Loading...
Join our Facebook Group: Join: Expats in Saudi Arabia
Loading...
Every VAT-registered business in Saudi Arabia must issue electronic invoices through ZATCA's Fatoora system. This guide explains what changed, who needs to comply, and how to get your business set up.
Until 2021, invoicing in Saudi Arabia worked the way it does in most countries: businesses created invoices in whatever format they liked - paper, PDF, Word documents - and sent them to their customers. ZATCA (the Zakat, Tax and Customs Authority) only saw these invoices if they audited you. That changed with Fatoora, Saudi Arabia's mandatory electronic invoicing system, which requires every invoice to be generated in a structured digital format and reported to the government.
The shift happened in two phases. Phase 1 (Generation), effective since December 4, 2021, required all VAT-registered businesses to stop using handwritten or unstructured invoices and switch to compliant electronic invoicing software. Phase 2(Integration), rolling out in waves since January 1, 2023, goes further: your invoicing system must connect directly to ZATCA's platform via API, so the government can validate and track invoices in near-real-time.
Fatoora is part of Saudi Arabia's broader Vision 2030 push to digitize the economy. Similar systems are rolling out across the GCC and MENA region, but Saudi Arabia's implementation is among the most comprehensive - covering both B2B and B2C transactions, requiring cryptographic stamps on every invoice, and giving ZATCA visibility into commercial activity that was previously only accessible through audits. All official specifications, developer documentation, and updates are published on the Fatoora portal.
The short answer: if your business is registered for VAT in Saudi Arabia, you need to comply with Fatoora. This applies to Saudi companies, foreign companies with Saudi VAT registration, sole proprietors, and any entity that issues tax invoices or simplified tax invoices for taxable supplies. The specifics depend on which phase and wave apply to you.
Since December 2021, every VAT-registered business in Saudi Arabia must generate invoices electronically using compliant software. This means no more handwritten invoices, no invoices created in Word or basic text editors, and no unstructured PDFs. Your system must produce invoices with all the fields required by VAT regulations, including a QR code. If you're VAT-registered and issuing invoices, you should already be Phase 1 compliant.
Phase 2 is more demanding. It requires your invoicing system to connect to ZATCA's Fatoora platform via API, so invoices can be validated, stamped, and tracked by the government. ZATCA has been rolling this out in waves based on annual revenue - the largest businesses went first (3 billion SAR+), and the threshold has been progressively lowered. By 2025, businesses with revenue above 5 million SAR were included, and remaining businesses are being brought in through 2026. ZATCA notifies businesses at least 6 months before their deadline, so check your registered email regularly.
Foreign companies must comply only if they hold a Saudi VAT registration. This typically applies to foreign businesses with a permanent establishment in the Kingdom or those making taxable supplies in Saudi Arabia above the registration threshold. If your company only exports goods to Saudi importers who handle VAT through reverse charge, you're not required to use Fatoora. For multinationals with Saudi operations, most major ERP vendors (SAP, Oracle, Microsoft Dynamics) now offer Saudi e-invoicing modules that can be added as a country-specific layer without modifying your core system.
Businesses that aren't registered for VAT in Saudi Arabia are exempt from e-invoicing. However, the pool of exempt businesses is small. Saudi Arabia's mandatory VAT registration threshold is 375,000 SAR in annual taxable supplies, and businesses between 187,500 and 375,000 SAR can voluntarily register. Once you're registered, Fatoora applies. You can also use a third-party e-invoicing provider to handle compliance on your behalf, but the legal obligation remains with you - if your provider makes an error, you're liable for any penalties.
ZATCA has phased the rollout to give businesses time to adapt. Phase 1 applied to everyone at once, while Phase 2 integration has been rolled out in waves based on annual revenue, starting with the largest companies and working downward.
| Date | Phase / Wave | Revenue Threshold | Status |
|---|---|---|---|
| December 4, 2021 | Phase 1 - Generation | All VAT-registered taxpayers | In effect |
| January 1, 2023 | Phase 2, Wave 1 | Revenue above 3 billion SAR | In effect |
| July 1, 2023 | Phase 2, Wave 2 | Revenue above 500 million SAR | In effect |
| October 1, 2023 | Phase 2, Wave 3 | Revenue above 250 million SAR | In effect |
| November 1, 2023 | Phase 2, Wave 4 | Revenue above 150 million SAR | In effect |
| December 1, 2023 | Phase 2, Wave 5 | Revenue above 100 million SAR | In effect |
| January 1, 2024 | Phase 2, Wave 6 | Revenue above 70 million SAR | In effect |
| 2024-2025 | Phase 2, Waves 7-13+ | Revenue thresholds lowered to 5 million SAR | In effect |
| 2026 | Phase 2, remaining waves | All remaining VAT-registered businesses | Rolling out |
There is no opt-out mechanism. Once your wave deadline passes, compliance is mandatory. If you haven't received a notification yet, that doesn't mean you're exempt - it means your wave hasn't been announced. Use the time to get your systems ready.
