Reporting in E-Invoicing

“Reporting” is the path a simplified tax invoice (B2C) takes in the second phase of e-invoicing. The invoice is issued and handed to the buyer instantly, then a copy is sent to the Fatoora platform within 24 hours. This guide explains the reporting mechanism from the ground up: what sets it apart from Clearance, how the technical flow works step by step, what the binding deadlines are, what the consequences of delay are, and how Qoyod’s e-invoicing software handles this entire cycle on your behalf.

This guide addresses business owners and their accountants who issue invoices to the end consumer: restaurants, retail stores, pharmacies, fuel stations, clinics, and every activity that sells directly to individuals. If your business sells to companies with full tax invoices, the path is different, and we have dedicated a separate Clearance guide to it.

What is reporting in e-invoicing?

Reporting is the model your business uses to deal with the Zakat, Tax and Customs Authority (ZATCA) in the second phase of e-invoicing. This model applies to the simplified tax invoice, the invoice you issue to the end consumer in individual (B2C) transactions.

The core idea is simple. The invoice is issued from your accounting system and handed to the customer at the moment of sale. You do not wait for prior approval from the Authority. After issuance, your system sends a copy of the invoice to the Fatoora platform within a window not exceeding 24 hours. This subsequent transmission is what we call “reporting.”

The logic behind this model is practical. A retail business issues hundreds or thousands of invoices to individuals every day. If every invoice had to wait for instant approval from the Authority, checkout lines would stall and points of sale would grind to a halt. That is why the Authority allowed instant issuance with deferred reporting within a 24-hour window, preserving the speed of sale while ensuring the data still reaches it.

The validity of a reported invoice rests on fixed technical elements: the cryptographic stamp, the invoice’s unique identifier (UUID), the hash value linked to the previous invoice, and the QR code. All of these elements are generated automatically by your system at issuance, long before the moment of reporting.

The difference between reporting and clearance in two practical lines

Many business owners confuse the two models, but the difference is settled by the invoice type and the timing of dealing with the Authority.

In Clearance, the full tax invoice directed at businesses (B2B) is sent to the Fatoora platform before it is delivered to the buyer. The platform verifies the invoice and approves it in real time, and the invoice is not valid until it comes back with an approval stamp. In reporting, by contrast, the simplified invoice is issued and delivered first, then sent to the platform later within 24 hours.

In short: clearance is instant prior approval on a business invoice, and reporting is subsequent notification within a day on an individual’s invoice. In this guide we wanted to focus entirely on reporting. To dive deeper into the other path, see the dedicated Clearance guide, and for the full picture of the second-phase requirements, see the requirements of the second phase of e-invoicing.

It helps you cement the difference to know the invoice types themselves. We detailed this in the guide types of electronic invoices in Saudi Arabia, where it becomes clear when you issue a simplified invoice subject to reporting and when you issue a full tax invoice subject to clearance.

When does your business use the reporting model?

Your business uses reporting when you issue a simplified tax invoice. The simplified invoice is the default in end-consumer transactions. Here are the clearest cases:

• A direct sale to an individual at a point of sale, such as a meal at a restaurant or an item at a retail store.
• A service provided to an end consumer who does not request an invoice in the name of their business.
• The invoice value is below the threshold that requires a full tax invoice, and the buyer does not need to deduct input tax.
• High-volume retail activities that issue invoices in rapid succession throughout the day.

The practical rule: if the buyer is an individual purchasing for personal consumption, you most likely issue a simplified invoice subject to reporting. If the buyer is a business registered for VAT that needs to deduct input tax, you most likely issue a full invoice subject to clearance.

To determine the correct moment to issue the invoice in the first place, the guide when must the electronic invoice be issued? is useful, as it links the timing of issuance to delivery and reporting.

Why did the Authority choose the reporting model for individuals’ invoices?

The Authority’s choice of two separate models, reporting for individuals and clearance for businesses, was not arbitrary. Behind it lies a careful balance between two goals that may appear contradictory: tightening tax oversight on one hand, and preserving the smoothness of daily transactions on the other.

In business transactions, the number of invoices is relatively limited and their value is high, and each invoice may be used to deduct input tax. They therefore warrant instant prior verification, which is what clearance provides. In individual transactions, the volume is enormous and the individual value is low, and most are not used for tax deduction. Imposing instant verification here would have paralyzed the movement of sales with no meaningful oversight benefit.

