E-Invoicing in Saudi Arabia: ZATCA Phase 2 Rules, Deadlines and Fines
E-invoicing in Saudi Arabia is the Zakat, Tax and Customs Authority (ZATCA) requirement that VAT invoices be generated, stored and, in Phase 2, cleared or reported through a compliant electronic system connected to ZATCA’s FATOORA platform. Phase 1 has applied since 4 December 2021. Phase 2 started on 1 January 2023 and is being rolled out in revenue-based waves.
The wave that matters now is Wave 25. On 24 July 2026, ZATCA said it covers every taxpayer whose VAT-taxable revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025, with integration due no later than 1 February 2027. That threshold is half the SAR 375,000 used for Wave 24, so many smaller businesses and Saudi subsidiaries of foreign groups now have a firm date.
For a finance team, most of the effort sits in systems. Every till, ERP instance, and billing tool that issues invoices under your VAT number has to be onboarded, tested, and locked down before that date.
Who must comply with E Invoicing Saudi Arabia?
ZATCA’s roll-out page states that Phase 1 applies to all taxpayers subject to the E-Invoicing Regulation, excluding non-resident taxpayers, and to any other party issuing tax invoices on behalf of a VAT-registered supplier. Phase 2 then applies wave by wave, and ZATCA notifies each wave at least six months before its integration date.
Two scope points trip up foreign companies. A foreign group that trades in the Kingdom through a resident Saudi entity is in scope through that entity, exactly like a local company. The “on behalf of” rule also means that a shared service center or outsourced billing provider that issues invoices for a Saudi supplier has to meet the same requirements. If your invoices are produced by a regional ERP instance outside Saudi Arabia, that instance is part of the compliance perimeter.
What changes between Phase 1 and Phase 2?
Phase 1 (Generation) bans handwritten invoices and invoices produced in word processors or spreadsheets, and requires a compliant solution that generates and stores e-invoices with the required fields. Phase 2 (Integration) adds a prescribed file format, security elements and live integration with FATOORA. ZATCA’s detailed e-invoicing guideline sets the two side by side.
| Requirement | Phase 1: Generation | Phase 2: Integration |
|---|---|---|
| Invoice format | Any electronic format | XML, or PDF/A-3 with embedded XML |
| Cryptographic stamp | Not required | Required, using a CSID issued by ZATCA |
| UUID and invoice hash | Not required | Required; each invoice carries the hash of the previous one |
| Device registration | Not required | Every device issuing invoices under the VAT number is onboarded |
| QR code | Required on simplified invoices | Required on all invoices; 9 TLV tags in Base64 |
| Integration with ZATCA | None | Clearance of tax invoices and reporting of simplified invoices via API |
Which Phase 2 integration wave applies to you?
ZATCA has lowered the revenue threshold with each wave. The first wave, according to Deloitte’s summary of the June 2022 announcement, covered resident businesses with taxable revenue above SAR 3 billion in 2021, with compliance due between 1 January and 30 June 2023. At SAR 187,500, Wave 25 reaches businesses averaging about SAR 15,625 a month in taxable sales.
| Wave | Taxable revenue test | Integration deadline |
|---|---|---|
| Wave 1 | Above SAR 3 billion in 2021 | 1 January to 30 June 2023 |
| Wave 24 | Above SAR 375,000 in 2022, 2023 or 2024 | No later than 30 June 2026 |
| Wave 25 | Above SAR 187,500 in 2022, 2023, 2024 or 2025 | No later than 1 February 2027 |
The test looks back across four years and any single year counts. A company that crossed SAR 187,500 in 2022 and fell below it afterwards is still in Wave 25. Check the taxable revenue in each VAT return, rather than relying on this year’s run rate.
How do clearance and reporting work in FATOORA?
