ZATCA Fatoora: Saudi Arabia e-Invoicing Phase 2 Explained

What is ZATCA Fatoora?

ZATCA Fatoora is Saudi Arabia's national e-invoicing programme, run by the Zakat, Tax and Customs Authority (ZATCA). It applies to all VAT-registered persons conducting taxable supplies in the Kingdom.

The programme has two phases. Phase 1 (Generation) has required structured e-invoices for B2B and B2C since 4 December 2021. All tax invoices and simplified tax invoices must be produced through a compliant e-invoicing solution that generates, stores, and amends invoices electronically in a structured format.

Phase 2 (Integration) adds real-time connectivity between the taxpayer's system and ZATCA. Invoices are transmitted to the Fatoora platform for clearance before being issued to buyers. The rollout is wave-based, with ZATCA notifying each group of targeted taxpayers at least six months in advance of their integration deadline.

How the Phase 2 waves work

Phase 2 started on 1 January 2023 with the largest taxpayers. Each subsequent wave brings smaller taxpayers into scope based on VATable revenue in the reference period, typically 2021, 2022, 2023, or 2024.

Recent waves reach steadily smaller businesses, and the threshold has roughly halved each time. Wave 23 fell due on 31 March 2026 for taxpayers with VATable revenue above SAR 750,000, and wave 24 on 30 June 2026 for revenue between SAR 375,000 and SAR 750,000, both measured across 2022, 2023 or 2024.

ZATCA set the wave 25 criteria on 24 July 2026: taxpayers whose VAT-subject revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025 must integrate with Fatoora by 1 February 2027. That halves the threshold again and adds 2025 to the reference years. Businesses below that figure have not yet been called into a wave.

ZATCA publishes each wave's criteria on its portal once announced. The authority also notifies affected taxpayers directly, usually six months before the deadline, to allow time for onboarding.

Technical specification: UBL 2.1 and cryptographic stamp

Invoices must be produced in UBL 2.1 XML. Every tax invoice is submitted to the Fatoora platform for clearance, while simplified tax invoices (typically B2C retail) are reported within 24 hours of issuance.

Each compliant invoice carries a cryptographic stamp applied by ZATCA and a QR code encoding the seller VAT number, invoice date, total, VAT amount, and the hash of the invoice. The cryptographic stamp is what makes the invoice legally valid. Invoices without a valid clearance response from ZATCA have no tax effect.

Technical controls extend to connectivity: the solution must support secure API integration with Fatoora, digital signatures via XAdES, and anti-tampering controls to prevent invoice modification after issuance.

Penalties and enforcement

E-invoicing violations scale by severity. Failure to issue compliant e-invoices starts at SAR 5,000. Progressive penalties for repeat offences within 12 months typically escalate through SAR 1,000 warnings and SAR 5,000 and SAR 10,000 fines, up to SAR 40,000 for persistent breaches. The overall violation scale can reach SAR 100,000 for the most severe breaches. QR code issues attract up to SAR 10,000 per invoice. Real-time reporting violations under the CTR framework range from SAR 5,000 to SAR 50,000 per violation.

ZATCA runs an "Initiative to Cancel Fines and Exempt Taxpayers from Penalties", extended on 29 June 2026 to run until 31 December 2026. Read its scope carefully before relying on it: it reaches late registration, late payment, late filing and VAT return corrections, not invoicing breaches. Tax evasion, fines under Article 45 of the VAT Law, and anything attached to a return due after 30 June 2026 sit outside it. Once it ends, the standard framework applies in full.

Enforcement has trended towards data analytics rather than physical audit. The invoice stream itself surfaces anomalies that trigger review.

Related reading

For country-level data on B2B and B2G status, see Saudi Arabia on e-Invoice.app. For the list of jurisdictions operating this model, see our clearance model countries summary.