If your business is registered for VAT in Saudi Arabia, e-invoicing is no longer a project you can postpone. The Zakat, Tax and Customs Authority (ZATCA) has moved the Kingdom from paper and PDF invoices to a fully structured, cryptographically stamped, machine-readable invoice that is validated by the tax authority itself. The programme is known locally as Fatoora, and its second stage — the Integration Phase — is what changes how your billing software has to work.

This guide explains what ZATCA e-invoicing is, how Phase 1 differs from Phase 2, what a compliant invoice must actually contain, how clearance and reporting work, and a practical checklist for getting ready. Because ZATCA publishes wave notifications and technical specification updates on an ongoing basis, we deliberately describe how the system works rather than quoting wave dates that may already have moved — always confirm your own deadline against the official ZATCA notification and the zatca.gov.sa portal.

What is ZATCA e-invoicing (Fatoora)?

E-invoicing in Saudi Arabia means issuing invoices in a structured electronic format that a computer can read and validate — not a scan, not a photograph, and not a plain PDF typed by hand. The regulation covers every VAT-registered resident taxpayer in the Kingdom, plus any third party issuing invoices on a resident taxpayer's behalf, such as an outsourced accountant or a billing agent. Non-resident taxpayers are outside the scope.

The objective is the same one driving similar reforms across Europe — Spain's VeriFactu regime, described in our guide to the VeriFactu electronic invoicing law, is a close cousin. Tax authorities want invoices that cannot be silently edited or deleted after they are issued, that arrive in a consistent format, and that can be reconciled automatically against VAT returns. Saudi Arabia simply went further and faster than most: ZATCA does not only require the structured format, it inspects the invoices themselves.

Two invoice types matter throughout the regulation, and almost every technical rule depends on which one you are issuing:

  • Standard tax invoice — typically business-to-business and business-to-government. It carries the buyer's full details, including their VAT registration number where applicable.
  • Simplified tax invoice — typically business-to-consumer, the receipt handed over at the point of sale.

Associated credit notes and debit notes follow the type of the invoice they correct.

Phase 1 vs Phase 2: what actually changed

Phase 1 — the Generation Phase

Phase 1 took effect on 4 December 2021 and applied to all in-scope taxpayers at once. Its demands were comparatively modest: stop producing invoices by hand or in editable documents, generate and store them electronically through a compliant e-invoicing solution, include the mandatory VAT fields, and print a QR code on simplified tax invoices. Invoices had to be archived electronically and could no longer be altered after issue.

Crucially, Phase 1 involved no connection to ZATCA. You generated compliant invoices in your own system; the authority saw them only during an audit.

Phase 2 — the Integration Phase

Phase 2 began on 1 January 2023 and is being rolled out in waves rather than in one step. ZATCA groups taxpayers by their annual taxable revenue and notifies each group directly, giving at least six months' notice before that group's integration date. The thresholds have been lowered wave after wave, progressively pulling smaller businesses into scope.

This is the single most important operational point in the whole regulation: your Phase 2 date is not a date you choose or infer — it is the date in the notification ZATCA sends you. Check the wave criteria currently published on the ZATCA portal and keep the contact details on your taxpayer account up to date so the notification actually reaches you.

What Phase 2 adds on top of Phase 1:

  • Your e-invoicing solution must integrate with ZATCA's Fatoora platform via API.
  • Invoices must be generated in a structured XML format (based on UBL 2.1, per ZATCA's e-invoice implementation standard). Standard invoices may also be exchanged as a PDF/A-3 file with the XML embedded.
  • Each invoice carries a cryptographic stamp, a UUID, an invoice counter value and the hash of the previous invoice, forming a tamper-evident chain.
  • The QR code is extended and becomes mandatory in the Phase 2 form.
  • Invoices must be cleared or reported to ZATCA (see below).

Clearance vs reporting: the two Phase 2 flows

Phase 2 splits into two very different transmission models, and getting them the wrong way round is one of the most common implementation mistakes.

Clearance — for standard tax invoices

A standard tax invoice must be sent to ZATCA before it is shared with the buyer. ZATCA validates it, applies its own cryptographic stamp, and returns the cleared invoice. Only the cleared version is legally valid for the buyer to claim input VAT. In practice this means clearance sits in the critical path of your billing process: if the connection fails, the invoice is not yet a valid invoice, so your system needs sensible retry and queueing behaviour rather than a silent failure.

