Maroof Verification for Saudi Online Stores: Requirements and the Mistakes That Get You Rejected

New Maroof verification requests are no longer completed on the old Maroof platform. Saudi Arabia moved ecommerce authentication to the Saudi Business Center's Business Platform. Prepare a valid Commercial Registration or Freelance Practitioner Certificate, a commercial bank account linked to the business, a working store URL, and matching business details. Always confirm the current form at business.sa.

Maroof is the search term, not the current application portal

Store owners still search for “Maroof registration” because that was the familiar name of the government-backed verification route. The operational detail matters: the Ministry of Commerce announced that ecommerce-store authentication had moved from Maroof to the Saudi Business Center's Business Platform and described that platform as the approved destination for the service.

That distinction protects you from following old tutorials. A video may accurately show the former portal yet send you to retired screens, outdated fields, or an obsolete eligibility explanation. Use the term Maroof to understand the topic, but submit through the official current channel.

The Ministry's transfer announcement states two headline conditions: a valid Commercial Registration or Freelance Practitioner Certificate and a commercial bank account. A later Ministry notice clarified that authenticated stores use commercial accounts connected to the store rather than personal accounts. Read the official transfer notice and the live service before acting.

What to prepare before opening the application

Separate eligibility documents from website readiness. Your registration or freelance certificate and commercial account establish the operating identity. Your domain, storefront, published policies, and contact routes show customers which operator stands behind the site and how it fulfils orders.

Prepare one controlled set of business data. It should contain the legal name, trading name where applicable, registration or certificate details, commercial-account reference, domain, customer-service email, telephone number, and any licences relevant to the activity. Give the same approved set to whoever manages the website and application.

Then inspect the public store without logging in as an administrator. A reviewer or customer must be able to open it, identify the seller, reach support, and read the relevant terms. A polished home page does not compensate for a broken policy link or a checkout that reveals a different legal name.

How to register through the current route

Interface labels can change, so the following list describes the durable sequence rather than promising exact button names. Follow the wording displayed by the official platform when you apply.

1. Enter the platform using the accepted Saudi Business Center sign-in method.
2. Select the service for ecommerce authentication from the available business services.
3. Choose the legal basis and connect the valid registration or freelance certificate.
4. Enter the store URL using the final public domain, not a preview or temporary address.
5. Connect the commercial account that belongs to the business identified in the request.
6. Review every field for exact agreement across the entity, activity, domain, email, and phone.
7. Submit the request and retain its reference, confirmation, or certificate as made available.
8. Maintain the record when the domain, activity, account, or operator information changes.

Do not promise your launch team a fixed approval time copied from someone else's experience. A correctly linked application may move quickly, while a mismatch or verification check can create more work. The live status and official support channel govern your case.

What the website should contain

The application is only part of readiness. Ministry of Commerce ecommerce assessment criteria published in 2024 also covered displaying relevant registration, tax, and licence details; linking the store URL to its record; publishing privacy, returns, complaints, shipping, and delivery policies; providing easy customer contact; and operating a secure HTTPS website.

Not every field applies identically. A tax number should be shown when the entity is required to have one; a regulated activity may need an additional licence. Confirm the legal position instead of filling the footer with numbers taken from another business.

CloudTopia includes the policy-page structure and visible contact details in its Saudi store builds, alongside native Arabic RTL and contractual client ownership of source code. For a pre-application review with a defined scope and Saudi-riyal pricing, send your store URL to the team on WhatsApp.

Eight mistakes that create rejection or rework risk

Only the platform's message can explain a particular returned request. The following are practical inconsistencies that can block completion or make the storefront unready for the wider compliance checks.

1. Using a mismatched record: The store name or activity conflicts with the registration or freelance certificate.
2. Connecting a personal account: The submitted payment identity is not the business's linked commercial account.
3. Submitting a preview domain: The URL opens maintenance mode, requires a password, or redirects elsewhere.
4. Omitting support details: Customers cannot find a working email, telephone number, or complaint route.
5. Copying generic policies: The text names another company, country, currency, or process.
6. Hiding return terms: Customers cannot access exchange, return, and refund information before purchase.
7. Publishing conflicting identities: The footer, invoice, checkout, and bank recipient show different operators.
8. Ignoring website security: HTTPS fails, certificates produce warnings, or forms expose customer information.

Treat these as diagnostic risks, not a fabricated official list of automatic rejection codes. When a request is returned, correct the stated reason first. Then perform a full consistency review so the second submission does not expose a different defect.

