Keeping E-Invoices and Its Requirements: A ZATCA Retention Guide

Every business registered for VAT in Saudi Arabia is required to keep its e-invoices for a specified period. This obligation is not optional, and it does not lapse the moment an invoice is issued and sent to the buyer. An e-invoice remains a tax document that must be retained in its original format, inside the Kingdom, for up to 6 years. Breaching this obligation exposes the business to direct financial penalties from the Zakat, Tax and Customs Authority (ZATCA).

In this guide we focus on the legal side of retention: how long you must keep invoices, in what format they must be kept, where they may be stored, what the regulatory basis of this obligation is, and what the penalties are for breaching it. If you are looking for how to organize, retrieve, and archive invoices in practice, that is a separate topic covered in our guide to archiving e-invoices. Here we discuss only the legal duty and its duration.

What does keeping an e-invoice mean?

Keeping an e-invoice means retaining the original copy of the tax document after it is issued, so that it stays available and readable throughout the statutory period. An e-invoice is not merely a PDF file sent to the customer. It is a structured document carrying precise tax data, an electronic signature, a unique identifier, and a verification chain linking it to previous invoices.

When we talk about statutory retention, we mean keeping these elements complete without alteration or deletion. A retained invoice must be retrievable when the Authority requests it, and must appear with the same content it had at the time of issuance. Any later change to the amount, the date, or the seller’s data strips the invoice of its value as tax evidence.

Many business owners confuse “issuing” an invoice with “keeping” it. Issuing is a momentary event that ends once the invoice is delivered to the buyer or reported to the Authority. Retention, on the other hand, is an extended obligation that begins the moment of issuance and continues for years. A business may issue its invoices perfectly correctly, then fall into a violation because it did not retain them in the correct manner.

The difference between retention and archiving

Retention is a legal obligation that defines “what,” “how long,” and “where.” Archiving is an organizational practice that answers “how.” Retention requires you to keep the invoice for 6 years in its original format inside the Kingdom. Archiving is the way you order, index, and quickly retrieve those invoices when needed.

To put it more clearly: you can be legally retaining your invoices while your archive is chaotic and hard to search. The reverse is also true. That is why we separate the two topics. This guide covers the legal duty, while you will find the organization and retrieval practices in the separate archiving guide.

The mandatory retention period for e-invoices

The basic period for keeping invoices and tax records in Saudi Arabia is 6 years. This period begins from the end of the tax period to which the invoice belongs. In practical terms, this means an invoice issued in 2026 must remain retained until at least the end of 2032.

The 6-year period applies to tax invoices, simplified tax invoices, credit and debit notes, and every accounting record that supports the VAT return. There is no difference here between a large business and a small one. The obligation is the same for every VAT-registered entity.

There is one special case where the period is longer. Invoices and records related to real estate assets must be kept for a longer period of up to 11 years. The reason is that the tax treatment of real estate extends over a longer horizon, so the Authority may need to refer back to the records during it. If your activity involves real estate, verify this longer period specifically.

When does the period start counting?

The period is counted from the end of the tax period, not from the invoice date itself. The tax period is monthly for businesses whose taxable supplies exceed SAR 40 million per year, and quarterly for the rest of registered entities. When counting, take the end of the period in which the invoice falls as the starting point, then add the statutory duration.

The safe practical rule: do not destroy any invoice before a full 6 years have passed from the end of its tax year. With real estate, extend this period to 11 years. Keeping records longer than required does no harm, but early destruction is an outright violation.

The required retention format

It is not enough to keep an image or a printed copy of the invoice. The Authority requires the e-invoice to be kept in its original structured format, which is the XML format compliant with the UBL 2.1 standard. This format is what carries all the tax data in a way that systems can read and verify automatically.

In Phase 2 of e-invoicing, the invoice carries additional technical elements that must remain retained with it without separation. The most notable are:

• The cryptographic stamp: a digital signature generated using the Cryptographic Stamp Identifier (CSID) issued by the Authority.
• The unique identifier (UUID): a number that distinguishes each invoice from the others.
• The verification value (Hash): a fingerprint derived from the previous invoice that links invoices into a connected chain.
• The QR code: it carries the invoice data and its signature in a machine-readable format.

