The First 100 Operating Days After Saudi Incorporation: From Legal Entity to Controlled Business

Incorporation is day zero, not launch day. During the first 100 operating days, the company must become able to contract, invoice, employ, deliver, and report without depending on one founder, adviser, mobile phone, or spreadsheet. Sequence authority, permissions, finance, people, and controlled transactions before the board decides whether to scale, remediate, or freeze obligations.

This plan is a governance framework, not an official universal timetable. The order and requirements vary by entity, activity, city, premises, workforce, product, customer, and tax position. The Saudi authority or licensed specialist responsible for each matter should confirm the live requirement and completion evidence.

Define “operating” as five separate permissions

A commercial registration does not mean every business process is ready. Track five gates:

Contract-ready: the entity’s registered activities, sector permissions, signatory powers, contract templates, and customer qualification support the transaction.
Invoice-ready: tax treatment, registration, invoice content, electronic-invoicing solution, credit/debit process, accounting and records are configured.
Employ-ready: establishment files, employment contracts, social insurance, payroll, work authorisations, policies, and workplace arrangements are operational.
Deliver-ready: premises, municipal or safety approvals, product/import route, vendors, data, quality, warranty, insurance, and continuity controls are in place.
Control-ready: bank and system rights, segregation of duties, parent reporting, compliance, document retention, incident escalation, and audit evidence work in practice.

Do not use a green “company incorporated” status to hide four red operating gates.

Days 0–10: freeze the legal baseline and control access

Create a legal-entity record from authoritative documents: Arabic and English name, investment registration, commercial registration, constitutional document, activities, managers or directors, capital, registered and national address, fiscal year, licences, beneficial ownership information, and renewal dates. Record the issuing authority and verification link rather than circulating uncontrolled scans.

Prepare a reserved-matters and delegation schedule. Identify who may sign customer and supplier contracts, open and operate accounts, hire, dismiss, borrow, give guarantees, appoint agents, settle disputes, access tax or labour systems, and issue powers of attorney. Where the constitutional documents and parent policy do not align, resolve the conflict before transactions.

Build an access register for government, banking, accounting, payroll, domain, cloud, and customer systems. Record owners, users, mobile dependencies, recovery, approvals, and removal. An adviser’s personal account must never be the company’s only access route.

Saudi counsel should confirm how the Companies Law, constitutional documents, and valid resolutions establish authority rather than relying on an English corporate title.

Days 11–25: make the physical and regulatory footprint true

Confirm that the real operating location matches the registered activity, lease, commercial record, municipality, national address, customer representations, insurance, and data or equipment needs. Saudi Post/SPL describes the official business address as the legal entity’s address for official communications and related regulatory purposes. Treat accuracy and access to notices as a control, not an administrative detail.

Map each activity to the licence or approval that permits it at that location. The Saudi Business Center’s municipal commercial-licence service refers to premises evidence and, where applicable, safety-related requirements and relevant Balady and Salamah conditions. Sector, profession, product, environmental, civil-defence, or customer permissions may add separate gates.

Set the obligations calendar to alert well before any registration, licence, lease, insurance, certificate, work authorisation, or power expires. Every date needs a primary owner and an approver.

Days 16–35: configure tax, accounting, and electronic invoices before revenue

Confirm the entity’s income-tax, Zakat where relevant, VAT, withholding, customs, transfer-pricing, payroll, and other positions with qualified Saudi tax advisers. Do not copy a rate table from a group model without mapping ownership, activity, transactions, and effective rules.

ZATCA provides a VAT registration service for businesses and current VAT laws and regulations. Registration obligations and timing depend on the facts; a tax identification number or commercial registration is not a substitute for a complete tax review.

Build the chart of accounts and Arabic/English master data around Saudi reporting, tax codes, related parties, projects, assets, inventory, source records, and parent consolidation.

Electronic invoicing is a system design task. ZATCA explains that a structured electronic invoice generated through electronic means is distinct from a scanned paper invoice, and that implementation has generation and integration phases. Confirm the entity’s applicable phase and configure invoice types, required fields, UUID/QR or integration requirements where applicable, credit and debit notes, archiving, access, backups, and change controls. Test rejected, cancelled, partially accepted, refunded, and foreign-currency transactions—not only a perfect invoice.

Run a “zero-value” or test environment rehearsal where permitted: quote, order, delivery evidence, acceptance, invoice, payment, credit note, ledger, tax report, and parent consolidation. No live invoice should be the first end-to-end test.

Days 20–45: open banking with real segregation of duties

Bank account opening is not complete when one executive can log in. Document account purpose, currency, funding source, authorised signers, transaction limits, payment creator, approver, beneficiary setup, payroll, card controls, statements, reconciliations, and emergency access. Ensure the bank mandate and internal delegation agree.

Before the first urgent payment, verify vendor identity, registration, tax data, bank account, conflicts, service evidence, related-party status, and any required integrity screening. Confirm bank-detail changes out of band.

Set a weekly 13-week cash forecast and compare it with actuals. Include capital, customer receipts, rent, payroll, tax, customs, insurance, professional costs, guarantees, inventory, and intercompany funding. Parent funding should have documented legal, tax, pricing, and approval treatment.

Days 25–60: build employment records and operational capability together

Design roles from the work needed to sell, deliver, account, comply, and support customers. Then confirm Saudization/Nitaqat, occupation-specific, immigration, qualification, and work-location implications under current rules. Do not treat Saudi hiring as a number added after expatriate roles are fixed.

