ZATCA E-Invoicing Guide: Fatoora Phase 1 and 2

Quick answer: ZATCA e-invoicing (the Fatoora program) requires VAT-registered businesses in Saudi Arabia to issue tax invoices from a compliant electronic system. Phase 1, live since 4 December 2021, bans handwritten and editable invoices and requires QR codes on simplified invoices. Phase 2 adds integration with ZATCA's platform in waves: standard B2B invoices are cleared in real time, and simplified B2C invoices are reported within 24 hours.

If you sell in Saudi Arabia, ZATCA e-invoicing changes what an invoice actually is: a structured data file, signed and checked by the authority, rather than a nicely laid out page. This guide explains both phases, how the waves work, what goes on standard and simplified tax invoices, and where a PDF from our free invoice generator still fits (mostly for quotes, proformas and sales that fall outside the mandate).

Important: This is general information, not tax or legal advice. ZATCA updates its rules, technical specifications and wave announcements regularly. Check the official ZATCA e-invoicing pages or ask a Saudi tax adviser before relying on any date in this article.

What is ZATCA e-invoicing (Fatoora)?

The Zakat, Tax and Customs Authority (ZATCA) runs the Kingdom's e-invoicing program under the name Fatoora. The idea is simple: instead of businesses creating invoices in any tool they like, invoices and their associated credit and debit notes must come from an electronic solution that meets ZATCA's technical rules, and eventually that solution must talk directly to ZATCA's systems.

The rules apply to resident VAT-registered taxpayers and to third parties issuing tax invoices on their behalf. Certain categories are excluded, and ZATCA publishes those exclusions in its e-invoicing regulation and guidelines. If you are VAT-registered in Saudi Arabia, assume the rules apply to you until you have confirmed otherwise.

Phase 1 vs Phase 2: what changed

	Phase 1: Generation	Phase 2: Integration
Start date	4 December 2021, all in-scope taxpayers	From 1 January 2023, in waves chosen by revenue
What it requires	Invoices generated and stored electronically by a compliant solution	Solution connected to ZATCA's Fatoora platform via APIs
Format	Electronic, structured format not strictly prescribed	XML based on UBL 2.1, or PDF/A-3 with embedded XML
QR code	Mandatory on simplified tax invoices	Mandatory on simplified invoices, with cryptographic stamp data
Standard (B2B) invoices	Issued directly to the buyer	Cleared by ZATCA before being shared with the buyer
Simplified (B2C) invoices	Issued directly to the customer	Shared with the customer, then reported to ZATCA within 24 hours

What Phase 1 prohibits

Phase 1 is often underestimated because it does not involve sending anything to ZATCA. It still sets firm rules. Handwritten invoices are no longer acceptable for in-scope taxpayers. Your solution must not let users alter or delete an issued invoice without a trace, must not allow multiple sequence counters to be manipulated, and must be able to produce invoices in Arabic (other languages can appear alongside). Corrections are made with credit or debit notes, never by editing the original.

What Phase 2 adds

In Phase 2, your e-invoicing solution has to be onboarded with ZATCA. Each device or unit that issues invoices obtains a cryptographic stamp identifier (CSID), each invoice is hashed and linked to the previous one, and the XML file is signed. Standard tax invoices go to ZATCA for clearance, and only a cleared invoice is valid to share with the buyer. Simplified invoices are given to the customer at the point of sale and reported afterwards, within 24 hours.

ZATCA integration waves and thresholds

ZATCA rolls out Phase 2 in waves. Each wave is defined by VAT-taxable revenue in specified past years, and ZATCA informs selected taxpayers directly, generally at least six months before their integration date. The first wave in 2023 covered only the very largest taxpayers (revenue above SAR 3 billion), and the threshold has fallen steadily since.

Wave	Revenue criterion (VAT-taxable)	Integration deadline
Wave 1	Above SAR 3 billion in 2021	Between 1 January and 30 June 2023
Wave 2	Between SAR 500 million and SAR 3 billion in 2021	From 1 July 2023
Wave 24	Between SAR 375,000 and SAR 750,000 in 2022 or 2023	30 June 2026
Wave 25	Above SAR 187,500 in 2022, 2023, 2024 or 2025	1 February 2027

Wave 25, announced in July 2026, is the first to look at 2025 revenue, which means businesses that only grew last year can now be pulled in. SAR 187,500 is also the voluntary VAT registration threshold, so Wave 25 reaches a large share of smaller registered businesses. If you have not been notified but think you might qualify, check your status on the Fatoora portal rather than waiting.

Standard tax invoice vs simplified tax invoice

Saudi VAT has two invoice types, and the e-invoicing rules treat them differently. Our VAT invoice guide covers the general logic; this is how it works in Saudi Arabia.

