The certifiable management system standard for compliance — the systematic framework for managing the rapidly expanding legal, regulatory, and ethical obligations facing organisations in the UAE and Saudi Arabia.
ISO 37301 was published in 2021 as the certifiable successor to ISO 19600. It provides the structure, processes, culture, and governance arrangements that give an organisation confidence it meets its obligations — and can demonstrate it. In the UAE, where corporate tax (2023), AML/CFT regulations, data protection laws, labour law reform, and SCA ESG guidelines have multiplied compliance obligations dramatically, ISO 37301 provides the systematic approach that replaces reactive firefighting with predictive management.
In Saudi Arabia, ZATCA e-invoicing, PDPL data protection, SAMA regulations, CMA governance requirements, and Nazaha anti-corruption expectations have created a similarly demanding compliance environment. Nathan ISO Consulting builds compliance management systems that satisfy the specific UAE and Saudi regulatory frameworks governing your business — not generic compliance templates.
Regulatory and Legal Compliance — UAE
| Regulatory Framework | How This Standard Applies |
|---|---|
| UAE Federal Decree-Law No. 26/2020 on Anti-Corruption | Anti-corruption obligations apply to public and private sector organisations. ISO 37301 (typically alongside ISO 37001) provides the documented, systematic approach to anti-corruption compliance that regulators and prosecutors look for |
| UAE Federal Decree-Law No. 45/2021 on Personal Data Protection | Data protection compliance requires documented policies, training, data mapping, and breach management. ISO 37301 provides the management system making data protection compliance systematic |
| UAE Federal Corporate Tax Law (2023) | Corporate tax introduces registration, calculation, filing, and related party compliance obligations. ISO 37301 provides the framework for systematic management |
| DFSA (Dubai Financial Services Authority) — DIFC | DFSA requires regulated firms to maintain compliance management programmes. ISO 37301 provides the internationally recognised CMS framework satisfying DFSA conduct expectations |
| FSRA (Financial Services Regulatory Authority) — ADGM | FSRA requires ADGM-regulated entities to maintain compliance programmes. ISO 37301 maps to FSRA requirements |
| SCA (Securities and Commodities Authority) | DFM and ADX listed companies face SCA governance requirements including compliance management. ISO 37301 addresses these systematically |
Regulatory and Legal Compliance — Saudi Arabia
| Regulatory Framework | How This Standard Applies |
|---|---|
| ZATCA (Zakat, Tax and Customs Authority) | VAT, zakat, e-invoicing (Fatoorah), and customs compliance obligations. ISO 37301 provides the framework for managing ZATCA's expanding requirements systematically |
| SAMA (Saudi Central Bank) Regulations | Banks, insurance companies, and financial institutions regulated by SAMA face extensive compliance programme requirements. ISO 37301 provides the management system |
| CMA (Capital Market Authority) | Listed companies and capital market intermediaries face CMA compliance requirements. ISO 37301 provides systematic compliance management |
| Nazaha (National Anti-Corruption Commission) | Nazaha expects organisations to maintain internal controls and reporting mechanisms. ISO 37301 alongside ISO 37001 provides the systematic anti-corruption compliance programme |
| Saudi PDPL (Personal Data Protection Law) | Saudi data protection law requires documented compliance programmes — ISO 37301 provides the management system |
Where This Is Most Relevant — Key Locations
| Location | Industry / Application Context |
|---|---|
| Dubai — DIFC financial institutions | DFSA conduct regulation, AML/CFT, and culture supervision make compliance programme quality a regulatory compliance issue, not just governance best practice |
| Abu Dhabi — ADGM regulated entities | FSRA culture and conduct supervision creates the same expectations for ADGM financial services firms |
| Dubai and Abu Dhabi — Listed companies (DFM, ADX) | SCA ESG guidelines, corporate tax compliance, and data protection create a multi-regulatory compliance management challenge |
| UAE — Real estate sector | AML/CFT obligations for real estate agents and developers under UAE anti-money laundering regulations |
| Saudi Arabia — Riyadh (Tadawul listed, SAMA regulated) | CMA governance, SAMA regulations, ZATCA e-invoicing, Saudi PDPL — multiple intersecting compliance obligations |
| Saudi Arabia — All commercial entities | Nitaqat, ZATCA tax, PDPL, and anti-bribery obligations under Nazaha across the commercial sector |
What the Standard Requires
| Requirement Area | What It Means in Practice |
