What could follow the December deadline is an assessment cycle, not a filing cycle.

By Manish Bansal, Associate Partner, Dhruva Advisors, A Ryan Affiliate, Saudi Arabia

For most of the past five years, inter-alia, one of the major topics of tax conversation in Saudi boardrooms has been e-invoicing. Are we on the Fatoora platform? Which wave are we in? Has the ERP been configured or do we go with a third-party e-invoicing solution? Will we make the deadline?

Those were the right questions for the period we have just left. They are not necessarily the right questions for the period we are entering.

On 29 June 2026, the Zakat, Tax and Customs Authority (“ZATCA”), acting on a decision of the Minister of Finance, extended the Cancellation of Fines and Exemption of Financial Penalties initiative for a further six months, running from 1 July to 31 December 2026. It covers excise tax, value added tax, real estate transaction tax, withholding tax and corporate income tax. That much has been widely reported.

Less widely noticed is a condition set out in the accompanying guideline. If the Authority extends the initiative again past December, that further extension will not reach returns that fell due after 30 June 2026.

The Authority has not simply granted more time. It has informed the market, in advance, where the relief eventually stops. Whatever is announced in December, the clean-up window for historical positions is being drawn shut. For a tax administration, that is about as clear a statement as one can give.

What the regulator already sees

The reason this matters now, rather than in some indeterminate future, is that the Authority’s information position has changed fundamentally.

Wave 24 of the e-invoicing Integration Phase closed on 30 June 2026. Announced in September 2025, it captured every taxpayer whose VAT-subject revenues exceeded SAR 375,000 in 2022, 2023 or 2024. That figure is not arbitrary: it is the mandatory VAT registration threshold. In effect, the wave brought the entire registered population into scope.

And the direction has not stopped there. On 24 July 2026 – ZATCA published the criteria for Wave 25, halving the threshold to SAR 187,500 of VAT-subject revenue in 2022, 2023, 2024 or 2025, with integration required by 1 February 2027.

Under the Integration Phase, standard business-to-business invoices are cleared by ZATCA before they reach the buyer, and simplified business-to-consumer invoices are reported within twenty-four hours. Invoices must be issued in a prescribed structured format, carrying a cryptographic stamp and a unique identifier.

The Authority is therefore no longer reliant on what appears in a filed return. It holds the underlying transactional record, in structured form, close to real time, across the whole economy.

This is the shift most finance functions have not yet absorbed. For years, the Saudi assessment process began with an information request. In an environment of structured, near-live data, it begins instead with an anomaly the system has already identified. The taxpayer’s first substantive contact with the process is not a request for documents. It is a proposition to be answered.

Key exposure areas to be mindful of

In our experience, the following key areas could be more visible and exposed to assessment risk in the Kingdom once transactional data can be cross matched against declarations.

The first is permanent establishment risk arising from project delivery. Groups routinely deploy technical staff, secondees and subcontracted specialists into Saudi projects while treating the arrangement as an offshore supply.  Given that most KSA government portals are inter-linked, careful monitoring of in-Kingdom presence is critical, in particular, employees of non-resident companies undertaking fly-in/fly-out assignments in the Kingdom.  It is worth noting that the current tax law has no de minimis threshold for the creation of a permanent establishment.  Accordingly, even a single day of presence in the Kingdom could potentially give rise to a permanent establishment, although in practice, the ZATCA may apply a more facts-based approach when assessing whether a permanent establishment exists.

Second is related-party pricing, and here a change that took effect two years ago is still under-appreciated. Following amendments to the Transfer Pricing By-Laws, the transfer pricing provisions apply to zakat payers as well as taxpayers for financial years beginning on or after 1 January 2024, and Advance Pricing Agreements became available to both. For a Saudi family group with decades of intercompany arrangements built for operational convenience rather than for documentation, this is a material change in obligation, and one that many such groups have not yet worked through.

Lastly, needless to state that VAT audits are likely to get much more sophisticated with real time data and the data analytics and AI tools available.

What the amnesty covers, and what it does not

Many companies are counting on this window. It is worth being precise about what it covers.

The initiative covers late registration, late payment and late filing fines, penalties on the amendment or correction of a VAT return, and other financial fines imposed under Article 45 of the VAT Law, including field detection and e-invoicing violations. To benefit, a taxpayer must register where registration is required, submit the outstanding returns, and either pay the amounts due or obtain ZATCA’s approval for an instalment plan.

Two limits deserve emphasis. The initiative does not extend to penalties relating to tax evasion violations. And it operates on fines for returns falling due up to 30 June 2026.

There is also a point that no guideline states because it does not need to. The initiative waives penalties. It does not validate a technical position. A voluntary disclosure that corrects an arithmetic omission is a straightforward matter. A voluntary disclosure that reveals a contestable tax treatment is a different exercise entirely, because it puts a position on the record that will be read. The analysis must come before the filing, not after it.

