+968 9596 3381
Phone Number
[email protected]
Email Address
Mon - Thu: 8:00 - 5:00
Online store always open
Compliance Requirements for Companies in Oman (2025 Guide)
Quick Overview
Setting up and operating a company in Oman means navigating an evolving compliance ecosystem. From corporate law modifications and beneficial ownership disclosures to ESG mandates and labor regulations—businesses must stay updated to avoid penalties and disruptions. This 2025 compliance guide provides the latest rules, practical checklists, and expert insights.
Corporate Registration & Delegation Requirements
Companies must register with the Ministry of Commerce, Industry & Investment Promotion (MoCIIP).
Under the most recent Ministerial Decision 245/2025, only company shareholders, board members, or employees can act as authorized signatories—excluding third-party agents.
All online filings via the MoCIIP portal require delegated signatory rights, which must be granted by a certified manager and can be set for up to five years.
Beneficial Ownership & UBO Reporting
Commercial companies (excluding public joint-stock entities) must now maintain a UBO register listing shareholders holding ≥25% equity.
Records must include name, nationality, civil ID, and residence. Updates must be made within 5 working days of change events. Noncompliance may result in fines, suspension, or removal from the register .
Mandatory Hiring of Omani Nationals
Newly established companies must hire at least one Omani employee within 12 months of CR activation.
Failure to comply can lead to a CR suspension by MoCIIP and block other legal modifications to the company.
Corporate Governance Standards
Closed joint-stock companies (SAOCs) must comply with the new Corporate Governance Code (Ministerial Decision 5/2025) .
Requirements include independent directors, clear roles for board committees, financial oversight, and conflict-of-interest procedures.
Companies are given 1 year to adjust governance structures from the publication date .
Financial Reporting & Audit Compliance
All companies must maintain annual financial statements and supporting records; audits are required, especially for larger entities.
Reporting must align with IFRS (mandatory for SAOGs, while SMEs may adopt simplified standards per FSA guidelines).
ESG Disclosure Obligations
Publicly listed companies must issue ESG reports based on MSX guidelines and file within 30 days of financial year-end
(45 days if subsidiaries are involved).Disclosure must be approved by the board, present both positive and negative aspects, and be publicly available via MSX platform and company website.
Non-compliance can lead to FSA intervention or penalties.
VAT, Tax Registration & Withholding Tax Compliance
Companies must register with the Oman Tax Authority for VAT (5%) and Corporate Tax (standard rate 15%, or special rates for SMEs or free zone entities).
DTAA changes and WHT modifications (such as the revised India–Oman agreement) must be applied The Economic Times.
Labor & Employment Law Compliance
Adhere to Oman’s labor law for contracts, working hours, termination procedures, probation terms, and worker welfare.
Companies must track labor card renewals, visa status, and respect Omanization ratios.
A one-time waiver of historical fines for expired labor cards and related obligations is in place for cases older than seven years.
Data Protection & Cybersecurity Regulations
Companies handling personal data must comply with the PDPL. The compliance deadline was extended to February 5, 2026.
Requires implementation of data policies, user consent procedures, breach notification processes, and secure data storage.
Anti-corruption & AML/CTF Compliance
Oman’s National Anti-Corruption Authority and AML laws enforce corporate integrity.
Companies must ensure adherence to regulations on bribery, nepotism (wasta), and conflict of interest.
Minimum Capital & Business License Conditions
Each entity type (LLC, Joint Stock, SPC) has specific minimum capital thresholds and licensing conditions under the Commercial Companies Law.
Complex structures require formal MOA/AOA drafting, shareholder agreements, and regulatory filing.
Records Maintenance & Statutory Books
Companies must retain:
CR and license documentation
MOA/AOA and shareholder registers
Board resolutions and meeting minutes
Financial books, tax returns, VAT filings, auditor reports
HR records, contracts, employment documentation
Records must be kept typically for 10 years and be available upon request.
Internal Controls & Group Reporting
Multinational groups should comply with Pillar Two/IIR regime disclosures, including Country-by-Country reporting and transfer pricing analysis.
Internal control policies must ensure segregation of duties, accurate financial reporting, and audit readiness.