The day-to-day impact of Fatoora depends on whether you're dealing with B2B or B2C transactions. Both require electronic invoices with QR codes and cryptographic stamps, but the government's involvement in the process differs significantly.
When you issue a standard tax invoice to another business, your invoicing system generates the invoice in UBL 2.1 XML format, applies a cryptographic stamp using your CSID certificate, and submits it to ZATCA's API. ZATCA validates the invoice against its business rules in real time. If everything checks out, ZATCA clears the invoice and returns it with their own stamp. If something's wrong - a missing field, an incorrect VAT calculation, an expired certificate - ZATCA rejects it with error details, and you cannot share that invoice with the buyer until it's cleared. The whole process typically takes seconds.
This is a fundamental change from the old system. Previously, you could send any invoice to your customer and sort out errors later. Now, ZATCA sits in the middle of every B2B transaction, acting as a real-time validator. It means cleaner data and fewer disputes, but it also means your invoicing system needs to handle rejections gracefully.
For sales to consumers (simplified tax invoices), the process is more relaxed. Your system generates the invoice, stamps it locally using your CSID, includes a QR code, and hands it to the customer immediately. You then report the invoice to ZATCA within 24 hours. This asynchronous approach is practical because retail point-of-sale systems can't afford to wait for a government API response for every customer transaction. It means your shop can keep operating even if there's a temporary connectivity issue with ZATCA's servers.
QR code requirements:Every e-invoice must include a QR code containing the seller's name, VAT registration number, invoice date and time, total amount with VAT, VAT amount, and a digital signature hash. For B2C invoices, this lets customers and ZATCA inspectors verify authenticity by scanning it. The QR data is TLV-encoded (Tag-Length-Value), not a simple text string.
If you're not yet integrated with Fatoora, here's the practical path to compliance. The process involves both administrative steps (VAT registration, portal access) and technical work (software configuration, API integration).
1. Confirm your VAT registration. Your VAT registration number (TIN) is your identity in the Fatoora system. Make sure your registration details - tax identification number, registered address, business activity codes - are current and correct on the ZATCA portal. Errors here will cause problems downstream.
2. Choose a compliant invoicing solution. Your accounting or ERP software needs to support UBL 2.1 XML generation, cryptographic stamping, QR code generation, API integration with Fatoora, and tamper resistance (preventing invoice modification after generation). Major options include SAP, Oracle NetSuite, Zoho Books, Cleartax, and various local Saudi solutions. For small businesses, cloud-based solutions are usually the simplest path to compliance.
3. Register on the Fatoora portal. Go to fatoora.zatca.gov.saand register your e-invoicing solution. You'll need to submit information about your software and generate a Certificate Signing Request (CSR) to obtain your CSID.
4. Obtain your CSID. Submit your CSR through the Fatoora portal API. ZATCA will issue a compliance CSID for testing first, and after successful validation, a production CSID for live operations. This certificate is what your system uses to cryptographically stamp every invoice. Store it securely and track its renewal date.
5. Test in the sandbox.Before going live, submit sample invoices of every type you'll use - standard tax invoices, simplified tax invoices, credit notes, debit notes - through ZATCA's sandbox environment. The sandbox applies the same validation rules as production, so if your invoices pass here, they'll work in production.
6. Go live.Switch to the production environment and start submitting real invoices. Monitor carefully for the first few days. Make sure your team knows how to handle rejected invoices and how to issue credit/debit notes through the system, since you can no longer just modify an invoice after it's been issued.
Tip:Don't skip the sandbox testing phase. Errors in production mean rejected invoices and disrupted business operations - you can't share a B2B invoice with your buyer until ZATCA clears it. The sandbox is free to use and simulates the full production API.
