E-Invoicing FAQ in Saudi Arabia: 37 Answers on ZATCA Compliance

The e-invoice has become a core part of the digital transformation in the Kingdom of Saudi Arabia. It falls within the efforts of the Zakat, Tax and Customs Authority (ZATCA) to boost transparency, combat commercial concealment, and raise the efficiency of tax compliance.

With the system rolling out in phases, many questions arise for business owners, entrepreneurs, and accountants. These questions revolve around implementation details, technical requirements, penalties, and other regulatory and practical aspects.

We have gathered here the most common questions along with accurate answers based on the Authority’s official specifications. The goal is for this guide to be a clear, up-to-date reference for anyone who wants to understand the e-invoicing system and apply it correctly.

Whether you are the owner of a small business, a medium-sized company, or an accountant looking for technical clarifications, you will find answers to most of what is on your mind in the lines that follow.

A quick look at the e-invoicing system in Saudi Arabia

E-invoicing replaces paper and handwritten invoices with unified digital documents. These are issued by an electronic system in line with the Authority’s specifications, then stored and exchanged in machine-readable formats.

The Authority rolled out the system in two phases. Phase 1 (the Generation phase) began on 4 December 2021, requiring all taxpayers registered for VAT to issue their invoices through an electronic system. Phase 2 (the Integration phase) then launched on 1 January 2023 in successive waves based on revenue size.

The core difference between the two phases is simple in concept. Phase 1 is only about issuing the invoice digitally. Phase 2 links your system directly to the Authority’s Fatoora platform, so the data of every invoice is sent for verification in real time or within a short window.

What is the difference between Generation and Integration?

In the Generation phase, you create the invoice electronically and store it on your system. There is no real-time link with the Authority. In the Integration phase, your system connects to the Fatoora platform through application programming interfaces (APIs), and every invoice goes through an official verification step before or after it is delivered to the customer, depending on its type.

The requirements added in Phase 2 are cryptographic values embedded programmatically inside the XML file of the invoice. Specifically, the XML file includes four main cryptographic elements:

• CSID (Cryptographic Stamp Identifier): The cryptographic stamp identifier issued by the Authority for each device or branch, used to sign invoices and prove their origin.
• UUID (Universally Unique Identifier): A unique identifier generated automatically for each invoice, ensuring it is not duplicated or its identity disputed.
• Hash (hash chain): A digital fingerprint for each invoice linked to the previous one, revealing any later modification or deletion.
• Digital Signature: A cryptographic signature embedded in the XML that proves the invoice was issued by its authorized issuer and has not been altered after issuance.

Qoyod automatically generates these four values and embeds them in the XML with no manual intervention from the user.

Frequently asked questions with answers

1. What is an e-invoice?

An e-invoice is a tax document issued in a digital format in line with the specifications of the Zakat, Tax and Customs Authority. It is used in sales transactions to ensure the accuracy of tax data and make verification easier. The main difference between it and a paper invoice is the reliance on a structured digital format, a Quick Response code (QR Code), and electronic storage in line with the official rules. In Phase 2, a cryptographic stamp (digital signature) and a unique identifier for each invoice are added.

2. Who is required to issue e-invoices?

The system covers all taxpayers registered for VAT who are resident in the Kingdom. It applies to both business-to-business (B2B) and business-to-consumer (B2C) transactions alike. Phase 2 compliance comes in waves defined by the Authority based on annual revenue size, and each establishment is notified of its wave date roughly six months in advance.

3. What are the types of e-invoices?

• The standard tax invoice: used in business-to-business (B2B) transactions. It includes the buyer’s and supplier’s details, the total, tax details, and the tax registration number of both parties.
• The simplified tax invoice: used in business-to-consumer (B2C) transactions such as retail shops. It does not require the buyer’s full details, but it must contain a Quick Response code (QR Code), the total amount, and the tax amount.

4. What are the system’s implementation phases?

• Phase 1: Generation (Phase 1): invoices are issued electronically according to the official specifications and stored on the establishment’s system without a real-time link to the Authority.
• Phase 2: Integration and linking (Phase 2): requires linking your system directly through application programming interfaces (APIs) to the Authority’s Fatoora platform, to verify and authenticate invoices.

5. What are the technical requirements for issuing invoices?

• An electronic invoicing system compliant with the Authority’s specifications (such as an accounting system or an approved cloud solution).
• The ability to generate a structured XML file that can be processed automatically.
• The cryptographic stamp (digital signature) and the Quick Response code (QR Code) in Phase 2.
• Integration with the Fatoora platform through application programming interfaces (APIs) or through a qualified solution provider.