Reporting — for simplified tax invoices

A simplified invoice is issued to the customer immediately — nobody waits at a checkout for a round trip to the tax authority — and then reported to ZATCA within 24 hours of issuance. The invoice is valid from the moment it is generated and stamped by your own compliant solution; reporting is an after-the-fact obligation.

The design logic is easy to remember: B2B is validated before delivery, B2C is validated after delivery.

What a Phase 2 compliant invoice must contain

Beyond the ordinary VAT fields, Phase 2 introduces a set of technical elements that your invoicing solution must generate automatically. You will never type these by hand, but you should know they exist — they are exactly what an auditor or a systems integrator will ask about.

  • Seller details — name, VAT registration number, and address; the additional identifiers ZATCA requires where applicable (commercial registration number, for example).
  • Buyer details — required in full on standard invoices, including the buyer's VAT number for B2B transactions.
  • Invoice date and time, invoice type code, and currency (with the SAR amounts where the invoice is issued in a foreign currency).
  • Line items with description, quantity, unit price, VAT rate and VAT amount per line.
  • Totals — taxable amount, VAT amount, and total including VAT. The standard VAT rate in Saudi Arabia is 15%; zero-rated and exempt supplies must be flagged with the correct VAT category code and, where required, the reason.
  • UUID — a universally unique identifier for the document.
  • Invoice Counter Value (ICV) — a sequential counter that cannot be reset.
  • Previous Invoice Hash (PIH) — the hash of the preceding invoice, chaining documents so a deletion or reordering becomes detectable.
  • Cryptographic stamp — generated with the certificate issued to your unit during onboarding.
  • QR code — TLV-encoded and Base64-represented, carrying at minimum the seller name, VAT number, timestamp, invoice total and VAT total; in Phase 2 it also carries the XML hash and stamp data so a receipt can be verified from a phone.

Language: invoices must be issued in Arabic. You may add a second language alongside it, and bilingual Arabic/English documents are common in practice, but Arabic cannot be omitted.

Archiving: invoices must be stored electronically, inside the Kingdom, in their structured form — keeping only a printed copy does not satisfy the requirement. If you also invoice customers abroad, the currency and language questions raised in our guide to invoicing international clients in multiple currencies apply on top of the ZATCA rules, not instead of them.

Onboarding your system to Fatoora

Integration is not a switch you flip. Each EGS unit — the E-invoice Generation Solution unit, meaning an individual till, branch instance or software instance that issues invoices — is onboarded separately and receives its own credentials. The sequence looks like this:

  1. Register the unit and generate a CSR (certificate signing request) from your e-invoicing solution, containing the unit's identifying data.
  2. Obtain an OTP from the Fatoora portal for that unit and submit the CSR with it.
  3. Receive a compliance certificate and run ZATCA's compliance checks — a battery of sample standard invoices, simplified invoices, credit notes and debit notes that your solution must produce correctly.
  4. Receive the production certificate once the checks pass. From that point the unit can clear and report live invoices.
  5. Renew before expiry. Certificates have a validity period; plan the renewal rather than discovering it at a checkout on a Thursday afternoon.

Your solution must also not do certain things. ZATCA explicitly prohibits functionality that would undermine the audit trail: exporting the stamping private key, resetting the invoice counter, tampering with timestamps, deleting or editing an issued invoice, or allowing anonymous access to the invoicing function. Corrections are made through credit and debit notes, never by rewriting history — the same principle behind the immutability and signature rules explained in our article on whether digital signatures make invoices legally binding.

Who has to comply, and what happens if you do not

All VAT-registered resident businesses in Saudi Arabia are in scope for Phase 1 already, and move into Phase 2 when their wave is called. That includes small businesses: the revenue thresholds have fallen steadily with each successive wave, and the direction of travel is unambiguous.

ZATCA applies a schedule of penalties for e-invoicing violations — for example, failing to issue or store invoices electronically, missing the QR code, deleting or amending invoices after issue, or not integrating by your wave date. Penalty amounts and the authority's grace or transitional arrangements have changed more than once, so we will not quote figures here: check the current penalty schedule published by ZATCA before relying on any number you read online, including the many outdated summaries still circulating.