That is why the reporting model came as a smart middle ground. The Authority receives the data of every simplified invoice within one day, so its revenue record is complete, while the point of sale keeps operating at its usual speed. The result is a comprehensive oversight system that does not disrupt the daily economy.

This also explains why the Authority requires the interlinked chain of hash values. Since verification is not instant, the Authority needs a means to detect any invoice deleted or unreported after the fact. The interlinked chain makes any gap visible upon review, compensating for the absence of instant verification. For the broader regulatory context, see the guide the Zakat, Tax and Customs Authority and the electronic invoice.

The technical reporting flow step by step

Reporting goes through a series of steps handled by your accounting system behind the scenes. We explain them here so you understand what happens, not so you carry them out manually, because a compliant system performs them automatically.

1. Creating the invoice in a structured format

Your system creates the simplified invoice in a structured digital format in line with second-phase specifications. The invoice contains the seller’s data, their tax registration number, the timestamp, the invoice line items, the VAT amount, and the total. This data is not written manually; the system generates it directly from the sales transaction.

2. Generating the cryptographic elements

The system adds the elements that guarantee the invoice’s integrity and its attribution to your business. The most prominent are the cryptographic stamp built on your business’s CSID certificate, the invoice’s unique identifier (UUID), and the hash value linked to the previous invoice to form an interlinked chain that is hard to tamper with. This chain shows that each invoice follows its predecessor without gaps.

The cryptographic stamp is not a minor detail; it is what proves the invoice was actually issued from your approved system. The stamp relies on the technical compliance certificate that links your device to the Authority. We explained this certificate in the guide CSID certificate: the cryptographic stamp identifier, and how to issue it for production in the guide Compliance CSID certificate.

3. Generating the QR code

The simplified invoice carries a QR code that includes the invoice’s essential data and the stamp. This code allows any party, including the buyer, to verify the invoice’s validity through the Authority’s app. The presence of a valid QR code is a basic condition for accepting the simplified invoice.

4. Issuance and instant delivery

Once the previous elements are complete, the invoice is issued and delivered to the customer instantly, on paper or electronically. There is no waiting stage here. The customer completes their payment and leaves, and the invoice remains valid the moment it is issued.

5. Reporting to the Fatoora platform

The final step is sending the invoice copy to the Fatoora platform. The system collects the issued invoices and reports them within a 24-hour window from the moment of issuance. The platform receives the invoice and records it, and the reporting log is saved within your invoice chain. This transmission is what completes the compliance cycle.

To understand the gateway that receives these invoices, see the guide the Fatoora system: the official gateway for e-invoicing, and for the broader picture of how integration with the Authority works, see integration with the Zakat, Tax and Customs Authority.

Components of the simplified invoice subject to reporting

Before an invoice is reported, its elements must be complete. Any shortfall in these elements means an invoice rejected upon reporting, even if it was delivered to the customer. That is why it matters to you to know what the simplified invoice must carry:

• The seller’s name and tax registration number: your business’s identity before the Authority.
• The timestamp: the precise date and time of issuance, from which the reporting window is calculated.
• The invoice line items and their values: a description of the goods or services and their prices before tax.
• The VAT amount: calculated at a rate of 15% on the taxable items.
• The total including tax: the final amount the customer pays.
• The QR code: it includes the invoice data and the stamp to enable verification.
• The cryptographic stamp, the unique identifier, and the hash value: the elements that prove the invoice’s integrity and its attribution to your system.

The difference between the simplified invoice and the full invoice is not limited to the path of dealing with the Authority; it extends to the data itself. The full invoice requires complete buyer data because it is directed at a business that needs to deduct input tax. The simplified invoice, by contrast, does not require this, because the buyer is an end consumer. This simplification is what allows fast issuance at points of sale.

A compliant system generates all these elements without any intervention from you. Your job is limited to entering the sales transaction, and the rest is built automatically in line with second-phase specifications. If you want a deeper understanding of the differences between invoice types and their data, the guide types of electronic invoices details them clearly.

