Fatoora Platform (Fatoora): The Official E-Invoicing Portal

If you are preparing to adopt e-invoicing at your business, you will come across the name “Fatoora platform” (Fatoora) at almost every step. It is the official portal launched by the Zakat, Tax and Customs Authority (ZATCA) to manage e-invoicing in Saudi Arabia. Through it you connect your accounting system, register your devices, and exchange invoices with the Authority. This guide explains exactly what the platform is, its role in the tax system, how your business signs in and completes the integration steps, and the difference between the simulation and production environments.

What is the Fatoora platform (Fatoora)?

The Fatoora platform is the official electronic portal of theZakat, Tax and Customs Authority, dedicated to managing everything related to e-invoicing. The taxpayer reaches it through the Authority’s website using the same business account used for other tax services. The platform acts as the link between the business’s accounting system and the Authority’s central systems. It is the cornerstone of the e-invoicing system overseen by the Authority.

The important thing is to understand the difference between two things. The accounting system (such as Qoyod) is what actually issues the invoice, signs it, and generates the QR code. The Fatoora platform, meanwhile, is the portal through which this system registers and which receives electronic invoices to validate and approve them. In other words: your system creates the invoice, and the platform receives it and clears or records it.

The platform serves every taxpayer registered for value-added tax within the Kingdom, small and large alike. As the second-phase waves have expanded, dealing with it has become a mandatory step for every business that has entered the linking and integration scope.

Why did the Authority create the Fatoora platform?

Before e-invoicing, paper invoices or PDF files were hard to track and prone to tampering or loss. The Authority wanted a unified channel through which invoice data flows in a single digital format. The platform achieves this goal through three main roles:

• Registering the systems and devices that issue invoices at each business.
• Issuing the digital signature certificates that bind each device to the taxpayer’s identity.
• Receiving electronic invoices to validate them (clearing business invoices) or to record them (simplified invoices).

The role of the Fatoora platform in the e-invoicing system

To understand the platform’s role, we need to place it within the context of the two phases into which the Authority divided e-invoicing. Each phase has a different relationship with the platform.

Phase One: Generation and Storage

Phase One became mandatory on 4 December 2021. During it, the taxpayer is required to issue invoices through a compliant electronic system and store them in a structured digital format. There is no direct connection to the platform in this phase. Invoices are created and stored in the business’s system, and the goal was to build electronic issuance capability. For more details, see the guide to Phase One of the e-invoice.

Phase Two: Linking and Integration

This is where the platform’s real role begins. Phase Two launched on 1 January 2023 in waves based on the taxpayer’s revenue size. In this phase, the business’s system must connect to the platform, and every invoice must pass through it before or after being sent to the customer. Phase Two adds new technical requirements to every invoice:

• The cryptographic stamp (electronic signature using a certificate from the Authority).
• The unique invoice identifier (UUID).
• A hash value of the previous invoice to ensure a sound sequence.
• The QR code that carries the invoice data and the signature.

For the full timeline and waves, see the phases and deadlines for e-invoice implementation.

Clearance versus reporting: how the platform handles each invoice type

The platform handles the two invoice types in two different ways, and this is a fundamental point to understand:

• Business invoice (B2B): A tax invoice addressed to another business. It must be sent to the platform for immediate clearance before being delivered to the customer. The invoice is not considered valid before it is cleared.
• Simplified invoice (B2C): An invoice addressed to the final consumer. It is delivered to the customer directly at the point of sale, then sent to the platform for reporting within 24 hours.

This difference between immediate clearance and later reporting is the essence of your business’s relationship with the platform. For a deeper understanding of the types, see the definitions of the simplified invoice and thetax invoice.

How does your business sign in to the Fatoora platform?

Accessing the platform does not require a separate new registration. Your business uses its existing account with the Authority. The general steps are as follows:

1. Make sure your business is registered for value-added tax and has an active account with the Authority.
2. Sign in to the Authority’s official website, then go to the e-invoicing services section.
3. Open the Fatoora platform from within the portal. There you will find a dashboard for managing devices, certificates, and received invoices.
4. Register the accounting system or point-of-sale device from which you will issue invoices. Each issuing unit is registered independently.