Fewer than four months

For most groups, what remains to be done before 31 December is a short list. It is also, notably, not a systems exercise. The e-invoicing platforms are already built and connected. The work now is reviewing the positions those systems have been reporting all along.

Reconcile first. Take VAT/ Tax/ Zakat returns, customs declarations, withholding tax filings and audited financial statements for the open years and reconcile them against one another before ZATCA’s systems do it. Where the numbers do not tie, understand why, and document the reason contemporaneously rather than reconstructing it under assessment.

Then sort. Separate the genuine errors, which the current window is designed to resolve, from the judgement positions, which need to be assessed on their merits and defended with evidence that pre-dates the query.

Finally, treat documentation as a deliverable with a deadline. Substantiation assembled after an assessment notice arrives carries markedly less weight than substantiation prepared when the transaction occurred.

A regulator that publishes wave criteria six months ahead, that notifies taxpayers directly, that issues guidance with worked examples, and that tells the market in advance where relief will end, is behaving like the administration of a mature investment destination. That predictability is an asset for serious businesses, and it is what long-term capital looks for.

But predictability runs in both directions. The Kingdom has been clear about what it expects and when. The businesses that will move through the coming assessment cycle with least disruption are those that use the next few months to answer the questions before they are asked.

Disclaimer: This article is intended for general information only and does not constitute tax, legal, accounting or other professional advice. It reflects the tax rules in force as of the publication date, and the described regulatory landscape continues to develop. Readers should obtain professional advice appropriate to their own facts and circumstances before acting on any matter discussed.

By Joe David, CEO of Nephos Group

“Move to Dubai for tax.”

I hear this constantly. From founders, investors, crypto-native operators – people building real businesses who reduce one of the biggest decisions of their professional lives to a single line on a spreadsheet.

And honestly, it is the wrong way to think about it.

Tax should rarely be the sole reason to relocate. When it is, it is usually where things go wrong. The corporate structure is not set up correctly. The banking relationships are not in place. The founder leaves within 18 months because the deeper rationale was never really there. I have seen this pattern play out dozens of times over the past decade, and it almost always traces back to the same root cause: a decision built on a tax rate rather than a strategy.

The tax-first trap

Dubai’s zero per cent personal income tax rate is real, and it is significant. But leading with tax creates a narrow frame that obscures the fuller picture. Founders who relocate purely for a rate often fail to consider the operational realities of building in a new jurisdiction. They underestimate the compliance infrastructure required to make the move defensible. They overlook the substance requirements that tax authorities in their home countries will scrutinise. When the expected savings do not materialise cleanly, because the structure was an afterthought, disillusionment sets in fast.

This does Dubai a disservice. It reduces a genuinely world-class business environment to a line in a tax planning brochure. The city deserves better than that, and so do the founders making life-altering decisions based on incomplete thinking.

What the successful ones actually optimise for

The founders and investors who get the most out of Dubai are not chasing a tax rate. They are making a broader strategic move.

Jurisdictional access is a major factor. Dubai sits at the crossroads of Europe, Africa and Asia, offering time zone coverage and travel connectivity that few cities can match. For businesses operating across multiple markets, particularly in digital assets, fintech and professional services, that geographic positioning is a genuine competitive edge.

Then there is the capital environment. Dubai has become a magnet for institutional and private capital, with fund structures, family offices and venture vehicles establishing a permanent presence. The banking infrastructure, while still maturing in certain areas, has improved significantly. For crypto-native businesses in particular, the regulatory clarity offered by frameworks like the Virtual Assets Regulatory Authority (VARA) provides something that many Western jurisdictions still cannot: a clear, codified path to operating legally with digital assets.

The business ecosystem itself is another draw. The speed at which you can incorporate, hire, open accounts and begin operating is remarkable compared to legacy jurisdictions. Free zones offer tailored licensing, and the government’s responsiveness to emerging sectors – AI, blockchain, tokenised finance – signals a jurisdiction that is building forward rather than regulating backward.

And then, yes, there is the lifestyle. Climate, safety, connectivity, quality of infrastructure. These are not trivial considerations when you are asking a founding team to commit to a base for the next five to ten years.

Tax is often the outcome of all of this. It is not the strategy itself.

The compliance landscape is shifting

There is another reason the tax-first mindset is increasingly risky. The global compliance environment is tightening rapidly. The Crypto-Asset Reporting Framework (CARF), developed by the OECD, will require automatic exchange of information on crypto transactions between jurisdictions. The EU’s DAC8 directive introduces similar obligations across member states. The days of relocating and assuming your home country’s tax authority will not follow are numbered.

