E-Invoicing for Small Businesses in Saudi Arabia

Before your group’s integration deadline in Phase Two of e-invoicing, your business needs more than the intention to comply. It needs actual, item-by-item measurable readiness. This checklist walks you through it step by step to make sure your business is fully prepared for e-invoicing, and helps you avoid any delay or penalties caused by a gap in the requirements.

E-invoicing in Saudi Arabia is no longer optional. It is a mandate issued by the Zakat, Tax and Customs Authority (ZATCA) on every business registered for VAT. But the difference between a business that clears integration smoothly and one that stumbles at the last minute is preparing in advance. In this guide we explain every readiness item in detail, clarify what you need to do and when, and show how a compliant accounting system helps you close these items all at once.

Why do you need a readiness checklist before integration?

Many businesses postpone preparation until they receive the Authority’s notice with their group’s date. This delay is a costly mistake. When the notice arrives, you have only a limited number of months to prepare your system, register your cryptographic certificate, test integration, and train your team. Any flaw in one of these elements means invoices rejected by the Fatoora platform, which directly affects your cash flow and your relationship with your customers.

The practical difference between a ready business and a struggling one does not show up on integration day, but in the weeks leading up to it. The ready business has closed the items on its checklist one after another, tested every scenario, and trained its team, so activation goes smoothly. The struggling business, on the other hand, discovers its gaps at the last minute, when time is short and options are few. This checklist was created to move you into the first category.

The checklist here is not just a reminder. It is a diagnostic tool. Go through every item and answer honestly: is this truly ready in my business today? Every item you answer “no” to is a gap you must close before the integration date. The goal is to reach activation day confident that your business is ready from the tax, technical, and operational sides all at once.

E-invoicing readiness checklist

Visual checklist

Before we explain each item, here is the full checklist at a glance. Review it quickly, then move on to the detailed explanation of each element:

• A valid and active VAT registration.
• Knowing your business’s group date from the Authority’s notice.
• An electronic invoicing system compliant with Phase Two requirements.
• Automatic generation of the mandatory elements: the QR code, the cryptographic stamp, and the unique identifier.
• Reviewing the accuracy of customer data and their tax numbers.
• Registering the cryptographic certificate (CSID) and testing integration in the sandbox environment.

Explaining the checklist items in detail

1. A valid and active VAT registration

Every electronic invoice begins with a valid tax number. First make sure your business is actually registered for Value Added Tax, and that your 15-digit tax number is correct and active. VAT registration is mandatory for every business whose taxable revenue exceeds SAR 375,000 per year, and optional once it exceeds SAR 187,500.

Also review the accuracy of your business data registered with the Authority: the legal name, the national address, and the type of activity. This data appears on every invoice you issue, and any conflict between it and the Authority’s records may cause the invoice to be rejected at integration. Start here, because the rest of the items are built on a valid tax number.

2. Knowing your business’s group date

The Authority applied Phase Two in waves (groups) ordered by the size of annual revenue. Each group receives a direct notice specifying the mandatory integration start date, with a preparation window that is usually about six months before the actual date. Do not rely on guesswork or on what you heard from another business, because your group’s date comes from the Authority’s official notice alone.

Check your email registered with the Authority and your account on its portal regularly. When the notice arrives, record the date and start preparing immediately. Every week of delay in preparation shrinks the safety margin you need to test integration calmly. The simple rule: prepare your business before the notice reaches you, not after.

3. A compliant and approved electronic invoicing system

This is the most important item on the checklist, because it covers most of the other requirements automatically. A compliant system is one that issues the types of electronic invoices in their regulated format, generates every mandatory element, and integrates directly with the Authority’s Fatoora platform. An invoice written in a word processor or a spreadsheet has not been accepted since Phase One.

Businesses issue two types of invoices through their compliant system:

• The tax invoice (B2B): sent to the Fatoora platform and passes through an instant clearance process before being delivered to the buyer.
• The simplified tax invoice (B2C): delivered to the customer immediately, and reported to the Authority within 24 hours of issuance.

Make sure your system supports both types, and that it meets all the e-invoice conditions in full. A system like Qoyod, compliant with Phase Two, issues both types in their regulated format and links them directly to the Authority without manual intervention.

4. The mandatory elements on every invoice

Phase Two added mandatory technical elements that were not required in the generation phase. These elements are what distinguish a compliant invoice from any other, and their absence means the invoice is rejected by the Fatoora platform. The most notable of these elements:

• The cryptographic stamp: a digital signature proving that the invoice was issued from an approved system and has not been modified after issuance.
• The unique identifier (UUID): a unique identification number for each invoice that is never repeated.
• The hash value of the previous invoice: links invoices in a connected chain that guarantees the integrity of the sequence.
• The QR code: carries the invoice data and the signature data, and allows them to be verified instantly.

