Saudi Arabia CIT Penalties and ZATCA Enforcement: What Finance Teams Must Know

Saudi CIT penalties are not discretionary — they are automatic consequences of defined trigger events. Once a penalty trigger occurs, the penalty accrues unless and until it is formally waived or challenged through the proper process. ZATCA does not routinely issue warnings before applying penalties.

There are four distinct penalty categories in the Saudi CIT framework: the non-filing penalty (for failure to file by the deadline); the delay penalty (for late payment of any tax amount); registration failure penalties; and the fraud penalty (for deliberate concealment or misrepresentation). These categories are cumulative — a company that fails to file and also fails to pay can face both non-filing and delay penalties simultaneously.

Understanding the structure is not academic — the compounding effect of penalties on a large, unaddressed CIT liability can be significant. A company that misses the filing deadline, makes no payment, and allows the position to remain unresolved for 12 months can face penalties equal to 25% of the underpaid tax plus 12% delay penalty (four 30-day periods × 1%), in addition to the underlying liability itself.

The non-filing penalty under Article 67 applies in several circumstances: failure to file the return within 120 days of the fiscal year-end; failure to use ZATCA’s prescribed return form even if filed on time; failure to pay the tax due per the return even if the return is filed correctly and on time; failure to notify ZATCA of cessation of activity within 60 days; and failure to file a partnership information return within 60 days.

When the filing deadline is missed, ZATCA applies the higher of two penalty calculations:

The “underpaid tax” is the difference between what the taxpayer paid by the deadline and the tax actually due — including any adjustments from ZATCA assessments that have become final. The penalty is calculated from the legally prescribed filing date, not from the date ZATCA raises a notice.

The delay penalty of 1% per 30-day period is the most commonly encountered penalty in Saudi CIT compliance. It applies automatically to any of the following:

• Late payment of tax per the annual return
• Late payment of tax per a ZATCA assessment
• Late payment of advance tax instalments (due at months 6, 9, and 12)
• Late payment of tax approved for installment payment
• Late remittance of WHT to ZATCA after the first ten days of the month following the month of payment

Two important qualifications: the 1% delay penalty does not apply if the delay is less than 30 days. This means a brief overrun — up to 29 days — is technically penalty-free. Beyond 30 days, the penalty accrues on the full outstanding amount for each complete 30-day period. Partial 30-day periods at the end of the delay are not counted.

The delay penalty and the non-filing penalty are not mutually exclusive — they can both apply to the same tax amount. Filing late creates the non-filing penalty based on the delay bracket. Not paying creates the delay penalty running from the payment due date. A company that both files and pays late will face both penalties on the same underlying liability.

Every CIT taxpayer must register with ZATCA before the end of their first fiscal year. Entities required to withhold tax must register before making the first WHT-applicable payment. Failure to register within the legally prescribed period attracts fixed penalties that are relatively modest compared to the ongoing compliance penalties — but they signal to ZATCA that the entity is non-compliant from its inception.

These are one-time fixed penalties for the registration failure itself — separate from any penalties for the underlying compliance failures (non-filing, underpayment) that will also apply to an unregistered entity that has been operating without ZATCA registration.

The fraud penalty under Article 77(b) of the Income Tax Law represents a qualitatively different category of non-compliance. It applies to a withholding taxpayer who conceals information or presents incorrect information to ZATCA, and who is obligated to remit withheld tax. Article 69 of the Implementing Regulations specifically applies the fraud penalty provisions to this context.

Fraud penalties are substantially higher than standard compliance penalties and can involve criminal referral in serious cases. Unlike the non-filing and delay penalties — which arise from procedural failures — the fraud penalty requires an element of deliberate misrepresentation. However, ZATCA does not need to prove criminal intent to apply the penalty; a finding that information was materially incorrect or concealed is sufficient.

The most common fraud penalty scenario in CIT audits involves WHT non-compliance — specifically, entities that have made payments to non-residents, withheld the tax, but failed to remit it to ZATCA while presenting incorrect WHT declarations. Finance teams should treat their WHT remittance obligations with the same rigour as their own CIT filing obligations.