If you are not sure whether your business is among those obligated, first review the guide to who is required to use the e-invoice first.

Essential prerequisites before signing in

Before you begin, make sure these requirements are in place so you do not stall midway through the steps:

• A valid value-added tax registration.
• Up-to-date business details with the Authority (name, tax number, national address).
• An accounting or point-of-sale system compliant with Phase Two requirements and capable of digital signing.
• Access permissions for the employee who will manage the platform within the business account.

Registration and linking within the platform, step by step

The onboarding process is the heart of dealing with the platform. Its purpose is to link your accounting system to the Authority’s systems so it can sign invoices and send them. The process goes through the following steps:

1. Generate the signing request: Your accounting system creates a signing request (CSR) carrying the issuing unit’s details.
2. Obtain the activation code: The platform issues a one-time activation code (OTP) for each issuing unit you want to link.
3. Issue the certificate: After entering the code, the Authority issues the Cryptographic Stamp Identifier (CSID), the certificate used to sign invoices thereafter.
4. Test in the simulation environment: Trial invoices are sent to confirm their compliance before moving to production.
5. Move to production: After the test succeeds, you begin sending real invoices for clearance or reporting.

The CSID is the cornerstone of security. It binds each invoice to your business’s identity and issuing unit, and prevents tampering because any change to the invoice invalidates its signature. A good accounting system’s job is to manage this identifier on your behalf without you having to intervene manually in its technical details.

Simulation environment versus production environment

The platform provides two separate environments, and understanding the difference between them spares you costly mistakes:

• Simulation environment (Simulation): A safe testing environment. In it you send trial invoices to confirm that your system generates the fields, signature, and QR code correctly. The invoices here have no system or tax impact.
• Production environment (Production): The real environment. Invoices sent to it are actual invoices with full tax impact, and they are officially cleared or recorded with the Authority.

The rule is simple: do not move to production before your invoices succeed in simulation. The common mistake is skipping the test and then discovering a defect in the signature or fields on real invoices. Testing first spares you from having to correct cleared invoices later.

When to use each environment?

You use the simulation environment when linking a new issuing unit, when updating your accounting system, or when changing the way invoices are formatted. You use the production environment in normal daily operation after linking has been completed successfully. A compliant accounting system lets you switch between the two environments clearly so you do not mix them up.

Common mistakes when dealing with the platform and how to avoid them

From businesses’ real experience, some mistakes recur that delay linking or invalidate invoices:

• Out-of-date business details: A mismatch in the tax number or address between your system and the Authority halts clearance. Update your details first.
• Ignoring the simulation environment: Moving straight to production without testing exposes faults on real invoices.
• Registering only one issuing unit: If you have several branches or sales devices, each unit must be registered separately.
• Mixing up the two invoice types: Sending a business invoice as if it were simplified (or vice versa) breaches the clearance and reporting requirements.

To verify your business’s full readiness before you begin, see the e-invoicing readiness checklist.

The platform portal’s functions in detail

When you sign in to the Fatoora platform, you find a dashboard that brings together several functions serving the full invoicing lifecycle. Understanding these functions helps you use the portal efficiently instead of stopping at the initial linking steps. The most notable features the dashboard offers:

• Managing issuing units: It displays all the devices and systems linked to your business, and lets you add a new unit or deactivate one no longer in use.
• Managing certificates: It tracks the status of the CSID for each unit, its validity date, and the ability to renew it when needed.
• Log of received invoices: It shows the invoices that reached the Authority and the status of each (accepted, or rejected with the reason for rejection).
• Activation codes: Generating an activation code for each new issuing unit as part of the linking step.

The rejected-invoices log is especially important. When an invoice is rejected, the platform states the reason for rejection (missing field, invalid signature, mismatched data), so you fix the problem in your accounting system and resend. A compliant system reduces rejection cases to a minimum because it builds the invoice according to the specification from the start.

