E-Invoicing in Saudi Arabia: The Regulatory Framework and Phases

Saudi Arabia launched the e-invoicing project to strengthen financial transparency and combat tax evasion, under the supervision of the Zakat, Tax and Customs Authority (ZATCA). In this guide we explain the full regulatory framework, the phases, the technical requirements, who falls under the system, and what that means in practice for your business at every step. To begin, learn about what an electronic invoice is.

What is an electronic invoice in the Saudi system?

An electronic invoice is an invoice generated and stored in a structured digital format through a compliant accounting system, not on paper or as a manually edited file. It carries the same data as a paper invoice: the seller’s name, tax number, issue date, line items, tax amount, and total. But it is created within a unified data structure that systems read automatically.

The essential difference is that a scanned image of a paper invoice is not an electronic invoice, and neither is a PDF file edited in a word processor. The system requires that the invoice be created in a compliant technical solution, and that it be stored in XML format or in PDF/A-3 format containing an embedded XML file. This requirement is what distinguishes e-invoicing from merely digitizing documents.

The project has a three-fold aim: raising transparency in commercial transactions, reducing tax evasion and the shadow economy, and making it easier for businesses to comply with value-added tax. When invoice data reaches the Authority in a unified format, verifying its accuracy becomes faster and more precise.

Why did Saudi Arabia move to e-invoicing?

Paper invoices left many gaps in the tax system. They could be altered, issued in two copies, or hidden from audit. These loopholes weaken value-added tax collection and open the door to unfair competition between a compliant business and an evading one.

E-invoicing comes as part of the Kingdom’s digital-transformation efforts and its support for a transparent economy under Vision 2030. When every invoice is created in a compliant system, linked to the one before it, and cryptographically signed, tampering with it becomes costly and hard to conceal. The business itself also benefits: manual-entry errors decrease, records are kept organized, and preparing the tax return becomes faster and less exposed to penalties.

On a broader level, unified data gives the Authority a more accurate picture of economic activity, improving the quality of statistics and the efficiency of audits. The result is a system that rewards compliance and tightens the net on evasion — which ultimately serves compliant businesses.

The regulator: Zakat, Tax and Customs Authority

The Authority is responsible for regulating e-invoicing in Saudi Arabia, and it operates the «Fatoora» platform to which taxpayers’ systems are linked in Phase 2. The Authority sets the compliance requirements and the dates for each group of taxpayers.

The «Fatoora» platform is the official Arabic name of the Fatoora platform. It is the technical gateway that receives invoices from businesses’ systems and clears them in the case of tax invoices, or receives a report of them in the case of simplified invoices. The Authority also issues the guidelines and technical specifications that solution providers must follow, and publishes the wave dates progressively through its website and through direct notifications to taxpayers.

E-invoicing is based on the E-Invoicing Regulation and the regulatory decisions issued by the Authority, which set out the obligations, technical requirements, and timeline. This regulation is the primary regulatory reference, and everything relating to formats, mandatory fields, and the linking mechanism is built upon it.

The regulation is complemented by the decisions on controls and technical requirements, which the Authority publishes and updates as needed. These decisions cover the details of the XML format, the mandatory fields for each invoice type, the specifications of the cryptographic stamp and QR code, and the clearance and reporting mechanism. The Authority also certifies solution providers and qualifies their systems, so choosing a certified system guarantees ready-made compliance without the burden of building the integration yourself. The business’s role remains limited to choosing the right system and carrying out the linking step, while the Authority handles the deeper regulatory and technical side.

The two implementation phases

The project is applied in two consecutive phases: Phase 1 (Generation) which began on December 4, 2021 and required those in scope to generate and store invoices electronically; then Phase 2 (Linking and integration) which began on January 1, 2023 in waves according to annual taxable revenue. Each phase has its own logic and requirements, which we explain in detail below.

