E-commerce authentication in Saudi Arabia: opening an online store

To open an online store legally in Saudi Arabia, first give the business a legal identity: a commercial registration that records your e-commerce activity and store link, or a freelance document if you sell as an individual. Then request e-commerce authentication in Saudi Arabia on the business platform, and set up the store to meet the E-Commerce Law's rules [1][2].

This guide uses the E-Commerce Law, its Implementing Regulations and the official service pages as we read them on 14 October 2026. It is general information, not legal advice: for a specific case, check the Ministry of Commerce's pages or ask a licensed lawyer.

Two legal routes: commercial registration or freelance document

The E-Commerce Law covers two kinds of seller. A "merchant" is a person entered in the commercial register who carries on e-commerce; a "practitioner" does the same without a commercial registration. Both are "service providers", and the law applies to both, as well as to practitioners abroad who offer goods or services to people in the Kingdom (Articles 1 and 2) [1]. The Implementing Regulations add that the activity counts as economic when the seller habitually carries it on for profit (Article 2) [3].

The Ministry of Commerce answers plainly that you can start e-commerce without a commercial registration by obtaining a freelance document from the freelance platform of the Ministry of Human Resources and Social Development [2].

A practitioner who later wants to become a merchant can apply to enter the store in the commercial register, giving their ID, address, contact details, activities and a description of the main store (Regulations, Article 12) [3].

Commercial registration for an online store

For most stores that plan to grow, the commercial registration is the base. The Ministry's sole proprietorship service costs SAR 500 and asks you to enter e-commerce data while you fill in the activities and capital [4]. Two conditions catch people out: the owner must not be a government employee, and may not already hold an active sole proprietorship registration [4]. If the activity needs a licence before issue, the licensing body's approval is attached [4]. A limited liability company costs more to set up: SAR 1,200 for registration plus SAR 500 for publication, with VAT [5].

After payment, the registration is issued and the establishment is registered automatically with the Ministry of Human Resources, ZATCA, GOSI, Saudi Post's national address and the chamber of commerce [4]. Each year, the annual confirmation of an establishment's registration costs SAR 500, and its form includes the e-commerce data [6].

Three rules shape the store's registration:

• Record the store link. The Ministry's answer is that the store link is added through the commercial registration issue or amendment service [2].
• Do it within 30 days. The Implementing Regulations require a merchant to enter the main online store in the commercial register within 30 days of creating it, giving the commercial registration number, the activities carried on through the store, and its description and address (Article 12) [3]. Article 15 of the law sets the underlying duty [1].
• Keep it current. Changes to that data are reported within 30 days (Regulations, Article 12) [3], and the Commercial Register Law requires any change to registered data to be updated within 15 days (Article 10) [7], so the 15-day limit is the safer one to work to.

An existing shop owner does not need a second registration: one registration may carry different activities with no requirement that they be related (Commercial Register Law, Article 9) [7]. If the store's brand is in English, reserving an English trade name costs SAR 500, against SAR 200 for an Arabic one [8].

E-commerce authentication in Saudi Arabia: what it is and how to apply

E-commerce authentication is the Ministry's way of showing shoppers that a real, identified seller stands behind a store. The Implementing Regulations require the Ministry to run a website for authenticating online stores, linked to licensed authentication bodies (Articles 13 and 14) [3]. Older guides point to Maroof; the route the Ministry documents today is the "E-commerce authentication" service on the business platform [2].

The steps, as the Ministry describes them [2]:

1. Log in to the business platform with the National Single Sign-On (Nafath).
2. From the Doing business menu, choose the Saudi Center for Competitiveness and Business, then the E-commerce authentication service.
3. Click New authentication request and choose the document type.
4. Accept the service conditions.
5. Fill in the basic data, contact details and contact channels, then submit.

The authentication data must cover, as relevant: the seller's name, address and contacts; whether they are a merchant or practitioner, and Saudi or foreign; their ID or commercial registration; the people authorised to sign and manage, for a company; the platform the store runs on; and any licences (Regulations, Article 15) [3]. If the store runs on its own domain, you may be asked to prove that you own it. The Center's guide to proving domain ownership, linked from its authentication platform, describes three methods: a TXT record in the domain's DNS, a meta tag named domain-verification in the site's head section, or a text file in the site's root folder [9].

Once authenticated, two duties follow: publish the authentication statement clearly in the store, and tell the authentication body about any change to the authenticated data within 30 days (Regulations, Article 16) [3]. Authentication also changes what the store must display: a seller registered with an authentication body need not show their name and address in the store or in each advertisement, though contact details are still required (Law, Articles 6 and 10) [1].

What the E-Commerce Law requires on your store

The table turns the law and its Implementing Regulations into a page-by-page checklist.

Two prohibitions apply to every advertisement: no false or misleading claims, and no logo or trademark the seller has no right to use (Article 11). If the Ministry finds a breach, it can order the advertisement removed within one day (Article 12) [1].

