CMA Auditor Rules 2026: Scope, Registration, Deadlines | Hespah LLC [Skip to main content](#main-content)[![Hespah LLC](https://centralcdn.hespah.com/home_logolight_file2png.webp)](/en)Search More [Home](/en) [Learning Hub](/en/courses) [About us](https://hespah.com/who-we-are) [Blog](/en/blog) [Contact Us](/en/contact) Login[New Account](/en/register) 1. [Home](/en) / 2. [Blog](/en/blog) / 3. CMA Auditor Rules Amended: What Changed CMA Auditor Rules Amended: What Changed ======================================= 2026-10-24 / 3 days ago What appeared in Umm Al-Qura on 23 October 2026? ------------------------------------------------ Umm Al-Qura published the amended CMA auditor rules on 23 October 2026, together with Capital Market Authority board resolution 3-106-2026. The resolution dropped the word "registration" from the title of the rules and stated that they apply from the date of their publication. Anyone auditing a listed company or an investment fund is therefore reading a new text today. The board issued the resolution on 29/2/1448H under the Capital Market Law promulgated by Royal Decree M/30 dated 2/6/1424H. The title is now "Rules for Auditors of Entities Subject to the Authority's Supervision" instead of "Rules for Registering Auditors of Entities Subject to the Authority's Supervision", while the original rules were issued by board resolution 1-135-2018 dated 12/4/1440H, corresponding to 19 December 2018. Dropping "registration" describes what the text actually does, because Article 1 sets the purpose of the CMA auditor rules as fixing the standards and conditions required of auditors of those entities: the registration requirement, its conditions and procedures, and the ongoing obligations on registrants, including the Authority's instructions on inspection and its results. Article 1 also states that the CMA auditor rules do not prejudice the obligations imposed by the Saudi Organization for Chartered and Professional Accountants under the Law of Accounting and Auditing Profession promulgated by Royal Decree M/59 dated 27/7/1442H. In short, a firm answers to both bodies. Who is covered by the CMA auditor rules? ---------------------------------------- Article 2 defines "entities subject to the Authority's supervision" in seven categories: the Exchange, the depository centre, the clearing centre, capital market institutions, investment funds, listed companies, and special purpose entities. Two of them carry a carve-out: capital market institutions licensed to arrange or to advise fall outside the scope, and so do special purpose entities whose purpose is issuing debt instruments in the context of securities crowdfunding. Whoever audits any entity in these categories falls under Article 5, because no person may carry out audit engagements for them unless registered with the Authority, and registration comes before appointment rather than after it. A firm nominated to audit an investment fund while unregistered therefore has to complete its registration first. ![The seven CMA-supervised entity categories and the two carve-outs](https://centralcdn.hespah.com/uploads/emils/17928317560.jpeg) Registration conditions in the CMA auditor rules ------------------------------------------------ The CMA auditor rules separate registration of the accounting firm in Article 7 from registration of the chartered accountant in Article 8. First the firm files its application on the Authority's form, then the chartered accountant files through his firm rather than directly. Condition Accounting firm (Article 7) Chartered accountant (Article 8) Licence Licensed to practise auditing under the Law of Accounting and Auditing Profession The same licence, plus the SOCPA fellowship Disciplinary record No judgment for fraud or any act breaching integrity or honesty in the ten years preceding the application Ten years for fraud, five for the offences in Article 10 of the profession law and for striking off, and two years for suspension Experience Enough audit managers holding the SOCPA fellowship or an equivalent fellowship accepted by the Authority Five years of practice after licensing, three of them at a supervisory level on entities supervised by the Authority or accepted by it or by a comparable foreign supervisor Internal set-up A quality management system, a technical documentation system, technical consultation arrangements, and adequate insurance against professional failure risks Full-time practice, and a firm registered with the Authority Fee Paid by the firm for its own registration Paid by the firm on his behalf Under Article 9 of the CMA auditor rules, the Authority may request additional information to be submitted within thirty days of its request, and may refuse to consider an application that misses that window. It also aims to study the application within thirty days of receiving