Board Delegations & Management Authority Rules
Apps now require electronic consent when appointing non-shareholder managers via MoCIIP portal.
Delegation rights for filings must be set up carefully, and companies must avoid using unauthorized third parties for signatory roles.
Compliance Grace Periods & Enforcement Risks
Updates like authorized signatory restrictions come with a six-month compliance window.
Penalties for noncompliance include CR suspension, fines, regulatory blacklisting, or forced deregistration.
Compliance Checklist for Companies
| Requirement | Who Applies | Action Item |
|---|---|---|
| CR & license renewal | All companies | Renew annually via MoCIIP |
| UBO register maintenance | All CR companies | Keep updated and report changes promptly |
| Omani hire mandate | All new companies | Hire within 12 months to avoid CR freeze |
| Board governance | SAOC / SAOG | Appoint committees & non-exec directors |
| ESG disclosures | Listed firms | File ESG report within regulatory window |
| VAT / tax return submission | Tax-registered | Monthly VAT, annual corporate tax filings |
| Employee labor compliance | All employers | Track visas, cards, labor ratios |
| Data protection policy | Data handlers | Implement PDPL controls by Feb 2026 |
| Records retention | All companies | Maintain statutory books for audits |
| Signatory delegation registration | All filing firms | Grant online CR rights via MoCIIP portal |
Final Thoughts
Oman’s regulatory environment is evolving swiftly—driven by Vision 2040, digital transformation, and investor assurance mandates. Remaining compliant involves staying updated with rule changes, structuring internal systems, and partnering with trusted legal and audit advisors. By proactively addressing governance, labor, tax, ESG, and data protection obligations, companies in Oman can maintain credibility, avoid penalties, and support sustainable growth.
FAQs
Is a UBO register required for LLCs?
Yes—any shareholder with ≥25% equity must be recorded and updated within 5 working days Can third-party consultants act as signatories?
No—only shareholders, directors, or employees are permitted under Article 13bis.What happens if I don’t hire an Omani employee within 12 months?
MoCIIP may freeze your CR and restrict modifications—you must hire or face suspension.Are ESG reports mandatory for SMEs?
Only MSX-listed public joint stock companies must report; SMEs are not required.When does the data protection rule end?
Full PDPL compliance is mandatory by February 5, 2026.How long must records be kept?
Typically 10 years, subject to audit or legal requirements.Are companies audited every year?
Yes—audited financials are required for registered companies as part of the annual filings.Is Pillar Two compliance necessary for Oman branches?
Yes—multinationals must assess IIR obligations under GloBE rules.Can a manager be appointed via email consent?
Yes—under latest amendment, appointment must be submitted electronically with consent.What’s the penalty for missing UBO update deadlines?
Warnings, fines, CR suspension, or registry deletion may apply
AML/CFT Requirements Under Omani Law
Oman’s AML/CFT framework—including Royal Decree No. 30/2016—sets strict rules for banks, financial entities, and DNFBPs (designated non-financial businesses and professions):
Implement a risk-based approach, identifying and scoring client risk profiles and transaction types FATF+13AML Watcher+13AML Compliance | Arctic Intelligence+13.
Mandatory customer due diligence (CDD) for transactions exceeding OMR 6,000 or wire transfers over OMR 400 AML Watcher+1AML Compliance | Arctic Intelligence+1.
Keep records—including due diligence, suspicious transaction reports (STRs), and correspondence—for a minimum of 10 years AML Watcher+1AML Compliance | Arctic Intelligence+1.
Appoint and maintain a senior-level compliance officer (MLRO) with functional independence and direct reporting to the board Global Practice Guides+4AML Compliance | Arctic Intelligence+4Alketbi Law Firm+4.
Compliance failures can result in fines, license revocation, or criminal liability.
Internal Compliance Program and Risk Management
All companies—especially regulated sectors—should establish:
Board-approved AML/CFT policies, internal controls, and audit protocols.
Periodic compliance risk assessments, client due diligence, and suspicious activity detection procedures.
Independent compliance audits and mandatory training for relevant personnel.
These ensure alignment with Financial Action Task Force (FATF) standards and Omani enforcement expectations.