Customer data

Personal data in a store includes names, ID details, addresses, phone numbers, card and account numbers, and photos. The seller must protect it, keep it only to meet its obligations to the customer, and use it for advertising or marketing only with the customer's explicit prior consent (Regulations, Article 5) [3]. If the data is breached, the seller notifies the Ministry and the affected customers within three days (Regulations, Article 5) [3]. Customer accounts may be kept until the customer asks to close them, and closing must be clear and easy [3].

The Personal Data Protection Law adds a privacy policy, available to people when their data is collected, stating the purpose, the data collected, how it is stored, processed and destroyed, and the person's rights (Article 12, as amended) [10]. If your store platform or payment provider keeps data outside the Kingdom, our guide to data residency in Saudi Arabia explains the transfer conditions.

Returns, delays and refunds under the E-Commerce Law

These are the rules shoppers rely on, so build them into the store's policies.

• Seven days to cancel. A consumer may cancel within the seven days after receiving the product, or after contracting for a service, provided they have not used it or benefited from it. The consumer bears the costs of cancelling unless the parties agree otherwise (Article 13) [1].
• Exceptions in the law: goods made to the consumer's specifications (unless defective or not as agreed), used software and media, newspapers, magazines and books, damage caused by the consumer, accommodation, transport and catering, and downloaded software (Article 13) [1].
• Exceptions in the Regulations, unless agreed otherwise: perishable goods, goods that cannot be resold for health reasons, combined goods that cannot be restored, hotel, travel, car rental, transport and event bookings, custom-made goods, auctions, and goods whose price follows a volatile market, such as gold and silver (Article 11) [3].
• Fifteen days to deliver. Unless another delivery date was agreed, a consumer may cancel and recover what they paid if delivery or performance is more than 15 days late from the contract date or the agreed date, unless the delay is due to force majeure. You must also tell the customer about any expected delay (Article 14) [1].
• Order mistakes. A customer who reports an error in their order within 24 hours of sending it is entitled to have it corrected, unless they have already benefited from the product or service (Regulations, Article 4) [3].

Dalni, O AI's consumer-rights guide, shows the same rules from the shopper's side, for example when an online order is not delivered.

Selling on marketplaces and store-builder platforms

Marketplaces, store builders and payment or advertising services count as intermediary platforms when they enable e-commerce, for example by accepting orders or payments (Regulations, Article 18) [3]. They must ask for the seller's data, contact details, authentication statement and commercial registration where these exist, store them and hand them to the Ministry on request. They must also remove content that breaks the law and keep records of contracts concluded through them for at least three years (Article 18) [3].

In practice, expect a platform to ask for your registration or freelance document and your authentication statement before your store goes live. Selling through a platform does not move your own duties to it: the disclosure, invoice, return and delivery rules still apply to you as the service provider [1].

Choosing between a ready-made store platform and a store built for you is a separate decision; our guide to custom software development in Saudi Arabia sets out when each makes sense.

Penalties for breaking the E-Commerce Law

A breach of the law or its Regulations can lead to one or more of: a warning; a fine of up to SAR 1,000,000; a temporary or permanent suspension from e-commerce; and partial or full blocking of the online store (Article 18) [1]. In urgent cases, the Minister may block the store until the violation is dealt with and refer it to the violations committee within three days (Article 17) [1]. The committee weighs the seriousness of the breach, repetition, the size of the seller's activity and the harm caused (Article 19) [1].

Registration failures are covered separately: not registering, not updating data or not filing the annual confirmation can bring a fine of up to SAR 50,000 under the Commercial Register Law (Article 21) [7].

A launch checklist for a new online store

Illustrative example. A seller in Riyadh opens a store for handmade abayas under an English brand name, as a sole proprietorship with one employee. The first-year government fees come to SAR 1,500: SAR 500 for the English trade name reservation [8], SAR 500 for the registration [4] and SAR 500 for the chamber of commerce, fifth class [2]. In later years, the annual confirmation (SAR 500) and the chamber (SAR 500) come to SAR 1,000 [6]. Before the first sale, the seller works through this list:

1. Registration issued, with e-commerce data and the store link recorded [2][4].
2. Main store entered in the commercial register within 30 days of creation [3].
3. E-commerce authentication requested, and the statement shown clearly in the store [2][3].
4. Footer shows the contact details and the commercial registration name and number [1].
5. Privacy policy, complaints procedure and VAT number, if any, linked in the store [3][10].
6. Checkout shows the full price with delivery and taxes, the cancellation right and its costs, and a clear "place order" button [1][3].
7. Invoices carry the fields in Article 8 of the Regulations [3].
8. Return policy excludes made-to-measure abayas unless defective, as the law allows for goods made to the consumer's specifications [1].
9. Marketing messages carry an opt-out, and customer data is used for marketing only with explicit consent [3].
10. A delivery promise within 15 days, or another date agreed at checkout [1].

Your next step

Pick your route this week: a commercial registration if the store will hire, hold stock or take on a partner, or a freelance document if you are testing a product on your own. Then request e-commerce authentication in Saudi Arabia as soon as the store link is live, and go through the table above page by page before the first order. If you want to know who we are, O AI is a software and AI company in Al Khobar.