SABIC suppliers register on SAP Ariba (by self-registration or SABIC’s invitation), then complete a due diligence assessment with SABIC’s provider Achilles, technical qualification where applicable, and onboarding before a vendor ID is issued. Suppliers in certain cybersecurity classifications also need the Group Cybersecurity Compliance Certificate (CCC), which replaced SABIC’s CyberTrust programme and is valid for two years. Registration does not guarantee business with SABIC.
- Platform
- SAP Ariba (self-registration or invitation)
- Due diligence
- Achilles, may include booking, payment and an on-site audit
- Cybersecurity
- Group CCC (formerly CyberTrust), valid 2 years
- Start window
- Begin due diligence within 1 week of SABIC’s email
- Fee
- No SABIC registration fee published; due diligence may involve a fee
- CCC contact
- GroupCCC@sabic.com
Why SABIC registration matters
SABIC is one of the world’s largest chemical companies and a major buyer of raw materials, equipment, maintenance, logistics, IT and professional services, especially around Jubail and Yanbu. Every one of those purchases goes to suppliers with an active SABIC supplier record.
How the SABIC process works
| Stage | What happens | Your action |
|---|---|---|
| 1. Ariba registration | Supplier self-registration form, or an invitation email from SABIC via SAP Ariba | Create/confirm your Ariba Network account and complete the SABIC profile |
| 2. Due diligence | Assessment run with SABIC’s provider Achilles: company, ownership, finance, compliance | Start within 1 week of the email; book, pay if required, prepare for any audit |
| 3. Technical qualification | Category-specific review; a site visit may be required | Provide technical documents, certificates and references |
| 4. Onboarding | Commercial set-up and vendor ID issued | Confirm bank, contacts and terms |
Documents to prepare
- Commercial Registration (and industrial licence for manufacturers)
- VAT and Zakat certificates
- GOSI and Saudization (Nitaqat) certificates
- Chamber of Commerce membership
- Ownership structure and authorized signatory letter
- Bank reference / IBAN letter
- Latest audited financial statements
- Company profile, product catalogues, ISO and HSE documents
- Acknowledgement of SABIC’s supplier code of conduct
Always check the exact list in your Ariba questionnaire, because it changes with your category.
Group CCC: SABIC’s cybersecurity requirement (formerly CyberTrust)
SABIC’s earlier CyberTrust certificate programme has been moved into the Group Cybersecurity Compliance Certificate (CCC) programme, which unifies SABIC’s and Saudi Aramco’s supplier cybersecurity processes. It is mandatory for new and existing suppliers in the relevant cybersecurity classifications.
- Review the Group CCC standard, guideline and supplier manual on SABIC’s supplier portal.
- Appoint an audit firm from SABIC’s authorized list.
- Complete the assessment against the Third Party Cybersecurity Standard.
- Submit the certificate to SABIC.
The certificate is valid for two years. If a new contract falls under a classification your certificate does not cover, an additional certificate is needed. We prepare your policies, evidence and self-assessment through our compliance service.
Cost and timeline
| Item | What to expect |
|---|---|
| Ariba registration | No SABIC fee published |
| Achilles due diligence | May involve a fee and an on-site audit |
| Group CCC | Audit firm fee; certificate valid 2 years |
| Overall time | Not published by SABIC; typically weeks, longer if an audit or site visit is needed |
Common mistakes
- Missing the one-week window to start due diligence
- Ariba profile name or bank details not matching the CR
- Under-prepared ownership and financial information
- Starting the CCC too late, when a contract is already waiting
- Applying for categories without technical proof
How Luba helps
We complete your Ariba profile, prepare the due diligence pack, coordinate the Achilles assessment and Group CCC, and follow up until onboarding. See also our Ma’aden fast-track guide and Aramco guide.
Frequently asked questions
How do I register as a SABIC supplier?
Register on SAP Ariba through SABIC’s supplier self-registration form or the invitation SABIC sends you, complete the SABIC profile, then go through due diligence with Achilles, technical qualification if applicable, and onboarding.
How long does SABIC vendor registration take?
SABIC does not publish a fixed time. Most complete applications take several weeks; due diligence audits, site visits or a Group CCC requirement can extend this.
What is Achilles in SABIC registration?
Achilles is the due diligence provider SABIC uses to assess suppliers’ company, ownership, financial and compliance information. The assessment may include booking, a fee and an on-site audit.
Is SABIC CyberTrust still required?
SABIC’s CyberTrust programme has transitioned into the Group Cybersecurity Compliance Certificate (CCC), shared with Saudi Aramco. Suppliers in the relevant classifications need a CCC from an authorized audit firm, valid for two years.
Can foreign companies register with SABIC?
Yes, SABIC works with international suppliers through SAP Ariba. Requirements and due diligence depend on your country and category.
Does SABIC registration guarantee business?
No. SABIC states that completing the supplier registration process does not guarantee business. It makes you eligible for SABIC’s sourcing events.
- SABIC – Group Cybersecurity Compliance Certificate Program
- SABIC – Registration guide for new suppliers (PDF)
- SABIC – Communication to new suppliers (PDF)
Requirements can change. Always confirm current rules with the official authority or our team before applying.
