E-Invoicing in Saudi Arabia: The Complete ZATCA Guide (Phase 2, Waves and Penalties)

E-invoicing in Saudi Arabia is the mandatory generation, storage and, in Phase 2, real-time exchange of structured electronic invoices with the Zakat, Tax and Customs Authority (ZATCA) through its Fatoora platform. It applies to every VAT-registered business resident in the Kingdom. As of October 2026, Phase 2 integration has been extended to businesses with VAT-able revenue above SAR 187,500.

This guide explains what ZATCA e-invoicing requires, which integration wave applies to you, how clearance and reporting work, what the penalties are, and how to prepare without disrupting sales. Every regulatory point below is checked against ZATCA publications and dated where it may change.

What is Fatoora, ZATCA's e-invoicing platform?

Fatoora (فاتورة) is the name of ZATCA's e-invoicing programme and of the platform that receives, validates and records electronic invoices. An electronic invoice is a tax invoice generated, exchanged and stored in a structured electronic format by a compliant solution. A handwritten invoice, a scanned paper invoice or an invoice typed in Word or Excel does not qualify.

The legal basis is the VAT Law and its Implementing Regulations (Article 53 sets out invoice content), together with ZATCA's E-Invoicing Regulation, published on 4 December 2020, and the controls and technical resolution published on 28 May 2021. ZATCA maintains the official overview, technical standards and FAQs on its e-invoicing portal.

Who must comply with e-invoicing in Saudi Arabia?

• In scope: all taxable persons resident in the Kingdom, plus any customer or third party that issues tax invoices on behalf of a resident VAT-registered supplier.
• Out of scope: taxable persons that are not resident in the Kingdom, and invoices covering only supplies that are not subject to VAT.
• Phase 2 timing: applies wave by wave, only after ZATCA notifies the taxpayer. ZATCA commits to notifying each wave at least six months before its integration date.

Phase 1 vs Phase 2: what is the difference?

Phase 1 (Generation) made electronic invoices mandatory. Phase 2 (Integration) connects your invoicing system to Fatoora so ZATCA sees invoices in real time or near real time.

Area	Phase 1: Generation	Phase 2: Integration
Effective date	4 December 2021, for all resident taxpayers	From 1 January 2023, in waves notified by ZATCA
Core obligation	Generate and store invoices and notes with a compliant electronic solution	Integrate that solution with Fatoora for clearance or reporting
Format	Electronic, no mandatory structured format	XML (UBL 2.1-based ZATCA standard), or PDF/A-3 with embedded XML for sharing; XML only for submission
QR code	Mandatory on simplified tax invoices (5 basic fields)	Expanded QR code (9 tags) including invoice hash and signature data
Security	Tamper-resistant solution, no prohibited functions	Cryptographic stamp, invoice hash chain, unique identifier (UUID) and invoice counter
Connection to ZATCA	None	API connection; each solution unit onboarded with its own cryptographic stamp identifier (CSID)

Which ZATCA integration wave applies to my business?

ZATCA selects each wave by VAT-able revenue in specified reference years. If your revenue exceeded the threshold in any of those years, you fall into that wave and must integrate by the date in your notification. The table below summarises the waves announced to date (as of October 2026).

Wave	Revenue subject to VAT exceeding	Reference years	Integration window
1	SAR 3 billion	2021	1 January to 30 June 2023
2 to 5	SAR 500 million down to SAR 100 million	2021 or 2022	July to December 2023
6 to 12	SAR 70 million down to SAR 10 million	2021 to 2023 (varies by wave)	2024
13 to 22	SAR 7 million down to SAR 1 million	2022 to 2024 (varies by wave)	2025 (Wave 22 closed 31 December 2025)
23	SAR 750,000	2022, 2023 or 2024	1 January to 31 March 2026
24	SAR 375,000	2022, 2023 or 2024	1 April to 30 June 2026
25	SAR 187,500	2022, 2023, 2024 or 2025	No later than 1 February 2027

ZATCA announced Wave 25 on 24 July 2026. It is the first wave to use 2025 revenue, and its SAR 187,500 threshold reaches deep into the SME segment. In practice, if you are VAT-registered and have not yet integrated, you should assume Phase 2 applies to you within months, not years. Always rely on the date in the notification ZATCA sends to your account.

Tax invoice vs simplified tax invoice: which one do you issue?

ZATCA e-invoicing distinguishes two invoice types, and Phase 2 treats them differently.

Feature	Tax invoice (standard)	Simplified tax invoice
Typical use	B2B and B2G sales	B2C sales; optionally B2B supplies below SAR 1,000
Buyer details	Required, including buyer VAT number where registered	Usually not required
Phase 2 process	Clearance: ZATCA validates before you share it	Reporting: you share it, then report it to ZATCA
Deadline to ZATCA	Before the invoice is issued to the buyer	Within 24 hours of issuance
Cryptographic stamp	Applied by Fatoora during clearance	Applied by your own solution using its CSID

Credit and debit notes follow the type of the original invoice. An issued invoice can never be edited or deleted; corrections are made with a credit or debit note.

What must a ZATCA-compliant e-invoice contain?