Phase 1: Generation

Phase 1 became mandatory on December 4, 2021, and covered all businesses registered for value-added tax. Its aim was to build businesses’ capacity to generate invoices electronically and stop using manual and paper invoices.

In this phase, the invoice is generated in a compliant accounting system and stored in a digital format, without a direct link to the Authority. That is, the invoice stays in the business’s system and is not sent in real time to the «Fatoora» platform. The core requirements included: generating the invoice in a structured format, including the mandatory fields, and adding a QR code for simplified invoices directed at consumers. Phase 1 also prohibited certain non-compliant functions, such as editing an invoice after it is issued or issuing it from a system that allows tampering.

Phase 2: Linking and integration

Phase 2 began on January 1, 2023 in successive waves that the Authority ordered by the size of annual taxable revenue. The first wave covered businesses whose annual revenue exceeded three billion Saudi riyals, then subsequent waves were announced in turn for smaller revenue brackets, with a preparation period before the linking date for each wave.

The essential difference in Phase 2 is the direct link with the «Fatoora» platform. It is no longer enough to generate and store the invoice; the accounting system must integrate with the platform, and every invoice must pass through it. This phase added new technical requirements that we detail later: the cryptographic stamp, the invoice’s unique identifier, linking each invoice to the one before it through a data chain, and a QR code carrying the signature data.

Note that the linking date for each business is set by an official notification from the Authority, and must not be assumed. Always check your business’s notification and do not rely on estimating the wave from activity size alone.

Who falls under the system?

E-invoicing applies to every business registered for value-added tax in Saudi Arabia, in addition to third parties that issue tax invoices on behalf of a taxable supplier. The system is not limited to large companies; as soon as your business is registered for tax, it falls within the scope of Phase 1 in terms of generating invoices electronically.

As for linking in Phase 2, it is applied gradually. The Phase 2 groups (waves) are announced in turn according to annual taxable revenue, and each taxpayer is notified of its linking date through an official notification. This means your business may have been compliant with Phase 1 for years, while its linking in Phase 2 awaits a later wave.

Always check the Authority’s notification specific to your business to know your linking date precisely, and use areadiness checklist to assess your technical and regulatory preparedness before the set date. Failing to comply with the dates and requirements exposes the business topenalties and violations.

Those not subject to the system, by contrast, are businesses not registered for value-added tax because they are below the mandatory registration threshold of SAR 375,000 of annual taxable revenue. Even so, it remains wise for any business close to this threshold to adopt a compliant accounting system early, to avoid a late transition once it reaches the registration threshold.

Types of invoices in the Saudi system

The system distinguishes between the tax invoice and the simplified tax invoice according to the type of customer, and each has its own procedure in Phase 2. Understanding this classification is essential for correct compliance, because confusing the two leads to errors in the sending and clearance mechanism.

The tax invoice (B2B)

The tax invoice is issued in transactions between businesses (from one business to another). In Phase 2, this invoice is subject to prior clearance: it must pass through the «Fatoora» platform and be cleared by it before being delivered to the buyer. That is, the invoice is not legally complete until the platform clears it in real time. The tax invoice carries the tax number of both the seller and the buyer, along with the breakdown of line items and tax.

The simplified tax invoice (B2C)

The simplified invoice is issued in transactions between the business and the final consumer. Here the mechanism differs: the invoice is created and delivered to the customer directly, then reported to the Authority within 24 hours of its issuance. There is no prior clearance in this case, so as not to disrupt the flow of sales at points of sale and stores. The simplified invoice includes a mandatory QR code carrying the invoice and signature data.

These types are complemented by the notes associated with them: the credit note and the debit note, which undergo the same processing (clearance or reporting) according to the type of the original invoice they are linked to. The credit note is used to reduce the value of a previous invoice (such as a return or discount), and the debit note is used to increase it. Linking the note to its original invoice is a condition of compliance, and the compliant accounting system handles it automatically.