The practical risk is rarely the fine on its own. It is the operational stall: a B2B customer who cannot claim input VAT because the invoice was never cleared, or a point-of-sale system that stops issuing valid receipts on the morning your wave starts.

How to get ready: a practical checklist

1. Confirm your wave and your date

Find your notification from ZATCA, or check the currently published wave criteria against your annual taxable revenue. Everything else is scheduled backwards from this date.

2. Inventory every system that issues an invoice

Not just the accounting package — the e-commerce checkout, the POS tills, the booking system, the spreadsheet someone in the branch still uses. Each is an EGS unit that must be compliant or retired. This inventory is usually where projects discover the real scope.

3. Choose your integration route

Either your invoicing software handles clearance and reporting natively, or you connect it to a certified middleware provider. What matters is that the XML, the stamping, the hash chain and the API calls are handled for you and kept current as ZATCA updates its specifications — hand-rolling UBL XML and cryptographic stamping is a poor use of a finance team's time.

4. Clean up your master data

Phase 2 validation is strict. Missing buyer VAT numbers, malformed addresses, inconsistent VAT category codes and free-text item descriptions that were fine on a PDF will now be rejected. Fixing customer records before onboarding is far cheaper than debugging rejected clearances in production.

5. Run the compliance checks early

Do not schedule ZATCA's compliance simulation for the week before go-live. Run it as soon as the certificate allows, on real invoice scenarios including credit notes, foreign currency, zero-rated lines and returns.

6. Train the people who issue invoices

Cashiers and billing staff need to know what a cleared invoice looks like, what to do when clearance fails, and why the old habit of editing an invoice after the fact no longer exists. The workflow discipline is similar to the one we describe in our guide to the legal requirements of a compliant invoice — the fields differ by country, but the principle that an issued invoice is final does not.

7. Verify your archive

Confirm that the structured XML — not just a rendered PDF — is retained, inside the Kingdom, for the full statutory period, and that you can actually retrieve a specific invoice on request.

ZATCA and the wider shift to structured invoicing

Saudi Arabia is early, not unusual. Continuous transaction controls — clearance, reporting, real-time validation — are becoming the default model for VAT administration worldwide, and businesses operating in more than one market increasingly need one invoicing process that satisfies several regimes at once. If you are new to structured, cloud-based billing generally, our primer on what an online invoicing system is and the practical walkthrough on creating a professional invoice online are a good place to start before you tackle the country-specific layer.

The businesses that handle these transitions well are the ones that stop treating invoicing as a document-production problem and start treating it as a data problem. Once your invoice data is clean, structured and generated by a system rather than by a person, adapting to the next regulation — ZATCA's future specification updates included — is a configuration change instead of a crisis.

Frequently asked questions

Does Phase 2 replace Phase 1?

No. Phase 2 builds on Phase 1. The Phase 1 obligations — electronic generation, electronic archiving, no post-issue editing — continue to apply, with integration, XML and clearance or reporting layered on top.

Can I still give the customer a paper receipt?

You can hand over a printed copy of a simplified invoice, but the legally required version is the electronic one your solution generated, stamped and reported. The paper is a rendering, not the invoice.

What if my business is below the current wave threshold?

Phase 1 already applies to you. For Phase 2, wait for the notification from ZATCA — but prepare before it arrives, because six months goes quickly once you have counted every system that issues an invoice.

Do I need an Arabic version of every invoice?

The invoice must be issued in Arabic. Adding English or another language alongside it is permitted and often practical for international customers.

Invoice compliantly, in any market

Facturi is a multi-language invoicing platform built for businesses that have to satisfy real tax regimes rather than just produce good-looking PDFs: structured invoice data, immutable records, sequential numbering, VAT handling, Arabic and English interfaces, and exports your accountant can actually use. Whether you are preparing for a ZATCA wave in Saudi Arabia or managing VAT invoicing elsewhere, the workflow stays the same.

Start invoicing with Facturi — create your account and issue your first compliant invoice today.

This article is general information, not tax or legal advice. ZATCA updates its wave criteria, technical specifications and penalty rules over time; confirm the requirements that apply to your business with ZATCA directly or with a qualified tax adviser in Saudi Arabia.