Governance Rules for SAOCs (Closed Joint-Stock Companies)
Under Ministerial Decision 5/2025, SAOCs must adopt a new corporate governance framework, including:
Boards with at least one-third non-executive or independent directors, and minimum board sizes depending on assets or members.
Governance structures requiring Audit & Risk Committees, Nomination and CSR committees, and formal KPIs with performance evaluations.
Semi-annual unaudited financial statements submitted to the regulator within two working days after board approval.
Strict policies on related-party transactions, shareholder equality, and disclosure responsibilities to safeguard minority investors.
Signatory Authority & Delegation Changes
In July 2025, Ministerial Decision 245/2025 introduced key updates:
Authorized signatories are limited to shareholders, directors, the manager, or internal financial/administrative staff only—excluding external agents.
Appointment of non-shareholder managers now requires electronic submission with written consent via the MoCIIP portal.
Firms are given a six‑month grace period to realign internal signatory roles accordingly .
Labor Law Compliance – New Obligations
The New Labour Law (Decree 53/2023) and Wage Protection System (Decision 299/2023) require:
Full compliance with contracts, leave, termination, working fees, and grievance processes—backed by statutory enforcement.
Payment of wages electronically within seven calendar days—failing which employers face progressive fines, warnings, and service suspension priority over visa renewals.
Social Insurance (PASI) and Employer Contributions
From July 2024, companies must:
Contribute 1% of non-Omani employees’ salary toward maternity insurance.
Be liable for late payment penalties (up to 5.5%) and may face service suspensions if not paid within 15 days.
This is in addition to regular PASI contributions for Omani staff (currently 7% employer, 8% employee).
Investment License Compliance under Foreign Capital Investment Law
Under Investment Law 50/2019, foreign investor companies must:
Meet activity-specific license conditions—for example, hiring local staff, Omanization ratios, and approved investment capital.
Non-compliance may result in investment license revocation or penalties via Ministry rulings.
Companies should track license expiry, renewal deadlines, and activity restrictions proactively.
Data Protection Law (PDPL) Compliance
Organizations processing personal data must comply with Oman’s Personal Data Protection Law (PDPL):
Appoint a Data Protection Officer, obtain citizen consent for data use, and establish breach notification systems.
Employers and corporate entities must ensure secure data storage, access controls, and compliance audits by February 5, 2026.
Consumer & Cybersecurity Regulations
Companies delivering digital services must align with the Consumer Protection Authority (CPA) and MTCIT security frameworks:
Conduct penetration testing (VAPT) by an approved third-party provider for digital systems related to public-facing services, contracts, or downloads.
Ensuring compliant encryption standards and secure infrastructure—especially for government or critical service vendors.
Anti-Corruption & Ethics Standards
While Oman has anti-corruption legislation, persistent practices like “wasta” (favoritism) and nepotism remain concerns:
Companies must enforce training, conflict-of-interest disclosures, and whistleblower policies to comply with national integrity laws and build a transparent culture.
The National Anti-Corruption Authority and other bodies now audit public procurement and large contracts for integrity compliance.
Compliance Culture & Internal Audits
Build a proactive internal compliance function:
Use internal or external audits to test policies, governance controls, and regulatory alignment.
Create compliance committees or officers to conduct frequent checks, document violations, and oversee remedial actions.
Have Any Question?
basic
OMR 500
- Company Formation
- Corporate Bank Account
- Office Address
- Power of Attorney
Standard
OMR 1700
- Company Formation
- Corporate Bank Account
- Virtual Address
- Power of Attorney
Gold
OMR 2150
- Company Formation in Oman
- Workdesk Address
- Corporate Bank Account
- Mail Routing
- Secretary
Premium
OMR 3500
- Company Formation
- Address: Private Cabin
- Corporate Bank Account
- Telephone
- Wifi
- Security
- Mail Routing
- 10-15 Business Days
Our Track Record For Delivering Success.
0
+
Happy Customers
0
+
Project completed
0
+
Years Experience
Ready to Get Stared?
Fill out our quick and easy contact form below. Briefly tell us about your vision and goals, and we’ll be in touch shortly to discuss a personalized plan for your success.