Wage Protection System Saudi: Full 2026 Guide

By Ishita Roy — Business Consultant, Noble Core · Updated June 2026

If you employ even one person in the Kingdom — Saudi national or expatriate — wage protection is not an optional back-office task. It is the data feed that tells the Ministry of Human Resources and Social Development (MHRSD) whether your payroll matches your registered contracts, and it quietly gates a long list of services you need every month: work-visa issuance, Iqama transfers, contract authentication, and even some tendering eligibility on Etimad.

This guide walks through what the system actually is, who it applies to, and exactly how to register, upload, and pay through Mudad — screen by screen — plus the documents you need, indicative costs, the errors that push compliance scores down, and how to keep everything green while you are still building the company.

What the wage protection system Saudi employers use actually is

The wage protection system Saudi Arabia introduced is a data-matching programme, not a bank product. Each month, the employer produces a payroll file listing every worker, their national ID or Iqama number, the salary components agreed in the registered contract, and the amount actually transferred. That file is compared against three other government datasets:

• Qiwa — the MHRSD labour platform holding your establishment file, employee list, and authenticated employment contracts.
• GOSI — the General Organization for Social Insurance record of registered wages used for contribution calculation.
• SAMA-licensed bank transfer data — proof that money genuinely moved from the company account to the employee account.

Where the three agree, the worker is counted as “protected” for that month. Where they disagree — a missing transfer, a salary lower than the contract, an employee on the establishment file who received nothing — the worker is flagged and the establishment’s compliance percentage falls.

Mudad is the platform most small and mid-sized employers now use to produce and submit that file. It began as an SME payroll service and has grown into the mainstream channel for wage protection filing, integrating directly with banks so that generating the file and executing the salary transfer happen in one session rather than two.

Why the compliance percentage matters more than the file itself

Employers often think of wage protection as “uploading a file.” In practice the output that matters is a percentage displayed against your establishment in Qiwa. That figure feeds the Nitaqat-linked service permissions. A healthy score keeps you able to issue block visas, transfer sponsorship of new hires, and renew work permits without friction. A poor or repeatedly missing score is the most common reason a company suddenly finds a routine Qiwa transaction blocked at exactly the wrong moment — usually the week a new hire is meant to land.

Who must comply in 2026

Coverage has widened in phases since the programme began, and by 2026 the practical answer for a new or foreign-owned company is simple: if you have a commercial registration and at least one employee on your Qiwa establishment file, you are in scope.

That includes:

• Limited liability companies formed under a MISA investment licence with 100% foreign ownership.
• Branches of foreign companies registered with the Ministry of Commerce.
• Saudi-owned establishments and companies of every size, including micro-employers with one or two staff.
• Companies whose only employees are the general manager and an administrative assistant — headcount does not create an exemption.

Domestic workers recruited through Musaned sit under a separate track with its own payment rules, so do not attempt to include a household driver or helper in a corporate wage file. Freelancers holding a freelance certificate are not employees and are not filed either; they are paid on invoice and, above the registration threshold, are subject to ZATCA VAT rules rather than payroll rules.

If you are still at the licensing stage and have not yet hired, the obligation begins the month your first employee appears on the establishment file. Many founders reach that point faster than expected, because the general manager listed on the MISA licence is themselves an employee and must be paid through the system. That is one of several reasons to sequence hiring properly during company formation in Saudi Arabia rather than treating payroll as a later problem.

What you need before you start

Registration fails most often because one upstream record is missing. Gather these first:

• Unified national commercial registration number — under the Commercial Register Law effective 3 April 2026, the CR is a single national record with an ID beginning with 7, with no expiry date; you file an annual confirmation instead of a renewal.
• Active Qiwa establishment account with the correct national address and the employee list populated.
• GOSI registration for the establishment, with each employee enrolled and a declared wage matching the contract.
• Corporate bank account at a Saudi bank, with online banking and a user authorised to release salary payments.
• Absher-verified mobile number for the authorised signatory or delegated administrator — one-time passwords route through it at almost every step.
• Employee data set: full name as printed on the Iqama or national ID, ID number, IBAN, basic salary, housing allowance, transport allowance, other allowances, and deductions.
• Authenticated employment contracts in Qiwa for each employee, because the contract wage is the benchmark the system compares against.

A recurring mistake: using a personal or foreign bank account to pay salaries. Transfers that do not originate from the company’s Saudi corporate account cannot be matched, so the employee is treated as unpaid no matter how much money actually reached them.

Step-by-step: registering on Mudad

The following sequence reflects the standard employer journey on mudad.com.sa. Screen labels are occasionally refreshed, so treat the wording as a guide and the sequence as the substance.

