Saudi Arabia e-Invoicing Guide

Saudi Arabia built its e-invoicing regime in two layers. Since December 2021 every resident taxable person has had to produce invoices in a structured electronic format. Sitting on top of that is the integration phase, where a standard tax invoice passes through ZATCA's FATOORAH platform and receives the Authority's cryptographic stamp before it reaches the buyer, while a simplified retail invoice is stamped locally and reported afterwards. Both layers rest on the E-Invoicing Regulation of December 2020 and the Implementation Resolution that carries the controls and technical specifications.

Scope follows residence rather than size. Residence in the Kingdom is what pulls a taxable person inside the rules, along with any customer or agent raising tax invoices on their behalf. A business with no residence here stays outside, even where its supplies are taxed in Saudi Arabia. Nor does the regime split by counterparty: B2B, B2G and B2C run through the same machinery, because there is no separate public-sector or retail track.

What varies by size is timing. Integration arrives in waves set by VAT-subject revenue, and the threshold has come down at every step, halving at each of the last two. Wave 25, announced on 24 July 2026, reaches taxpayers above SAR 187,500 and falls due on 1 February 2027, per ZATCA.

Phase 1, the generation phase, took effect on 4 December 2021 and applied to everyone at once. From that date taxpayers had to stop raising invoices by hand or in word processing and spreadsheet software, and move to a technical solution that met ZATCA's requirements. Phase 2, the integration phase, opened on 1 January 2023 with the largest taxpayers and has run wave by wave ever since, each group notified at least six months before its own date, as ZATCA's roll-out page sets out.

The threshold has fallen steadily: SAR 1.5 million by 31 October 2025, SAR 1 million by 31 December 2025, SAR 750,000 by 31 March 2026 and SAR 375,000 by 30 June 2026. On 24 July 2026 ZATCA set the wave 25 criteria at SAR 187,500 of VAT-subject revenue during 2022, 2023, 2024 or 2025, with integration due by 1 February 2027. Businesses below that figure have not yet been called into a wave.

The generation duty is universal among residents. Whatever its revenue, a resident taxable person must issue invoices and notes through a compliant solution carrying the mandated fields, a universally unique identifier, a hash of the previous document and a tamper-resistant counter. Simplified invoices have had to carry a QR code since December 2021.

The integration duty is what the waves control. Once a taxpayer's wave date arrives, it connects its solution to FATOORAH through ZATCA's API, clears its standard tax invoices and reports its simplified ones. ZATCA notifies each targeted taxpayer directly rather than leaving the calculation to the business, so the practical trigger is the notification, not a self-assessment of turnover.

Four categories of transaction sit outside the duty under the Implementation Resolution: anything fully exempt from VAT, prepayments against those exempt supplies, purchases where the reverse charge moves the tax to the buyer, and goods imported into the Kingdom. Note what is absent from that list. Selling abroad and selling within the GCC both still call for an electronic invoice.

Clearance and reporting are two different mechanisms. A standard tax invoice is transmitted to ZATCA, which checks it against the controls in the Resolution and applies its cryptographic stamp only to invoices that meet them, notifying the issuer before the document goes to the customer. A simplified tax invoice is stamped by the taxpayer's own solution, using a cryptographic stamp identifier requested through ZATCA's portal, and shared with the Authority within 24 hours of being generated.

The transmitted format is XML in UBL 2.1 syntax, set out in the Electronic Invoice XML Implementation Standard and Data Dictionary that ZATCA published on 19 May 2023 and organised to conform to EN 16931. PDF/A-3 with an embedded XML file is permitted only as the readable copy shared with the buyer, never as the document sent to the Authority. QR codes work differently by invoice type: the taxpayer generates one on a simplified invoice, while on a standard tax invoice it comes back from ZATCA at clearance.

There is no central archive to fall back on, so retention is the taxpayer's own problem. Article 66 of the VAT Implementing Regulations runs the clock for six years from the close of the tax period the documents belong to. Capital assets are treated apart, adding five years to their adjustment period, so a movable asset attracts 11 years and an immovable one 15. Wherever the data physically sits, it has to be reachable from inside the Kingdom, and Arabic is the language of record.

Penalties for e-invoicing are graduated rather than flat. The Authority's board set a scale that opens with a warning and a window of 30 to 60 days to put the breach right, then escalates across six detections, with the ceiling depending on which duty was broken. Failure to connect to ZATCA carries the steepest ladder; a missing QR code or an incomplete field starts far lower. The scale is published in ZATCA's guideline on classifying general VAT violations, which exists in Arabic only.

Two things follow from that shape. A first detection costs nothing beyond the work of putting it right, so the real exposure lies in leaving a fault in place while inspectors keep finding it, and ZATCA publishes quarterly inspection results in which e-invoicing failures feature. The amnesty running until the end of 2026 offers no shelter either, having been built for filing and payment failures rather than invoicing ones.