How to become an Aramco vendor: steps, documents and the CCC

Aramco asks every company that wants to supply it to register first. The route depends on where you are based. Companies in Saudi Arabia register through the Aramco e-Marketplace Platform, and the Dhahran office handles them. Suppliers in other countries follow other routes, often through Aramco affiliates abroad.

Registration starts with a questionnaire on the e-Marketplace. Aramco publishes a Supplier Registration Technical Guide and video tutorials for this step, plus separate In-Kingdom registration forms for vendors and for manufacturers. Read the guide before you start, because the form follows it closely.

Be careful with your search words. In Saudi Google, "التسجيل في ارامكو" on its own mostly brings jobs and graduate programs. The supplier pages are under "suppliers" on aramco.com. Use only the official site and the official e-Marketplace link from that page, and ignore offers that promise to register you for a fee.

For companies based in Saudi Arabia, Aramco's supplier page asks for valid copies of these government documents: the Commercial Registration (CR) certificate; the industrial licence, for manufacturers only; the investment licence, if it applies; the Zakat certificate; the VAT certificate; the GOSI certificate; a Civil Defense licence or an equivalent government licence; the Chamber of Commerce and Industry membership certificate; and the contractor government classification, for service providers only and if it applies.

The key word is "valid". An expired certificate is a common reason for a request to stop, so check every expiry date before you upload. Make sure the company name is the same on all of them and matches the CR exactly.

Three of the nine depend on your company type. A trading company that does not manufacture does not need the industrial licence, and a supplier of goods does not need the contractor classification. Do not upload something that does not apply, and do not skip something that does.

Aramco also asks Saudi-based suppliers for six documents of its own. The first is the original signed acknowledgement of the Aramco Supplier Code of Conduct, which is published in English and Arabic. The second is a letter from your bank that describes the services it gives your company and the status of the relationship. The third is a Company Ownership Profile with supporting documents. The fourth is an Authorized Signatory Letter that names the employees who will deal with Aramco.

The fifth is the Jadeer certificate from Monsha'at, for small and medium enterprises only, if it applies. Jadeer is a free Monsha'at pre-qualification service; its page says requests take 3 working days and need current records with the Ministry of Commerce, ZATCA and GOSI.

The sixth is the Cybersecurity Compliance Certificate (CCC). It takes the longest to prepare, so start it early. The next section explains it.

Aramco says all third parties doing business with Aramco Group companies must obtain the CCC. It is based on the Third Party Cybersecurity Standard, SACS-210. Aramco does not issue it itself: an authorized audit firm does. The program page lists 11 authorized firms and says Aramco has no preference among them.

The steps on the page are: prepare by getting your classification template from the Aramco department you work with and applying the SACS-210 controls; register on the CCC Portal and send a request to an authorized audit firm; complete the assessment, which the firm verifies before it issues the certificate; then submit the certificate and the compliance report to Aramco through the e-Marketplace.

The standard CCC is a self-assessment that the firm verifies remotely. CCC+ needs an on-site assessment and applies to some higher-risk classifications; the page's table and FAQ differ on which ones, so confirm with Aramco. The certificate is valid for two years and is accepted by Aramco, SABIC and other Aramco Group companies. Aramco does not publish the cost.

After you submit, Aramco evaluates the information. Its page says it decides whether there is a business need for what you offer and whether the supplier is financially and technically acceptable. Aramco does not publish a review time, so plan for a wait and keep your documents valid while you wait.

Aramco also states that registering and then qualifying as an Aramco supplier does not guarantee future business. Treat registration as the entry ticket. Business still depends on Aramco's needs, on your prices and on how you answer each bid.

Two more programs are worth knowing. iktva is Aramco's local content program, which Aramco describes as designed to drive supply chain efficiency and value across its operations; read its official page for the details that apply to you. For some materials, Aramco also publishes Engineering Requirements for Technical and Quality Approval (ERTQA), which may apply on top of registration.

ENTEK is not linked to Aramco, is not an Aramco partner and does not register suppliers on the Aramco e-Marketplace. It does not issue, check or approve the CCC, iktva, Jadeer or any other certificate. You register with Aramco yourself, on Aramco's own platform.

This article is an explainer. The nearest ENTEK feature is the verified company profile with CR and VAT numbers, certifications, key personnel and official stamp. Many of the papers Aramco asks for are the same papers other Saudi companies ask for, so keeping them in one profile, with the same company name and current dates, makes each new registration easier to fill in.

On ENTEK, corporate buyers who use the platform see that profile, and you can receive RFQs, submit bids and negotiate in rounds, with purchase orders when you win. You can start on the Free plan (1 store, 10 RFQs, 10 users). None of this changes how Aramco reviews your registration.