6. What are the key mandatory fields in the invoice?

• The buyer’s details (name, address, tax registration number) in the standard invoice.
• Details of the goods or services and the tax value on each line item.
• A Quick Response code (QR Code) carrying data for instant verification.
• The cryptographic stamp and the unique invoice identifier (UUID) in Phase 2.
• In the simplified invoice, the buyer’s full details are not required, but the essential regulatory fields remain mandatory.

7. How are invoices sent and stored?

• The supplier sends the invoice electronically to the buyer in line with the approved systems.
• Invoices must be kept for at least six years in their original form, electronic or paper, inside the Kingdom.

Penalties, violations, and how to avoid them

8. What are the penalties and violations associated with the system?

The Authority applies a graduated scale of penalties based on the type of violation and how often it is repeated. The penalties in the e-invoicing system include the following:

• Failure to issue a compliant e-invoice: a penalty ranging from SAR 5,000 to 50,000 depending on the severity and repetition of the violation.
• Failure to include the Quick Response code (QR Code) in the simplified invoice: starts with a warning, then escalates from SAR 1,000 to 5,000 to 10,000 upon repetition within 12 months, and may reach SAR 40,000.
• Tampering with the invoicing system or altering the invoice after issuance: larger penalties with the possibility of criminal referral.
• Failure to keep invoices for six years: a penalty ranging from SAR 1,000 to 50,000.

The Authority usually starts with a warning on the first noticeable violation, then escalates to penalties if the violation is repeated within 12 months.

Learn about the penalty relief initiative with Qoyod.

9. How do I choose an invoicing solution provider?

• Its system should be compliant with the specifications of the Zakat, Tax and Customs Authority and ready to link with the Fatoora platform.
• It should support Phase 2 and real-time integration with the Authority’s system through application programming interfaces (APIs).
• It should provide technical support and regular updates that keep pace with any changes in the Authority’s requirements.

The Authority publishes an indicative list of solution providers that have passed the compliance tests. Choosing a system from this list is a best practice to avoid technical problems.

10. Frequently asked questions from small and medium-sized establishments

• If I am not registered for VAT, does the system apply to me? The system obligates those registered for VAT. If your sales exceed the mandatory registration threshold (SAR 375,000 per year), you must register, and then the system applies to you.
• Can I use Excel? A spreadsheet program such as Excel alone is not enough. The system requires a technical solution capable of generating the required formats and linking with the Fatoora platform.
• Is there support? Yes, the Authority provides awareness guides, solution providers offer technical support, and updates are available through the Authority’s official portal.

11. Can you voluntarily join Phase 2 ahead of its due date?

Yes, establishments can voluntarily join Phase 2 before their official wave date. This gives them more time to test the integration, a smooth experience before it becomes mandatory, and a way to avoid deadline pressure.

12. How do I prepare my e-invoicing system?

• Check the system’s ability to issue invoices in a structured XML format.
• Make sure the technical integration with the Fatoora platform through application programming interfaces (APIs) is ready.
• Make sure the system supports Arabic, with the option of English when needed.
• Register the cryptographic stamp identifier (CSID) for each device or branch with the Authority.

13. What is meant by Offline Archiving?

Offline archiving means storing the e-invoice file on servers inside the Kingdom, in line with technical requirements that ensure it cannot be modified and is kept in a structured encoding. These copies remain available to the Authority when needed throughout the statutory retention period.

14. Does the establishment have to process inbound invoices?

So far, the system does not require receiving inbound invoices electronically in a unified format. Nonetheless, inbound invoices must be kept as tax evidence, whether electronic or paper, within the statutory retention period.

15. Does the system cover foreign companies that are non-resident?

The system applies to taxpayers resident in the Kingdom. Non-resident persons who make taxable supplies in the Kingdom have special treatment for tax registration, but the e-invoicing requirements across its phases are directed at resident taxpayers. Review your situation with the Authority to determine your obligations accurately.

16. What is the invoice retention period and for notes?

E-invoices and their associated notes (debit note and credit note) must be kept for at least six years, inside the Kingdom and in their original form. It is preferable to refer to the Authority’s official guide for more details on special cases that may require a longer period.