1. Open the portal and choose “Register” / “New Account” on the homepage, then select the employer or establishment path rather than the employee path.
2. Authenticate the owner or authorised person with the national ID or Iqama number and date of birth, then confirm the one-time password sent to the Absher-registered mobile number.
3. Select the establishment. The platform pulls the establishments linked to that ID from the Ministry of Commerce and Qiwa records. If your company is missing, the gap is almost always in Qiwa or the CR, not in Mudad.
4. Confirm establishment details — CR number, unified number (700 number), national address, and contact email. Correct any mismatch at source before continuing.
5. Accept the service terms and complete the subscription step for the tier that matches your headcount.
6. Link the bank. Under “Banks” or “Payroll Settings”, pick your Saudi bank and authorise the connection. Your bank’s own portal will usually require a matching authorisation from a signatory before the link goes live.
7. Import the employee list. Employees flow in from Qiwa/GOSI. Review each row and add the missing payroll fields — IBAN above all.
8. Set the payroll cycle: pay period, cut-off date, and the salary elements you use (basic, housing, transport, other allowances, deductions).
9. Run a validation. The platform flags employees with no IBAN, a wage below the registered contract, or an ID that does not resolve. Clear every flag before the first live run.

Expect the end-to-end setup, including bank authorisation, to take three to seven working days for a new company — mostly waiting on the bank rather than the portal.

Delegating access safely

Most companies do not want the owner personally logging in every month. Mudad supports delegated users, and Qiwa supports its own delegation. Grant the accountant or PRO the narrowest role that lets them prepare the file, and keep the release-of-payment authority with a signatory. This separation also survives staff turnover: you revoke one delegation rather than resetting the owner’s credentials.

Step-by-step: filing and paying each month

1. Open the payroll for the month from the dashboard. The current cycle appears with the employee list pre-loaded from the previous run.
2. Update variable items — overtime, commissions, unpaid leave deductions, end-of-service items for leavers, and new joiners added mid-month.
3. Handle exceptions explicitly. An employee on unpaid leave, on secondment, or who joined after the cut-off must be marked with the correct status rather than left at zero with no reason. Unexplained zeros are read as non-payment.
4. Review the totals screen and reconcile the grand total against your accounting system before proceeding.
5. Submit for approval. The authorised signatory receives the request and approves it in Mudad or in the bank portal, depending on the integration model.
6. Execute the transfer. Once approved, the bank debits the company account and credits each employee IBAN. Ensure cleared funds are in place a day early; a failed batch on the last permitted day is the classic cause of a bad month.
7. Confirm the upload status. The file is transmitted to the ministry’s systems and the run moves to “Completed” or the equivalent status.
8. Check the compliance result in Qiwa a few days later, under the wage protection section of your establishment file. Download the report and keep it.

Salaries in Saudi Arabia are due within the period set by the employment contract and the labour regulations — in practice, monthly-paid staff should be paid by the end of the first week of the following month, and the wage file should follow immediately. Filing early and paying early costs nothing; filing late costs you service permissions.

Indicative fees and timelines

Wage protection filing itself is a compliance obligation rather than a large cost centre. What you pay is the platform subscription and normal bank transfer charges. Figures below are indicative — confirm current figures on the official portal before budgeting.

Item	Indicative cost (SAR)	Typical timeline
Mudad subscription — micro employer (up to ~5 staff)	Often free or nominal tier	Activated same day
Mudad subscription — SME tier	~1,000–3,000 per year (indicative)	Activated 1–2 days
Bank payroll-file service / per-transfer charge	~1–5 per employee transfer (indicative)	Same day to next day
Corporate bank account opening (new company)	Bank-dependent; minimum balance may apply	2–6 weeks
Qiwa establishment subscription (annual, tier-based)	~800–2,400 per year (indicative)	Immediate on payment
GOSI contributions — Saudi employee	~21.5% of wage total (employer + employee shares)	Monthly
GOSI — non-Saudi employee (occupational hazards)	~2% employer-paid	Monthly
Iqama issue/renewal government fee	~650 per year plus applicable levies	1–3 days on Absher/Muqeem
Commercial registration (new company)	~1,200–2,000	1–3 days via Saudi Business Center
Chamber of Commerce membership	~2,000–3,000 per year	1–2 days
MISA licence issue/renewal	Fees suspended in 2026 (previously 12,000 / 62,000)	~3–10 business days for licensing
Monthly wage file preparation + submission	Internal or outsourced	1–2 hours once set up

Two adjacent numbers are worth holding in mind because they drive total payroll cost more than wage protection does: GOSI at roughly 21.5% combined for Saudi employees, and VAT at 15% on the services you buy, including outsourced payroll. ZATCA’s Fatoora e-invoicing rollout continues in waves, so your payroll provider’s invoices should already carry compliant e-invoice formatting.

