC) Gold Store Verification, mandatory 7-day return policies, SAMA-licensed Mada payment gateway integrations, and ZATCA Phase 2 e-invoicing under Royal Decree No. M/126.
1. Statutory Legal Mandate & Saudi E-Commerce Law (Royal Decree No. M/126)
Electronic commerce in the Kingdom of Saudi Arabia is governed primarily by the Saudi E-Commerce Law (Nizam Al-Tijarah Al-Iliktroniyyah - Royal Decree No. M/126) and its Executive Regulations promulgated by the Ministry of Commerce (MoC).
Enacted under the Vision 2030 National Transformation Program, the statute fundamentally transformed the digital marketplace by establishing rigid legal definitions, standardizing electronic contracting, and creating an inter-agency supervisory framework overseen by three primary government bodies:
1. Ministry of Commerce
Formulates commercial regulations, conducts digital compliance audits, prosecutes fraudulent practices, and issues punitive administrative closure orders.
2. Saudi Business Center
Operates the centralized digital store verification gateway (Tawtheeq Al-Matajir), issuing cryptographic QR trust seals and verifying merchant banking credentials.
3. E-Commerce Council
Coordinates strategic policy between SAMA (fintech rails), ZATCA (e-invoicing), and CST (national domain and telecommunications infrastructure).
Statutory Scope: Universal Jurisdiction Over Digital Commerce
Under Article 2, the E-Commerce Law applies universally to: (1) Any commercial service provider or merchant established within the Kingdom, and (2) Any international merchant or cross-border platform that markets, displays, or sells goods and services to consumers located physically inside Saudi Arabia. Claiming that an e-commerce platform is hosted outside the Kingdom does not shield the merchant from domestic consumer protection mandates, CST domain blocks, or ZATCA customs import seizures.
2. The Two Lawful Pathways to Selling Online: CR vs Freelance Document
To legally operate an online storefront, digital marketplace, or social media store in Saudi Arabia, a merchant must hold verified commercial status through one of two mutually exclusive statutory mechanisms:
| Evaluation Dimension | Commercial Registration (CR - Sijil Tijari) | Freelance Document (Wathiqah Al-Amal) |
|---|---|---|
| Eligible Beneficiaries | Saudi Citizens, GCC Nationals, and Foreign Investors (via MISA License). | Saudi Citizens & Premium Residency Holders ONLY. |
| Legal Entity Status | Full corporate entity (LLC, Sole Proprietorship, Joint Stock Company). | Individual professional accreditation; no separate corporate entity. |
| Corporate Bank Account | Full corporate commercial bank account with trade name. | Designated individual freelance account (linked to National ID). |
| Payment Gateway Access | Unrestricted integration with all commercial payment gateways (Mada, Apple Pay). | Supported on specialized e-commerce platforms (Salla, Zid, Tap, Moyasar). |
| Hiring & Sponsorship | Full authority to recruit Saudi & expatriate staff via Qiwa & Muqeem. | Zero foreign visa quotas; cannot sponsor expatriate personnel. |
| Statutory Cost | SAR 1,200/yr (MoC) + Chamber fee (SAR 2,000+) + SBC platform fee. | Free issuance via Ministry of Human Resources (Future Work). |
Severe Legal Hazard: Anti-Commercial Concealment (Tasattur)
Foreign expatriates residing in Saudi Arabia who operate online stores, sell products on TikTok/Instagram, or collect e-commerce payments into personal bank accounts without a formal MISA license and Commercial Registration commit a major criminal offense under the Anti-Commercial Concealment Law (Nizam Mukafahat Al-Tasattur). Penalties include: up to 5 years imprisonment, fines up to SAR 5,000,000, total asset confiscation, permanent deportation, and a lifetime commercial ban.
3. Maroof Digital Verification Tiers (Gold vs Commercial Badges)
Originally introduced as an independent platform, Maroof (معروف) has been integrated into the unified Saudi Business Center (SBC) Store Verification Engine (توثيق المتاجر). This digital infrastructure serves as the official trust registry validating legitimate e-commerce operators for Saudi consumers.
The Gold Verification Badge (Tawtheeq Thahabi)
To obtain the coveted Gold Verification Badge and display the official dynamic QR trust certificate, an online merchant must fulfill three non-negotiable technical requirements:
Mandatory Storefront Legal Disclosures
Under Article 5 of the E-Commerce Law, every verified storefront must visibly display the following legal data in its website footer and mobile application checkout flows:
- Commercial Registration (CR) / Freelance Document Number: Must match SBC records.
