The Zakat, Tax and Customs Authority (ZATCA) and the Electronic Invoice

When we talk about e-invoicing in Saudi Arabia, the authority behind every decision, regulation, and mandate deadline is the Zakat, Tax and Customs Authority (ZATCA). This guide does not explain what the electronic invoice itself is; it answers a deeper question: who is this authority? What are the limits of its regulatory power over e-invoicing? And how does it exercise its monitoring and supervisory role over businesses? Here we focus solely on the institutional and regulatory dimension, and we refer you to our detailed pages whenever explaining the concepts, phases, or deadlines is required.

Understanding the regulating authority before understanding the technical details gives you a clearer picture. You are not complying with isolated requirements; you are dealing with an integrated oversight system run by a government body with broad powers. The more you grasp the nature of this authority and the basis of its statutory mandate, the more informed your compliance becomes and the less exposed you are to violations.

Who is the Zakat, Tax and Customs Authority?

The Zakat, Tax and Customs Authority is a Saudi government body responsible for administering and collecting zakat, taxes, and customs duties, and for overseeing the application of the related regulations. The Authority reports to the Minister of Finance and has an independent legal personality that grants it the power to issue executive regulations and binding decisions within its scope of jurisdiction.

The Authority in its current form was created by merging entities that were previously separate. The General Authority of Zakat and Tax merged with the General Authority of Customs under a single umbrella, with the aim of unifying the body responsible for non-oil sovereign revenues. This merger was not merely administrative; it created a single body with a comprehensive view of the business from the perspective of zakat, tax, and customs together.

Falling under the Authority’s umbrella is the regulation of several areas: zakat imposed on Saudi and Gulf businesses, value-added tax at its standard rate, withholding tax on payments to non-residents, excise tax, and customs duties on imports. E-invoicing is one of the most prominent projects the Authority has launched to tighten oversight over these tax areas collectively.

Why does defining the authority matter before defining the obligation?

Many business owners treat e-invoicing as a purely technical requirement. But the more accurate understanding is that it is a tool in the hands of an oversight body with the power to mandate, inspect, and impose fines. When you look at compliance from this angle, you realize that every invoice you issue passes within a regulatory framework supervised by the Authority, which monitors compliance with it.

The statutory basis for the Authority’s power over e-invoicing

The Authority’s power to require businesses to adopt e-invoicing is not a standalone decision; it rests on a tiered legislative framework. At the top comes the VAT Law and its executive regulation, which grant the Authority the power to regulate how tax invoices are issued, retained, and exchanged.

Based on this mandate, the Authority issued the E-Invoicing Regulation, which serves as the primary regulatory reference for the project. The regulation defined who is subject to the mandate, the technical requirements for invoices, taxpayers’ obligations, and the violations arising from non-compliance. It was then followed by the Authority’s resolutions on the controls, technical requirements, and procedures, which are more detailed documents explaining the precise technical specifications.

This tiering is important because it explains why some operational details change without the statutory basis changing. The Authority has the power to update the technical resolutions and requirements flexibly, while the general framework remains fixed and grounded in the VAT Law. To learn the regulatory framework and phases in detail, see our guide on E-invoicing in Saudi Arabia and its regulatory framework.

The chain of regulatory reference

The regulatory reference for e-invoicing is arranged in clear layers. The first layer is the Law (the VAT Law). The second layer is the Executive Regulation of the VAT Law. The third layer is the specialized E-Invoicing Regulation. The fourth layer is the technical resolutions and controls issued by the Governor of the Authority.

Each layer derives its legitimacy from the layer above it. A technical resolution cannot override what the higher law stipulates. This ordering protects taxpayers from arbitrary changes and gives them a clear reference in any dispute over whether a particular requirement is mandatory.

The Authority’s monitoring and supervisory role

The Authority’s role is not limited to issuing regulations; it extends to actual oversight of business compliance. The Authority exercises this role through several integrated tools, most notably direct technical integration with taxpayers’ invoicing systems, field and electronic inspection, and reconciling invoice data with the submitted tax returns.

In the integration phase, the Authority became able to view invoices at the moment they are issued or within a short time of issuance. This shift from after-the-fact monitoring to near-real-time monitoring represents the essence of the new supervisory role. The Authority no longer waits for the periodic return to detect evasion; it has a continuous flow of invoice data.

This monitoring capability gives the Authority a significant advantage in combating tax evasion and fake invoices. Matching issued invoices against the purchases declared by the other party exposes manipulation far more easily. This is one of the fundamental reasons for launching the e-invoicing project in the first place.

How does the Authority use invoice data?

The Authority collects an enormous amount of data through the invoicing system. This data is used to build an integrated digital profile for every business, linking its sales to its purchases to its tax returns. Any unjustified discrepancy between these elements raises the risk indicator at the Authority and may trigger a review or an audit.

This analytical use of data means that the accuracy of your invoices is no longer a formality. Every correct invoice builds a clean record for your business at the Authority, and every recurring error may raise the likelihood of being audited. Therefore, adopting a reliable e-invoicing system compliant with the Authority’s requirements protects your business from regulatory risks before it provides you with operational convenience.

The Fatoora platform: the Authority’s executive tool

The technical arm through which the Authority carries out its oversight of invoicing is the Fatoora platform. This platform is not an accounting program; it is a government gateway through which taxpayers connect their systems to complete clearance and reporting operations. Through it, the Authority receives invoices, verifies their conformity with the technical specifications, and grants businesses the encryption certificates they need.

The platform’s institutional role lies in being the sole official point of contact between taxpayers’ systems and the Authority. Any invoicing system, including Qoyod’s integration solution with the Authority, must integrate with this platform according to defined protocols. Through it, the Authority issues the Cryptographic Stamp Identifier (CSID), which establishes the identity of the system approved by the Authority.

The Fatoora platform performs two different functions depending on the invoice type. Business invoices (B2B) are subject to prior clearance before being delivered to the buyer, while consumer invoices (B2C) are reported within a defined period after their issuance. This distinction is part of the Authority’s design of the oversight system and reflects its concern not to disrupt the flow of direct sales to consumers.

The relationship between the accounting system and the platform

It is important to distinguish between the role of the Authority and the role of the accounting system provider. The Authority sets the specifications, operates the platform, and monitors compliance. The accounting system, such as Qoyod, handles generating the invoice in the required format, signing it, and connecting it to the platform automatically. The Authority does not register your business on the platform on your behalf; you are the one who connects your certificate, and the accounting system guides you through this step and automates everything after it.

This division of roles protects the business from a common confusion. Compliance is your responsibility before the Authority, but the tools that achieve it come from your accounting system. Choosing a system compliant with Phase Two of e-invoicing ensures that the bridge between you and the Authority is technically sound.

The Authority’s role in defining the scope of the mandate

Among the Authority’s most prominent institutional powers is determining who is subject to e-invoicing and when. The Authority did not require all businesses at once; instead, it adopted a phased-waves approach in the integration phase, notifying each group of taxpayers according to a certain annual revenue threshold, with sufficient lead time to prepare.

This gradual approach is a deliberate regulatory decision. Requiring everyone immediately would have overwhelmed small businesses and the platform alike. That is why the Authority starts with large taxpayers, who have a greater capacity to adapt, and then expands gradually. The Authority announces each wave through its official channels and direct notifications to the relevant taxpayers.

The important institutional rule here is that your obligation begins on the date the Authority notifies you, not on a hypothetical date you set yourself. Every business has its own integration date, which is communicated officially. To learn in detail who these obligations cover, see our guide on those required to issue the electronic invoice, and to learn the schedule of phases and deadlines, see the phases and deadlines for implementing the electronic invoice.

The logic of the phased approach from the Authority’s perspective

When you look at the phased approach from the Authority’s position, you find that it serves two goals at once. The first is to ensure the project’s technical success, as the platform tests its capacity to absorb large volumes before onboarding millions of small businesses. The second is to provide sufficient awareness and technical support for each wave before mandating it.

This explains why the Authority dedicates awareness campaigns, guidance manuals, and workshops before each wave. The goal is not to impose fines, but to raise the rate of voluntary compliance. A business aware of this philosophy prepares early rather than waiting for the notification at the last moment.

The penalty role: fines and how they are imposed

The Authority’s oversight role is completed by penalty powers. The regulation grants the Authority the power to impose fines for e-invoicing violations, graduated according to the type of violation and its recurrence. Violations include failing to issue invoices electronically, issuing them in a non-conforming format, deleting or manipulating invoices, or failing to include the mandatory elements such as the QR code.