The reporting deadline: the 24-hour rule

The time rule governing reporting is clear: your business must send the simplified invoice to the Fatoora platform within 24 hours of the moment of its issuance. This window is the fundamental difference between reporting and clearance. Clearance is instant and tolerates no delay, while reporting gives you a full day.

The window begins from the moment the invoice is issued and delivered to the customer, not from the end of the day. The reporting due moment therefore varies from one invoice to another. An invoice issued at ten in the morning must be reported before ten the following morning.

In practice, you do not need to monitor this window yourself. A compliant system reports invoices automatically in the background, usually as soon as an internet connection is available. This is how you stay within the deadline without manual intervention.

The importance of this rule lies in the fact that it allows retail businesses to keep selling even during a temporary internet outage. Invoices are issued locally and delivered, then reported all at once when the connection returns, as long as that is within the 24-hour window.

Here another fundamental difference from clearance appears. In clearance, a connection outage halts the issuance of the full invoice, because approval is instant and the invoice is not complete without it. In reporting, by contrast, a connection outage does not halt the sale, because the invoice is issued locally and awaits reporting. This flexibility is intentional, and it is what makes the reporting model suitable for retail environments that cannot tolerate the cashier stopping.

But flexibility does not mean leniency. The 24-hour window is a maximum limit, not a target. The faster your system reports, the lower the risk of unreported invoices piling up and the narrower the margin for error. That is why good compliant systems report as soon as a connection is available, not at the last moment of the window.

Reporting and the VAT return

Reporting is not an operation isolated from the rest of your tax obligations. The simplified invoices you report represent part of your VAT-taxable sales, and they must be reflected accurately in your periodic return.

As you report your invoices in succession, organized sales data accumulates, ready for the return. At the end of the tax period, whether monthly or quarterly, the output tax amount is known precisely from the sum of your reported invoices. This match reduces the risk of discrepancies that raise questions from the Authority.

The risk appears when reported invoices become detached from recorded sales. If you report invoices you did not record in your books, or record sales you did not report, a discrepancy arises that is hard to explain upon review. That is why the value of an integrated system becomes apparent, one that makes issuance, reporting, and the accounting entry a single connected event, not three separate operations.

Qoyod handles linking these loops automatically. Every simplified invoice that is reported is recorded at the same time within your sales and feeds the VAT return summary. What remains for you is submitting the return through the Authority’s portal and paying what is due, as these are two steps the system does not perform on your behalf.

Consequences of delay or failure to report

Exceeding the 24-hour window or failing to report is not a trivial matter. The Authority treats late reporting as a violation of second-phase requirements, and it may expose your business to fines that escalate according to the type of violation and its recurrence.

The most prominent risks arising from weak reporting:

• Statutory fines for non-compliance with e-invoicing requirements, escalating with the recurrence of the violation.
• Gaps in the invoice chain that appear upon the Authority’s review, because the interlinked hash value exposes any invoice that was not reported.
• Difficulty in reconciling the VAT return when reported invoices do not match recorded sales.
• A weakened position during an audit, as proving the completeness of revenue becomes harder without a regular reporting log.

The most common causes of delay are simple technical errors: a long internet outage that exceeds the day’s window, an expired CSID certificate that was not renewed, or a non-compliant system that issues invoices without reporting them at all. The solution in all three cases is one: an accounting system that manages reporting and certificates automatically and alerts you before a failure occurs.

The Authority does not issue a fine merely for a second’s delay. But it is the recurring pattern of late or incomplete reporting that calls for accountability. That is why regular compliance, supported by automation, remains the first line of defense.

How Qoyod handles the entire reporting cycle

Qoyod was designed Qoyod’s e-invoicing software to hide the complexity of reporting behind a simple interface. You issue the invoice and deliver it to the customer, and Qoyod handles the rest of the cycle without any intervention from you.

What Qoyod does in the reporting path:

• Issues the simplified invoice in the required structured format with all mandatory elements.
• Generates the cryptographic stamp, the unique identifier, the hash value, and the QR code automatically for every invoice.
• Reports the invoice to the Fatoora platform within the 24-hour window without you tracking the deadline yourself.
• Manages the CSID certificate and handles it automatically so the reporting cycle is never interrupted.
• Preserves the interlinked chain of hash values to prove the completeness of your invoices upon any review.

