Verify a Saudi agency before you sign by checking three official records, in order: the commercial registration (CR), proving the entity exists and is registered for the work; the Saudi Business Center authentication record, tying that entity to a business bank account and a real domain; and Maroof, read correctly — store verification moved to the Business Center's Business Platform. Then run one test: one legal name must appear on the quote, contract, invoice and bank account. Portfolios prove none of this; the records do.
The short answer: the three-record check, in order
- CR first. Ask for the CR number, then confirm it yourself via the Ministry of Commerce's commercial registration inquiry — existence, status and registered activity, not the agency's screenshot.
- Saudi Business Center second. Find the authentication record issued against that CR; it confirms a bank account linked to the registration.
- Maroof third, in context. Treat any Maroof presence as history, not the current verification route — and never as proof of quality.
- Consistency last. Compare the legal name across quote, contract, invoice and bank account; a mismatch undoes every earlier pass.
Not yet chosen between agency, freelancer and in-house? That comparison comes first — see our guide to web development in Saudi Arabia.
Check 1 — The commercial registration: does the entity exist, is it active, and does its activity cover web work?
The CR is the foundation record. The Ministry of Commerce provides a commercial registration inquiry service via its e-services, delivered through the Saudi Business Center platform — verify the data yourself instead of trusting a PDF the agency sends.
Read four things: the legal name, exactly as registered; the status — active, not expired or suspended, today; the validity dates, so registration cannot lapse mid-project; and the registered activities — your work should fall inside them. An active CR for an unrelated trade proves a business exists, not that it is registered for your project.
Check 2 — The Saudi Business Center record: name, entity and details that must match the quote
The Saudi Business Center is where verification now happens. Its e-commerce authentication service (described on the Center's own pages at business.sa) verifies an online business and issues an accredited certificate. Its stated conditions make the record useful: an active CR or freelance practitioner certificate must exist; the bank account must be linked to it; the web address must be an owned domain, not a social media link; and the services offered must fall within the registered activities.
An authenticated record ties together entity, registration, bank account and domain — confirm its name and CR number match Check 1 and the quote. An agency selling web design in Saudi Arabia under one brand while its records sit under an unrelated entity owes you an explanation first.
Check 3 — Maroof: what a presence proves, what an absence means for an agency (and what it does not prove)
Maroof began as a Ministry of Commerce and Ministry of Human Resources initiative, operated by THIQAH, to authenticate store owners and collect ratings. On 29 March 2023 the Ministry announced that e-stores register through the Business Platform, operated by the Saudi Business Center, instead of Maroof — the only place for verifying and registering electronic stores in the Kingdom.
A Maroof listing therefore proves, at most, that a store record existed under that name once. It does not prove the entity is active, registered for web work, or good at delivering it. Absence proves even less: a B2B agency that never traded as a store may legitimately have none. Judge the agency on the CR and Business Center record; Maroof is supporting history — useful when it matches, meaningless when offered instead.
Agency or freelancer in costume? The CR vs freelance-document difference
Saudi Arabia has two legitimate registration bases, and confusing them is how the classic burn happens. A CR belongs to an establishment or company: a legal entity with registered activities and a checkable status. A freelance document — the freelance practitioner certificate the Business Center recognises — belongs to an individual, authorised for listed activities.
Neither is automatically wrong: a disclosed freelancer, contracted and paid as an individual under that same name, is an honest arrangement. The fraud is the costume — an individual presenting as an agency while the only registration behind the pitch is a freelance document, or nothing. The tell: the brand has no CR of its own. If the entity signing is a person, set price, timeline and expectations for a person.
Identity consistency: quote, contract, invoice and bank account under one legal name
Lay four documents side by side — quote, draft contract, sample invoice, bank details. One legal name, the CR name from Check 1, should appear on all four.
Money should go to a business bank account held by that same registered entity. The Ministry's own guidance to merchants includes opening an establishment bank account, not using personal accounts — the same link Business Center authentication relies on. An agency asking for a deposit into a personal account under a different name is asking you to fund someone your contract does not name; if the project collapses, that person holds your deposit, domain and half-built site.
Portfolio verification: three checks a polished case-study page cannot fake
Registration proves the business exists, not that it built the work it shows. First, visit the portfolio sites live and ask which parts the agency built — design, build, content — because white-labelled work is often presented as in-house. Second, contact one or two named clients directly, using details you find yourself: did this entity, under this name, deliver this project? Third, check the timeline — a case study dated before the CR existed is a story, not evidence. Our website RFP template shows how to request that evidence in writing.
Red flags that should pause a signing, however good the pitch
- No CR number on the quote, contract or website — or a number returning no record.
- A deposit requested into a personal account, or an account under a name found nowhere in the records.
- A brand matching no registered entity, explained as a "sister company" but never documented.
- An unverifiable address, and meetings that only happen online or in cafés.
- Pressure to sign before you can check the paperwork, or a discount expiring the day you start verifying.
- Testimonials with no named, findable clients behind them.
One flag deserves a question; two deserve a pause. Verification is quick — unwinding a collapsed project is not.
When an agency fails a check: the questions that separate a fixable gap from a walk-away
Not every failure is fraud. An expired CR renewed before signing is a fixable gap. A registered activity that does not cover your project, amended on the record, is a fixable gap. A brand-versus-entity mismatch, corrected so the contract names the registered entity, is a fixable gap.
A walk-away sounds different: the record belongs to someone else; the explanation changes each time you ask; payment still goes to a personal account; or verification itself is treated as an insult. Ask three questions — "Which legal entity signs our contract?", "Show me the record under that exact name", "Why does the bank account differ from it?" — and judge the answers, not the portfolio. After signing, protect the other end with our website handover and ownership checklist — domain, code and accounts in your name at the end.
FAQ
How do I check a Saudi company's commercial registration before hiring an agency?
Ask for the CR number, then verify it yourself through the Ministry of Commerce's commercial registration inquiry, delivered via the Saudi Business Center platform. Check the name matches the quote, the status is active, the validity covers your project, and the registered activities include the work you are buying.
What does a Maroof listing prove about a web agency?
Very little. Maroof authenticated store owners and collected ratings; since March 2023 store verification sits with the Saudi Business Center's Business Platform instead. A listing is supporting history; it proves neither that the entity is active nor that it is registered for web work.
Is paying an agency into a personal bank account a problem?
Yes — a stop sign. Your contract names a registered entity, so pay a business account held by that entity. Business Center authentication links the account to the registration for exactly this reason: money paid to an unnamed individual is money your contract cannot reach.
What is the difference between an agency with a CR and a freelancer with a freelance document?
A CR belongs to an establishment or company — a legal entity whose status you can check. A freelance document belongs to an individual practitioner authorised for listed activities. Both are legitimate when disclosed; the problem is an individual presenting as a registered agency when no agency entity exists behind the brand.
What should I do if an agency fails verification but its portfolio looks good?
Ask which legal entity would sign, ask to see its record under that exact name, and ask why any bank details differ. Renewed registrations and corrected documents are fixable; borrowed records, shifting explanations and personal-account payment after you raised it are walk-away signals, however strong the portfolio looks.
Work with an agency whose details survive your own checks (CTA)
Run the three-record check on every agency — including us. A verifiable counterparty welcomes it — its records match its quote, and one legal name runs through contract, invoice and bank account. For a proposal you can check line by line, start with our web development services for Saudi Arabia: WebStackRank provides an itemised proposal within 24 business hours, works on 50% deposit to begin and 50% at launch, and transfers full ownership of IP, code and domain on final payment. See also the Saudi Arabia hub.