How wage protection connects to your other government files

The wage protection system Saudi authorities run does not sit alone. It is one node in a network, and a break anywhere shows up here first.

Qiwa

qiwa.sa holds the establishment file, employee roster, authenticated contracts, and work permits. If a contract in Qiwa says SAR 12,000 and you pay SAR 10,000, the mismatch is visible immediately. Fix the contract through a proper amendment if the wage genuinely changed — never simply pay a different number.

GOSI

gosi.gov.sa carries the registered wage used for contributions. Under-declaring here to reduce contributions creates a permanent inconsistency across three systems and is not worth the saving.

Muqeem and Absher

muqeem.sa and absher.sa govern Iqama issuance, renewal, and exit/re-entry permits. An employee whose Iqama has lapsed can drop out of the wage file entirely, so a residency lapse quietly becomes a payroll compliance problem too.

Saudi Business Center, ZATCA, Balady and beyond

business.sa (the Saudi Business Center, with the Ministry of Commerce at mc.gov.sa) issues and maintains the commercial registration. zatca.gov.sa handles VAT and e-invoicing, balady.gov.sa the municipal licence, najiz.sa the judicial portal, etimad.sa government tendering, and monshaat.gov.sa SME support programmes. Bidders on Etimad are routinely asked to evidence labour compliance, so a strong wage protection record is a commercial asset, not just a regulatory one.

Reading your compliance status

Once a file is processed, your establishment receives a status. Typical outcomes:

• Compliant — the great majority of employees matched on amount and timing.
• Partially compliant — some employees matched, some flagged. Services usually stay open but the clock is running.
• Non-compliant — the file is missing, largely unmatched, or repeatedly late. Expect Qiwa service restrictions.

The right response to a partial result is forensic, not cosmetic. Download the detail report, identify each flagged employee, and classify the cause: wrong IBAN, amount below contract, employee not in GOSI, transfer executed from the wrong account, or a status that should have been recorded as leave. Then correct the underlying record and, where the platform allows, submit a corrective file for the affected period rather than waiting for next month to average it out.

Common mistakes to avoid

• Paying salaries in cash or from a personal account. The money moved, but the system cannot see it, so the employee counts as unpaid.
• Paying a round net figure that differs from the contract wage. Basic plus allowances must reconcile to the authenticated Qiwa contract.
• Leaving new joiners off the file for their first month instead of adding them with a partial-month amount and the correct start date.
• Leaving leavers on the file at zero rather than recording the termination in Qiwa and GOSI first.
• Recording unpaid leave as SAR 0 with no status. Unexplained zeros read as non-payment; use the leave status field.
• Using an IBAN belonging to someone else — a relative, a colleague, a money-transfer intermediary. Each employee needs an account in their own name.
• Funding the account on the deadline day. A rejected batch cannot always be re-run in time; fund it a day or two earlier.
• Declaring a lower wage in GOSI than you pay. Saves a little in contributions, guarantees a mismatch across systems.
• Ignoring the establishment’s national address and contact email — notifications go there, and companies miss warnings simply because the mailbox is unmonitored.
• Assuming a one-employee company is exempt. The general manager on the MISA licence is an employee and must be paid through the system.
• Letting a delegation lapse when the accountant leaves, so nobody can file until the owner re-authenticates through Absher.
• Treating the file as done at upload. Check the resulting status in Qiwa; an uploaded file is not automatically a matched file.

A practical monthly rhythm

Companies that never have a wage protection problem tend to run the same simple calendar:

1. Days 20–25 of the month: freeze variable payroll inputs — overtime, commissions, leave.
2. Days 25–28: reconcile the employee list against Qiwa and GOSI. Add joiners, remove leavers, amend any contract that genuinely changed.
3. Days 28–30: prepare the file in Mudad, clear all validation flags, confirm cleared funds in the corporate account.
4. Days 1–5 of the following month: approve and execute the transfer, then submit the file.
5. Days 5–10: pull the compliance report in Qiwa, archive it, and resolve any flagged employee immediately.

Archiving matters more than people expect. When a bank, a tender committee, or a government service asks you to evidence twelve months of compliant payroll, having the reports already saved turns a two-week scramble into a five-minute email.

Wage protection during the first year of a new company

Foreign-owned entities feel the pressure earliest, because the sequencing is tight: the MISA investment licence comes first, then the commercial registration, then the Chamber of Commerce membership, the national address, the Qiwa and GOSI files, the corporate bank account, and only then the ability to run a compliant payroll. If the bank account lags — and it frequently does, taking two to six weeks — you can arrive at your first payroll date without a compliant way to pay.