the information and documents it considers necessary, then approves it, approves it subject to conditions and restrictions, defers, or refuses with reasons. Ongoing obligations under the CMA auditor rules ----------------------------------------------- Part Three of the CMA auditor rules carries the practical weight, because Article 10 sets fourteen conditions for the firm's continued registration and eleven for the chartered accountant. Four of them carry explicit deadlines that govern the firm's year: 1. **Transparency report:** published annually in Arabic and English on the firm's website within no more than four months of its financial year end, carrying the information in Annex 1, and kept publicly available for at least five years from publication. The firm also notifies the Authority and provides a copy in both languages as soon as it is published. 2. **Periodic data:** filed with the Authority on its prescribed form within the same window, four months from the financial year end (Article 14). 3. **Change notices:** seven days from any change in the information given to the Authority, including partner names, contact officers, address, website and email, and the articles of association, bylaws or commercial register (Article 12). 4. **Inspection results to the audit committee:** ten days from the firm receiving the Authority's final inspection results on a listed company audit file, which it passes to that company's audit committee. Some items bind immediately on knowledge rather than on a counted deadline: a lawsuit relating to the firm's work or to the practice of the profession, the opening of an investigation into any of the offences in the Law of Accounting and Auditing Profession, or any judgment or decision imposing a penalty or corrective or precautionary measures. The firm likewise informs the Authority as soon as it knows that a continuing registration condition is no longer met by it or by any registered chartered accountant working for it, and the Authority may then request further information or impose conditions and restrictions to address actual or potential effects. Some obligations call for a new internal record: the firm must keep a log of engagement team hours for every audit of a supervised entity and provide a copy on request. Where inspection results call for a remediation plan, the firm prepares it within the periods the Authority sets and implements it once approved. The registered chartered accountant, for his part, must devote sufficient working hours to every audit on which he signed a report. The sanction sits in Article 16: the Authority may suspend or cancel a registration, or restrict the activity, where the firm or the accountant breaches the Law or its implementing regulations or fails any registration standard or condition. Even stopping is regulated, because Article 17 requires a fair plan for clients: prior written notice to the Authority of the stopping date, its duration and reasons, reasonable advance notice to clients, completion of remaining engagements, and a report to the Authority on the steps taken. Liability for any error made before stopping nevertheless remains. ![Ongoing deadlines: four months, seven days and ten days](https://centralcdn.hespah.com/uploads/emils/17928317561.jpeg) What to do now -------------- 1. Fix your financial year end and count from it to both the transparency report and the periodic data dates. Four months is the ceiling for each. 2. Open Annex 1 and compare its items with what your firm publishes today, because it asks for the basis of partner remuneration, independence policies, the quality management system and its annual evaluation outcome, the Saudisation ratio, internal monitoring results, penalties and lawsuits, the client list with hours worked, and the financial figures in riyals. 3. Check that the practice licence and the insurance policy are both valid, because continued registration requires validity and a copy filed with the Authority at each renewal. 4. Appoint the registered chartered accountant responsible for contact with the Authority if none is appointed (Article 15), and leave with him a list of the immediate-notice events so that no lawsuit or penalty passes unreported. 5. Start measuring engagement team hours per engagement now, because assembling them retroactively at year end is harder than logging them weekly. 