You are not supposed to create these elements manually. The compliant system generates them automatically with every invoice according to the Authority’s technical specification. Your task here is only to verify that your system actually generates them, and that they appear correctly on the copy of the invoice the customer receives.

5. Reviewing the accuracy of customer data and their tax numbers

A tax invoice directed to another business (B2B) requires the customer’s tax number within its data. If this number is wrong or incomplete, the invoice is rejected or recorded incorrectly. Set aside time to review your database of business customers and confirm the accuracy of their tax numbers and national addresses before you start actual issuance.

This is a step many overlook, because it is not related to the system but to the quality of your own data. The cleaner and more up to date your customer database is, the fewer rejected invoices you get and the less time is wasted on corrections after integration. Make cleaning customer data part of your preparation, not a postponed item.

6. Registering the cryptographic certificate and testing integration

Before you issue your first real invoice, you need to register your business on the Fatoora platform and obtain your cryptographic certificate, known as the Cryptographic Stamp Identifier (CSID). This certificate is what allows your system to sign invoices and send them to the Authority. The certificate is registered by the business itself through the Authority’s portal, and your compliant system guides you through the steps.

After registration, do not move straight to production. Test integration first in the sandbox environment provided by the Authority. Issue test invoices of each type, and confirm that they pass clearance and are accepted. This step reveals any flaw in the setup before it affects your real invoices and customers. Review the beginner’s guide to e-invoicing if you are at the start of the journey and need the foundational steps first.

How do you know your system is truly compliant?

The phrase “compliant system” is repeated a lot, but what actually makes it compliant? Before you adopt any system, ask it these questions, and make sure the answer is “yes” to each one:

• Does the system issue the tax invoice and the simplified invoice in their approved regulated format?
• Does it generate the cryptographic stamp, the unique identifier, and the QR code automatically with every invoice?
• Does it link invoices in a chain via the hash value of the previous invoice?
• Does it integrate directly with the Fatoora platform for instant clearance and reporting?
• Does it guide you through registering the cryptographic certificate and testing integration?
• Does it release updates that keep pace with any change in the Authority’s technical specification?

A system that answers “yes” to these six questions covers the largest part of your readiness checklist automatically. A system that stumbles on any of them will turn preparation into hard, error-prone manual work. Choosing the right system from the start saves you time and effort that are hard to recover later.

The difference between Phase One and Phase Two readiness

Many businesses think they are ready because they passed Phase One successfully. This is an incomplete understanding. The generation phase that started in December 2021 only required you to issue your invoices from an electronic system instead of paper or word-processing files. It did not require any direct integration with the Authority, nor a digital signature, nor an encrypted sequence of invoices.

Phase Two is fundamentally different. Here the system transforms from a mere invoice issuer into a system connected to the Fatoora platform in real time. Every tax invoice between businesses must pass through an instant clearance process before being delivered to the buyer, and every simplified invoice to a consumer must be reported within 24 hours. This difference means the technical readiness requirements are much deeper, and any flaw that did not matter in Phase One could halt your business in Phase Two.

So do not treat your previous readiness as proof of your current readiness. Reassess your system specifically from the Phase Two perspective: does it generate the cryptographic stamp? Does it link invoices in a chain? Does it actually integrate with the Fatoora platform rather than just store invoices locally? If the answer is “no” to any of these, you need a newer system before your group’s date.

Invoice readiness by business size

The readiness requirements are the same for everyone, but the path to reaching them differs with the size of the business and the nature of its work. Understanding your position helps you spend your time and effort in the right place.

Small businesses and individuals

Small businesses often issue simplified invoices to consumers more than tax invoices between businesses. Their main challenge is not size but simplicity: they need a ready system that does not require a technical team or complex setup. The rule here is to choose a system that handles the technical side entirely, so you focus on your work rather than on compliance.

Medium businesses

Medium businesses deal with a mix of individual and business customers, and their invoice volume is larger. Here the accuracy of customer data and their tax numbers becomes more important, because the proportion of tax invoices between businesses rises. These businesses need a little more time to clean their data and test the different issuance scenarios before activation.

Large businesses

Large businesses that issue thousands of invoices a day face the highest level of complexity. Testing in the sandbox environment is not an option for these businesses but a necessity, because any flaw is magnified with the volume of invoices. They need a wider time margin, broader training for the accounting teams, and close monitoring in the first weeks after activation.

Whatever your size, the six items on the checklist remain the standard. What changes is the time and effort required to close each item, not the items themselves.

What happens when you are not ready?

Failing to complete readiness before the integration date does not mean just an administrative delay. It has direct operational and financial effects. When your group’s date arrives and you are not ready, the problems start to pile up quickly.