HRSD describes core employment-contract information such as employer and employee details, wage and allowances, work type and location, start date, and duration. Its Qiwa contract-management service explains that the employee can approve, reject, or request amendment of the contract. Align the offer, approved employment contract, Qiwa record, payroll, GOSI, job description, working reality, and access rights.

Use GOSI’s employer information and Saudi labour advice for social-insurance treatment. Joiner, mover, and leaver workflows must align screening, contract, registration, payroll, benefits, devices, access, training, and final settlement. Give expatriate assignments a capability-transfer purpose and end date.

Days 40–75: qualify suppliers and rehearse delivery

Map the first customer promise into a delivery-control plan: contract scope, inputs, import or product approvals, supplier qualification, data, site access, health and safety, quality checks, acceptance, invoice trigger, warranty, complaint, incident, and continuity.

Classify suppliers by risk. Regulated subcontractors, customs brokers, cloud or payroll providers, engineers, and customer-facing agents require evidence of authority, ownership, competence, insurance, data access, conflicts, service, audit, and exit.

Rehearse one realistic failure, such as a held shipment, rejected invoice, bank-detail fraud attempt, data incident, or safety complaint. Record detection, decisions, communications, containment, evidence, and dated corrections.

Days 61–90: execute controlled transactions and prove the close

Limit the first live transactions by value, product, customer, and contractual complexity. Require a release checklist signed by commercial, legal, finance, tax, operations, quality, and compliance owners as relevant. Preserve evidence from quote to bank receipt.

Perform the first close as if audited: reconcile bank, receivables, payables, payroll, tax, assets, inventory, intercompany, accruals, and customer acceptance. Report cash, pipeline quality, overdue actions, complaints, workforce and licence status, exceptions, and forecast changes—not profit alone.

Test parent visibility. Can headquarters retrieve the signed contract, authority, invoice, delivery acceptance, tax treatment, payment, customer complaint, and approval trail without asking one person to assemble them? If not, the control system is not yet operating.

Days 91–100: hold an evidence-based operating review

The board or sponsor should choose among three outcomes:

Scale: all critical gates pass, controls work, and customer evidence supports the next commitment.
Operate with remediation: lawful operation can continue within defined limits while dated actions close non-critical gaps.
Freeze new obligations: a legal, licence, cash, safety, integrity, customer, or control issue prevents responsible scaling.

Day-100 checklist

Entity, activity, managers, address, permissions, and renewals are verified and current.
Contract, payment, hiring, data, government, bank, and system authorities are controlled and recoverable.
Tax positions, registrations, electronic invoicing, records, and first close have been reviewed.
Bank mandates, beneficiary changes, payments, reconciliation, and cash forecast work without one-person control.
Employment contracts, Qiwa, GOSI, payroll, duties, access, and actual work are reconciled.
Premises, municipal, safety, product, sector, customer, and insurance gates fit actual delivery.
Suppliers, complaints, incidents, continuity, and regulatory escalation are controlled and rehearsed.
The board has approved scale, bounded remediation, or a freeze based on evidence.

Common mistakes

Using a spreadsheet invoice while the ERP is “coming soon.” Electronic-invoicing requirements should be designed and tested before billing.

Scaling sales before completing one controlled close. Revenue volume amplifies weak customer master data, tax codes, acceptance evidence, and collections.

Clearly labelled scenario: technical-services company

Scenario—not a report of a real company. A newly incorporated foreign-owned technical-services company expects to begin customer work in week three. Its commercial registration is complete, but the lease does not yet support the intended activity, the bank account has a single approver, Qiwa contracts do not match allowance terms, and the invoicing tool produces PDFs without the required structured workflow.

Management pauses customer mobilisation, limits spending, resolves premises and licence dependencies, corrects employment records, implements dual payment control, and runs invoice tests before signing the first service acceptance. The company starts later than its sales target but avoids creating uncollectible invoices and uncontrolled payroll and site obligations. The scenario illustrates sequencing, not an official timeframe.

When licensed specialists are needed

Use Saudi licensed legal, tax, labour, immigration, customs, engineering, data, safety, accounting, and sector specialists when the company sets or changes activities, constitutional authority, regulated contracts, tax positions, electronic-invoicing scope, employment status, product/import routes, premises approvals, personal-data transfers, professional services, customer disputes, or closure plans. Specialists should provide facts assumed, authority, date, uncertainty, and completion evidence. Management remains responsible for integrating the advice into operations.

Executive questions for day 100

Which revenue can the company lawfully sign, deliver, invoice, and collect today?
Which critical action depends on one person, mobile number, adviser, or undocumented password?
Can the company complete payroll, tax, invoicing, and bank reconciliation if the general manager is absent?
Which licence, role, supplier, customer, or system creates the largest stop risk?
What did the first live transaction and first close disprove about the investment case?
What obligation would survive if the board froze new business tomorrow?

Executive conclusion

The first 100 days should convert legal existence into controlled operating evidence. Sequence authority before access, permissions before promises, systems before invoices, records before scale, and capability before dependency. A day-100 review is successful when the board can see exactly what the company may do, how it controls cash and conduct, what customers have proven, and where it must stop.

Official and primary sources

All sources were accessed on 2026-07-14. Requirements and service details must be checked live for the company’s facts.