6. Read the version published on the Authority's website, since the rules themselves warn that the versions published there are the ones to rely on. If you are an accountant planning to work on listed company files, the path starts with the fellowship and then with supervisory years. See [the Saudi SOCPA fellowship: conditions and the full path](https://hespah.com/en/blog/socpa-fellowship-exam-guide), and also [SOCPA's amendment of professional exam eligibility](https://hespah.com/en/blog/socpa-professional-exams-eligibility). Those working inside capital market institutions follow a different track, because [registered functions at the Capital Market Authority](https://hespah.com/en/blog/cma-registered-functions-exams) carry their own exams, separate from these rules. FAQs on the CMA auditor rules ----------------------------- ### Does registration with the Authority replace the SOCPA licence? No, because a licence to practise auditing under the Law of Accounting and Auditing Profession is a condition of registration in the first place and of keeping it. Article 1 also states that the rules do not prejudice what the Saudi Organization for Chartered and Professional Accountants imposes. ### When do the amended CMA auditor rules apply? The adopting resolution states that they apply from the date of their publication, while Article 18 states that the rules take effect in accordance with the resolution adopting them. The full text was published in Umm Al-Qura on 23 October 2026. ### What about auditing a listed company before registration is complete? Article 5 prohibits it. Registration precedes appointment, and it falls on the firm and the chartered accountant alike. ### Can an accounting firm challenge an Authority decision? Yes, because Article 4 gives every person subject to the rules the right to file a grievance with the Committee for the Resolution of Securities Disputes against any decision or action the Authority takes under them. Sources ------- - [Umm Al-Qura · Capital Market Authority board resolution 3-106-2026 dated 1448/02/29H](https://www.uqn.gov.sa/decisions-and-regulations/4002167), published 23 October 2026 - [Umm Al-Qura · Rules for Auditors of Entities Subject to CMA Supervision, full text](https://www.uqn.gov.sa/decisions-and-regulations/4002164), published 23 October 2026 - [Capital Market Authority · the published version of the rules](https://cma.org.sa/en/RulesRegulations/Regulations/Documents/Rules-Registering-Auditors-of-Entities-EN_2026.pdf) This article was written on 24 October 2026 from the text of the CMA auditor rules published in Umm Al-Qura on 23 October 2026. This article is for information only and does not replace the official sources or advice from a specialist before taking any action. Articles you might like ----------------------- [![Management Discussion in the Board Report: the CMA Draft](https://centralcdn.hespah.com/249/conversions/cover-sm.webp)2026-10-24 ### Management Discussion in the Board Report: the CMA Draft The CMA draft requires a separate management discussion section in listed companies' annual Board report. Consultation c](/en/blog/cma-mdna-disclosure-draft)[![CMA Certification for a Saudi Accountant: Rules and Fees](https://centralcdn.hespah.com/246/conversions/cover-sm.webp)2026-10-24 ### CMA Certification for a Saudi Accountant: Rules and Fees CMA certification for Saudi accountants: membership, degree and experience rules, the fees, case-based questions from Se](/en/blog/cma-certification-saudi-accountant)[![SOCPA Fellowship Exam: Entry Rules, Papers and Fees](https://centralcdn.hespah.com/204/conversions/cover-sm.webp)2026-10-22 ### SOCPA Fellowship Exam: Entry Rules, Papers and Fees A full guide to the SOCPA fellowship exam in 2026: entry rules, the six subjects and eight papers, fees in riyals, exemp](/en/blog/socpa-fellowship-exam-guide)[![CMA Registered Functions: Which Exam Does Each Need](https://centralcdn.hespah.com/202/conversions/cover-sm.webp)2026-10-20 ### CMA Registered Functions: Which Exam Does Each Need A guide to the registered functions at the Saudi CMA: the five roles that require registration, the exams each one needs](/en/blog/cma-registered-functions-exams)[![SOCPA Amends Professional Exam Eligibility: Students In](https://centralcdn.hespah.com/200/conversions/cover-sm.webp)2026-10-20 ### SOCPA Amends Professional Exam Eligibility: Students In SOCPA amended the SOCPA professional exams eligibility rules on 18 October 2026: accounting students can sit four certif](/en/blog/socpa-professional-exams-eligibility) [![Hespah LLC](https://centralcdn.hespah.com/home_logolight_file2png.webp)](/en)Tax and Accounting Professional Training [Hespah ](/en)[Courses](/en/courses)[Blog](/en/blog)[Contact us](/en/contact)[Partners & Discounts](https://hespah.com/partners) [Policies ](https://hespah.com/privacy-policy)[Privacy Policy](https://hespah.com/privacy-policy)[Usage and Refund Policy](https://hespah.com/refund-policy) ### Contact us New Castle, DE, 19720 US ### Follow us [](https://www.facebook.com/HespahCo)[](https://www.instagram.com/hespahco)[](https://www.linkedin.com/company/hespahco/)[](https://x.com/hespahco)[](https://www.tiktok.com/@hespahco) ### Payment methods Visa Mastercard Apple Pay All Rights Reserved Hespah LLC © 2026 , Developed by [10 - Ashara](https://10ashara.com)