If you're evaluating software or building a custom integration, here are the technical specifications your solution must meet:
| Requirement | Details |
|---|---|
| Invoice Format | XML based on UBL 2.1 with ZATCA extensions |
| Cryptographic Stamp | Digital signature using CSID certificate (X.509) |
| UUID | Each invoice must have a Universally Unique Identifier (v4) |
| QR Code | TLV-encoded QR containing seller info, amounts, and hash |
| API Integration | RESTful API with OAuth 2.0 authentication (Phase 2) |
| Invoice Counter | Sequential counter with hash chain linking invoices |
| Tamper Resistance | Solution must prevent deletion or modification after generation |
If this feels complex, you're not alone. Many businesses in Saudi Arabia work with an accountant or tax advisor to handle ZATCA compliance.
Saudi tax and Zakat regulations can be confusing for foreigners. Get matched with an accountant who speaks English and knows the rules for expats.
Tax filing support
VAT, Zakat, and withholding tax returns handled correctly - avoid penalties and overpayment
Fluent in English
No language barrier - discuss your finances clearly and get advice you understand
Expat tax expertise
ZATCA compliance, e-invoicing (Fatoora), Zakat obligations - they know the specifics
Free matching
No cost to you - we connect you with the right accountant for your situation
ZATCA enforces e-invoicing compliance through fines that are applied per violation and can stack up quickly. Early on, the focus was on education and guidance, but enforcement has been tightening as the system matures. Here's what you're looking at if you don't comply:
| Violation | Penalty (SAR) |
|---|---|
| Not issuing e-invoices | 5,000 - 50,000 |
| Missing required fields on invoice | Up to 10,000 |
| Deleting or modifying invoices after issuance | Up to 10,000 |
| Not integrating with Fatoora platform (Phase 2) | Up to 50,000 |
| Missing QR code on invoice | Up to 10,000 |
| Repeat violations | Doubled penalties |
The repeat violation multiplier is worth paying attention to. A single missing QR code is a 10,000 SAR problem. If ZATCA finds the same issue on a subsequent inspection, it becomes 20,000 SAR. For businesses processing high volumes of invoices, systemic issues in your invoicing software can result in penalties that add up across every non-compliant invoice.
Yes. Unlike some other national e-invoicing systems, ZATCA's Fatoora covers both B2B and B2C transactions. B2B invoices (tax invoices) require real-time clearance through ZATCA's API before they can be shared with the buyer. B2C invoices (simplified tax invoices) are generated and stamped locally, then reported to ZATCA within 24 hours. Both types must include a QR code.
ZATCA e-invoices use XML format based on UBL 2.1 (Universal Business Language) with Saudi-specific extensions defined by ZATCA. The invoice must include a UUID (Universally Unique Identifier), a cryptographic stamp generated using a CSID (Cryptographic Stamp Identifier), and a QR code containing key invoice data. The XML schema and business rules are published on the Fatoora portal.
A CSID (Cryptographic Stamp Identifier) is a digital certificate issued by ZATCA that allows your e-invoicing solution to generate cryptographic stamps for each invoice. You obtain a CSID by registering your e-invoicing solution on the Fatoora portal, submitting a Certificate Signing Request (CSR), and receiving the certificate from ZATCA. The CSID must be renewed periodically.
Your accounting or ERP software must be ZATCA-compliant, meaning it can generate invoices in the required UBL 2.1 XML format, apply cryptographic stamps, generate QR codes, and communicate with the Fatoora platform via API. Major providers like SAP, Oracle, Zoho, Cleartax, and many local Saudi solutions have built ZATCA compliance into their products. For small businesses, cloud-based solutions are usually the easiest path.
Foreign companies must comply only if they are registered for VAT in Saudi Arabia. If a foreign business has a VAT registration in the Kingdom and issues invoices for taxable supplies, it falls under the Fatoora requirements just like domestic businesses. Foreign companies without Saudi VAT registration are not subject to the e-invoicing mandate.
Businesses are required to retain e-invoices and related documents for a minimum of 6 years from the end of the tax period to which they relate, in line with Saudi VAT regulations. ZATCA also maintains records on the Fatoora platform. Proper electronic archiving with the ability to retrieve invoices on demand is a compliance requirement.
If ZATCA rejects a B2B invoice during clearance, you'll receive an error response with details about what failed validation. You cannot share the invoice with the buyer until it's cleared. Common rejection reasons include invalid XML structure, missing required fields, incorrect VAT calculations, or expired CSID certificates. Fix the issue in your system and resubmit.