This means that substance, genuine economic activity, real operational presence, defensible corporate structures, matters more than ever. A Dubai relocation that is purely cosmetic will not survive scrutiny. One that is built on genuine strategic foundations, with proper advisory support and compliant structures, will.

The conversation worth having

None of this is an argument against moving to Dubai. Quite the opposite. For the right founder, with the right business, at the right stage, it can be a transformative decision. But that decision needs to be grounded in strategy, not arithmetic.

Before you start calculating your tax savings, ask the harder questions. Does your business model benefit from being in this jurisdiction? Can you build genuine substance here? Are your corporate structures defensible under international reporting frameworks? Do you have the advisory infrastructure to get this right from day one?

That distinction – between tax as a tactic and strategy as a foundation – matters more than most people realise. And it is a conversation worth having before you make any decisions.

By: Avi Pardo, Co-Founder & CBO, LeapXpert

Financial firms globally have similar playbooks for off-channel communications: ban the channel, run a training, and send attestations for signing. Yet, the conversations are still happening on personal phones. Calling that playbook ‘good enough’ only hides how little has changed.

More than 100 organisations have faced charges under the US Securities and Exchange Commission’s off-channel communications initiative, while other regulators have pursued similar failures. Yet the response is still another rule, another warning, another ban.

The missing piece is the psychology behind banning. Until firms understand what drives employees towards off-channel apps, even banned ones, the next record-keeping failure is already on its way.

Why employees find workarounds

These channels are already part of the client relationship. A banker may be chasing a decision, dealing with a concern or replying to a question that has come through on Signal, WeChat or WhatsApp. In that moment, getting back to the client takes priority.

If replying through the approved channel takes too long, creates operational friction, or disrupts the conversation flow, the employee is likely to answer somewhere else. The message gets sent, but the firm may never see the full exchange.

Psychologists have studied this response to bans for decades. Jack Brehm’s work on psychological reactance shows people can push back when they feel their freedom of choice has been restricted. Research into imposed workplace change points to the same response: people who feel pushed into a new way of working may quietly find another route. Someone reads the policy, completes the training and then uses a personal phone when a client needs an answer.

Daniel Wegner’s work on ironic rebound also helps explain why bans can misfire. Tell people often enough to avoid something and it can make it more appealing. The channel remains on the phone, the client is waiting and the approved route takes longer.

Once the conversation moves to a personal phone, the firm may never recover the full exchange. Employers also face legal limits on how far they can inspect a private device.

Governance beats the workaround

Governance should redirect behaviour instead of trying to suppress it. Employees need an approved route that works while the client conversation is happening, or the workaround will keep winning.

Financial firms still need clear rules and a complete record of business conversations. Regulators expect those messages to be kept, whether they were sent by email, text, WhatsApp or another service.

The problem usually shows up during an ordinary working day: between meetings, on a journey or while a client is waiting for an answer. If the approved channel holds things up, few people will pause the conversation to sort out the process. They will reply another way.

Businesses are losing valuable conversation data

Regulatory risk is obvious when messages go missing: a firm cannot supervise what it cannot see or produce records that were never captured.

Client conversations carry information a business would want to know: a concern raised weeks before a relationship starts to slip, pricing pushback that never reaches the CRM or a salesperson handling a difficult exchange in a way others could learn from. Repeated questions may also point to problems with onboarding, service or product design.

Governed communication creates a record the organisation can learn from. Applied responsibly, conversation data can support supervision, client service, dispute resolution, coaching and a clearer view of relationship risk.
That information is already being generated every day. The difference is whether it remains scattered across personal devices or becomes something the organisation can understand and act on.

Bring the conversation back into view

Plenty of companies have the basics in place: a policy, training and an approved tool. What is often missing is a setup that matches how people work and talk to clients.

The existence of a policy says very little about whether it works. ‘Good enough’ governance can leave a business with all the right paperwork while the same behaviour carries on underneath it.

A quick exchange can soon include a shared document, a follow-up question and another colleague joining the conversation. Messages, files, participants and timing all form part of the record, which needs to stay within the firm without someone rebuilding the exchange later.

If senior leaders use the same channels they have banned for everyone else, the policy is a sham. Employees follow what leaders do, rather than what the compliance manual says. Training can help, particularly when people understand the reason behind it. But explanations only go so far if the approved route slows down a live client conversation. Technology can capture the record, but leadership decides whether people take the rules seriously. No system can rescue a policy that senior figures ignore.

Keeping those exchanges within view gives the business more than a record for compliance. It can also pick up concerns, repeated questions and early signs that a client relationship is beginning to change.

More rules have not stopped the conversations. They have pushed them onto personal phones and out of sight. Calling that ‘good enough’ is no longer credible.