You don't run a company in Saudi Arabia. You run its portals.

Every company operating in Saudi Arabia lives inside a set of government portals. Not a filing cabinet or a folder of PDFs. Live systems, each run by a different authority, each holding one piece of your company's right to operate. Your staff are real in Qiwa. Their residency is real in Muqeem. Their salaries clear through Mudad. Their pensions accrue in GOSI. Your tax lives in ZATCA. Let one lapse and the others start refusing you.

I log into all of them. Running finance, HR and compliance for a group in Riyadh makes these portals my Monday morning, not something I set up once and forgot. None of them opens until you hold the one credential that unlocks the rest.

Nafath, the master key

Start here, because nothing else works without it. Nafath is the national digital identity, one login backed by your face that the Digital Government Authority now requires as the single sign-on for government services. SDAIA built it in 2021, and it has become the front door to almost every portal on this list. When Qiwa or GOSI asks who you are, Nafath answers.

You do not browse to a Nafath site and type a password. You install the app, and every login elsewhere routes through it. Open Qiwa, choose the national single sign-on, enter your ID, and Qiwa hands the question to Nafath. Your phone buzzes. The app shows a two-digit number that has to match the one on your screen. You tap to approve, enter your six-digit PIN, and you are in. Nothing to phish, no code to intercept.

Setting it up takes one dependency, and it is the next portal on the list. You register Nafath with your national ID or iqama number and your Absher credentials, confirm a one-time code, set the PIN, and pass a face scan. Which means before Nafath, you need Absher.

Absher, the identity root

Absher is the oldest and widest of them. The Ministry of Interior launched it in 2010, and it now carries more than 460 services for over 28 million people. For an individual, it holds a resident's whole legal life: the iqama, exit and re-entry visas, dependents, traffic and passport services. For a company, Absher Business handles the equivalent at the establishment level.

One step stops people on day one. Registration and activation are not the same thing. You can register in a few minutes with an ID or iqama number, a Saudi mobile number in your own name, and an email. That gets you an account that does almost nothing. To activate it you verify yourself in person: a fingerprint at one of the self-service kiosks in the malls and government offices, an ATM at most major banks, or a counter at Passports or Civil Affairs. Skip the activation and you hold a login that cannot transact, and the whole chain above it stalls.

Muqeem, the residency desk

Once your people are in the country, Muqeem is where you keep them legal. It is the company's residency console: issue and renew iqamas, request exit and re-entry visas, register and update employee records. For a foreign company, this is the portal that decides whether your general manager can fly out in December and get back in January. Watch it monthly. An iqama that lapses does not email you a warning. It surfaces at an airport.

Qiwa, the labor relationship

Qiwa is the labor market platform, run by the Ministry of Human Resources. Every employment contract, Saudi or expat, lives here. Work visas, sponsorship transfers, and the Saudization ratio that governs your right to hire the next foreigner all run through it. When the Nitaqat band you sit in changes, Qiwa is where you feel it first. A company that ignores Qiwa until it needs a visa finds its quota closed and its ratio red, and by then the fix is a hire, not a click.

Mudad, the payroll proof

Mudad is how the government checks that you paid the salaries you claim. It runs the Wage Protection System: each month you submit a file of what every employee was paid, and the labor ministry matches it against their contracts. Pay late, pay short, or miss the file, and your compliance score drops until the system starts blocking your other transactions. Payroll here is not finished when the bank transfer clears. It is finished when Mudad accepts the file.

GOSI, the social insurance ledger

GOSI, the General Organization for Social Insurance, has run since 1973, longer than any portal here by decades. Every employee is registered, and each month you contribute against their wage, the employer share and the worker's share, toward occupational-hazard cover and pensions. The wage you declare in GOSI is expected to match the wage in Mudad and the contract in Qiwa. Declare three different salaries across three portals and you have built your own audit finding.

The rest you will meet

Five more you register for and then live with:

• ZATCA. The Zakat, Tax and Customs Authority. VAT, corporate tax, and Fatoora, the e-invoicing system your billing software has to connect to directly.
• Saudi Business Center. Where the commercial registration and Articles of Association are issued and amended.
• Balady. The municipal portal for the premises license, if you hold physical space.
• Etimad. The Ministry of Finance platform for government tenders and payments. Sell to the state and you live here.
• Chamber of Commerce. Membership, and the attestation of documents you use abroad or in court.

How they connect, and who owns them

Treating these as seven separate logins is the mistake. They are one system wearing seven faces. Nafath authenticates you into all of them. Absher holds the identities Nafath checks. The wage you set in a Qiwa contract is the wage GOSI charges against and the wage Mudad expects to see paid. An iqama renewed in Muqeem rides on a Saudization ratio that lives in Qiwa. Break one link and the failure travels down the chain.

So the real question is not which vendor registers them for you. Plenty will, inside a week. The question is who owns them afterward, because a portal needs a person, not a filing. That person watches the renewals, keeps the three wage figures identical, catches the ratio before it turns red, and knows that a blocked GOSI account this morning is a payroll that fails on Thursday. In most companies that person sits in finance, because finance is where the consequences land.

What you are actually running

A formation agent switches these portals on and hands you the passwords. That is the easy day. Every day after, the portals are the company, and keeping them green is the difference between a business that operates and one that loses a Tuesday to unblocking itself.

If your portals are switched on and nobody owns the morning after, that is the work I do.

---

Written from operating experience in Riyadh. General guidance, not legal or tax advice on any specific company.