|---|---|
| Leadership and governance ownership | Governing body and senior management must take active ownership — not delegate compliance entirely to a compliance department |
| Compliance obligations register | A structured, maintained register of all applicable legal, regulatory, and contractual obligations — specific requirements that apply to this organisation |
| Compliance risk assessment | Each obligation assessed for compliance risk, with prioritised controls identified and documented |
| Compliance culture | Leadership behaviours and organisational norms that determine whether compliance happens in practice — addressed explicitly |
| Speak-up mechanisms | Channels for reporting concerns without fear of retaliation — connecting to ISO 37002 whistleblowing management |
| Monitoring and incident management | Compliance performance measured and tested; non-compliance incidents investigated, root-caused, and used to improve the system |
Why Nathan ISO Consulting — What We Do Differently
Nathan ISO Consulting builds compliance management systems to the specific UAE and Saudi regulatory frameworks governing your business — not a generic international compliance template applied regardless of jurisdiction.
| What We Do Differently | How It Benefits Your Project |
|---|---|
| We map to your specific regulators (DFSA, FSRA, SAMA, CMA, ZATCA) | Your ISO 37301 CMS is built around the regulators and laws that govern your business — not a generic list of international compliance topics |
| We integrate ISO 37301 with ISO 37001 (anti-bribery) | Most organisations benefit from both implemented as an integrated ethics and compliance programme. We design them together, not as two parallel systems |
| We understand the GCC compliance culture dynamic | Compliance culture in the UAE and Saudi Arabia has specific dynamics. We design speak-up mechanisms and awareness programmes calibrated for GCC organisational contexts |
| We provide compliance horizon scanning after delivery | UAE and Saudi compliance obligations are expanding rapidly. We maintain awareness of new requirements and update your obligations register as the landscape changes |
| We prepare for DFSA and FSRA culture assessments | Financial services regulators assess culture as a conduct risk factor. We build programmes that satisfy what DFSA and FSRA supervisors specifically look for |
Frequently asked questions
ISO 37301 is the certifiable management system standard for compliance, published in 2021. It replaced ISO 19600 (a guidance-only document) and provides the internationally recognised framework for building and certifying a compliance management system.
ISO 37301 demonstrates a structured, systematic compliance management approach that DFSA views favourably. We map the CMS specifically to your DFSA conduct programme obligations so both are served.
Yes. Corporate tax is a legal obligation within the scope of an ISO 37301 CMS. The standard provides the framework for systematic management of tax compliance — registration, calculation, filing, and related party documentation.
ISO 37001 is the specific anti-bribery management system standard. ISO 37301 covers the full scope of compliance. Anti-bribery is one element within a comprehensive CMS. We implement both as an integrated programme.
A documented register of all applicable legal, regulatory, contractual, and voluntary obligations — specific requirements that apply to this organisation's operations. It is the foundational document of a CMS.
Three to five months. The compliance obligations mapping phase typically takes the most time — it requires legal analysis, regulatory knowledge, and process review to complete correctly.
Federal Decree-Law No. 45/2021 on Personal Data Protection creates specific compliance obligations. ISO 37301 provides the management framework for systematically managing these alongside other regulatory requirements.
Senior leadership and the governing body must take active ownership. The compliance function manages the system; accountability sits at board level.
The degree to which compliance values, behaviours, and accountability are embedded in daily operations. A good compliance culture means people follow rules because they understand why — not just because they fear consequences.
Yes. Data protection compliance within ISO 37301 connects naturally to ISO 27001's information security management system. Integration through the common High Level Structure is practical and recommended.
Talk to Nathan ISO Consulting
Send us your sector, the regulators that govern your business, and any recent compliance concerns. We scope the obligations mapping and CMS project from there with a fixed-fee proposal.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving