ZATCA E-Invoicing: What Saudi Businesses Must Do

If you're running a VAT-registered business in Saudi Arabia, ZATCA e-invoicing (Fatoora) isn't optional — it's the law, and it's been rolling out in phases since December 2021. Here's what applies to you right now and how compliance actually works.

Quick answer

ZATCA e-invoicing is mandatory for every taxable person resident in Saudi Arabia who is registered for VAT. Phase 1 (Generation) has been in force since 4 December 2021 and requires issuing structured electronic invoices from a compliant system — no handwritten or free-form PDFs. Phase 2 (Integration) requires linking your invoicing system to ZATCA's Fatoora platform for real-time clearance (B2B) or reporting (B2C). ZATCA rolls Phase 2 out in waves based on your annual taxable revenue, with 30+ waves announced so far. Non-compliance carries fines starting at SAR 1,000 per violation. ^[1][2]

Who has to comply and when

Phase 1 applies to everyone registered for VAT in the Kingdom, plus any third party issuing tax invoices on behalf of a resident taxable person. No revenue threshold. If you issue a tax invoice, it must be electronic. ^[1]

Phase 2 is different. ZATCA (the Zakat, Tax and Customs Authority) notifies you in waves, giving at least six months' notice before your integration date. The waves are set by prior-year taxable revenue:

• Wave 1: revenue above SAR 3 billion — went live 1 January 2023
• Wave 2: above SAR 500 million — 1 July 2023
• Later waves have dropped progressively. By Wave 20+ the threshold reached businesses with revenue above SAR 1.75 million, and ZATCA has continued announcing new waves roughly every quarter. ^[2][3]

Check the Fatoora portal or your registered email. ZATCA sends the notification directly — don't wait to be surprised.

What a compliant e-invoice actually looks like

Two invoice types matter. Tax invoices are B2B (and any B2G) — these need clearance from ZATCA before you send them to the buyer under Phase 2. Simplified tax invoices are B2C — you issue them immediately, then report to ZATCA within 24 hours. ^[1]

Mandatory technical features under the E-Invoicing Resolution (issued 28 May 2021) and its implementing rules:

• XML format (UBL 2.1 based) or PDF/A-3 with embedded XML
• A UUID for each invoice
• A cryptographic stamp (Phase 2)
• A QR code — mandatory on simplified invoices from day one, mandatory on all invoices in Phase 2
• Previous invoice hash (chaining)
• Seller VAT number, buyer VAT number for B2B, invoice counter value, timestamp

Handwritten invoices, scanned paper, Word documents, or Excel printouts don't count. Neither does a PDF generated by a non-compliant tool. This is where smaller merchants slip up most often.

Penalties for getting it wrong

ZATCA publishes a graduated penalty schedule. First violations often trigger a notice rather than a fine, but repeat issues escalate quickly. Typical penalties under the VAT and E-Invoicing framework:

• Not issuing or archiving e-invoices: SAR 5,000 to SAR 50,000
• Missing QR code on a simplified invoice: starts around SAR 1,000, repeated per invoice
• Deleting or modifying an issued invoice: SAR 10,000 to SAR 50,000
• Failure to notify ZATCA of system issues: SAR 1,000 to SAR 10,000 ^[4]

Fines double for repeat offences within a year. ZATCA also runs field inspections — especially in retail — and inspectors do actually check QR codes on receipts.

Watch out: your accounting software vendor saying "we're ZATCA-ready" means nothing unless the solution appears on ZATCA's published list of compliant solution providers, or you've completed the Fatoora onboarding (CSID issuance, compliance checks, production CSID). Ask for proof.

Getting onboarded to Phase 2

Once you're in a wave, the sequence is:

1. Pick a compliant e-invoicing solution (in-house build, ERP module, or SaaS provider)
2. Log into the Fatoora portal with your ZATCA credentials
3. Generate an OTP, pass it to your solution, and request a Compliance CSID
4. Run the compliance checks (sample invoices, credit notes, debit notes)
5. Request your Production CSID and go live

Allow 2–4 weeks if your software is already certified. Longer if you're building in-house or using a smaller ERP that needs patching. For related obligations once you're integrated, see our guide on VAT filing in Saudi Arabia.