Middle East Hot Topics 2026 Mid-Year Review

This alert discusses hot topics and enforcement trends that have made an impact across the Middle East region in the first half of 2026, and signals developments to watch by the end of the year, with a focus on Compliance (Anti-Bribery and Corruption, Anti-Money Laundering, Sanctions, Data Protection), Foreign Direct Investments, Competition, Employment, and ESG.

The Kingdom of Saudi Arabia has increased its enforcement activity in 2026 with regard to anti-corruption and anti-bribery concerns. In the first half of this year, the Oversight and Anti-Corruption Authority (“Nazaha”) carried out over 13,000 oversight visits, 2,000 investigations, and arrested or detained over 650 individuals. Recent Nazaha enforcement actions indicate an increasing focus not only on public officials, but also on private-sector executives, business owners, consultants, and commercial entities involved in alleged bribery schemes relating to public procurement, project awards, customs clearance, licensing, inspections, and other government-facing activities.

We have also seen an increase in internal Saudi company whistleblowing alongside increased Nazaha activity. Anti-corruption investigations may hold broader implications for multinational companies by giving rise to reporting obligations and risks of exposure in other jurisdictions, such as the U.S. and the EU. Those complaints should therefore be promptly investigated and assessed from both a local and cross-border compliance perspective.

All businesses operating in Saudi Arabia should review their internal controls, third-party due diligence processes, investigations protocols, and employee training programs to ensure they can identify, escalate, and remediate potential issues.

This is the first full year that the UAE’s Federal Decree-Law No. 10 of 2025 Regarding Combating Money Laundering Crimes, Combating the Financing of Terrorism and the Financing of Arms Proliferation, replacing previous AML laws, has been in force, which brought virtual assets and virtual asset service providers into scope, introduced offenses based on proliferation financing and the use of encryption technology, digital systems, and virtual assets in the financing of terrorism. With that law coming into force in April 2026, the UAE's National Committee for Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing approved a series of reforms aimed at further strengthening the UAE's AML framework, investigative capabilities, and inter-agency coordination. Key measures included adopting a new National Guide on Financial Intelligence and Money Laundering Investigations, updating procedures for investigations, asset tracing, confiscation, asset recovery, and virtual asset-related enforcement. Other measures approved were updated risk assessments for financial institutions, virtual asset service providers (VASPs), and designated non-financial businesses and professions (DNFBPs), and endorsing updated national risk assessments relating to proliferation financing and non-profit organizations. These developments signal the UAE's continued emphasis on a risk-based approach to financial crime compliance supervision and enforcement, with particular focus on virtual assets, financial crime investigations, asset recovery, and targeted oversight of higher-risk sectors.

On 17 April 2026, the Saudi Council of Ministers approved targeted amendments to Royal Decree No. M/20, the Kingdom’s Anti-Money Laundering Law, reinforcing Saudi Arabia’s increasingly risk-based AML framework. The amendments formally assign the Permanent Committee for Combating Money Laundering as responsible for developing, coordinating, and periodically reviewing national AML policies, including an assessment of high-risk jurisdictions. These legislative changes operate alongside continued supervisory and operational developments, including the Saudi Financial Intelligence Unit’s ongoing rollout of its TAQASIY electronic platform for the receipt, analysis, and referral of suspicious transaction reports, as well as the issuance of sector-specific guidance for designated non-financial businesses and professions.

Regulated companies operating in the UAE and Saudi Arabia should review their policies to ensure compliance with AML developments in those jurisdictions, particularly given the evolving regulatory regimes and increased scrutiny.

In parallel, U.S. export controls have become increasingly significant for UAE-based businesses, particularly following the expansion of the U.S.-UAE AI Acceleration Partnership and the continued use of licensing requirements for the export of advanced U.S.-origin AI and semiconductor technologies to the UAE. In July 2026, the U.S. reclassified the UAE from the previous D:3 and D:4 categories into Country Group A:5. This reclassification relaxes export controls on the UAE, allowing the UAE easier access to a range of sensitive technologies. These include semiconductors, military equipment, commercial spacecraft, advanced computing products, and other dual-use technologies, without requiring individual export licenses in certain cases. UAE companies should note that where an item is a dual-use, strategic, military, nuclear, or otherwise controlled product, the UAE operates its own import/export control regime and may require separate import or export licenses or permits from the relevant UAE authorities. Accordingly, companies should conduct a separate UAE classification analysis.

For further information on the UAE’s reclassification under the U.S. Export Administration Regulations, see here.

In July 2026, U.S. President Trump initiated a 45-day statutory process to remove Syria from the U.S. list of State Sponsors of Terrorism, on which it has been designated since 1979. Once finalized, among other changes, companies can expect additional progress on Syria’s re-entry into the global financial system, new eligibility for foreign aid, and potential easing of U.S. export controls concerning Syria under the U.S. Export Administration Regulations. Pending subsequent implementation of export controls changes, however, many items subject to U.S. export controls outside of the least-sensitive ‘EAR99’ category will continue to require licensing for export, reexport, or transfer to Syria. Given the continuing designation of many entities and individuals for U.S. property-blocking sanctions and (for the time being) restrictive export controls, companies looking to seize opportunities in Syria given the progressive sanctions-relief regime must nevertheless remain cognizant of the overlapping U.S. restrictions and authorizations required, and maintain ongoing counterparty and AML due diligence.

On 30 April 2026, the UAE issued Cabinet Decision No. 59 of 2026 (the “2026 Executive Regulations”), the executive regulations for Federal Decree-Law No. (36) of 2023 on the Regulation of Competition, which entered into force on 30 July 2026. Together with Cabinet Resolution No. (3) of 2025, which introduced the UAE’s new merger control filing thresholds, the 2026 Executive Regulations complete a long-awaited overhaul of the UAE’s competition regime. The 2026 Executive Regulations introduced greater certainty, transparency, and procedural structure to the UAE merger control framework. They clarify merger filing requirements, offer a more predictable review process by introducing defined timelines for completeness assessments, formally recognize the rights of third parties to submit observations and objections during merger reviews, expand the Competition Department’s investigative powers in relation to reportable transactions, and establish cooperation mechanisms between the Ministry of Economy and Tourism, local authorities, and sector-specific regulators.

In July 2026, the UAE also issued new Guidelines on Relevant Market Definition (“Guidelines”). The Guidelines provide clarity on notification requirements given the UAE filing obligations’ dependence on revenue and/or market-share thresholds, and the competition authority’s practices in terms of assessing both product and geographic markets and relying primarily on demand-side substitutability. The Guidelines will also assist companies in self-assessing compliance with the UAE's behavioral competition law rules.

For an in-depth overview of the UAE’s New Merger Control Framework, see Covington’s review here and here.

The UAE now joins Saudi Arabia, Kuwait, and Egypt as key regional jurisdictions having active competition law requirements with potential enforcement consequences. Businesses operating in the UAE, and parties to transactions with a UAE nexus, should therefore assess their merger control obligations. Companies should also consider the active competition enforcement postures more generally across countries in the region, which have divergent requirements and timelines.

On 14 June 2026, the UAE announced the creation of the Federal Artificial Intelligence and Data Authority (“Authority”), a new federal body that will serve as the single national authority responsible for artificial intelligence, data governance, and digital government. The Authority has been tasked with developing and implementing the UAE’s national AI strategy, proposing legislation and public policy relating to AI and data, overseeing government data governance and sharing, and coordinating digital transformation initiatives across the federal and local levels. The Authority is also significant for privacy regulation, as it may accelerate long-awaited implementation of the UAE’s federal Personal Data Protection Law and signals a broader centralization of regulatory oversight over AI, data, and digital services in the UAE.

The UAE also introduced a comprehensive new child digital safety regime through Federal Decree-Law No. 26 of 2025 on Child Digital Safety and Cabinet Decision No. 106 of 2026 (“Child Digital Safety Regime”). The Child Digital Safety Regime combines privacy protections, online-safety obligations, parental controls, content-governance rules, advertising restrictions, and age-assurance requirements within a single regulatory architecture. Organizations that may fall within the Child Digital Safety Regime’s scope should not only ensure compliance but explore engagement opportunities with the UAE Ministry of Family and the newly established Child Digital Safety Council.

Other jurisdictional developments in 2026:

• The Saudi Data and Artificial Intelligence Authority announced that it had issued over 45 Notices of Violation to non-compliant entities, reflecting the continued trend in Saudi Arabia of increased enforcement activity by the Kingdom’s regulators.
• Egypt issued Executive Regulations to the Personal Data Protection Law No. 151 of 2020 under Ministerial Decree No. 816 of 2025 (“Egyptian PDPL Regulations”), set to come into force in November 2026. The Egyptian PDPL Regulations operationalize the Personal Data Protection Law by introducing detailed rules on data processing, cross-border transfers, data subject rights, data breach notifications, children’s data, direct electronic marketing, CCTV use, and the appointment of Data Protection Officers. The Egyptian PDPL Regulations detail the licensing requirements pertaining to data controllers and processors, cross-border data transfers, and certain high-risk processing activities.

Companies should ensure that their policies are compliant with regional data privacy and protection laws, as the UAE, Saudi Arabia, Egypt, Jordan, Qatar, and Oman all have laws in force. Enforcement is expected to continue and increase throughout the latter half of 2026, as regulators develop their capabilities and sophistication.

By 30 June 2026, UAE private-sector employers with 50 or more employees were required to show a cumulative 1% increase in skilled Emirati employees. From 1 July 2026, the Ministry of Human Resources and Emiratization (“MoHRE”) increased the financial contribution payable by non-compliant employers to AED 120,000 annually (approximately USD 33,000) for each unfilled Emiratization position. Alongside these measures, MoHRE has intensified enforcement against ‘fake Emiratization’ arrangements through the use of AI-enabled monitoring tools. Also, effective September 2026, the UAE's Nafis program will require private-sector employers to bear their full 12.5% share of pension contributions for enrolled Emirati employees. The UAE government had previously covered a 2.5% subsidy on behalf of employers whose Emirati staff earned below AED 20,000 per month; however, under the new rules, this subsidy will be terminated. 

