Payroll Key-Person Risk: What Happens When the Only Person Who Knows Your Payroll Leaves

What is payroll key-person risk? Short answer: Payroll key-person risk is the operational and compliance exposure created when one individual holds knowledge or access that the employer cannot reconstruct without them. In the Gulf states it is sharper than in most markets, because statutory payroll access is frequently bound to a named natural person rather than to the company, and because the rules that the documentation describes change often enough that a handover pack written eighteen months ago is already wrong in more than one country.

When the only person who knows your payroll leaves, the pay run itself is rarely what breaks first. What breaks is everything around it: portal access bound to that person’s national identity, the reason a particular allowance sits outside the end-of-service base, the bank cut-off nobody wrote down, and the filing calendar that lived in their head. Payroll key-person risk is the gap between what your payroll owner knows and what your organisation can prove. Closing it takes four things: current documentation, a named backup, cross-training against the calendar, and a handover pack that is maintained every month rather than written on the way out.

What Payroll Key-Person Risk Actually Means

Most employers recognise the problem in its mildest form. One person runs payroll. They take leave, and the cycle either waits for them or goes out with less checking than usual. That is the visible symptom, and it is one of the signs that in-house payroll has outgrown its arrangements. The underlying exposure is larger, and it has three parts.

Access

Payroll in the Gulf is transacted through statutory systems, and in several states those systems authenticate a person, not a company. Bahrain’s Labour Market Regulatory Authority requires an Advanced eKey, an individual national identity credential, and permits exactly one Wage Responsible Person per employer. Saudi Arabia’s Ministry of Human Resources and Social Development describes the wage protection file as uploaded by “the establishment owner or a commissioner”, with establishments listed against the user’s own ID or residency number. In the United Arab Emirates, the General Pension and Social Security Authority directs employers to register and log in to its Maashi platform using UAE PASS, a personal digital identity. None of these are corporate passwords that can be handed over in an envelope.

Interpretation

Payroll rules in the region define the base precisely, and the work of applying that definition to your own pay elements still has to be done by someone. Saudi Arabia calculates the end-of-service award using the worker’s last Wage. Article 2 defines “Wage” as the Actual Wage, which consists of the Basic Wage plus the other wage elements that fall within the statutory definition. Article 86 separately allows the parties to agree that all or some commissions, sales percentages and similar variable wage elements that naturally increase or decrease are excluded from the wage used to calculate the end-of-service award. For continuity purposes, the handover pack should therefore document which pay elements form part of Actual Wage and any valid Article 86 exclusions rather than relying on an undocumented payroll convention.

Qatar works differently again. Article 54 of Labour Law No. 14 of 2004 provides for an end-of-service gratuity of not less than three weeks’ Wage for every year of employment, while specifying that the worker’s last Basic Wage is the basis for calculating the gratuity. The pay-element treatment should therefore be documented using the Labour Law’s defined terms rather than treating “Wage” and “Basic Wage” as interchangeable. Oman and Bahrain both name the basic wage, and Bahrain adds the social allowance to it. The country-by-country position is set out in more detail in our guide to GCC end-of-service benefits. Whoever resolves these questions in your payroll is making a documented decision or an undocumented habit. Only one of those survives a resignation.

Sequence

Payroll is a dated process, not a calculation. The dates differ by country, they are not all in the statute, and several of them moved recently. The current position is set out in our breakdown of GCC payroll deadlines for 2026. A continuity plan that transfers the calculation but not the calendar transfers the easy half.

This is a different question from the one answered by our earlier piece on the hidden risks of in-house payroll management, which frames the risk of running payroll without specialist expertise in general terms. This article is narrower and more practical: what specifically breaks when one person leaves, and what you put in the pack so that it does not.

What the Departing Payroll Owner Takes With Them, Country by Country

This is the table to work through first, because it is the part that cannot be rebuilt by reading last month’s payslips. For each country, identify which named individual currently holds each credential, and what the re-appointment route is if that person is unavailable.

