01Executive overview
Saudi Arabia runs the most mature e-invoicing regime in the GCC. Since 4 December 2021 every resident VAT taxpayer must generate invoices electronically (Phase 1 — "Generation"); handwritten and plain-PDF invoices are prohibited. Phase 2 — "Integration" — connects taxpayers’ systems directly to ZATCA’s Fatoora platform in waves determined by revenue, running from January 2023 and by 2026 reaching businesses with only a few million SAR of taxable turnover.
The regime is a clearance model for standard (B2B) tax invoices: the invoice must be cryptographically stamped and cleared by ZATCA in real time before it is shared with the buyer. Simplified (B2C) invoices are reported to ZATCA within 24 hours. For businesses entering scope, the hard parts are onboarding (device/CSID registration), the cryptographic requirements, and Arabic-language content.
02At a glance
Mandate status
Live — Phase 2 waves continuing through 2026
Scope
All resident VAT taxpayers; B2B (clearance) and B2C (reporting)
Model
Centralised clearance (standard invoices) + 24h reporting (simplified)
Format
UBL 2.1 XML, or PDF/A-3 with embedded XML
Security
Cryptographic stamp, hash chain, UUID, QR code
Language
Arabic mandatory (other languages may accompany)
Wave notice
ZATCA notifies each wave ≥ 6 months before integration
03Legal basis & authority
The E-Invoicing Regulation was issued by ZATCA (then GAZT) on 4 December 2020 under the VAT Law, followed by implementing resolutions detailing controls, technical specifications and phased enforcement. ZATCA designates Phase 2 waves by taxable-revenue thresholds and formally notifies affected taxpayers at least six months ahead of their integration date.
04Timeline
- 4 Dec 2021Phase 1 — GenerationAll resident VAT taxpayers must generate e-invoices; simplified invoices carry QR codes.
- 1 Jan 2023Phase 2 begins — Wave 1Taxpayers > SAR 3bn revenue integrate with Fatoora.
- 2023–2025Waves 2–15+Thresholds step down from SAR 500M to ~SAR 3M across successive waves.
- 2026Long tail of wavesIntegration reaching small businesses; ZATCA continues 6-month notifications.
05Who and what is in scope
Applies to all VAT-registered residents and third parties issuing on their behalf. Non-resident VAT taxpayers are excluded.
In scope
- Domestic B2B, B2G and B2C supplies
- Exports (standard invoices, cleared)
- Self-billing and third-party billing arrangements
Out of scope / excluded
- Non-resident VAT taxpayers
- Exempt supplies without invoicing obligation
06How the system works
Standard tax invoices are transmitted to ZATCA for clearance in real time: Fatoora validates, applies its cryptographic stamp, and only then is the invoice legally issuable to the buyer. Simplified tax invoices (typically B2C at point of sale) are generated with the taxpayer’s own stamp and QR code, then reported to ZATCA within 24 hours. Solutions must maintain an unbroken hash chain and tamper-proof counters, and each device/solution unit is onboarded via a Cryptographic Stamp Identifier (CSID).
07Invoice content requirements
Beyond standard VAT invoice content (Article 53 of the KSA VAT Implementing Regulations), the e-invoicing rules add technical fields:
- UUID per invoice
- Cryptographic stamp and previous-invoice hash (chain)
- QR code (mandatory on simplified; on standard post-clearance)
- Invoice counter value
- Buyer VAT number for standard invoices
- Arabic-language content
Rounding, credit/debit note linkage to original invoices, and correct invoice-type codes (standard vs simplified, invoice vs note) are frequent validation failures.
08Penalties & enforcement
ZATCA has applied a cooperative enforcement posture — warnings first, then escalating fines for repeat violations. Published ranges:
Warning → SAR 50,000
Escalating sanctions for issuing non-compliant e-invoices or failing to integrate, depending on repetition.SAR 10,000–40,000
Typical mid-range fines for repeated violations (missing QR, failure to report, tampering).09Common pitfalls
Missing the wave notificationZATCA notifies six months ahead — but to the registered contact. Out-of-date taxpayer records mean the clock runs without you.
CSID/device onboarding underestimatedEvery solution unit needs onboarding; retail chains with many POS devices face a logistics project, not a config change.
Offline B2C syncSimplified invoices must reach ZATCA within 24 hours — patchy connectivity at outlets breaks compliance silently.
Credit notes without linkageNotes must reference the original invoice; bulk or unlinked credit processes fail clearance.
Arabic content gapsERP templates configured only in English fail; Arabic is mandatory content, not a courtesy.
10What leading businesses are doing
They centralise via middlewareA single e-invoicing layer between ERPs/POS and Fatoora — one hash chain discipline, one upgrade path as ZATCA specs evolve.
They monitor clearance SLAsReal-time dashboards for clearance failures, because a blocked invoice is blocked revenue.
They treat KSA as the GCC templateGroups use their ZATCA build (data model, middleware, governance) as the starting point for UAE 2027 — different model, same data disciplines.
11Your action plan
- Verify your Phase 2 wave status and ZATCA contact details
- Inventory every invoice-generating system and device for CSID onboarding
- Validate Arabic content and QR generation end-to-end
- Stress-test offline-to-sync flows for B2C within the 24h window
- Align credit-note processes to original-invoice linkage
12Sources
- ZATCA E-Invoicing Regulation (Dec 2020) and implementing resolutions
- ZATCA Fatoora portal and wave announcements
- KSA VAT Implementing Regulations, Art. 53
Last verified: 8 July 2026 · report a change: hello@e-invoicing.org