ZATCA e-invoicing (Fatoora) explained for finance teams

What is ZATCA e-invoicing?

E-invoicing is the requirement that tax invoices, credit notes and debit notes are generated and stored in a structured electronic format by a compliant electronic solution. ZATCA, the Zakat, Tax and Customs Authority, calls the programme Fatoora, and its Fatoora platform is where invoice data is received.

It applies to all taxpayers subject to VAT except non-resident taxpayers, and to any party that issues tax invoices on behalf of a supplier subject to VAT. A paper invoice that is scanned or copied into an electronic file is not an electronic invoice under the rules.

There are two kinds of invoice, and the difference drives most of what follows:

• Tax invoice: generally issued business to business or to government, with the buyer's details.
• Simplified tax invoice: generally issued business to consumer, usually without buyer details. A supplier may also choose to issue one to a business customer when the value of the supply is below SAR 1,000.

What is the difference between Phase 1 and Phase 2?

Phase 1, the generation phase, governs how invoices are created and kept. Phase 2, the integration phase, connects your invoicing solution to ZATCA, so ZATCA sees each invoice when it is issued.

Phase 1 also rules out some functions. A compliant solution must not let anyone modify or delete an invoice once it is issued, change the date or time so that documents carry false information, reset the invoice counter, or edit the activity log. To cancel an invoice, you issue a credit note and, where needed, a new invoice.

How do clearance and reporting work in Phase 2?

Clearance applies to tax invoices and their credit and debit notes. Your solution sends the invoice as XML to Fatoora, which validates it. If it passes, Fatoora adds ZATCA's cryptographic stamp and a QR code and sends it back. Only the cleared invoice is valid to share with the buyer, as XML or as PDF/A-3 with the XML embedded.

Reporting applies to simplified invoices and their notes. Your solution stamps the invoice with the cryptographic stamp identifier (CSID) that ZATCA issued to it, adds a QR code and gives the invoice to the customer straight away, as a printed copy unless the two parties agree on an electronic one. It then sends the XML to Fatoora within 24 hours.

Every invoice also carries technical fields the solution generates: a unique identifier (UUID), an invoice counter that cannot be reset, and the hash of the previous invoice. The hash links invoices in sequence, so a missing or altered invoice breaks the chain.

The readable invoice must be in Arabic. Other languages may appear alongside the Arabic.

Which Phase 2 wave applies to your business?

ZATCA selects each wave by revenue subject to VAT in the years it names, and tells the taxpayers in a wave at least six months before their integration date. The threshold has come down wave by wave since 2023. The two most recent waves are:

If your revenue crossed a higher threshold in an earlier wave, your integration date has already passed. If you are unsure which wave applies, rely on ZATCA's notification to your business or ask ZATCA directly, rather than working it out from the thresholds alone.

How do you prepare for your integration date?

1. Confirm the dateFind ZATCA's notification for your wave and put the integration date in the finance calendar. Six months is the minimum notice, and solution changes, testing and training take most of it.
2. List every system that issues invoicesThe ERP, point of sale, billing and any marketplace tool. Each one needs a Phase 2 compliant solution, from your ERP vendor or a provider, that produces the XML, the stamp, the QR code, the counter and the hash chain.
3. Clean the master dataCheck your own VAT number and company details, and the VAT numbers of your business customers. A tax invoice without the buyer's VAT number is one of the violations ZATCA lists.
4. Onboard each unitEach system or device that issues invoices is a unit. A user signs in to the Fatoora portal, requests a one-time password for each unit and enters it in the solution, which is then onboarded with its CSID. Keep the CSID and its keys secure, and track when they need renewing.
5. Test the failure casesRun invoices that Fatoora rejects or accepts with warnings, and agree what happens when the connection fails. You must notify ZATCA of any malfunction that stops you issuing e-invoices.
6. Set the rules for notes and recordsIssued invoices are never deleted or edited: corrections go through credit and debit notes, which must be issued within 15 days after the end of the month in which the event that requires them happened. Keep invoices and records for at least six years from the end of the tax period they relate to, accessible from within the Kingdom.
7. Reconcile e-invoices to the ledgerEach month, agree the invoices cleared and reported through Fatoora to revenue and output VAT in the ledger before you prepare the VAT return.

What are the penalties for e-invoicing violations?

When ZATCA published the e-invoicing violations in November 2021, it set fines by type of violation and by how often it is repeated:

• A warning first for a simplified invoice without the QR code, a tax invoice without the buyer's VAT number, or failing to tell ZATCA about a malfunction that stops you issuing e-invoices.
• A fine starting at SAR 5,000 for not issuing electronic invoices.
• A fine starting at SAR 10,000 for deleting or amending electronic invoices after they are issued.

Fines rise with repetition. Penalties under the VAT rules, such as those for late returns, are separate: see VAT returns in Saudi Arabia and the UAE.

What should the finance team check every month?

Make these checks part of the month-end close, before the VAT return is prepared:

• Every system that issues invoices is onboarded and connected, and none issues invoices outside the compliant solution.
• Rejections and warnings from Fatoora are resolved, and no rejected tax invoice went to a customer.
• Every simplified invoice was reported within 24 hours.
• Invoice numbers run without gaps and the hash chain is unbroken.
• Credit and debit notes were issued on time, and none stands in for an invoice that was edited or deleted.
• Cleared and reported totals agree to revenue and output VAT in the ledger.

Questions people ask