Country	Systems the employer transacts on	How access is bound	Continuity action
United Arab Emirates	MOHRE wage-protection processes through an approved bank, financial institution or exchange house; GPSSA Maashi where the employer has employees subject to GPSSA; DIFC and ADGM regimes separately where you have entities there. ILOE is documented separately below, because it is not an employer filing portal	GPSSA directs employers to register and log in to Maashi using UAE PASS, a personal digital identity, and Maashi provides employer access to employee pension-registration services. Authorised signatories on the MOHRE establishment file are approved through the Federal Authority for Identity, Nationality, Customs and Port Security	Record who holds UAE PASS access to Maashi and who is named on the establishment file. MOHRE operates an “Updating the Establishment File” service; confirm the current route and documents before you need it
Saudi Arabia	Mudad Business for the wage protection file; GOSI for social insurance; Qiwa for establishment and contract management; the MHRSD establishment file	MHRSD states the wage protection file is uploaded by “the establishment owner or a commissioner”, selecting the establishment from the list affiliated to the user’s ID or residency number. GOSI requires a written authorisation from the employer, with the registration form approved by the authorised person. Qiwa publishes user-management guidance for business accounts	Maintain a written delegated-user register per system. The MHRSD employer compliance guide requires the establishment to update its data on any change, enforced as a violation
Qatar	ADLSA wage protection system, mandatory for all establishments subject to Labour Law No. 14 of 2004; the General Retirement and Social Insurance Authority, whose current public-facing portal and brand is DAMAN, for Qatari nationals’ retirement contributions; the Ministry of Commerce and Industry for authorised signatories	The credential model is not clearly addressed in the authorities’ published guidance. Changing authorised signatories runs through the Commercial Registration and Licenses Department at MOCI	Check older continuity documents to ensure that links and portal instructions point to the current DAMAN service environment rather than to superseded addresses
Oman	Social Protection Fund employer electronic services; Ministry of Labour wage protection system; wages transferred through institutions licensed by the Central Bank of Oman	The Social Protection Fund publishes a user manual for employer electronic services. The account and delegation model is not clearly addressed in that published guidance	Record the SPF employer account holder and the bank contact for the wage file. Confirm the current delegation route with the Fund where its published guidance does not address the replacement scenario you need
Bahrain	LMRA Expat Management System for the wage file; Social Insurance Organisation employer services, including the end-of-service gratuity scheme for expatriate staff; approval of the file through the employer’s own banking channel	LMRA requires an Advanced eKey, an individual credential. The employer appoints a Wage Responsible Person and only one is permitted per employer; the assignee must accept the role using their own eKey. Up to five Authorized Persons may be added, each with their own eKey and a defined authorisation level. SIO uses an establishment account with an eKey required for certain services	Only one Wage Responsible Person is permitted per employer, so the role cannot be duplicated and has to be transferred rather than shared. Appoint Authorized Persons in advance to provide supporting maker and checker access, and check that the Wage Responsible Person is not the same individual as your only payroll preparer
Kuwait	PIFSS employer registration and the E-Portal for Business Owners; the Sahel channel; wage protection administered through the labour ministry	PIFSS registration requires two duplicate specimen signature cards on Form 52, so a signatory record exists. The authentication model for the business portal is not clearly addressed in the authority’s published guidance	Hold a copy of the lodged Form 52 and confirm with PIFSS how a specimen signature is replaced. Confirm the portal credential model, and the current scope of the wage protection requirement as it applies to your establishment, with the Public Authority for Manpower directly; do not assume either mirrors another state

Two cross-border points sit underneath this table. First, Gulf nationals working outside their home state are on a third statutory track. The GPSSA sets out that a GCC national working in the United Arab Emirates is registered with their home country’s social security organisation, with contributions remitted to a bank designated by each state, and any rate difference borne by the employee. Bahrain’s Social Insurance Organisation lists a different documentation set for each nationality it registers under the extension system. That per-nationality knowledge is almost always tacit. Second, the United Arab Emirates is not one payroll regime. DIFC and ADGM operate their own employment law, including their own end-of-service and record rules, so a group with entities in those jurisdictions should read that position separately in our guide to free zone versus mainland payroll in the UAE.

What Your Documentation Has to Outlive

Continuity planning is often framed as a people problem. It is also a records problem, and the requirements are shorter, and less uniform, than most finance teams assume. In the United Arab Emirates, two separate requirements run in parallel. The employment-law worker file carries its own minimum period, and records that support the employer’s Corporate Tax position are subject to a longer tax record-keeping requirement. The tax period does not automatically govern every payroll record, so identify which records support a Corporate Tax position and retain those accordingly. Different record-retention requirements can apply across UAE mainland, DIFC and ADGM entities. The applicable rule should therefore be documented at entity level rather than applying one UAE-wide retention period.