17. What are the minimum elements for the Quick Response code in the simplified invoice?

The Quick Response code (QR Code) in the simplified tax invoice must contain the following minimum data:

• The supplier’s (seller’s) name.
• The supplier’s VAT registration number.
• The date and time the invoice was issued.
• The total invoice value including tax.
• The VAT amount.

In Phase 2, additional data related to the cryptographic stamp and the public key is added to the QR code of the standard invoice, bringing the number of fields to nine.

18. A company deals with individuals, establishments, and companies. Which type of tax invoices does it issue? And is the same system enough?

• With establishments and companies (B2B): the standard tax invoice is issued, containing detailed buyer information such as the name and tax registration number.
• With individuals (B2C): the simplified tax invoice is issued, which does not require full buyer details but includes the essential invoice data and the Quick Response code.

The same invoicing system can be used to issue both types, provided the system supports issuing standard and simplified invoices while respecting the requirements of each type.

19. How do I share the invoice with the client or buyer?

There are several approved ways to share the e-invoice with the customer:

• Sending an electronic link to the invoice via email or text messages.
• Providing a downloadable copy (PDF or XML) through the invoicing system.
• Displaying the Quick Response code (QR Code) on the invoice for the customer to scan and verify it.

What matters is that the invoice reaches the buyer in a way that makes it easy for them to verify and legally retain it.

20. What are the required invoice formats in Phase 2?

In Phase 2, specific formats are required to ensure the invoice complies with the Authority’s requirements and to facilitate linking and verification:

• XML: the primary approved format, containing all the data in a structured, machine-processable way in line with the UBL 2.1 standard.
• PDF/A-3 with embedded XML: a PDF format that allows embedding an XML file within it, so the invoice is displayed visually while retaining the structured electronic data.

These files are sent to the Fatoora platform through application programming interfaces (APIs) for verification and authentication.

21. What languages are permitted for issuing invoices?

Arabic is the primary and mandatory language for issuing invoices in the Kingdom. English may be added alongside Arabic, especially in international transactions or at the customer’s request. An invoice may not be issued in English alone without Arabic.

22. Is a digital signature required on all invoices?

• In Phase 1, the cryptographic stamp (digital signature) is not mandatory, but it enhances security and credibility.
• In Phase 2, the cryptographic stamp becomes mandatory on issued invoices, to ensure data integrity and prevent tampering.

23. What are the conditions for listing invoicing solution providers on the indicative list?

The company must complete the qualification program by submitting an application on the Authority’s website, then present its electronic solution and pass the compliance tests. After that, the company is added to the indicative list of solution providers.

24. Can different serial numbers be issued for invoices by branch or by customer?

Yes, different serial sequences may be used for each branch or type of customer, provided the invoices are clear and distinct with each sequence, without duplication or overlap.

25. Must all branches use one unified invoice sequence?

No. What is meant by preventing multiple sequences is preventing the system from issuing several simultaneous sequences in a way that technically confuses tracking. However, each branch can have its own independent and organized sequence.

26. What are examples of e-invoicing systems that can be used?

These include traditional point-of-sale (POS) devices, virtual POS on tablets, invoicing software on computers and phones, and cloud solutions. The essential condition is that they are compliant with the Authority’s specifications and capable of linking with the Fatoora platform.

27. Does the system have to be approved by the Authority in Phase 1?

Phase 1 does not require the system to be officially approved by the Authority, but it does require the ability to issue compliant e-invoices. In Phase 2, the system’s readiness to link with the Fatoora platform becomes an essential condition.

28. What are the legal and security steps to protect invoice data?

To protect invoice data, the establishment needs an invoicing system that adheres to the approved security standards. This includes data encryption, applying access permissions, using the cryptographic stamp, and keeping invoices in a secure environment inside the Kingdom. It is also advisable to take periodic backups and document the processes to ensure full compliance.

29. What are the procedures when an error is discovered after the invoice is issued?

The original invoice may not be modified after it is issued. To correct the error, an electronic debit note or credit note linked to the original invoice must be issued. This is done through the electronic system in line with the approved technical requirements.

30. How does the system affect periodic tax reports ?

The e-invoicing system improves the accuracy of the data in periodic tax returns. Invoice data is linked directly to your tax records, so errors decrease and transparency increases. This also makes it easier to review the data and reconcile it with the returns submitted to the Authority.

31. What is meant by self-registration in e-invoicing?

Self-registration is a procedure carried out by the taxpayer themselves through their account on the Zakat, Tax and Customs Authority platform, to register their establishment in the e-invoicing implementation phase. This procedure is an essential condition for the establishment to be able to issue approved invoices that comply with the Authority’s requirements.