Two habits prevent this. First, start the bank account application the moment the CR is issued rather than after the first hire. Second, do not put employees on the establishment file before you can actually pay them through a Saudi corporate account. Getting the order right is part of getting the MISA licence in Saudi Arabia to translate into an operating business rather than a dormant registration.

Note also that under the 2026 Commercial Register Law the register no longer expires: instead of renewing, you submit an annual confirmation, English trade names are permitted, and a five-year grace period applies to existing registrations transitioning to the unified national CR. MISA licence issuance and renewal fees are suspended in 2026, which removes a recurring cost from the first-year budget — but none of that reduces the payroll obligation, which begins with your first employee.

How Noble Core helps

We handle wage protection as part of ongoing corporate compliance rather than as an isolated upload. For clients that typically means: registering the establishment correctly across Qiwa, GOSI and Mudad; mapping contract wages so the three systems agree from day one; arranging the bank linkage; running or supervising the monthly file; and monitoring the compliance percentage so problems surface in week one rather than at the moment a visa is blocked.

Where a company has no Saudi-based administrator, our PRO and mandoob service covers the government-relations legwork — Absher and Muqeem transactions, Iqama issuance and renewal, contract authentication, and the in-person steps that still need a representative on the ground.

For new entrants, our end-to-end company setup package starts from SAR 36,999 and covers the MISA licence application, commercial registration, Chamber membership, national address, and the labour and social insurance registrations that wage protection depends on. Because MISA licence fees are suspended in 2026, the first-year cost profile is unusually favourable for foreign investors — most activities also permit 100% foreign ownership, and MISA licensing typically completes in three to ten business days once the file is clean.

Saudi government platforms are continuously improved, and interfaces and fee schedules are updated as services evolve. Treat the figures here as indicative, confirm current figures on the official portal before you commit budget, and keep one person accountable for the monthly rhythm. Do those two things and wage protection stops being a risk and becomes what it is designed to be: routine proof that your company pays its people properly, on time, every month.

Frequently Asked Questions

What is the wage protection system in Saudi Arabia?

The wage protection system Saudi Arabia operates is an MHRSD programme that verifies employers pay staff correctly and on time through Saudi banks. Employers file a monthly payroll file, usually through Mudad, listing each employee’s ID, IBAN and salary. The data is matched against Qiwa contracts, GOSI wages and actual bank transfers to produce a compliance percentage.

Who must comply with the wage protection system in 2026?

By 2026, essentially every establishment with a commercial registration and at least one employee on its Qiwa file is in scope, including micro-employers and 100% foreign-owned companies formed under a MISA licence. Headcount creates no exemption. Domestic workers hired via Musaned follow a separate track, and freelancers on invoice are not filed as employees.

How do I register for the wage protection system on Mudad?

Go to mudad.com.sa, choose the employer registration path, authenticate with your national ID or Iqama plus an Absher one-time password, select your establishment, confirm the CR and national address, complete the subscription, link your Saudi corporate bank, import employees from Qiwa and add IBANs, then run validation. Allow three to seven working days, mostly for bank authorisation.

When is the monthly wage protection file due in Saudi Arabia?

Salaries are due within the period set by the contract and labour regulations, and in practice monthly-paid staff should be paid by the end of the first week of the following month, with the wage file submitted immediately after. Most compliant employers freeze payroll inputs around day 25, execute transfers in days one to five, and check Qiwa by day ten.

What does the wage protection compliance percentage mean?

The percentage shown against your establishment in Qiwa reflects how many employees matched on amount and timing across Qiwa contracts, GOSI records and bank transfers. Most employers target above 80% to keep services open. A low or missing score can restrict block visas, sponsorship transfers and work-permit renewals, which is when companies usually discover the problem.

How much does the wage protection system cost employers?

Filing itself is a compliance duty, not a major cost. Micro-employers often sit on a free or nominal Mudad tier, while SME tiers run roughly SAR 1,000-3,000 per year and banks charge about SAR 1-5 per transfer. These figures are indicative. Larger adjacent costs are GOSI at around 21.5% for Saudi employees and 15% VAT on outsourced services.

What are the most common wage protection system errors?

The frequent failures are paying from a personal or foreign account, paying a net figure that does not reconcile to the authenticated Qiwa contract, omitting new joiners in their first month, leaving departed staff at zero, recording unpaid leave as zero without a status, using another person’s IBAN, and funding the corporate account only on the deadline day.

Does a one-employee company need wage protection in Saudi Arabia?

Yes. A company whose only staff member is the general manager named on the MISA licence still files, because that manager is an employee on the Qiwa establishment file. The obligation starts the month your first employee appears there. New foreign-owned entities should open the corporate bank account as soon as the commercial registration issues, since account opening can take two to six weeks.