ZATCA Fatoora: Saudi Arabia e-Invoicing Phase 2 Explained

What is ZATCA Fatoora?

ZATCA Fatoora is Saudi Arabia's national e-invoicing programme, run by the Zakat, Tax and Customs Authority (ZATCA). It applies to all VAT-registered persons conducting taxable supplies in the Kingdom.

The programme has two phases. Phase 1 (Generation) has required structured e-invoices for B2B and B2C since 4 December 2021. All tax invoices and simplified tax invoices must be produced through a compliant e-invoicing solution that generates, stores, and amends invoices electronically in a structured format.

Phase 2 (Integration) adds real-time connectivity between the taxpayer's system and ZATCA. Invoices are transmitted to the Fatoora platform for clearance before being issued to buyers. The rollout is wave-based, with ZATCA notifying each group of targeted taxpayers at least six months in advance of their integration deadline.

How the Phase 2 waves work

Phase 2 started on 1 January 2023 with the largest taxpayers. Each subsequent wave brings smaller taxpayers into scope based on VATable revenue in the reference period, typically 2021, 2022, 2023, or 2024.

Recent waves focus on medium and smaller businesses. Wave 23 has a deadline of 31 March 2026 for taxpayers with VATable revenue above SAR 750,000 in any of 2022, 2023, or 2024. Wave 24 follows with a 30 June 2026 deadline for taxpayers with revenue between SAR 375,000 and SAR 750,000 across the same reference years.

ZATCA publishes each wave's criteria on its portal once announced. The authority also notifies affected taxpayers directly, usually six months before the deadline, to allow time for onboarding.

Technical specification: UBL 2.1 and cryptographic stamp

Invoices must be produced in UBL 2.1 XML. Every tax invoice is submitted to the Fatoora platform for clearance, while simplified tax invoices (typically B2C retail) are reported within 24 hours of issuance.

Each compliant invoice carries a cryptographic stamp applied by ZATCA and a QR code encoding the seller VAT number, invoice date, total, VAT amount, and the hash of the invoice. The cryptographic stamp is what makes the invoice legally valid. Invoices without a valid clearance response from ZATCA have no tax effect.

Technical controls extend to connectivity: the solution must support secure API integration with Fatoora, digital signatures via XAdES, and anti-tampering controls to prevent invoice modification after issuance.

Penalties and enforcement

E-invoicing violations scale by severity. Failure to issue compliant e-invoices starts at SAR 5,000. Progressive penalties for repeat offences within 12 months typically escalate through SAR 1,000 warnings and SAR 5,000 and SAR 10,000 fines, up to SAR 40,000 for persistent breaches. The overall violation scale can reach SAR 100,000 for the most severe breaches. QR code issues attract up to SAR 10,000 per invoice. Real-time reporting violations under the CTR framework range from SAR 5,000 to SAR 50,000 per violation.

ZATCA currently runs an "Initiative to Cancel Fines and Exempt Taxpayers from Penalties" which the authority has extended to 30 June 2026. Under the initiative, eligible taxpayers can regularise their position without the full penalty framework being applied. Once the initiative ends, standard penalties resume.

Enforcement has trended towards data analytics rather than physical audit. The invoice stream itself surfaces anomalies that trigger review.

Related reading

For country-level data on B2B and B2G status, see Saudi Arabia on e-Invoice.app. For the list of jurisdictions operating this model, see our clearance model countries summary.