Country	Statutory record floor	Provision	What this means for a handover
United Arab Emirates (federal)	Worker file kept not less than two years from the end of service. Separately, records that support the employer’s Corporate Tax position are retained at least seven years after the end of the relevant tax period	Federal Decree-Law No. 33 of 2021, Article 13. Federal Tax Authority guidance on record retention	Identify which payroll records support a Corporate Tax position and retain those to the seven-year tax requirement. The two-year employment-law floor continues to apply to the worker file in its own right; the seven-year period is not a blanket rule for all payroll records
United Arab Emirates (DIFC)	Six years after the termination date	DIFC Employment Law No. 2 of 2019, Article 16(2)(c)	A fixed period, and the longest of the UAE employment-law floors
United Arab Emirates (ADGM)	Under the ADGM Employment Regulations 2024, effective 1 April 2025, employers must maintain the employment records prescribed in section 10 and retain them in accordance with the ADGM Data Protection Regulations 2021. The current Employment Regulations do not prescribe a fixed two-year employment-record retention period	ADGM Employment Regulations 2024, section 10; ADGM Data Protection Regulations 2021	The Data Protection Regulations apply a storage-limitation principle, under which personal data should not be retained in identifiable form for longer than necessary for the purpose for which it is processed, subject to other applicable legal and regulatory retention requirements
Saudi Arabia	The Labour Law requires records including the workers’ wage payroll, and the Implementing Regulations prescribe their content. Neither states a retention period	Labour Law Article 17; Implementing Regulations Article 5	Set your own retention standard and write it down, because the statute will not set it for you. Confirm the position with MHRSD
Qatar	Individual worker file kept at least one year after separation. Five registers are prescribed, including the wage register, with no period attached to them	Labour Law No. 14 of 2004, Articles 47 and 48	The wage register has no stated retention period. Treat that as a gap to be filled by policy, not as permission to discard
Oman	Worker file kept at least one year from the date the employment relationship ends	Labour Law, Royal Decree 53/2023, Article 52	A one-year floor does not survive a two-year-old dispute. Set a longer internal standard
Bahrain	Worker file kept at least two years from expiry of the labour contract. A wage register is separately prescribed with no period attached	Law No. 36 of 2012, Articles 68 and 46	Since March 2024 the expatriate end-of-service gratuity runs as a monthly SIO contribution, so the contribution history is now part of the record set
Kuwait	A record-keeping duty applies. No retention period in years could be verified against the law or an official publication	Law No. 6 of 2010, period not located	Confirm the position with the Public Authority for Manpower and record the answer in the pack

Compliance check required: no Kuwaiti payroll record-retention period in years, and no Saudi payroll record-retention period, could be verified against an official source. Confirm both with the Public Authority for Manpower and MHRSD respectively before relying on an internal standard in a client-facing document.

OPS Expert View: Documentation Decays Faster Than People Leave

OPS expert view The continuity conversation usually assumes a static rulebook and a mobile workforce. In Gulf payroll the opposite is closer to the truth. A handover pack written in early 2025 and filed away is already out of date in more than one state, and none of those errors required anyone to leave. In the United Arab Emirates, the wage protection position changed with effect from 1 June 2026, and Ministerial Resolution No. 340 of 2026 now governs it. Wages for the previous month are due on the first day of each Gregorian month. Any pack still describing the previous arrangement is describing a rule that has been superseded. In Qatar, the General Retirement and Social Insurance Authority’s current public-facing portal and brand is DAMAN, so written procedures that name GRSIA and give its older web addresses will send a new payroll owner to a superseded service environment. Neither of those changes announced itself inside anybody’s documentation. This is why the useful unit of continuity planning is not the handover document. It is the review cycle that keeps the document true. A pack with an owner and a monthly review date is a control. The same pack without one is an archive, and an archive gives a new payroll owner false confidence at exactly the moment they have none to spare.

 

Four Controls That Close the Gap

The four controls below are operational practices OPS applies and recommends. They are not statutory requirements, and no Gulf labour law prescribes them. Treat them as the employer’s own continuity standard, applied on top of the statutory obligations set out in the tables above.