These elements are not decoration. They are what proves the invoice has not been altered after issuance. Keeping a PDF image alone without the original XML file strips the invoice of its value as a statutorily retained document. That is why the original XML file must remain in place throughout the period, even if you keep a visible PDF copy alongside it.

The PDF/A-3 format and its role in retention

The Authority permits a presentation format for the buyer, PDF/A-3, which includes an embedded XML file inside it. This format combines the visible copy and the structured copy in a single file. Its advantage is that it simplifies retention: a single file carrying everything required instead of two separate files.

The important thing is to make sure the presentation copy actually carries the XML file inside it, and is not merely an image. A copy that does not contain the structured data is not considered a retained original, no matter how visually identical it looks to the invoice.

Where must invoices be stored? The in-Kingdom retention rule

The retention obligation relates not only to the period and format, but to the location as well. The Authority requires e-invoices and tax records to be available inside the Kingdom of Saudi Arabia. This is what is known as the principle of keeping data within the national borders.

What is meant is that the Authority can access the invoices when it requests them, through a system or a copy available inside the Kingdom. Using cloud storage services does not prevent compliance, provided the data remains accessible and retrievable inside the Kingdom. The decisive point is providing access to the Authority, not merely the physical server location.

This condition protects the Authority’s right to audit. If a business kept its invoices on a system that cannot be accessed from inside the Kingdom, or with a party that does not allow retrieval on request, it would have breached the retention obligation even if the invoices actually exist. So always make sure your accounting system provider complies with this principle.

The regulatory basis of the retention obligation

The retention obligation is not a matter of discretion; it stems from an integrated regulatory framework. The VAT Law and its Implementing Regulation require the registered person to keep invoices, books, and tax records for a specified period, and to present them to the Authority on request. This is the general foundation on which the e-invoicing rules are built.

The e-invoicing resolutions issued by the Authority added details specific to the e-invoice: its format, its technical elements, and the way it is retained so as to prevent tampering. These resolutions govern the two phases: the generation phase that began on 4 December 2021, and the integration phase that started on 1 January 2023 in waves based on the size of the business’s revenue.

The bottom line of the regulatory basis is that the e-invoice is an official tax document. Keeping it is an integral part of the business’s compliance with the VAT framework, not merely an optional internal procedure. Whoever understands this basis realizes why the Authority treats breaches of retention seriously.

The relationship between retention and tax audits

When the Authority conducts an audit on a business, the first thing it requests is the records and invoices supporting the returns filed. An invoice retained in its original format is the evidence that proves the accuracy of what the business declared in terms of sales, output tax, and input tax.

The absence of an invoice, its damage, or the incompleteness of its elements puts the business in a weak position during the audit. The input tax claimed for deduction may be rejected for lack of a sound invoice supporting it. So proper retention is not only protection against penalties, but also protection of the business’s own tax rights.

Who is responsible for keeping invoices?

The obligation to keep invoices falls on the business registered for VAT, that is, on the seller who issued the invoice. This responsibility does not transfer to the accounting system provider nor to the external accountant. Even if you engage a third party to manage your invoices, the business remains the party legally responsible before the Authority.

This distinction matters in practice. Some business owners think that hiring an accounting firm or subscribing to a cloud system exempts them from responsibility. The truth is that the role of these parties is supportive and operational, while the regulatory liability lies with the business. So it is your right to ask your system provider for a clear guarantee that invoices are kept in the correct format, period, and location.

The buyer, too, has an interest in keeping the invoices it received, especially tax invoices on the basis of which it claims input tax deduction. If it is asked for them during an audit and cannot find them, it may lose its right to the deduction. So retention is an obligation that serves both parties, the seller and the buyer, each from its own angle.

The role of the accountant and the system provider

The accountant is responsible for alerting the business to the retention obligations and making sure they are applied within the accounting cycle. The system provider is responsible for providing the technical tools that make retention possible in the statutory format. But the decision and the liability remain with the business that owns the tax record.