In Saudi Arabia, the Ministry of Human Resources and Social Development adopted a sectoral approach to Saudization and accelerated this agenda in 2026 through the launch of its second iteration of the three-year ‘Nitaqat Mutawar’ program covering the period from 2026 to 2028. Effective from 16 April 2026, the reforms are intended to create additional jobs for Saudi nationals and increase localization rates across a wide range of sectors. Profession-specific localization requirements also continue to expand, with more than 269 professions now subject to targeted Saudization mandates across a range of sectors and industries. Compliance has become increasingly important given that a company’s Nitaqat classification directly affects access to expatriate visas, residency renewals, and government procurement opportunities. As a result, workforce localization has become not only a labor law issue but also a significant operational and commercial consideration for businesses operating in the Kingdom.

The stepped-up enforcement indicates that both the UAE and KSA will continue to vigorously enforce their localization requirements in the second half of 2026, by proactively assessing workforce composition, hiring strategies, and regulatory reporting obligations, particularly as Emiratization and Saudization numbers are expected to increase.

As of July 2026, over 700 foreign companies, in total, have established regional headquarters in Saudi Arabia under the Regional Headquarters Program (“RHQ”). The RHQ mandates that multinational companies that are in scope (i.e., if they have a legal presence in at least two countries, excluding Saudi Arabia and the country in which the company is headquartered) are required to establish a new legal entity in Saudi Arabia as their regional headquarters, in order to be eligible to tender for Saudi government contracts worth more than 1 million SAR (approximately US$ 266,000). As of mid-2026, enforcement of the RHQ requirements has been active, including penalties ranging from warnings to suspension and, ultimately, revocation of the RHQ license and prevention from government procurement opportunities. In addition, the Saudi Zakat, Tax, and Customs Authority is actively monitoring compliance with the RHQ tax substance requirements, issuing penalties ranging from monetary fines and suspension of tax incentives to license revocation in cases involving inaccurate or misleading submissions. As a result, non-compliance may expose an entity to both regulatory and tax enforcement measures.

The Saudi Ministry of Investment recently released draft proposed amendments to the RHQ framework, which are yet to be enacted but in practice are already being enforced. These new regulations clarify and broaden certain RHQ requirements, for example, clarifying that the RHQ must employ at least three executive-level employees, who must be the highest-ranking managers in the region (with all regional executives reporting to them), and be resident in Saudi Arabia.

Concurrently, the Economic Participation Program (“EPP”) is also being enforced. The EPP framework requires that companies bidding for government tenders commit to additional local investments in the Kingdom as a prerequisite to a tender contract award. Reinvestments may be demonstrated through technology and knowledge transfer, investments in Saudi Arabia, export development, research and development initiatives, localization of industries or services, and subcontracting with local entities. In April 2026, the Local Content and Government Procurement Authority issued an updated draft of the EPP for public consultation. One of the key changes includes reducing the localization requirements from 35% of the total contract value to 25%.

Companies intending to enter the Saudi Arabia market or establishing an RHQ should be mindful of the above requirements in their planning and aware of both their regulatory and tax-related risks. If companies intend to bid for Saudi government contracts, a review of their RHQ footprint and potential EPP exposure should be carried out and analyzed.

The UAE has marked significant developments in the realm of ESG. The Federal Decree-Law No. 11 of 2024 on the Reduction of Climate Change (the “Climate Change Law”) was issued in May 2025. The Climate Change Law requires companies to measure and track their greenhouse gas emissions. Later in 2026, ‘Technical Guidelines’ related to compliance with the measurement and reporting obligations, as laid out in Article 6 of the Climate Change Law, are expected to be released. While the Climate Change Law does not contain a detailed framework, it represents a shift toward a binding climate-compliance regime applicable across the economy, and we can expect more information from the forthcoming Technical Guidelines. Listed companies in the UAE must now manage a multi-layered reporting regime, with the newly introduced federal reporting obligations under the Climate Change Law, and the existing capital-markets disclosure and reporting requirements under the Abu Dhabi Securities Exchange and Dubai Financial Market.

Saudi Arabia has also begun to focus its ESG efforts to mirror international best practice. In February 2025, the Kingdom hosted the World ESG Summit in Riyadh, where the Kingdom announced that it is developing national ESG guidelines, focusing on corporate monitoring and reporting of sustainability measures within the Kingdom. As of 2026, ESG reporting remains principally guided by the Capital Market Authority’s ESG Disclosure Guidelines and Tadawul’s ESG guidance, both of which are heavily influenced by international frameworks. As such, we can expect increased activity with regard to sustainability efforts in Saudi Arabia.