ZATCA has broad authority to assess, reassess, and conduct audits of CIT taxpayers. The standard assessment period is five years from the return filing deadline. Where a return was filed late, or was incomplete, or failed to pay the correct tax, the period extends to ten years. Where fraud or deliberate concealment is involved, there is no statutory limitation on ZATCA’s right to assess.

ZATCA can issue estimated assessments — applying prescribed profit margins to gross revenues — in four main circumstances: non-filing; failure to maintain adequate books and records; failure to prove the correctness of a filed return; and failure to comply with required record formats. In any estimated assessment, no cost deductions are permitted. ZATCA applies the gross revenue figure and a minimum profit margin determined by activity type.

Objection and Appeal Process

A taxpayer who disagrees with a ZATCA assessment has a structured dispute process. First, a formal objection can be submitted to ZATCA’s Preliminary Objection Committee. If that does not resolve the dispute, an appeal can be made to the Higher Appeal Committee. From there, unresolved matters can be appealed to the Board of Grievances (Saudi Arabia’s administrative court system).

During the appeal process: the taxpayer must be properly represented; tax that is not in dispute must be paid; and a bank guarantee is typically required for disputed amounts. Appeal Committee resolutions are binding on both parties unless further appealed to the Board of Grievances.

• Missing the 120-day filing deadline: The most common penalty trigger. Solution: engage your CPA in January, complete financial statements by February, and file no later than mid-April. Never leave filing to the last week of April.
• Filing without a CPA certification on revenues ≥ SAR 1M: Treated as non-filing even if the return is submitted on time. Solution: confirm your CPA’s ZATCA registration before the year begins.
• Late advance payment instalments: Easy to miss as a mid-year obligation when the filing deadline gets most of the attention. Solution: calendar the three advance payment dates in your tax compliance tracker from the start of the fiscal year.
• WHT remittance delays: The monthly WHT statement is due within 10 days of the following month. Many companies with seasonal or project-based payments fall behind on WHT cycles. Solution: automate your WHT calendar and treat monthly remittance as a fixed treasury obligation, not an ad hoc task.
• Unregistered PE operating without a ZATCA registration: Creates retroactive liability stretching back to when the PE first arose, plus registration and non-filing penalties for every year. Solution: assess PE risk before operations begin, not during an audit.

Does ZATCA send a warning before imposing a penalty?

No — penalties are automatic consequences of defined trigger events under Saudi tax law. ZATCA does not issue advance warnings before penalties arise. The obligation to file and pay by the deadline is the taxpayer’s responsibility; ZATCA’s role is to assess and collect, not to remind. That said, ZATCA does issue formal penalty notices once a breach is identified, which is typically when an audit or a system cross-check flags the non-compliance.

Can penalties be reduced or waived?

Standard compliance penalties are not routinely waived. The Minister of Finance has the authority to write off tax and penalties in specific circumstances (bankruptcy, death, liquidation with no assets), but these are narrow grounds. The objection and appeal process allows taxpayers to contest the calculation of penalties and the underlying assessment — but if the penalty trigger is confirmed, the penalty itself is generally upheld. Voluntary disclosure before ZATCA identifies the issue may in some cases result in more favourable treatment, but this should be assessed case by case with qualified tax advisors.

How long does ZATCA have to audit a CIT return?

The general assessment period is five years from the return filing deadline. If the return was filed late, incomplete, or did not pay the correct tax, the period extends to ten years. For fraud or deliberate concealment, there is no statutory time limit — ZATCA can assess at any time. For ongoing assessments or appeals, the records must be retained until the matter is finally resolved.

What is the penalty for failing to withhold and remit WHT?

Failure to remit withheld tax to ZATCA by the 10th of the following month triggers the 1% delay penalty per 30-day period on the unremitted amount. If the entity collected WHT from a payment but deliberately failed to remit it to ZATCA, the fraud penalty provisions may also apply. The entity bears joint liability with the non-resident recipient for the correctly calculated WHT — paying it late is costly; not paying it at all is significantly more so.