Answer ... (a) Commercial/corporate
The due diligence request should include:
- constitutional documents;
- registrations;
- licences;
- the articles of association; and
- the bylaws.
A search of the Ministry of Commerce website by the target’s commercial registration number and its expiry date will verify the company’s corporate status.
The bidder should also take steps to understand the target’s material contracts, based on a commercial assessment of its business.
(b) Financial
Limited liability companies and joint stock companies must prepare, audit and file with the authorities the audited financial statements. Reviewing these financial statements can provide the prospective buyer with high-level preliminary information about the target’s historical financial performance.
(c) Litigation
Legal due diligence covers any pending or actual litigation concerning the target.
(d) Tax
Tax due diligence is normally carried out as part of the financial due diligence on the target.
Companies in Saudi Arabia, other than listed companies, and with some other exceptions, are subject to two different tax regimes based on the nationality of their shareholders. Companies that are 100% owned by Saudi or Gulf Cooperation Council (GCC) shareholders are subject to the Zakat regime. Companies that are 100% owned by foreign (non-Saudi and non-GCC) shareholders are subject to the income tax regime.
Companies that are owned by Saudi or GCC shareholders and foreign shareholders are subject to the Zakat regime in proportion to the Saudi or GCC shareholding and the income tax regime in proportion to the foreign shareholding.
(e) Employment
Legal due diligence covers the review of employment policies and contracts. The review will examine matters relating to:
- the transfer of employees and employee sponsorship;
- liabilities relating to end-of-service benefits;
- social security registration and compliance; and
- ‘Saudisation’ requirements.
The Labour Law regulates the treatment of employment contracts in the case of an M&A transaction. In the post-M&A transaction phase, the transfer of employees should be handled efficiently to avoid any regulatory implications.
(f) Intellectual property and IT
The due diligence usually covers:
- IP registrations;
- IP litigation; and
- IT policies.
(g) Data protection
The bidder should take steps to conduct due diligence on the target’s compliance with applicable data protection laws. Saudi Arabia issued its first data protection law – the Personal Data Protection Law – in 2021, to regulate the collection and processing of personal data. The law applies to any personal data processing carried out by a ‘controller’, which is any entity that determines the purpose of processing personal data and how it is processed, regardless of whether the data processing is initiated by it or through any processer that processes data on its behalf.
(h) Cybersecurity
The due diligence may include technical reviews of cybersecurity.
(i) Real estate
Real estate due diligence should ascertain the extent of owned and leased real estate assets that the target relies upon to carry out its business. The review usually covers:
- title deeds of the real estate owned by the target;
- lease agreements between the target and third parties;
- identification of any liens, mortgages, encumbrances or third-party interests; and
- any real estate litigation.