- Tax Identification Number (TIN): 15-digit ZATCA VAT registration number (if registered).
- Legal Trade Name & Physical Address: Official registered name and national address.
- Customer Service Communication Channels: Working phone number, email, and complaint portal.
- Clickable SBC Verification QR Code: Dynamic badge linking directly to the SBC trust registry.
4. Mandatory Consumer Protection Regulations (Articles 10 to 18)
The Saudi E-Commerce Law imposes stringent consumer protection obligations designed to maintain high trust in digital transactions. Failure to embed these statutory rules into store terms and conditions renders conflicting contractual clauses null and void by operation of law.
The 7-Day Unconditional Right of Withdrawal (Article 13)
Under Article 13, Paragraph 1, a consumer has the absolute statutory right to rescind an e-commerce purchase and return the merchandise within 7 calendar days from the date of physical receipt, without having to prove any product defect or non-conformity.
The merchant is legally obligated to execute a full cash or card refund within 14 calendar days of receiving the returned goods. The merchant cannot force the consumer to accept store credit or gift cards in lieu of their original payment method.
Statutory Legal Exceptions to the 7-Day Return Right
Under Article 13, Paragraph 2, the right of withdrawal is legally extinguished in the following specific commercial circumstances:
| Statutory Exception Category | Legal Condition / Prerequisite | Operational Commercial Examples |
|---|---|---|
| Customized / Bespoke Goods | Manufactured according to bespoke customer specifications. | Tailored abayas, custom-engraved jewelry, custom-cut furniture. |
| Perishable Goods | Subject to rapid spoilage or strict temperature sensitivity. | Fresh groceries, fresh flowers, prepared dairy, live flowers. |
| Unsealed Digital Software / Media | Packaging seal or digital access key has been broken. | Software licenses, gaming discs, unsealed audio recordings. |
| Hygiene & Personal Care Products | Protective hygienic seal opened after delivery. | Cosmetics, perfume bottles, underwear, personal medical devices. |
| Printed Publications | Content can be consumed immediately upon delivery. | Newspapers, trade magazines, physical textbooks. |
The 15-Day Delivery Delay Mandate (Article 14)
Timely logistics execution is an enforceable statutory duty. Under Article 14:
- If a merchant fails to deliver the purchased goods on the agreed delivery date, or within 15 calendar days from the date of contract execution if no specific date was set, the consumer acquires the immediate legal right to cancel the contract.
- Upon cancellation, the merchant must refund the full purchase price and shipping costs immediately, without imposing restocking fees or administrative deduction penalties.
5. SAMA-Approved Payment Gateway Integration & Fintech Rules
Digital payments in Saudi Arabia are strictly regulated by the Saudi Central Bank (SAMA). The national payment network, Mada (مدى), represents over 80% of all electronic point-of-sale and e-commerce transactions in the Kingdom.
Mandatory Payment Infrastructure Requirements
To maintain compliant e-commerce operations, online stores must adhere to the following standards:
1. Mandatory Mada & Apple Pay Rails
Every e-commerce checkout must provide seamless integration with the national Mada debit network and Apple Pay via SAMA-licensed payment aggregators (Moyasar, Tap, Geidea, HyperPay, PayTabs).
2. Licensed BNPL Compliance
Buy Now Pay Later (BNPL) services can only be offered through SAMA-licensed providers (Tabby, Tamara). Stores cannot offer informal deferred financing without central bank authorization.
Criminal Prohibition of Personal P2P Bank Transfers
Instructing consumers to transfer purchase sums to a personal individual bank account (P2P wire transfer) is strictly prohibited under joint MoC and SAMA regulations. Banks monitor high-velocity personal accounts for commercial inflows, automatically freezing funds and referring account holders to the General Department of Financial Investigation for suspected commercial fraud and tax evasion.
6. Taxation, Customs & ZATCA E-Invoicing for Online Stores
Digital retail operations must comply with the comprehensive tax mandates enforced by ZATCA (Zakat, Tax and Customs Authority), encompassing Value Added Tax (VAT) and the national Fatoora E-Invoicing Program.
E-Commerce VAT Thresholds
- Mandatory VAT Registration: Required if annual taxable e-commerce turnover exceeds SAR 375,000 across any 12-month rolling window.
- Voluntary Registration: Permitted once annual sales surpass SAR 187,500, enabling the store to reclaim input VAT paid on inventory, warehousing, and marketing expenses.
- Standard VAT Rate: 15% applied uniformly across consumer goods, delivery fees, and service charges.
ZATCA Phase 2 E-Invoicing at Checkout
Under the Fatoora mandate, e-commerce engines (Shopify, Salla, Zid, WooCommerce, Magento) must be integrated via REST API with the ZATCA Phase 2 clearance platform:
Cross-Border E-Commerce Customs Clearance
For international e-commerce platforms shipping goods into Saudi Arabia:
- Consignments Under SAR 1,000: Subject to 15% import VAT; exempt from standard customs tariffs if classified for personal consumer use.
- Consignments Exceeding SAR 1,000: Subject to 15% import VAT plus applicable customs duties (ranging from 5% to 20% depending on HS Code classification).
- Foreign platforms must register as non-resident taxable persons or appoint an authorized Saudi tax representative to clear import taxes smoothly.
7. Advertising, Influencer Endorsements & The Mawthoog License
Commercial advertising in digital commerce is heavily regulated to protect consumers from fraudulent, exaggerated, or unverified claims. Online marketing is governed jointly by the Ministry of Commerce and the General Authority of Media Regulation (GAMR).
The Mandatory Mawthoog License Mandate
Under Council of Ministers Decision No. 433, any individual (Saudi citizen, foreign resident, or visiting content creator) who publishes commercial advertisements or paid product endorsements on social media platforms (Snapchat, Instagram, TikTok, YouTube, X) must hold an official Mawthoog License (رخصة موثوق) issued by GAMR.
- Merchant Liability: An e-commerce brand that contracts with an unaccredited influencer who lacks a Mawthoog license is held jointly liable under the law.
- Statutory License Fee: SAR 14,000 for a 3-year validity license.
- Advertising Disclosure: All sponsored content must explicitly state that it is an advertisement (e.g., using the hashtag
#إعلانor#Adprominently at the beginning of the post).
Prohibited Deceptive E-Commerce Tactics
Article 10 of the E-Commerce Law strictly prohibits the following marketing manipulations:
8. Administrative Fines, Domain Blocking & Judicial Sanctions
Enforcement committees within the Ministry of Commerce possess broad administrative powers to sanction non-compliant e-commerce merchants under Article 19 of the Saudi E-Commerce Law:
| Sanction Classification | Statutory Threshold / Measure | Execution Mechanism |
|---|---|---|
| Administrative Financial Fine | Up to SAR 1,000,000 | Assessed by the Violations Adjudication Committee based on infraction gravity and repeat counts. |
| Digital Domain Suspension / Blocking | Immediate DNS / IP Blacklisting | Executed in real-time via the Communications, Space & Technology Commission (CST). |
| Payment Gateway Freeze | Merchant Account De-authorization | SAMA directs payment processors to terminate Mada merchant contracts and freeze settlement balances. |
| Public Defamation (Tash-heer) | Publication in National Media | Full court judgment published in national newspapers and digital media at the offender's expense. |
| Permanent Store Revocation | Commercial Registration Cancellation | Cancellation of CR/Freelance Document and permanent bar from e-commerce licensing. |
9. Technical Troubleshooting Matrix (Top 10 Maroof Errors)
When setting up or maintaining verified e-commerce platforms, merchants frequently encounter verification rejections and integration blocks. The following matrix details the top 10 technical bottlenecks and their resolution workflows:
| Error Code | System Rejection Notice | Root Cause Analysis | Immediate Corrective Protocol |
|---|---|---|---|
| ERR-MR01 | Payment Gateway Webhook Desync | SAMA-compliant payment aggregator rejected webhook callbacks due to expired HMAC token. | Regenerate API keys in merchant portal (Moyasar/Tap) and update webhook secret in store settings. |
| ERR-MR02 | Freelance Activity Mismatch | Selected freelance category on Wathiqah does not cover the physical products sold on storefront. | Issue supplementary Freelance Document on Future Work covering specific commercial craft or upgrade to CR. |
| ERR-MR03 | Ejar National Address Unlinked | Store verification stalled because registered commercial lease is not geocoded to Saudi Post SPL. | Link active Ejar contract to company's National Address via the Saudi Business Center portal. |