1. Documentation that is current rather than historic

The test is not whether documentation exists. It is whether someone who has never run your payroll could produce a correct cycle from it. Write the procedure against the calendar, name the authority behind each rule, and date every statement. Where the position is genuinely unsettled, such as the record retention period in Saudi Arabia or the wage register period in Qatar, write down that it is unsettled and record the internal standard you have adopted instead. A documented decision is auditable. A silent one is not.

2. A named backup who has actually run a cycle

A backup who has read the procedure is not a backup. As an OPS continuity control rather than a legal requirement, the person should have prepared and submitted at least one live cycle per country in the last two quarters. Separately, and this part is driven by the statutory systems themselves, the backup should hold their own credentials where the system requires an individual identity. In Bahrain that means being appointed as an Authorized Person on the Expat Management System with their own Advanced eKey, not sharing the primary holder’s. In Saudi Arabia it means holding a documented authorised or delegated access route on each platform separately rather than borrowing a login.

3. Cross-training against the calendar, not the person

Shadowing teaches habits, including the undocumented ones. Train against the dated cycle instead: inputs close, validation, variance review, sign-off, file preparation, submission, statutory filings, payslip publication. Each step has an owner, a deadline and an evidence artefact, and the deadline differs by country. Article 90 of the Oman Labour Law requires wages to be paid within three days of the date on which they become due, and the Ministry of Labour’s current wage protection FAQ gives the same instruction and states that an establishment is considered late once the three-day period has been exceeded. In Bahrain, the Enhanced Wages Protection System is designed to document and monitor the timely electronic payment of wages through the LMRA framework and participating banks and financial institutions approved by the Central Bank of Bahrain. Employers should document the operational submission timetable applicable to their WPS channel, but should not treat an operational file-submission period as a statutory grace period for late wage payment. Saudi Arabia’s employer compliance guide treats the first day of the month as the wage due date where the establishment’s own documents do not fix one. These are not interchangeable.

Joiner and leaver deadlines belong on the same calendar, because they are where a covering colleague most often falls behind. In Kuwait, PIFSS requires the employer to notify it of an employee’s enrolment within the first ten days of the appointment, and a late notification calls for a written explanation from the employer. In the United Arab Emirates, GPSSA publishes slightly different timing language across its current service pages. Its Employer Registration page states that an Emirati employee must be registered within 30 working days of joining, while its Registration of an Insured service states that the employer’s request must be submitted within one month of the employee joining. Employers should follow the deadline displayed in the applicable Maashi service and confirm the current requirement with GPSSA where the distinction affects a live registration. In Qatar, changes to authorised signatories run through a separate ministry from the one that supervises wage protection, so the two do not update each other. A backup who knows the monthly run but not these dates will pass the first cycle and fail the second.

Compliance check required: the GPSSA joiner deadline is stated differently on two current GPSSA service pages: 30 working days on Employer Registration, and one month on Registration of an Insured. Confirm the applicable figure with GPSSA before it affects a live registration.

4. A handover pack that is maintained monthly

The pack is a live artefact with a named owner and a review date, refreshed as part of the cycle rather than assembled during a notice period. The same discipline applies to the control that sits at the end of the cycle: the point at which someone other than the preparer approves the run. That control is set out in our piece on the payroll sign-off step providers skip, and the segregation it depends on is covered in our guidance on payroll fraud and salary diversion controls.

What Belongs in a Payroll Handover Pack

Section	What it must contain	How to test it
Entity and calendar map	Every legal entity, its country, its pay frequency, its wage due date, its statutory filing dates and its non-banking days	Ask someone outside payroll to state next month’s submission date for each entity using only the pack
Access register	Each statutory system, the named individual who holds access, the credential type, the delegated users, and the documented route to appoint a replacement	Remove the primary holder on paper and trace every system to a second named person
Pay element dictionary	Every earning and deduction code, whether it sits in the basic wage, whether it enters the end-of-service base, whether it is contributory, and the country rule or internal decision behind each answer	Pick three allowances and ask why each is treated as it is. If the answer is “that is how we have always done it”, the entry is missing
Statutory position per country	The end-of-service base, the social insurance treatment for nationals, expatriates and other Gulf nationals, and the record retention standard, each with its source and date	Check that each entry names an authority and carries a date. Undated entries are assumptions
Controls and sign-off	The variance thresholds, the checks performed before release, who approves, and where the approval evidence is stored	Reconstruct last month’s approval trail from the pack alone
Exceptions log	Every off-cycle payment, retrospective correction, unusual leaver and disputed calculation from the last twelve months, with the resolution	Count the entries. A log with no entries is not a clean payroll, it is an unmaintained log
Third-party contacts	Named contacts at each bank or exchange house, the pension or social insurance authority relationship, and the escalation path when a file is rejected	Confirm each contact is still in post at review
Change log	Every regulatory change applied in the last eighteen months, the cycle it took effect in, and what was reconfigured	If the log has no entry for the UAE wage protection change of June 2026, the pack is out of date