This automation is the practical difference. A retail business does not have the luxury of monitoring every invoice and its reporting timing manually. With a compliant system, reporting becomes an invisible event running in the background while you focus on selling.

Your only remaining role is the initial registration of your certificate with the Authority, a step Qoyod guides you through. After that, the entire cycle runs without a daily burden. For more on the system’s capabilities in the second phase, see the page second-phase compliance.

The benefit beyond compliance itself is peace of mind. When you know that every invoice you issue is reported on time, that your invoice chain is complete without gaps, and that your certificate is valid, you are freed from the worry of a violation. This freedom lets you focus on running your business instead of chasing shifting technical details.

Qoyod also integrates reporting within your complete accounting ledger. The reported invoice appears automatically in your sales and in your VAT return data, so your figures match without manual reconciliation. This integration between issuance, reporting, and accounting is what sets an integrated system apart from a standalone reporting tool. To review the accounting foundation this cycle rests on, see the page Qoyod accounting software.

Steps to get your business ready for reporting

Moving to correct reporting does not require great effort once your tools are ready. Here are the practical steps in a logical order:

• Make sure you are registered for VAT. Reporting concerns registered businesses whose taxable revenue has exceeded SAR 375,000 annually, or those registered voluntarily.
• Adopt an accounting system compliant with the second phase that issues simplified invoices in the structured format and reports them automatically.
• Issue a CSID certificate for your business and link your system to the Authority, as it is the basis of the cryptographic stamp on every invoice.
• Test the issuance and reporting cycle on trial invoices before actual operation to confirm the elements are complete.
• Train the point-of-sale team on issuing and delivering the invoice, while resting assured that reporting happens automatically in the background.

If you want to measure your readiness precisely, the second-phase requirements list gives you a complete reference for the requirements. The advantage is that an integrated system shortens these steps, because it manages the certificate, the format, and reporting in one place without you piecing together scattered tools.

Common mistakes in reporting and how to avoid them

We have observed recurring patterns of errors that lead businesses into reporting violations. Avoiding them safeguards your compliance:

• Believing the invoice is not delivered before reporting. This is a confusion with clearance. The simplified invoice is delivered instantly, and reporting comes later.
• Neglecting to renew the CSID certificate. An expired certificate stops the generation of the cryptographic stamp, so the entire reporting cycle fails.
• Using a system that only issues without reporting. Some older systems issue nominal invoices that are not sent to the Authority, which is a clear violation.
• Ignoring alerts of a long connection outage that exceeds the 24-hour window and drops invoices out of the reporting scope on time.
• Failing to match reported invoices against sales when preparing the VAT return, which creates discrepancies that are hard to explain.

The common denominator among these mistakes is that they arise from a manual process or a deficient system. The solution in all of them is automation: a system that manages the certificate, reports automatically, and alerts you before a failure occurs. Then reporting turns from a daily burden into a silent, reliable process.

Frequently asked questions about reporting in e-invoicing

What is the fundamental difference between reporting and clearance?

Reporting concerns the simplified invoice (B2C) and is sent to the Authority within 24 hours after it is delivered to the customer. Clearance concerns the full invoice (B2B) and is approved by the Authority in real time before it is delivered. The first is a subsequent notification, and the second is prior approval.

Does the simplified invoice remain valid before it is reported?

Yes. The simplified invoice is valid the moment it is issued and delivered to the customer. Reporting is a subsequent step to notify the Authority, and it does not disrupt the invoice’s validity before the buyer.

What happens if the internet goes down at the point of sale?

You keep issuing and delivering invoices locally. The system reports them as soon as the connection returns, as long as that is within the 24-hour window. This flexibility is why the reporting model was adopted for individual transactions.

Do I need to report every invoice individually?

You do not need to do that manually. A compliant system reports invoices automatically, individually or all at once, within the prescribed deadline. Your role is limited to correct issuance.

Which element proves that the invoice was issued from my system?

The cryptographic stamp built on your business’s CSID certificate. This stamp links every invoice to your approved system, and it is generated automatically in compliant systems.

Does Qoyod handle reporting on my behalf?

Yes. Qoyod issues the simplified invoice with all its elements, reports it to the Fatoora platform within the deadline, and manages the certificates and the hash chain automatically. The initial registration of the certificate is your only role, and Qoyod guides you through it.