Managing multiple branches and devices

Many businesses do not operate from a single location. A restaurant with several branches, a retail store with several points of sale, or a company with several outlets all need careful organization within the platform. The rule is that each independent issuing unit is registered separately and gets its own identifier.

This means that a branch in Riyadh and a branch in Jeddah have two separate issuing units, even if they belong to the same business. The benefit is that any fault in one branch does not halt the rest of the branches, and the invoice log stays clear and attributed to each unit. A cloud accounting system greatly simplifies this because it manages the multiple units from a single dashboard without you moving between devices manually.

How does invoice data flow through the platform?

To understand the platform’s security, it helps to trace the journey of a single invoice from the moment it is created until it is cleared. The journey passes through the following stages:

1. The accounting system creates the invoice in a structured digital format containing all the mandatory fields.
2. The system signs the invoice digitally using the CSID belonging to the issuing unit.
3. The QR code is generated, carrying the invoice data and the signature in compressed form.
4. The invoice is sent to the platform, which validates the signature and the completeness of the fields.
5. The invoice is cleared (for business invoices) or reported (for simplified invoices), and the hash value is stored to link it to the next invoice in a connected chain.

The hash chain is what makes tampering nearly impossible. Each invoice carries the fingerprint of the previous invoice, so if someone tried to delete or alter an invoice, the chain would break and the flaw would appear immediately. This structure gives the Authority and the business a trustworthy record that is hard to tamper with.

The role of the QR code

The QR code on every invoice is not a cosmetic element. It carries a signed summary of the invoice data: the seller’s name, the tax number, the date, the total, and the tax amount. The customer or an auditor can scan it to verify the invoice’s validity without referring back to the system. In simplified invoices specifically, the code is the primary means of verification because the customer receives the invoice before it is recorded with the Authority.

The platform versus manual compliance: why you need a compliant system

A small-business owner might wonder: can I deal with the platform manually without a specialized accounting system? In theory, the portal receives invoices, but preparing a compliant invoice manually is extremely difficult. In Phase Two, the invoice requires a digital signature in a specific format, a unique identifier, a hash value, and a QR code built to a precise specification. Generating these elements accurately for every invoice manually is impractical.

This is where the value of a compliant system becomes clear. It builds the invoice according to the specification, signs it, and sends it to the platform in the background without you feeling the technical complexity. The gap in effort between the two approaches is large, and it grows with the volume of daily invoices. For large businesses that issue hundreds of invoices, automation is not a luxury but an operational necessity.

Businesses’ needs also differ by size. Mid-sized companies face the challenge of managing a large volume of invoices across several issuing units, which we cover in the guide to e-invoicing in Saudi Arabia: the regulatory framework and phases.

The platform’s impact on your business’s daily operations

Linking to the platform is not just a regulatory requirement you complete once. It changes the way the accounting and sales departments work every day. After linking, every sales invoice becomes part of a digital flow connected to the Authority, and this carries positive effects:

• Higher accuracy: The mandatory fields are filled automatically, so manual entry errors decrease.
• Easier tax return: The data from cleared invoices feeds the return summary directly.
• A trustworthy record: The hash chain gives you an archive that is hard to tamper with during any later audit.
• Transparency with customers: The QR code lets the customer verify their invoice themselves.

In return, it requires discipline in updating data and following up on the rejected-invoices log. A business that does not follow up on rejections may accumulate uncleared invoices, which creates a gap between its records and the Authority’s records. A good system alerts you to a rejection the moment it happens so you can address it quickly.

How does Qoyod help you deal with the Fatoora platform?

The Fatoora platform is the Authority’s portal, but you need a compliant accounting system that connects you to it and handles the technical side on your behalf. This is where the role of Qoyod’s e-invoicing softwarecomes in, compliant with Phase Two of e-invoicing. Qoyod offers your business the following:

• Signing and stamping each invoice and generating the unique identifier and QR code according to the Authority’s requirements.
• Managing the Cryptographic Stamp Identifier (CSID) automatically without manual intervention in its technical details.
• Immediate clearance for business invoices (B2B) and reporting within 24 hours for simplified invoices (B2C).
• Storing the chain of invoice hash values to verify the integrity of the sequence.
• Calculating value-added tax automatically on every transaction and preparing the tax return summary.
• Technical support available 24 hours a day, seven days a week, to help you through the linking steps.

