Suspecting embezzlement is one thing; proving that a specific amount left the company’s accounts to a specific recipient on a specific date is another thing entirely. The first is enough to start an examination; the second is what the prosecutor and the court need to move a case forward or order restitution. The bridge between them is tracing the funds: linking every suspect riyal to its source, its path and its beneficiary with evidence that holds.
In Embezzlement and Financial Fraud Reports we explained what a business owner should do in the first days and what makes a report usable. This guide goes one step deeper: how the money is actually traced, which sources of evidence the Evidence Law recognises, and how the schedule on which the report stands is built.
1. The legal framework in brief
- Breach of trust: imprisonment of up to five years and a fine of up to SAR 3 million, or either, for anyone who misappropriates money entrusted to them by virtue of their work or by way of trust, partnership, deposit or agency, or who disposes of it in bad faith (Anti-Financial Fraud and Breach of Trust Law, Article 2).
- Financial fraud: imprisonment of up to seven years and a fine of up to SAR 5 million, or either, for taking another’s money by fraudulent means such as lying, deception or delusion (Article 1); instigators, accomplices and attempts are also punishable (Articles 3 and 4).
- Digital evidence: any evidence derived from data created or stored by digital means, with the same evidentiary status as writing (Evidence Law, Articles 53–55); unofficial digital evidence binds the parties to a transaction where it was produced under the Electronic Transactions Law or derived from a digital means stipulated in the contract (Article 57).
- Books: a merchant’s books are evidence against their owner in whatever the opponent relies on (Article 31); the court may compel a party to produce documents and treat refusal as a presumption (Articles 34 and 36), and may obtain documents from public bodies (Article 37).
- Expertise: a court-appointed expert may request books, records and documents from the parties and others and inspect premises (Article 115), and no one may refuse to enable the expert’s work (Article 116).
2. The money map — three layers that must agree
Every successful trace compares three layers of data, not one:
| Layer | Contents | What the comparison reveals |
|---|---|---|
| The accounting books | Entries, ledgers and attached documents | What the accountant said happened |
| Bank and point-of-sale statements | The actual flows with their dates and beneficiaries | What actually happened to the cash |
| External sources | E-invoicing data and VAT returns, the GOSI register, supplier and customer statements, e-commerce platforms | What was declared to third parties and cannot be altered by the perpetrator |
Embezzlement lives in the gaps between these layers: revenue reported to ZATCA but never deposited, a supplier in the books that does not exist, an employee on the payroll who is absent from GOSI, a bank transfer with no entry.
3. The methodology, step by step
- Preserve the evidence before anything else: a full copy of the accounting and invoicing system databases and their access logs, frozen user rights, and a record of who received what and when (chain of custody). Any change after the suspicion arises opens everything that follows to challenge.
- Define the scope of the trace: the period, all bank accounts including closed ones, points of sale, digital wallets, and every account the suspect had authority over.
- Analyse the bank statements: classify every movement and match it to an entry and a document; the unmatched movements are the first work list.
- Analyse the beneficiaries: recurring account numbers, round-amount transfers, unusual timing (holidays, out of hours), suppliers whose details match employees’ (address, phone, bank account), and suppliers created after the suspect obtained authority.
- Cross-check revenue: compare sales reported through the Fatoora platform and VAT returns with actual deposits, and examine cancelled invoices, credit notes and unusual discounts.
- Cross-check payroll: the payroll sheet against the GOSI register and Wage Protection System transfers, to detect ghost employees and duplicated salaries.
- Examine the supporting documents: altered invoices, duplicate documents behind multiple payments, expense claims with no original, and field verification of suppliers where needed.
- Quantify: a schedule of every suspect movement — date, amount, account, beneficiary, evidence and level of proof (established / probable / needs a third-party document).
- Timeline and narrative: how it started, how it developed, and where the control gap was.
- The report, under Article 117 of the Evidence Law where the expert is court-appointed, and with the same structure where the expert is engaged by a party.
4. What is proven and what remains probable
An amount supported by a bank movement into an account in the suspect’s name is established. An amount that left in cash with no documented beneficiary remains probable unless reinforced by another indication (an admission, or a match with deposits in the suspect’s personal account obtained by the court under Article 37). Separating the two categories in the schedule is what gives the report its credibility; a report that mixes them is challenged in its entirety because of its weakest part.
5. Sources of evidence with weight — and how they are obtained
- Official bank statements of the business: requested from the bank directly, not taken from the suspect’s files.
- Data generated automatically by the digital systems of public bodies (Fatoora, GOSI, ZATCA platforms): carries the weight of an official document under the conditions of Article 56 of the Evidence Law.
- Accounting and invoicing system logs with access and edit records: unofficial digital evidence binding on the parties to the transaction (Article 57).
- Supplier and customer confirmations of their balances and movements.
- The suspect’s personal accounts: not accessible to the business itself, only through the court or the investigating authority (Article 37).
6. The errors that weaken a trace
- Relying on the books alone — the very records the perpetrator manipulated.
- Altering data or confronting the suspect before the evidence is preserved.
- Mixing estimates with established amounts in a single figure.
- Overlooking secondary accounts, points of sale and digital wallets.
- Accusing without linking the beneficiary to the suspect by evidence.
- A report that lists conclusions without explaining how they were reached and why the evidence is sufficient.
7. After the report — recovering the money
The report serves two tracks at once: the criminal complaint under the Anti-Financial Fraud and Breach of Trust Law, and the civil claim for restitution and compensation. In the civil track a precautionary attachment over the defendant’s assets is usually sought to secure enforcement, and the documented schedule is the basis for the amount attached. See quantifying financial damages for losses beyond the misappropriated amount itself.
We conduct embezzlement examinations and tracing within our fraud and misconduct reports service, with a report fit for the prosecutor, the court and arbitration.
Frequently asked questions
Is the accountant’s report enough to convict the suspect?
The report is technical evidence weighed by the investigating authority and the court with the other evidence. Its value is that it turns suspicion into specific facts with amounts, dates, beneficiaries and verifiable evidence, on which the criminal and civil cases are built.
How do we obtain the suspect employee’s personal bank statements?
The business cannot do that itself. They are requested through the investigating authority or the court, which may obtain documents from public bodies and third parties (Evidence Law, Articles 36 and 37). The report is built first on the business’s own accounts and external sources, then completed with what the competent authority obtains.
Do accounting system logs count as admissible evidence?
Yes. Digital evidence has the status of written evidence (Article 55), and unofficial digital evidence binds the parties to the transaction in the cases set out in Article 57, provided its integrity is preserved and its chain of custody documented.
How long does an examination take?
It depends on the number of accounts, the period, the volume of transactions and the completeness of documents. A limited examination of one account and one year is very different from a full examination of several accounts and years with fictitious suppliers, and the scope is agreed in writing before work starts.
Do we report first or examine first?
Preserve the evidence first and immediately. Then legal counsel decides the timing of the report in light of the preliminary findings; an early report with no preserved evidence may allow the suspect to tamper with it.