The simple practical rule: look at your customer. If it is a business registered for tax that requests an invoice in its name and tax number, then you are issuing a tax invoice that goes through clearance. If it is a final consumer buying for personal use, then you are issuing a simplified invoice that is delivered immediately and reported. Choosing the right type protects you from customers rejecting invoices and from audit remarks.

The difference between electronic and paper invoices

Many people confuse digitizing an invoice with regulatory e-invoicing. The difference is fundamental and determines the extent of your compliance.

• Format: The electronic invoice is created in a structured data format (XML) that systems read, not merely an image or a text file.
• Creation: It is issued from a compliant accounting system, not from a word processor or a spreadsheet.
• Verification: It carries a cryptographic stamp and a QR code that allow its validity to be confirmed, unlike the paper invoice, which is hard to verify.
• Linking: In Phase 2 it passes through the «Fatoora» platform for clearance or reporting, whereas the paper invoice does not reach the Authority except at audit time.
• Storage: It is archived electronically within an interlinked chain that is hard to tamper with.

The conclusion is that printing an invoice from an old system, or exporting a simple PDF, does not make it an electronic invoice in the regulatory sense. What matters is the structured format, the signature, and the linking — and only compliant systems provide these.

The technical requirements of Phase 2

Phase 2 added a set of fields and technical mechanisms that ensure the invoice’s integrity and prevent it from being tampered with. These requirements are managed automatically by the compliant accounting system, but it is useful for the business owner and the accountant to understand their role.

• The cryptographic stamp: a digital signature added to the invoice using a certificate issued by the Authority, which proves that the invoice was issued from a certified system and has not been altered after issuance.
• The unique identifier (UUID): a unique, non-repeating identification number for each invoice, distinguishing it from any other invoice in the system.
• The Hash: a digital fingerprint that links each invoice to the one before it, forming a continuous chain that is hard to tamper with or to delete an invoice from the middle of.
• The QR code: a code carrying the invoice and signature data, allowing its validity to be verified by scanning it.
• The data format: the invoice is created in structured XML format according to the Authority’s technical specification, or in PDF/A-3 format containing an XML file.

For the system to be able to sign invoices, the taxpayer needs to register the Cryptographic Stamp Identifier (CSID) with the Authority. This is a one-time step the taxpayer carries out at linking, and the accounting-solution provider guides them through it. After the certificate is issued, the system uses it to sign every invoice automatically without manual intervention.

What matters is realizing that these technical details do not require any programming expertise from you. Your task is to choose a compliant accounting system that handles creating the XML, signing, and linking on your behalf, then carry out the one-time certificate-registration step.

The compliance journey step by step

Moving to e-invoicing is not so much a complex technical decision as it is a series of organized steps. Here is the practical path a business takes from scratch to issuing compliant invoices.

1. Make sure you are registered for value-added tax: this is the very condition for falling under the system. If you are not registered and have exceeded the mandatory registration threshold, register first.
2. Know your wave date: check the Authority’s notification to learn your linking date in Phase 2, and do not assume the date.
3. Choose a compliant accounting system: look for a solution that meets the Authority’s technical specification and integrates with the «Fatoora» platform.
4. Register the cryptographic stamp certificate (CSID): carry out the one-time first linking step with guidance from the solution provider.
5. Test invoice issuance: issue trial invoices and make sure they are cleared or reported successfully.
6. Move to live operation: begin issuing your daily invoices through the compliant system, and store your records electronically.

Many businesses postpone these steps until the linking date approaches, then find themselves under time pressure. It is better to start preparing early, because choosing and testing the system takes time, and any late linking puts your daily operations at risk of a halt.

E-invoicing and value-added tax

E-invoicing is closely tied tovalue-added tax, as the invoice is the document on which the tax is calculated and by which it is documented. Value-added tax in Saudi Arabia is 15% as of July 1, 2020, and is applied to most goods and services. When you issue a compliant invoice, the tax amount is recorded accurately, making it easier for you to prepare the tax return later.