 

How OPS Approaches Payroll Continuity

OPS builds and maintains the payroll calendar per country and per entity, and applies regulatory change to that calendar before the affected cycle rather than after it. Each client entity is configured to its own payroll calendar, approval flow and statutory rules, confirmed during implementation and maintained through monthly governance. Validation, quality assurance and variance review happen before anything reaches a bank file, and nothing is released until the client signs off.

The continuity point is structural rather than contractual. Work is owned by a named specialist with a named backup, not a shared queue, so the second person is part of the operating model rather than a contingency. For a healthcare operator of around 270 staff across the United Arab Emirates and Saudi Arabia, that model removed key-person dependency and produced a full audit trail alongside an employee self-service rollout. Statutory scope per country, integrations and country coverage are confirmed during scoping rather than assumed. Employers weighing the arrangement against an in-house team will find the numbers set out in our payroll outsourcing cost and total cost of ownership breakdown, and employers already mid-transition should read our parallel-run guide to switching payroll providers.

“Audit-ready” here describes operating discipline: controlled cycles, evidence packs, statutory checks, monthly governance and advisory updates within the agreed scope. It is not a legal or tax guarantee.

 

A 30-Day Plan for a Single-Owner Payroll

Week 1. Build the access register

One row per statutory system per country, naming the individual who holds it today and the credential type.

Week 2. Appoint the second holder where the system allows it

In Bahrain, add an Authorized Person on the Expat Management System. In Saudi Arabia, document the authorised or delegated access route separately for Mudad, GOSI and Qiwa, including the named user, the authority under which that person acts and the current replacement procedure; do not assume that one delegation mechanism applies across all three platforms, and test each route before it is needed for a live payroll cycle. In Kuwait, confirm with PIFSS how a Form 52 specimen signature is replaced and who may transact on the business portal. In the United Arab Emirates, Qatar and Oman, confirm the delegation or replacement route with the authority in writing and record the answer wherever the authority’s published guidance does not clearly address the replacement or delegation scenario you need.

Week 3. Write the pay element dictionary

This is the slowest section and the one that carries the most undocumented judgement.

Week 4. Run the removal test

Take the primary owner out of the process on paper and have the backup produce the next cycle from the pack, with the primary available only to answer questions that the pack cannot. Every question they have to ask is a defect to log.

This article is general guidance and not legal advice. Figures, deadlines and thresholds change; verify each against the named authority for your country and entity type before acting.

Frequently Asked Questions

What is payroll key-person risk?

Payroll key-person risk is the exposure created when one individual holds knowledge or system access that the employer cannot reconstruct without them. In the Gulf states it is heightened because several statutory systems authenticate a named individual rather than the company, and because the interpretation of pay elements against each country’s end-of-service and contribution base is frequently undocumented.

What should be in a payroll handover pack?

Eight sections: an entity and calendar map, an access register naming who holds each statutory credential, a pay element dictionary explaining how every earning and deduction is treated, the statutory position per country with sources and dates, the controls and sign-off trail, a twelve-month exceptions log, third-party and bank contacts, and a change log of regulatory changes applied. Each section should have a test that proves it works, not only a heading.

How long must payroll records be kept in the Gulf states?

The floors differ. The United Arab Emirates sets not less than two years from the end of service under Federal Decree-Law No. 33 of 2021. Separately, records that support the employer’s Corporate Tax position are retained for at least seven years after the end of the relevant tax period, which is a tax requirement applying to those records rather than a blanket rule for all payroll data. DIFC sets six years after termination. Bahrain sets at least two years from expiry of the contract. Qatar and Oman each set at least one year after separation. Saudi Arabia’s Labour Law and Implementing Regulations prescribe the records but state no period. No period could be verified for Kuwait. Confirm the current position with the authority for each country you operate in.