Write policies that match actual operations

A compliance page is not useful merely because it exists. It should explain what your team will actually do: eligible return conditions, exclusions permitted by law, pickup or shipping arrangements, refund method, complaint channel, and how customers receive a decision. Those promises must agree with the payment gateway, warehouse, carrier, and support scripts.

Start with a decision map for each product family. Record the product type, fulfilment method, conditions of return, evidence required, responsible team, and refund route. Obtain legal review when you sell regulated goods, food, healthcare services, subscriptions, or digital products. A developer should implement approved rules, not invent consumer rights from a template.

Link the pages from the footer, cart, checkout, and relevant confirmation messages. For a bilingual store, the Arabic version should be written and implemented as native RTL content rather than a mirrored English layout. Keep a visible revision date and an internal owner for each policy so operational changes reach the site.

Does authentication make the whole store compliant?

No. Authentication associates a digital storefront with a verified business identity; it does not replace every other obligation. The merchant still needs to follow Saudi ecommerce requirements, customer-data rules, applicable invoicing and tax requirements, advertising controls, and any sector-specific licensing.

This is why the Ministry's published store-assessment criteria extend beyond authentication. They also address returns, refunds, privacy, complaints, shipping, contact accessibility, URL security, and business information. Treat the certificate as one verified link in a wider operating system, not as a decorative badge that cures missing pages.

Consumers can use the official authenticated-store enquiry service to check a store. That makes identity consistency visible. The domain and entity returned by the enquiry should make sense alongside the name, invoice details, and seller statement on the site. If one company operates several brands, explain that relationship accurately.

A practical pre-submission test

Run the check from a private browser window and a mobile connection. This removes administrator cookies and cached pages that can hide access failures.

1. Verify the identity: Compare public names, activities, and numbers with the current official document.
2. Verify the domain: Open the final URL and confirm that it does not redirect to another operator.
3. Verify the policies: Reach every customer policy from the footer and purchase path.
4. Verify the account: Use only the qualifying commercial account linked to the business.
5. Verify both languages: Remove contradictions between Arabic and English business information.
6. Verify the security: Test HTTPS, forms, checkout, and error states on a real phone.
7. Verify the submission: Save the entered data and reference after sending the request.

Assign an internal owner to every item. The business owner controls certificates and approved statements. The developer controls display and technical access. Operations controls fulfilment promises. Customer support controls the published contact channels. Named ownership prevents stale data from surviving because each team assumed another team would update it.

What website preparation should cost

Do not quote a government-service fee unless the official portal displays it for the specific request. Website preparation is a separate commercial service, and its cost depends on the gap. A healthy store may need a focused review and small content changes; an old build may need HTTPS repair, policy templates, bilingual layout work, or checkout fixes.

To keep the entry point competitive, a proposed CloudTopia authentication-readiness audit can start at SAR 790, with any implementation priced after the gaps are identified. That starting price sits far below a store rebuild, but it is not a promise that every case costs the same and not an unverifiable claim to be the cheapest provider.

If you want a report that allocates each action to the merchant, adviser, or developer, talk to CloudTopia on WhatsApp. Send the public URL; the team can define the deliverables and quote in Saudi riyals before any work begins.

Frequently asked questions

What is Maroof verification?

Maroof verification is the familiar name many people still use for Saudi ecommerce-store authentication. The government service moved from Maroof to the Saudi Business Center's Business Platform. It connects a storefront to an eligible business identity with a valid Commercial Registration or Freelance Practitioner Certificate and a linked commercial bank account.

Is Maroof mandatory for online stores?

Do not treat the retired Maroof route as a separate current obligation. The Ministry describes the Business Platform as the approved ecommerce-authentication channel and includes store authentication in its published compliance criteria. Your precise duty depends on the business, activity, and applicable rules, so verify it through the official service or qualified advice.

Why was my Maroof application rejected?

Use the reason shown in the platform notification for your particular case. Common readiness problems include an expired or mismatched business record, a personal rather than commercial bank account, an inaccessible store URL, inconsistent operator information, or missing contact and policy pages. Correct the stated issue, then recheck every linked detail before resubmitting.

How long does ecommerce authentication take?

There is no single safe duration to promise for every application. Timing depends on complete documents, successful system links, matching bank and entity details, and whether correction or additional verification is required. Track the request inside the Saudi Business Center platform and rely on its current status and support guidance, not an undated tutorial.

Read also

• Launching an Online Store in Saudi Arabia: From CR to First Order
• Saudi PDPL: What the Personal Data Protection Law Means for Your Website and Store
• Integrating mada, Apple Pay, Tabby and Tamara in Your Saudi Store: A Technical Guide