Mandatory business fields

Under Article 53 of the VAT Implementing Regulations and ZATCA's data dictionary, a tax invoice must show, among other fields: the issue date, a unique sequential invoice number, the seller's name, address and VAT number, the buyer's name, address and VAT number (where registered), a description and quantity of goods or services, unit price, taxable amount, VAT rate (15% standard) and VAT amount per line, and the total including VAT in SAR. Zero-rated or exempt lines need the reason. Phase 2 adds technical fields such as the UUID, invoice counter value, previous invoice hash and additional seller identifiers such as the Commercial Registration number. Human-readable invoices must be in Arabic, and may also include other languages.

The QR code

In Phase 1 the QR code on simplified invoices carries five fields: seller name, VAT number, invoice timestamp, invoice total with VAT and VAT total. In Phase 2 it expands to nine tags encoded in TLV and Base64, adding the hash of the XML invoice, the digital signature, the public key and, for simplified invoices, ZATCA's signature on the stamp's certificate. This lets anyone verify an invoice with ZATCA's VAT app.

XML, UBL 2.1 and PDF/A-3

Phase 2 invoices are produced as XML following ZATCA's XML Implementation Standard and Data Dictionary, which build on the international UBL 2.1 syntax. You may share a PDF/A-3 file with the XML embedded, but only XML is submitted to Fatoora.

Cryptographic stamp and CSID

The cryptographic stamp is an electronic signature proving that the invoice came from your onboarded solution and has not been altered. Each e-invoice generation solution (EGS) unit, whether an ERP instance, a billing server or a POS terminal that generates invoices, is onboarded on the Fatoora portal using a one-time password and receives its own CSID. The private key must never be exportable.

How do clearance and reporting work?

Clearance for tax invoices (B2B)

1. Your system generates the invoice XML and sends it to Fatoora via API.
2. Fatoora validates the content and format, applies ZATCA's cryptographic stamp and QR code, and returns the cleared XML.
3. Only then do you share the cleared invoice with the buyer. A rejected invoice is not a valid invoice.

Reporting for simplified invoices (B2C)

1. Your solution generates the invoice, stamps it with its own CSID and adds the QR code.
2. You hand the printed or electronic invoice to the customer immediately.
3. Your solution reports the XML to Fatoora within 24 hours of issuance.

If a system failure prevents issuance, clearance or reporting, ZATCA expects you to notify it through its failure notification service and to submit the pending invoices once systems recover.

What are the penalties for e-invoicing violations?

ZATCA's November 2021 announcement listed violations including not issuing or not storing e-invoices (fines starting from SAR 5,000), omitting the QR code, omitting the buyer's VAT number, failing to report a malfunction (all starting with a warning), and deleting or amending an issued e-invoice (fines starting from SAR 10,000), with amounts rising by type and repetition. In January 2022 ZATCA adopted a graduated approach for field inspections: a first violation receives a warning and three months to correct, after which repeated violations are reported to attract escalating fines of SAR 1,000, 5,000, 10,000 and 40,000. A recurrence more than 12 months later restarts the cycle. Penalty schedules can change, so confirm the current table with ZATCA.

Step-by-step e-invoicing readiness checklist

1. Confirm your wave. Check your ZATCA account and notification; record your integration deadline.
2. Map every invoicing source. ERP, POS terminals, e-commerce store, branch systems, subsidiaries and manual processes. Each one that generates invoices becomes an EGS unit.
3. Decide the architecture. Direct integration from each system, or a central e-invoicing service that stamps and submits for all of them. Central services are usually easier to maintain across regulation updates.
4. Clean master data. Customer VAT numbers, addresses, product tax categories and Arabic item names cause most rejections.
5. Close compliance gaps. Remove prohibited functions: editable issued invoices, multiple numbering sequences, user-changeable system time, shared or default passwords and missing audit logs.
6. Build or configure XML generation, hashing, stamping and QR logic to ZATCA's current specification.
7. Test in ZATCA's sandbox and simulation environments with real scenarios: discounts, returns, credit notes, zero-rated lines and foreign-currency sales.
8. Onboard each EGS unit on the Fatoora portal and store CSIDs and keys securely, with a renewal register.
9. Plan for failure. Queues, retries, offline buffering for POS and a documented ZATCA notification procedure.
10. Train staff and go live before the deadline, then monitor rejection rates daily for the first weeks.

How do you choose a compliant e-invoicing solution?

ZATCA publishes an indicative directory of solution providers, but it states that taxpayers may use any compliant solution, listed or not. Evaluate options on these points:

• Coverage of all your invoice sources, not only the ERP: POS, online store and branch systems.
• Clearance performance and resilience: queueing, retries and graceful handling when Fatoora is slow or unreachable.
• Maintenance commitment: who updates the XML schema, validation rules and certificates when ZATCA publishes changes.
• Arabic output and bilingual invoices that render correctly in print, PDF and email.
• Data protection and hosting: invoice archives contain personal and commercial data, so check alignment with the PDPL and NCA controls.
• Audit trail and archive export that ZATCA can access on request.

For organisations with several systems, our article on ZATCA integration for enterprise systems covers the central-service architecture in more depth. Retailers should also read our guide to ZATCA-compliant POS systems, and finance teams replacing core systems can start with our ERP guide for Saudi Arabia.

Next step

If your wave date is approaching, or you are unsure whether every invoice source is covered, Amwaj Solutions can review your invoicing landscape and design the integration. See our ZATCA e-invoicing integration service or request a consultation; we respond within 24 to 48 business hours.