An important note for the record: Qoyod guides you through the steps of registering the CSID with the Authority, but registering the business on the platform remains an action you perform from your account with the Authority. Likewise, Qoyod generates the tax return data, while filing and paying the return through the Authority’s portal remains your responsibility.

Meeting the deadline: what happens after you enter your linking wave?

Each business is notified of the date it enters the linking and integration wave through an official notice from the Authority. After this date, linking to the platform becomes mandatory, and all your invoices begin passing through it. It is worthwhile to start preparing early instead of waiting until the last moment, because linking and simulation testing take time.

The recommended practical order: update your business details, choose a compliant accounting system, link the issuing units, test in the simulation environment, then move to production well before the deadline arrives. This sequence gives you room to address any fault without pressure. Those who started preparing early avoided the last-minute crowding, especially since system support is in higher demand near the deadlines.

If you are at the start of the road and have not dealt with e-invoicing before, it is best to begin with the beginner’s guide to the e-invoice which takes you step by step, or with the guide to what is an e-invoice? to understand the basics before entering the platform.

Benefits of completing the linking correctly

Correct linking to the platform achieves not only regulatory compliance but also real operational gains for the business:

• Reducing human errors in preparing invoices and calculating tax.
• Speeding up tax-return preparation based on pre-cleared data.
• An organized digital archive that is easy to refer back to during any audit.
• A professional image before customers who receive signed and authenticated invoices.
• Readiness for any future expansion in business volume without rebuilding the process.

These benefits apply to small businesses as much as to large ones. The difference is that a small business feels the impact in simplifying its daily work, while a large business feels the impact in managing volume across multiple branches. Whatever your size, dealing correctly with the platform turns a regulatory obligation into an operational advantage.

Is the platform sufficient on its own for compliance?

The platform is part of a broader compliance system. It is the channel through which you exchange invoices with the Authority, but full compliance also requires a valid value-added tax registration, issuing invoices according to the specification, and filing the return and paying the tax on time. The platform covers the invoice-exchange side, while the rest of the obligations remain the business’s responsibility through the Authority’s other portals. This is why a compliant accounting system is seen as the bridge that connects these obligations in a single organized flow.

Frequently asked questions about the Fatoora platform

Is the Fatoora platform the same as the accounting software?

No. The Fatoora platform is the Authority’s portal that receives invoices and clears or records them. The accounting software, meanwhile, is the system that creates the invoice, signs it, and sends it to the platform. The two work together, but each has a different role.

Do I need a special registration to sign in to the platform?

You sign in to the platform with your business’s same existing account with the Authority. There is no need to create a separate new account, but your business must be registered for value-added tax and have up-to-date details.

What is the difference between clearing an invoice and reporting it?

A business invoice (B2B) is sent to the platform for immediate clearance before being delivered to the customer. A simplified invoice (B2C), meanwhile, is delivered to the customer directly and then sent for reporting within 24 hours. Clearance precedes delivery, and reporting follows it.

Why should I test my invoices in the simulation environment first?

The simulation environment lets you send trial invoices with no tax impact to confirm the soundness of the signature, the fields, and the QR code. Testing first spares you from discovering faults on real, cleared invoices.

What is the CSID and why is it important?

The CSID is the stamp certificate the Authority issues at linking, and with it your invoices are signed. It binds each invoice to your business’s identity and issuing unit, and prevents tampering because any change invalidates the signature. A compliant accounting system manages it automatically.

Does Qoyod file the tax return on my behalf through the platform?

Qoyod prepares the tax return data and calculates the tax automatically, but filing the return and paying the tax are done through the Authority’s portal from your account. This is the business’s responsibility and not a service Qoyod performs on your behalf.