| ERR-MR04 | Missing ZATCA Phase 2 Stamp | Digital checkout invoice lacks cryptographic CSID stamp and compliant Phase 2 QR payload. | Activate ZATCA Fatoora Phase 2 integration app/plugin on Salla, Zid, or custom ERP engine. |
| ERR-MR05 | Mada Merchant Account Blocked | Bank KYC identified merchant account using an unverified personal account rather than corporate IBAN. | Submit active Commercial Registration and corporate mandate to bank to activate Mada V-Terminal. |
| ERR-MR06 | Return Policy Non-Compliant | Store footer displays illegal “No Returns or Exchanges” clause violating Article 13. | Update store return policy to state mandatory 7-day right of return and 14-day cash refund protocol. |
| ERR-MR07 | Foreign Expatriate Flag | Store ownership linked to non-Saudi resident without an active MISA Foreign Investment License. | Cease retail operations immediately; establish a 100% foreign-owned LLC under MISA regulations. |
| ERR-MR08 | Chamber SADAD Fee Pending | SBC verification badge blocked due to unpaid Chamber of Commerce annual membership invoice. | Query SADAD Biller Code for Chamber of Commerce (e.g., Code 048 for Riyadh) and settle balance. |
| ERR-MR09 | Mawthoog Advertising Violation | Campaign launched with social media influencer lacking active GAMR Mawthoog accreditation. | Audit all influencer partners; contract exclusively with verified Mawthoog license holders. |
| ERR-MR10 | SaudiNIC Domain Conflict | Store applying for `.sa` or `.com.sa` domain lacks matching Commercial Registration trade name. | Submit MoC CR certificate proving legal trade name ownership to CST SaudiNIC domain registry. |
10. Statutory Frequently Asked Questions (FAQs)
Q1.Is Maroof / Saudi Business Center (SBC) verification mandatory for selling online in Saudi Arabia?
Yes. Under Article 4 of the Saudi E-Commerce Law, every commercial website, mobile application, or social media store engaging in electronic commerce directed at consumers in the Kingdom must possess verified legal standing either through a Ministry of Commerce Commercial Registration (CR) or an official Freelance Document (Wathiqah) authenticated on the unified Saudi Business Center (SBC) platform.
Q2.Can an expatriate resident obtain a Freelance Document (Wathiqah) to sell goods online?
No. The standard Freelance Document issued through the Future Work / MHRSD portal is strictly restricted to Saudi citizens and accredited Saudi Premium Residency (Iqama Mumayyaza) holders. Standard expatriate residents are legally barred from operating solo home-based e-commerce stores using personal accounts under the Anti-Commercial Concealment Law (Tasattur). To sell legally, foreigners must incorporate an LLC with a MISA investment license.
Q3.What is the statutory Right of Return (Right of Withdrawal) under Saudi E-Commerce Law?
Under Article 13 of the Saudi E-Commerce Law, consumers have an unconditional statutory right to terminate the purchase contract and return any physical goods within 7 calendar days of receipt without providing justification, provided the goods remain unused and in their original packaging. The merchant must refund all paid sums within 14 days.
Q4.What products are legally exempt from the 7-day e-commerce return policy in KSA?
Under Article 13, Paragraph 2, products exempt from return include: (1) Goods custom-manufactured to consumer specifications, (2) Perishable items or goods with short expiration dates, (3) Video tapes, compact discs, or software programs that have been unsealed, (4) Newspapers, magazines, and printed books, and (5) Health and personal hygiene products once opened.
Q5.What is the 15-day delivery delay rule under Saudi E-Commerce Law?
Under Article 14, if an online store fails to deliver purchased goods within the contracted delivery timeline, or within 15 calendar days from the date of contract execution where no specific date was agreed, the consumer acquires the immediate legal right to cancel the transaction and receive a full, unconditional refund of all paid amounts and shipping fees.
Q6.Can an online merchant accept payments via direct personal bank transfers in Saudi Arabia?
No. Direct personal bank account wire transfers (P2P) for commercial transactions are strictly prohibited under Ministry of Commerce and SAMA regulations. All commercial e-commerce storefronts must integrate a licensed payment gateway supporting the national Mada card rail, Apple Pay, or SAMA-licensed Buy Now Pay Later (BNPL) platforms.