So choose an accounting system that clearly states how it retains invoices and their technical elements, the duration of this retention, and the mechanism for retrieving them. Ambiguity on this point is a warning sign you should not ignore when evaluating any system.

Keeping the different types of documents

The retention obligation is not limited to the ordinary sales invoice. It extends to cover every tax document connected to your activity. It is useful to know that each type is subject to the same retention rule in its original format and for its statutory period:

• The tax invoice (B2B): kept in its structured format after the Authority clears it.
• The simplified tax invoice (B2C): kept with the QR code and its data after the Authority is notified of it.
• The credit note: kept linked to the original invoice it amended.
• The debit note: likewise kept linked to its original invoice within the chain.

Credit and debit notes follow the same retention rules as the invoice they relate to. Keeping the invoice without its notes leaves the record incomplete, because the note amends the invoice value or cancels part of it. So every amending document must remain retained alongside its original to complete the picture before the Authority at the time of audit.

Alongside invoices and notes, the accounting books and records that support the tax return must be kept. The invoice alone is not enough if it is not backed by consistent accounting entries. A sound retention framework includes the tax document and its accounting support together.

The transition from paper to electronic retention

Before e-invoicing, businesses kept their invoices on paper in files and drawers. With Phase 2, the concept of retention changed fundamentally. The paper copy is no longer sufficient; the approved original became the structured electronic file with its signature and technical elements.

This shift requires the business to review its old habits. Printing the invoice and keeping it in a paper file no longer serves the purpose. The original the Authority relies on is the XML file, and the paper copy carries neither the electronic signature nor the verification chain that proves the invoice’s integrity.

Businesses that started their activity before Phase 2 may keep two types of records: old paper invoices and recent e-invoices. The rule is to keep each type until its statutory period ends. Do not destroy the old paper invoices before their retention period passes, even if your system has fully switched to e-invoicing.

The penalties for breaching the retention obligation

Breaching the retention of invoices and tax records falls under the violation of “failure to keep records.” The penalty for this violation ranges between SAR 1,000 and SAR 50,000 depending on the severity of the violation and its repetition. This penalty is independent of any other penalties that may result from missing records during an audit.

More serious is that missing retained invoices may lead to consequences beyond the direct penalty. When a business cannot find an invoice supporting a tax deduction it claimed, the Authority may recalculate the tax due and impose differences and late-payment penalties on it. This multiplies the impact of the retention breach.

The Authority usually handles a first violation with a warning in many cases, then the penalties escalate upon repetition within 12 months. But relying on the warning is a risky policy. Getting compliance right from the start is far cheaper than dealing with violations later.

When does the retention period extend beyond 6 years?

The general rule is 6 years, but there are cases where the period effectively extends and must be watched so that you do not destroy an invoice that is still needed. The most notable of these cases:

• Real estate records: kept for a period of up to 11 years due to the long horizon of the tax treatment of real estate assets.
• The existence of an ongoing tax dispute or objection: the related invoices must be kept until the dispute is finally settled, even if that exceeds the original period.
• An open audit by the Authority: as long as the audit is ongoing over a particular period, the invoices of that period remain required as evidence.

The governing rule here is that the statutory period is a minimum, not a maximum. If there is a reason that keeps the invoice still tax-relevant, keeping it remains necessary until that reason ceases. So review your business’s situation before destroying any batch of old invoices, and make sure they are not connected to an ongoing dispute or audit.

On the other hand, there is no harm in keeping invoices for longer than required. Many businesses choose to keep their e-invoices permanently because the cost of digital storage is trivial, while the cost of losing a required invoice can be steep. Early destruction is the only risk that must be avoided.

Common mistakes in keeping e-invoices

Awareness of the recurring mistakes saves the business a great deal. The most notable of them:

• Settling for keeping a visible PDF copy and neglecting the original structured XML file.
• Destroying old invoices before the 6-year period ends on the assumption that they are no longer needed.
• Applying the 6-year period to real estate records that require 11 years.
• Storing invoices on a system that does not allow their retrieval or access inside the Kingdom on request.
• Relying on an employee’s memory or a single personal device without a reliable system that organizes retention.