Phase 2 splits invoices into two flows. Standard tax invoices, issued mainly business-to-business, go through clearance. Simplified tax invoices, issued mainly to consumers, go through reporting. A supplier may also issue a simplified invoice to a business customer when the value of the supply is below SAR 1,000, per ZATCA’s guideline.
| Clearance (standard tax invoice) | Reporting (simplified tax invoice) | |
|---|---|---|
| Typical use | B2B and B2G | B2C, or B2B below SAR 1,000 |
| Timing | Real time, before the invoice reaches the buyer | Issued to the customer at once, reported within 24 hours |
| What ZATCA does | Validates the XML, adds its cryptographic stamp and QR code, returns the cleared invoice | Validates the XML and runs referential checks, returns an API response |
| What you share with the buyer | Only the cleared invoice | The invoice your system stamped, printed or electronic |
Clearance moves error-checking to the day of issue. An invoice that fails validation cannot go to the buyer, so mistakes surface in the source system that same day instead of weeks later at VAT return time.
Submissions to FATOORA must be XML, not PDF/A-3, even if you send customers a PDF/A-3 copy. Corrections are made with credit or debit notes, which follow the same flow as the invoice they adjust.
What must a compliant invoice contain?
ZATCA’s announcement on Phase 1 violations reminded taxpayers to issue and keep invoices with all their elements, including the QR code on simplified invoices, the buyer’s VAT registration number on tax invoices, and the correct invoice title for each type. The simplified e-invoicing guide lists the five values encoded in the Phase 1 QR code.
Phase 1 QR code contents
- Seller name
- Seller VAT registration number
- Date and time of the invoice or note
- VAT amount
- Invoice or note total including VAT
Phase 2 adds technical fields that a buyer rarely sees but ZATCA checks on every submission: a UUID generated by the solution, a sequential invoice counter, the hash of the previous invoice to chain documents together, and the cryptographic stamp. Each stored invoice file is named with the VAT registration number, the generation timestamp and the invoice reference number.
Functions ZATCA prohibits in an e-invoicing solution
- Resetting the invoice counter
- Changing the system date or time
- Deleting or modifying an invoice after it is generated
- Exporting the private key behind the cryptographic stamp
- Access without a logged-in user limited to role-based functions
How to onboard your systems to FATOORA: a plan for finance teams
The onboarding step itself is short. ZATCA’s guideline describes it as logging in to the FATOORA portal with taxpayer portal credentials, requesting a one-time password (OTP) for each solution, entering the OTP in that solution, and confirming it appears in the list of onboarded solutions and devices. The work sits in the preparation around it.
- Map every invoice touchpoint. ERP, point-of-sale tills in each branch, the e-commerce platform, subscription billing, and any third party issuing invoices on your behalf. ZATCA expects every device issuing invoices under the same VAT number to be registered.
- Get written confirmation from each vendor. Ask for Phase 2 support, the onboarding procedure per device, and how the vendor handles CSID renewal and offline scenarios.
- Clean master data. Buyer VAT numbers and addresses feed straight into the XML. Foreign-addressed buyers with a Saudi VAT number are allowed, per the FAQ in ZATCA’s detailed guideline, but the data has to be right.
- Request OTPs and onboard. One per solution or device, from the FATOORA portal.
- Test each invoice type. Standard, simplified, credit note and debit note, then confirm clearance and reporting responses.
- Check hosting and access. Cloud hosting is allowed under the VAT Implementing Regulations if ZATCA can access the data through a direct link; other rules, such as National Cybersecurity Authority controls, may also apply to your entity.
Very small VAT-registered businesses have another route. ZATCA offers an e-invoice issuing portal for taxpayers that have no e-invoicing system and issue no more than 1,000 invoices a year. It covers tax invoices, simplified invoices and related notes.
What are the penalties for non-compliance?
ZATCA published the main e-invoicing violations before Phase 1 went live. Failing to issue electronic invoices starts with a fine of SAR 5,000. Deleting or amending an e-invoice after issuance starts at SAR 10,000. Omitting the QR code on simplified invoices, leaving out the buyer’s VAT number, or failing to notify ZATCA of a malfunction that prevents invoicing starts with a warning. Fines then scale with the type of violation and the number of repetitions.
Deloitte’s reading of the announcement puts the ceiling at SAR 50,000 and notes it was unclear whether penalties apply per invoice or per tax period. The practical lesson for controllers: never edit a posted invoice. Issue a credit or debit note instead.
How HyperPay helps you issue and collect invoices online
HyperBill is HyperPay’s web-based invoicing platform. You create an invoice in a few clicks, send it by SMS, email or WhatsApp, and the customer pays on a secure checkout without leaving the page. Funds go to your bank account automatically. HyperBill covers one-time bills as well as recurring billing and subscriptions, and you do not need a website to use it.