Who should be the named backup for payroll?

As an operational control rather than a legal requirement, OPS recommends someone who has prepared and submitted at least one live cycle per country in the last two quarters. What the statutory systems themselves require is that the backup holds their own credentials where the system is bound to an individual identity. Sharing a login is not a backup arrangement, and in jurisdictions that bind access to a personal digital identity it may not be permissible.

What happens to statutory portal access when a payroll manager leaves?

It depends on how the access is bound. Where a personal identity credential is used, such as Bahrain’s Advanced eKey or UAE PASS for the GPSSA Maashi platform, the access leaves with the person and must be re-appointed. Bahrain permits only one Wage Responsible Person per employer, so the appointment has to be transferred rather than duplicated. Establish the replacement route for each system in advance and record it, because discovering it during a pay cycle is expensive.

How often should a payroll handover pack be updated?

Monthly, as part of the cycle, with a named owner and a review date. Rules change often enough that an annual refresh leaves the pack wrong for most of the year. The wage protection position in the United Arab Emirates changed with effect from 1 June 2026, and a pack still describing the previous window would have been out of date within one cycle.

Does outsourcing payroll remove key-person risk?

It changes where the dependency sits, and that is only an improvement if the provider’s model is built for it. The questions to ask are whether a named specialist and a named backup are assigned to your account rather than a shared queue, whether the payroll calendar is maintained per country and per entity, whether regulatory change is applied before the affected cycle, and whether you sign off before anything is released. A provider who cannot answer those four has moved your key-person risk rather than reduced it.

Ask OPS to review your payroll continuity before the next cycle If one person holds your statutory access, your pay element decisions and your filing calendar, the removal test is worth running before you need it. You can also book a payroll consultation or visit www.ops.ae. Review My Payroll Continuity

This guidance reflects OPS’s current understanding of applicable requirements and does not constitute legal advice. Statutory deadlines, retention periods and portal access rules across the GCC change regularly; confirm any specific obligation with the relevant authority or professional adviser before acting on it.

Sources

• Ministry of Human Resources and Emiratisation (MOHRE): establishment file and wage protection processes; Ministerial Resolution No. 340 of 2026, effective 1 June 2026. Wage obligation under Federal Decree-Law No. 33 of 2021, Article 13 for the worker-file retention floor
• General Pension and Social Security Authority (GPSSA): Maashi employer access via UAE PASS, employer registration timing, and the GCC national registration position
• Ministry of Human Resources and Social Development (MHRSD), Saudi Arabia: wage protection file upload and the employer compliance guide; Labour Law Articles 2, 17, 84 and 86, and Implementing Regulations Article 5. Social insurance via GOSI; establishment and contract management via Qiwa
• Ministry of Labour, Qatar (ADLSA): wage protection system; Labour Law No. 14 of 2004, Articles 47, 48 and 54, under which the end-of-service gratuity is expressed as not less than three weeks’ Wage per year of employment with the last Basic Wage as the calculation basis. Retirement contributions for Qatari nationals through GRSIA, whose current public-facing portal and brand is DAMAN
• Ministry of Labour, Oman: Wages Protection System FAQ, confirming the three-day transfer instruction under Article 90 of the Labour Law and the treatment of late transfers; worker-file retention under Royal Decree 53/2023, Article 52
• Labour Market Regulatory Authority (LMRA), Bahrain and the LMRA Wage Protection Guideline: Advanced eKey, the Wage Responsible Person and Authorized Persons; Private Sector Labour Law No. 36 of 2012, Articles 46, 47 and 68
• Public Institution for Social Security (PIFSS), Kuwait: employer registration, Form 52 specimen signature cards and the ten-day enrolment notification; Labour Law No. 6 of 2010. The scope and commencement of Kuwait’s wage protection requirement is not stated here, as it could not be verified against a current official Public Authority for Manpower source
• DIFC Employment Law No. 2 of 2019, Article 16(2)(c); ADGM Employment Regulations 2024 (effective 1 April 2025), section 10, read with the ADGM Data Protection Regulations 2021
• Secondary sources, disclosed as such: the UAE wage protection change effective 1 June 2026 is carried on firm commentary (EY, Baker McKenzie, Deloitte) because the MOHRE primary text was unreachable at the time of writing. No threshold percentage, day count or enforcement-ladder figure is published here as a result