A registered business is required to issue the simplified tax invoice or the full tax invoice depending on the customer, and to clearly include the tax number and tax amount. E-invoicing makes this data organized and auditable, reducing the manual-calculation errors that used to cost businesses penalties.

The system also regulates the handling of zero-rated and exempt supplies. The compliant accounting system distinguishes between them automatically, so the correct classification of each item appears on the invoice and in the tax reports. This distinction is important when preparing the return summary, which separates output tax from input tax to arrive at the net amount due.

Remember that the mandatory registration threshold for value-added tax is SAR 375,000 of annual taxable revenue, while voluntary registration starts from SAR 187,500. The return frequency is quarterly for most businesses, and monthly for those whose revenue exceeds SAR 40 million per year. When your invoices are electronic and organized from the start, these figures flow into the return smoothly without tedious manual collation.

The benefits of e-invoicing for your business

Compliance is not the only benefit. A business reaps tangible operational gains when it moves to a compliant system:

• Higher accuracy: calculating tax automatically reduces the manual-entry errors that cost penalties.
• Less time: preparing the tax return becomes faster because the data is organized and ready.
• Reliable archiving: an interlinked invoice record that is easy to refer back to at audit or review.
• Commercial trust: compliant invoices are accepted by your business customers without disruption.
• Financial visibility: linking invoices to accounting gives you real-time reports on your sales and tax.

Penalties and non-compliance

Failing to comply with e-invoicing exposes the business to violations and penalties set by the Authority. Common violations include: not issuing invoices electronically, not linking after the wave date has arrived, issuing invoices missing mandatory fields, deleting and editing invoices in a non-compliant way, or not keeping records electronically.

Processing usually escalates from a warning to a financial penalty according to the type of violation and its recurrence. The details penalties and violations are published and updated by the Authority, so refer to the official source for the up-to-date values. The practical takeaway is that early compliance with a compliant system is far cheaper than bearing penalties later.

Most importantly, non-compliance is not measured by the penalty alone. Non-compliant invoices may be rejected by your business customers, may complicate your tax audit, and weaken your business’s commercial reputation. Compliance here is not merely a regulatory burden, but an element of trust in your dealings.

How Qoyod helps you comply

Qoyod is a cloud accounting system compliant with the requirements of the Zakat, Tax and Customs Authority in both e-invoicing phases. The system handles creating the invoice in the required structured format, adds the mandatory fields, signs it cryptographically, and links it to the «Fatoora» platform for clearance or reporting according to its type.

In practice, Qoyod does the following on your behalf:

• Creating compliant tax and simplified invoices, in XML format and with a QR code.
• Adding the cryptographic stamp, the unique identifier (UUID), and the Hash chain to each invoice automatically.
• Managing the cryptographic stamp certificate (CSID) after registering it, and using it to sign invoices without manual intervention.
• Real-time clearance of tax invoices (B2B) with the «Fatoora» platform, and reporting within 24 hours for simplified invoices (B2C).
• Calculating value-added tax on every transaction, and preparing the tax-return summary.
• Keeping the invoice record and the Hash chain to verify compliance when needed.

In return, some tasks remain the business’s responsibility: registering the cryptographic stamp certificate with the Authority once (Qoyod guides you to it), and filing the tax return and paying the tax through the Authority’s portal. Qoyod prepares the accurate data for you, but filing and payment are done from your account with the Authority. Learn more about Qoyod’s compliance with Phase 2 and about linking Qoyod with the Authority, or browse the e-invoicing software andintegrated accounting system.

Try Qoyod free for 14 days, no credit card required.

Frequently asked questions

Read also in the Fundamentals hub

• What is an electronic invoice?
• Phase 1
• Types of electronic invoices
• readiness checklist
• Definition of the Zakat, Tax and Customs Authority