32. Can a postponement of e-invoicing implementation be requested?

E-invoicing implementation cannot be postponed. The Authority has obligated all taxpayers to comply according to the implementation phases and their waves. Anyone who does not comply is subject to penalties. Therefore, you must start registering and applying the system before the date set for your wave.

33. Can I use an invoicing system that is not compliant with the Authority?

In Phase 2, the invoicing system must be compliant with the requirements of the Zakat, Tax and Customs Authority and ready for direct linking with the Fatoora platform. The Authority does not require official approval from a third party, but it publishes an indicative list of solution providers that have passed the compliance tests. Using a system from this list is the best practice to ensure compliance and avoid technical problems.

34. What if the internet goes down or the connection to the Fatoora platform is lost?

When the connection is lost, the establishment continues to issue invoices electronically and store them locally. Once the connection is restored, all pending invoices (simplified B2C invoices) must be sent to the Fatoora platform within 24 hours of their issuance. This procedure ensures all transactions are recorded and penalties are avoided.

35. Is the full invoice sent to the Fatoora platform?

In the case of the simplified invoice (B2C), a summary or structured content of the invoice is sent to the Fatoora platform within 24 hours for authentication. As for the standard invoice (B2B), it goes through the verification procedure (Clearance) before being delivered to the buyer, where the platform returns a copy authenticated with its stamp. The goal is verification and authentication while maintaining the confidentiality of the transaction details.

36. What is the cryptographic stamp and why is it mandatory in Phase 2?

The cryptographic stamp (digital signature) is a technical procedure that ensures the integrity of the invoice and prevents tampering with it. In Phase 2 it becomes mandatory, and it is used to create a unique fingerprint for each invoice that proves it has not been altered after issuance. This stamp is based on the cryptographic stamp identifier (CSID) issued by the Authority for each device or branch, and it enhances the reliability of invoices and the Authority’s efforts to combat commercial concealment.

37. Can invoices be issued in languages other than Arabic and English?

According to the executive regulation of the e-invoicing system, invoices must be issued in Arabic primarily. Another language such as English may be added alongside Arabic, but Arabic remains the primary language. Issuing an invoice in another language alone without Arabic may be considered a violation.

Technical concepts frequently asked about in Phase 2

After understanding the basic questions, a number of technical concepts remain that recur in Phase 2. Clarifying them helps you handle your system with confidence.

The unique invoice identifier (UUID)

The unique identifier is a number that distinguishes each invoice from others in a non-repeating way. The system generates it automatically for each invoice in Phase 2, and it is used to track and verify the invoice within the Fatoora platform.

Hash Chain

Each invoice in Phase 2 carries a digital fingerprint linked to the invoice before it. This chain proves the sequence of invoices and reveals any attempt to delete or retroactively modify an invoice. The result is a coherent record that is hard to tamper with.

Clearance vs. Reporting

The standard invoice (B2B) goes through the clearance procedure before being delivered to the buyer, meaning it is sent to the platform and returns authenticated with the Authority’s stamp. The simplified invoice (B2C), on the other hand, is delivered to the customer immediately and then reported to the platform within 24 hours. The difference is fundamental in the timing of communication with the Authority.

How does Qoyod help you comply with e-invoicing?

Complying with Phase 2 needs a system that handles the technical side on your behalf. This is where Qoyod, compliant with Phase 2, comes in.

Qoyod issues your invoices in the structured XML format in line with the UBL 2.1 standard, along with the Quick Response code (QR Code) and the cryptographic stamp. It also manages the link with the Fatoora platform and handles registering the cryptographic stamp identifier (CSID) for each branch or device, so B2B invoices are cleared in real time and B2C invoices are reported within the statutory window.

Alongside invoicing, Qoyod calculates value-added tax (VAT) on every transaction, classifies taxable, exempt, and zero-rated transactions, and prepares the tax return summary. Filing the return and paying the tax through the Authority’s portal remains the establishment’s responsibility.

Summary

The e-invoicing system is no longer optional; it is a statutory obligation applied in defined phases and waves. Understanding the requirements of both phases, knowing the penalties and how to avoid them, and choosing a system that is compliant with the Authority are the steps that protect your establishment from violations and give it a smooth transition.

The earlier you prepare, the less pressure you face when the mandatory date arrives. Start by reviewing your tax situation, and make sure your system is ready to link with the Fatoora platform before your wave’s date arrives.