Opening an online store in Saudi Arabia is not difficult. It is just sequenced, and getting the sequence wrong means redoing steps. Most people discover the requirements in the wrong order: they build the store, start selling, then find out that the payment gateway will not fully activate without Maroof verification, which needs a commercial registration they do not have.

Here is the order that works.

Step one: decide what you are actually selling

This determines your activity classification, and the classification follows you through every subsequent step. Retail of physical goods, wholesale, dropshipping, digital products and services each register differently.

Be accurate here. A commercial registration that does not cover the activity you are performing is a compliance problem even though everything else is in order, and amending it later is a bureaucratic exercise you would rather avoid.

Step two: commercial registration

The commercial registration, or CR, is issued by the Ministry of Commerce and is the legal foundation of the business. You apply through the ministry portal, select e-commerce as your activity, specify the type, and pay electronically.

Budget roughly SAR 1,200 to 2,000 a year, varying by activity and by the municipal and chamber fees attached. The process is largely digital and reasonably quick for a straightforward sole activity.

Two things to sort out at this stage rather than later: your trade name, which needs to be available and appropriate, and whether you need a physical address on the registration.

Step three: Maroof verification

Maroof is the Ministry of Commerce national register of online stores. Registration is free and typically completed within a couple of days.

Skipping it is a mistake for two separate reasons. First, it is a legal expectation for stores selling to Saudi consumers, and it is one of the first things checked in a compliance context. Second, and more immediately painful, local platforms including Salla and Zid, plus a number of payment providers, restrict full payment features until you are verified. Without it you may find yourself limited to cash on delivery or manual transfer, which caps your conversion rate severely.

You will need your CR number, trade name, store URL, product categories and contact details. Do this before you launch, not after your first campaign.

Step four: register with ZATCA when you need to

VAT registration with the Zakat, Tax and Customs Authority becomes mandatory once taxable turnover exceeds SAR 375,000 across a rolling twelve-month period. The standard rate is 15 per cent.

Two details people miss. It is a rolling twelve months, not a calendar year, so you can cross the threshold in July based on the previous August. And there is a lower voluntary registration threshold, which is worth considering only if you sell mainly to VAT-registered businesses who prefer a registered supplier.

Once registered, you must issue electronic invoices under the Fatoorah system. This is a specified technical format with structured data and validation, not a PDF template. Local accounting platforms and the major store builders handle it; a spreadsheet does not. Build this in when you register rather than discovering it at your first filing.

Step five: pick the platform

Salla and Zid are the pragmatic local defaults. They are built around Saudi payment rails, Arabic-first interfaces, local shipping integrations and the compliance requirements, which means a large amount of plumbing arrives already connected.

Shopify works well and has a deeper app ecosystem, but you assemble more of the local integration yourself. WooCommerce gives you the most control and the lowest platform cost, at the price of maintaining it, which is a real cost in hours even if it is not a subscription line.

Choose on the basis of who maintains it. If nobody on your side can fix a broken checkout at nine in the evening, choose a hosted platform.

Step six: payments

A Saudi store needs mada, the domestic debit network, before anything else. A meaningful share of local transactions run on it and omitting it is the single most expensive configuration error in Saudi e-commerce.

Beyond that: Visa and Mastercard, Apple Pay, STC Pay. Buy-now-pay-later through Tabby or Tamara has become close to an expectation in retail categories and demonstrably lifts both conversion and average order value, though it takes a commission.

Cash on delivery remains significant in some categories. Support it if your category demands it, but understand what it does to your cash cycle: you fund inventory and shipping weeks before the money lands, and your return rate on COD orders will be higher.

Step seven: the policies the law actually requires

This is where enforcement concentrates, and it is entirely avoidable work.

Your store must clearly display your commercial identity: trade name, CR number, working contact details, VAT number if registered. It must show the total price including VAT and shipping, with nothing appearing for the first time at checkout. It must publish a written return and refund policy, a privacy policy, terms and conditions, and delivery timelines.

All of this in Arabic. English in addition is fine; English instead is not. This is a consumer protection requirement.

Penalties under the E-commerce Law reach up to SAR 1 million alongside suspension of activity or blocking of the store, and they double for repeat violations. Almost none of the common violations require money to fix. They require an afternoon.

Step eight: data protection

The Personal Data Protection Law applies to your customer database. Collect only what you need, secure it, be clear in your privacy policy about what you collect and why, and be careful about where it is processed and stored. Treating a customer list casually is the kind of thing that seems harmless until it is not.

What this costs in year one

Commercial registration and associated fees: SAR 1,200 to 2,000. Maroof: free. Platform: SAR 1,000 to 4,000 depending on tier. Domain and email: a few hundred. Payment gateway: setup plus a percentage per transaction. Policies and Arabic content: free if you write them, a few thousand if you commission them properly, which for the legal pages is money well spent.

So somewhere around SAR 4,000 to 8,000 before you have bought a single unit of inventory or run a single advertisement. Inventory and advertising are the real budget, and they are the ones people underestimate.

The order that fails

For contrast, here is the sequence people actually follow: build the store, add products, run advertisements, make sales, discover the payment gateway is limited, apply for Maroof, discover Maroof needs a CR, apply for the CR, wait, lose momentum, restart the advertising from zero.

The registration steps take days. Doing them first costs you a week. Doing them last costs you a launch.

Verify fees and thresholds on the Ministry of Commerce and ZATCA portals before committing, as these are adjusted periodically.