The first effect is invoice rejection. If your system does not generate the mandatory elements correctly, or does not integrate with the Fatoora platform, your tax invoices will not be accepted. And a rejected invoice means a stalled deal, a delayed payment, and an unsatisfied customer. This hits your cash flow directly.

The second effect is the possibility of being exposed to penalties and fines as a result of not complying with the Authority’s requirements by the specified date. The Authority sets the integration dates clearly, and complying with them is the business’s responsibility. Avoiding these fines is the strongest motive to finish the readiness checklist early.

The third effect is less obvious but important: operational chaos. When readiness is delayed, the accounting team finds itself dealing with the crisis instead of organized work. Early preparation turns activation from a crisis into a routine, measured step.

Team readiness is no less important than system readiness

The six items focus on the technical and tax side, but there is a human dimension that is no less important: your team’s readiness. A compliant system alone does not guarantee correct issuance if the accounting team does not know how to use it properly.

Before activation, set aside time to train those who issue invoices in your business. Explain to them the difference between the tax invoice and the simplified invoice, when each is used, and how they verify the completeness of customer data before issuance. Human error in data entry is one of the most common causes of rejected invoices, and it can be reduced by training alone.

Have your team try issuance in the sandbox environment before production. This hands-on experience is more useful than any theoretical explanation, and it reveals the real questions your team will face in daily work. A team trained on a compliant system is the last line of defense that ensures your technical readiness translates into actual compliance on the ground.

A timeline for reaching full readiness

Readiness is not completed in a single day. Spread preparation across clear stages that begin well before the integration date. The following plan organizes the six items in a logical sequence that ensures each step is built on the one before it:

The preparation timeline

This plan is indicative, and the durations vary according to the size of your business and the complexity of your operations. Large businesses that issue thousands of invoices a day need more time for testing, while small businesses may finish preparation faster. What matters is that you start early and leave a sufficient margin for testing before actual activation.

Common mistakes that delay readiness

From the real experience of businesses in Phase Two, a set of mistakes recurs that could easily be avoided if planned for early:

• Waiting until the last minute: leaving preparation until after the notice arrives compresses the timeline and raises the likelihood of error.
• Choosing a non-compliant system: relying on software that does not generate the mandatory elements or does not integrate with the Fatoora platform.
• Neglecting to clean customer data: entering production with wrong tax numbers generates rejected invoices.
• Skipping the sandbox environment: moving straight to production without testing reveals problems on real invoices.
• Not training the team: system readiness alone is not enough if the accounting team does not know how to issue correctly.

Avoiding these mistakes does not require deep technical expertise. It only requires an early start and a compliant system that handles the technical side on your behalf. The sooner you close these gaps before the integration date, the more smoothly your activation goes.

How Qoyod helps you close the whole checklist

The largest part of the readiness items is technical by nature: generating the cryptographic stamp, the unique identifier, and the QR code, and real-time integration with the Fatoora platform. This is exactly what a compliant accounting system handles on your behalf. The Qoyod accounting software is designed to cover these items automatically with every invoice, without you needing to deal with the complex technical side.

With Qoyod you issue the tax invoice and the simplified invoice in their regulated format, linked directly to the Fatoora platform via integration with the Authority. The system also guides you through registering the cryptographic certificate and testing integration, so you reach activation day confident that every item on the checklist is closed. And to verify the tax calculations on your invoices, you can use the VAT calculator.

Try Qoyod free for 14 days, no credit card required.

After the checklist is complete

Once all six items are met, your business is ready for full compliance with Phase Two requirements. But readiness is not a final destination. Keep your data clean, follow any updates the Authority issues to the technical specification, and monitor the performance of your invoices in the first weeks after activation to make sure everything is going as expected.

Continuous compliance is much easier than one-time compliance. With a compliant system that handles the technical side, issuing a compliant invoice becomes a natural part of your daily work rather than an added burden. This is the ultimate goal of the readiness checklist: to turn e-invoicing from a challenge into a routine.

Keep a copy of this checklist and review it every quarter, especially if your business expands, enters new markets, or changes the nature of its customers. Readiness is not a certificate granted once and kept forever, but a state you maintain through follow-up. The more you keep your data clean and your system up to date, the more your business stays on the safe side of compliance without any noticeable extra effort.

Finally, remember that the value of e-invoicing does not stop at compliance. Structured, integrated invoices give you a clearer picture of your sales and taxes, make preparing your returns easier, and reduce manual errors. What begins as a regulatory mandate ends as a tool that gives you higher financial discipline. And that is exactly what makes completing the readiness checklist an investment in your business, not just a duty you perform for the Authority.

Frequently asked questions

The final readiness checklist

Read also in the Fundamentals hub

• beginner’s guide to e-invoicing
• the types of electronic invoices
• Phase One of e-invoicing
• Definition of the electronic invoice
• Qoyod’s e-invoicing software