Each of these mistakes turns a clear obligation into a potential violation. What they have in common is that the business treated retention as a marginal matter, whereas it is a pillar of tax compliance.

How Qoyod helps you keep your e-invoices

Qoyod is a Saudi accounting software compliant with Phase 2 of e-invoicing. It handles the technical side of keeping the e-invoice in its correct statutory format, so you do not have to manage the files manually. In practice, Qoyod delivers for this obligation specifically:

• Keeping every invoice in its original XML format compliant with the UBL 2.1 standard, with all Phase 2 elements.
• Embedding the XML file inside a PDF/A-3 copy automatically for sales invoices and debit notes, so you have a single file combining the visible and structured copies.
• Retaining the chain of verification values (Hash) that links the invoices together and proves they have not been tampered with.
• Keeping the unique identifier, the cryptographic stamp, and the QR code linked to every retained invoice.
• Enabling quick retrieval of any old invoice when the Authority requests it during an audit period.

This turns the retention obligation from a manual burden into a process that runs automatically in the background of your accounting system. You issue your invoice, and Qoyod takes care of keeping it in the form the Authority requires throughout the statutory period.

A quick checklist for keeping e-invoices

Before you feel confident that your business is compliant, review these points:

• Do you keep every invoice in its original XML format, not just a PDF image?
• Do you keep invoices for at least 6 years from the end of the tax period?
• Do you apply the 11-year period to real estate records, if any?
• Are your invoices available for retrieval and access inside the Kingdom when the Authority requests them?
• Are the technical elements (the cryptographic stamp, the unique identifier, the verification chain, the QR code) kept with every invoice?

If your answer is “yes” to every item, you are in a sound compliance position. Any item answered “no” needs immediate attention before it turns into a violation.

Frequently asked questions

How long must an e-invoice be kept in Saudi Arabia?

The basic period is 6 years from the end of the tax period to which the invoice belongs. As for records and invoices related to real estate assets, they are kept for a longer period of up to 11 years.

Is it enough to keep a PDF copy of the invoice?

No. The invoice must be kept in its original structured XML format compliant with the UBL 2.1 standard. A visible PDF copy alone is not considered an original copy unless it includes the XML file inside it in PDF/A-3 format.

Where must e-invoices be stored?

Invoices must be available for access and retrieval inside the Kingdom when the Authority requests them. Using cloud storage is acceptable as long as the data is retrievable inside the Kingdom at the time of an audit.

What is the difference between keeping invoices and archiving them?

Retention is a legal obligation that defines the period, the format, and the location. Archiving is an organizational practice concerned with how invoices are ordered, indexed, and retrieved. You will find the archiving details in the guide to archiving e-invoices.

What is the penalty for not keeping invoices?

Breaching the retention of records falls under the violation of failure to keep records, and its penalty is between SAR 1,000 and SAR 50,000. It may also entail larger consequences, such as the rejection of the input tax deduction during an audit.

Does Qoyod keep invoices automatically?

Yes. Qoyod keeps every invoice in its original XML format with the Phase 2 elements, and lets you retrieve them when needed, so you do not need to manage the files manually. Learn more about Qoyod’s e-invoicing software.

A practical summary

Keeping an e-invoice is a legal duty with three pillars: a 6-year period (and 11 years for real estate), the original XML format compliant with Phase 2, and providing access inside the Kingdom. Breaching any pillar exposes the business to a penalty of up to SAR 50,000 and to further consequences during an audit. As for organizing and retrieving these invoices in practice, that is a topic completed in the guide to archiving e-invoices. For a deeper look at the full framework, see the definition of the Zakat, Tax and Customs Authority andvalue-added tax andthe simplified tax invoice, in addition to the guide to e-invoicing in Saudi Arabia and the explanation of Phase 2 of e-invoicing.

And if you want your system to take care of this obligation on your behalf, then the accounting software from Qoyod keeps your invoices in the correct form, and it is compliant with Phase 2 andintegrated with the Fatoora platform.