	Standard tax invoice	Simplified tax invoice
Typical use	Sales to VAT-registered businesses (B2B)	Sales to consumers (B2C)
Buyer details	Buyer name, address and VAT number required	Buyer details not generally required
QR code	Optional in Phase 2 (included in the cleared invoice)	Mandatory
Phase 2 flow	Clearance: ZATCA validates before you share it	Reporting: share first, report within 24 hours
Shared as	Cleared XML, or PDF/A-3 with the cleared XML embedded	Printed or electronic copy with QR code

The same split applies to credit and debit notes: a credit note against a standard invoice follows the clearance flow, and one against a simplified invoice follows the reporting flow. For how credit notes work in general, see our credit note guide.

Fields a Saudi tax invoice must show

E-invoicing does not replace the VAT invoice content rules; it encodes them as XML elements. A standard tax invoice generally needs:

• The words "Tax Invoice" (in Arabic, optionally with English)
• Invoice issue date and, where different, the supply date
• A unique sequential invoice number
• The seller's name, address and VAT registration number
• The buyer's name, address and VAT registration number
• A description of the goods or services, quantity and unit price
• The VAT rate (15% standard) and the VAT amount per line or in total, in SAR
• The total including VAT, and any discounts
• The reason for any zero-rating or exemption, where that applies

Phase 2 adds technical fields that a person never types: a universally unique identifier (UUID), the invoice hash, the previous invoice hash, an invoice counter value and the cryptographic stamp. That is the main reason ordinary invoice software and document templates cannot meet Phase 2 on their own. If the VAT number field is new to you, our article on the tax ID on an invoice explains how different countries label it.

Worked example: a standard tax invoice in Riyadh

A Riyadh IT services company bills a VAT-registered client for a network installation. The numbers are what the XML would carry; the compliant system calculates them and sends the invoice for clearance.

Description	Qty	Unit price (SAR)	Net (SAR)	VAT 15% (SAR)
Network switches, 24-port	4	1,850.00	7,400.00	1,110.00
Installation and configuration (hours)	12	250.00	3,000.00	450.00
Annual support plan	1	2,600.00	2,600.00	390.00
Totals			13,000.00	1,950.00
Total including VAT				14,950.00

The maths: 7,400 + 3,000 + 2,600 = SAR 13,000 net. VAT at 15% is SAR 1,950, giving SAR 14,950. In Phase 2 the company's system generates the XML, signs it, submits it to ZATCA for clearance, and only then emails the cleared invoice (often as a PDF/A-3 with the XML inside) to the client. A calculator can check VAT arithmetic like this, but the invoice itself must come from the compliant system.

Is a PDF invoice valid in Saudi Arabia?

For an in-scope VAT-registered business, a PDF built in Word, Excel or a browser-based generator is not a compliant tax invoice under Fatoora. That includes PDFs from our generator. The tool runs in your browser, saves drafts in local storage and exports a PDF; it does not generate UBL XML, apply a cryptographic stamp, or connect to ZATCA, and we do not claim otherwise.

Where a free generator remains useful:

• Quotations and proformas before the sale. These are not tax invoices. See proforma vs commercial invoices.
• Businesses not registered for VAT that simply need a clear bill for a customer, although they must not label it a tax invoice or show VAT.
• Invoices issued by a foreign business with no Saudi VAT registration, to the extent Saudi rules do not apply to it.

If you fall into one of those groups, the Corporate invoice template gives tax IDs and notes a clear place.

How to get ready for your Phase 2 wave

1. Confirm your wave. Look for ZATCA's notification and check your revenue against the latest wave criteria.
2. Choose a compliant solution. Ask your ERP, POS or accounting provider whether it is Phase 2 ready and how onboarding works. ZATCA does not certify vendors, so ask for evidence of successful onboarding and compliance checks.
3. Onboard every invoicing unit. Each branch, POS terminal or system that issues invoices needs its own cryptographic stamp identifier, generated using a one-time password from the Fatoora portal.
4. Clean your customer data. Clearance fails when a buyer's VAT number or address is wrong. Fix master data before go-live.
5. Test credit notes and exceptions. Returns, partial refunds and cancelled sales are where most first-month errors happen.
6. Plan your archive. The XML is the legal record. Saudi rules require invoices and records to be kept for years, so check the current retention period; our guide on how long to keep invoices gives the wider context.

Penalties for non-compliance

ZATCA can impose fines for failing to issue e-invoices, issuing them without required elements, not reporting to ZATCA, or deleting or altering invoices. ZATCA has said its approach includes warnings before fines for some first-time violations, but the penalty schedule is set in regulation and can change, so check the current table on ZATCA's site rather than relying on amounts quoted by software vendors.

Next step

If you are VAT-registered in Saudi Arabia, your next step is to confirm your Phase 2 wave on the Fatoora portal and speak to your software provider. If you sell into Saudi Arabia from abroad, compare the neighbouring rules in our UAE e-invoicing guide and the wider e-invoicing guide. For quotes and non-tax documents, you can still use the generator to produce a clean PDF in minutes.