Q7.What is the difference between Maroof and the Saudi Business Center (SBC) Store Verification?
The Ministry of Commerce transitioned the regulatory verification functions of the legacy Maroof platform into the unified Saudi Business Center (SBC) Store Verification Engine (Tawtheeq Al-Matajir). SBC verification provides a cryptographically secure QR trust seal confirming that the store's CR/Freelance Document, commercial bank account, and digital domain are verified.
Q8.What is the VAT threshold for e-commerce stores in Saudi Arabia?
An online store must register for standard 15% Value Added Tax (VAT) with ZATCA if its taxable annual turnover exceeds SAR 375,000 over any 12-month rolling period. Voluntary registration is permitted if annual revenue exceeds SAR 187,500. Failure to register upon reaching the threshold triggers a SAR 10,000 fine plus retroactive tax assessments.
Q9.Are e-commerce stores required to integrate ZATCA Phase 2 E-Invoicing?
Yes. Online stores operating in Saudi Arabia that meet the revenue wave thresholds set by ZATCA must integrate their checkout and order management systems with the ZATCA Fatoora Phase 2 portal. Every digital order confirmation must automatically generate a compliant XML cryptographic e-invoice with a valid Phase 2 QR code.
Q10.What is the Mawthoog license, and is it required for e-commerce advertising?
The Mawthoog license is a mandatory regulatory accreditation issued by the General Authority of Media Regulation (GAMR). Any social media influencer, digital creator, or advertiser publishing sponsored commercial advertisements or paid product promotions in Saudi Arabia must hold an active Mawthoog license.
Q11.What is the maximum statutory fine for violating the Saudi E-Commerce Law?
Under Article 19 of the Saudi E-Commerce Law, violators face administrative fines of up to SAR 1,000,000, temporary or permanent closure of the online store, domain blocking by the Communications, Space & Technology Commission (CST), and public naming and shaming (Tash-heer) in national newspapers at the offender's expense.
Q12.Can an e-commerce store operating outside Saudi Arabia sell to Saudi consumers?
Yes, cross-border e-commerce is permitted. However, foreign platforms actively targeting the Saudi market must comply with consumer protection provisions (7-day return policy, Arabic contract disclosures), collect 15% import VAT, and ensure shipments exceeding SAR 1,000 are declared through ZATCA customs clearing systems.
Q13.What mandatory information must be displayed on a Saudi e-commerce website footer?
Under Article 5, an online store must clearly display: (1) Commercial Registration (CR) or Freelance Document number, (2) ZATCA Tax Identification Number (TIN), (3) Legal commercial trade name, (4) Physical geographical address, (5) Official contact email and phone number, and (6) Clickable SBC / Maroof verification trust seal.
Q14.How does the Personal Data Protection Law (PDPL) apply to online stores in KSA?
Under the Saudi PDPL, e-commerce merchants cannot collect customer personal data (phone numbers, national IDs, locations) beyond what is strictly necessary to fulfill the commercial order. Merchants are prohibited from retaining customer payment details without consent, selling customer lists, or transferring consumer data abroad without legal authorization.
Q15.What happens if an online merchant falsely advertises fake discounts or artificial scarcity countdowns?
Deceptive marketing practices—such as inflating pre-discount prices, utilizing fake countdown timers, or publishing unverified fabricated consumer reviews—constitute direct violations of Article 10 of the E-Commerce Law and the Anti-Fraud Law, exposing the merchant to fines up to SAR 1,000,000 and store suspension.
11. Companion Compliance Hubs & Interactive Calculation Engines
E-commerce compliance directly intersects with corporate formation, taxation, e-invoicing, and digital labor rules. Utilize our specialized companion guides:
Implement Phase 2 Fatoora cryptographic e-invoices, manage 15% VAT returns, and prevent tax penalties.
Establish a 100% foreign-owned LLC in Saudi Arabia to operate legal e-commerce and retail storefronts.
Manage digital labor contracts, logistics personnel quotas, and Saudization tiers for your e-commerce operations.
Ensure electronic salary disbursement and 80%+ WPS compliance for warehousing and fulfillment teams.
Need Expert Help?
Get a free 30-min consultation on ZATCA, GOSI, or business setup from a licensed advocate and GCC VAT certified specialist.