ZATCA compliance, meaning clearance, reporting and the cryptographic stamp, stays with the e-invoicing solution your business has onboarded to FATOORA. HyperBill handles the collection side: a clear payment request on the customer’s phone and one dashboard to track what has been paid. A payment link or card slip never replaces the cleared or reported invoice, so put the invoice reference in each payment request and receipts will match cleared invoices without manual work.
We recommend HyperPay for the collection side because its credentials are on public record. HyperPay appears on the Saudi Central Bank’s register of licensed payment companies as an Electronic Money Institution, Unified No. 7016872546, license valid to 29/12/2029. That matters. Under SAMA Circular 46004436, contracting with merchants and settling funds into their accounts must be done by a SAMA-licensed payment company or a bank, so the money your customers pay against an invoice should reach you through a regulated party. Our guide on how to choose an online payment solution shows how to check any provider against the register.
HyperPay also holds Saudi Payments permits as a Payment Technology Service Provider and as an eMSP payment gateway, and is certified to PCI DSS v4.0.1 Level 1, ISO/IEC 27001:2022 and ISO 22301. Through its payment gateway (see our overview of the payment gateway market in Saudi Arabia) merchants accept mada, Visa, Mastercard, American Express, STC Pay, UnionPay, Apple Pay, Tabby, Tamara, SADAD and PayPal. For a finance team that sells to both companies and consumers, that list covers almost every way a Saudi customer expects to pay. HyperPay is headquartered in Riyadh with offices in Jordan and the UAE, and serves merchants across Bahrain, Lebanon, Iraq, Qatar and Kuwait.
If you are reworking your invoicing before the Wave 25 deadline, set up collection at the same time. Talk to the HyperPay team about running HyperBill alongside your e-invoicing system so invoices go out and get paid online from day one.
Frequently asked questions about E Invoicing Saudi Arabia
Is e-invoicing mandatory in Saudi Arabia?
Yes. Phase 1 has been mandatory since 4 December 2021 for all taxpayers subject to the E-Invoicing Regulation, except non-residents, and for parties issuing tax invoices on behalf of VAT-registered suppliers. Phase 2 integration with FATOORA applies in waves; the latest, Wave 25, covers taxpayers whose VAT-taxable revenue exceeded SAR 187,500 in any year from 2022 to 2025.
What is the ZATCA Wave 25 deadline?
Wave 25 taxpayers must integrate their e-invoicing solutions with the FATOORA platform no later than 1 February 2027. ZATCA announced the criteria on 24 July 2026: VAT-taxable revenue above SAR 187,500 during 2022, 2023, 2024 or 2025. ZATCA says it notifies each wave directly at least six months before the integration date.
What is ZATCA Phase 2 e-invoicing?
Phase 2, the Integration Phase, requires your e-invoicing solution to connect to ZATCA’s FATOORA platform, issue invoices in XML or PDF/A-3 with embedded XML, and add security elements such as a UUID, invoice hash and cryptographic stamp. Standard tax invoices are cleared in real time; simplified invoices are reported within 24 hours.
Does e-invoicing apply to foreign companies?
ZATCA excludes non-resident taxpayers from Phase 1 scope. A foreign group operating through a resident Saudi entity is in scope through that entity, and any party issuing invoices on behalf of a Saudi VAT-registered supplier must also comply. That includes regional shared service centers and ERP instances hosted outside the Kingdom that produce Saudi invoices.
Can a PDF be a valid e-invoice in Saudi Arabia?
A PDF typed in a word processor or a scanned paper invoice is not an e-invoice. In Phase 2 a PDF/A-3 file with the XML embedded is an accepted format for storing and sharing invoices, but the XML is what you submit to FATOORA, and it must come from a compliant, onboarded solution.
Do I need a new invoicing system for Phase 2?
Not necessarily, but your current system must support Phase 2: XML output, a UUID, invoice hash chaining, a cryptographic stamp using a ZATCA-issued CSID, and API connection to FATOORA for clearance and reporting. Ask your vendor for written confirmation. VAT-registered businesses issuing no more than 1,000 invoices a year can also use ZATCA’s own e-invoice issuing portal.