In imposing fines, the Authority follows a graduated approach in many cases. For some first-time violations, a warning and a grace period for correction may suffice before moving to a monetary fine upon repetition. This gradation reflects the Authority’s philosophy of encouraging compliance rather than mere punishment, but it does not mean leniency toward deliberate or repeated violations.

What matters institutionally is that the power to impose a fine is an inherent part of the Authority’s mandate and is tied to the same statutory basis. No fine is imposed without a basis in the regulation, and the taxpayer has the right to file a grievance and object in accordance with the prescribed procedures. Knowing this framework helps you deal with any notice from the Authority with awareness and calm rather than confusion.

The existence of the right to file a grievance ensures a balance between the Authority’s oversight power and the taxpayer’s rights. A business can object to a fine through the approved channels and present evidence of its compliance or justification for the violation. If the dispute is not resolved, escalation paths are available before specialized committees. This graduated procedural system protects the taxpayer from unilateral decisions and establishes the principle of fairness in application.

In practical terms, the best way to avoid entering the grievance path in the first place is precise compliance from the outset. A correct invoice issued through an approved system cuts off most of the causes of a fine. Prevention with a sound system is far more economical than remedying a violation after it occurs.

The relationship of e-invoicing to the rest of the Authority’s jurisdictions

E-invoicing is not an isolated project within the Authority; it is a link in a broader system. Invoice data feeds directly into the value-added taxsystem, as invoices represent the basis on which periodic returns are built. The more accurate and compliant your invoices are, the easier your return is to prepare and the less prone to errors.

Invoicing also intersects with the zakat file. The financial statements built on accurate invoices constitute a reliable input for calculating the zakat base. It also connects to other data at the Authority, such as the real estate transaction tax and customs duties, within the Authority’s vision of building an integrated financial picture of every taxpayer.

This integration between files explains why the Authority invests heavily in digitizing invoices. It is not an end in itself, but a means to tighten the entire sovereign-revenue system. Whoever understands this interconnection realizes that precise compliance with invoicing reflects positively on the rest of their tax obligations.

The electronic invoice and the simplified tax invoice

In its regulations, the Authority distinguishes between invoice types according to the counterparty. A business invoice differs in its requirements from the simplified tax invoice directed at the final consumer. This distinction is part of the Authority’s precise design of a system that accounts for the differing nature of transactions.

We are not here to explain the detailed differences between invoice types, as that is a topic covered by other pages. But what matters institutionally is that the Authority is the one that defines these types and the requirements of each, and any approved system is obligated to observe this classification when generating invoices.

The origins of the Authority and its institutional evolution

The Authority did not appear in its current form all at once; it went through an evolutionary path that reflects the state’s orientation toward diversifying income sources and strengthening financial oversight. The story began with a body specialized in zakat and income, and its role then expanded with the enactment of value-added tax, becoming the pivotal body in managing non-oil revenues.

The most notable step was merging the tax body with the customs body into a single entity. This merger unified the government’s view toward the taxpayer, so a single body came to hold zakat, tax, and customs data together. From this institutional integration was born the need for digital tools to link these files, and e-invoicing was one of its most important fruits.

Understanding this path helps you realize that e-invoicing is not a sudden project, but a logical outcome of a long institutional orientation toward digitization and transparency. The Authority builds on it progressively by launching complementary platforms and initiatives that serve the same goal.

E-invoicing within the digital transformation vision

E-invoicing falls within a broader state orientation toward the digital economy and financial governance. The goal is not limited to collecting tax; it extends to building a business environment that is more transparent and fairly competitive. When all invoices become digital and documented, it becomes difficult for evaders to compete with compliant businesses using unrealistic prices.

This strategic dimension explains the Authority’s insistence on proceeding with the project despite its challenges. The return is not measured by tax revenue alone, but by the health of the market as a whole. The compliant business benefits from this cleaner environment as much as the state benefits from the revenue.

The Authority’s relationship with other government bodies

The Authority does not operate in isolation from the state’s system; it integrates with multiple government bodies. Businesses’ data at the Authority intersects with their records at the Ministry of Commerce through the commercial register, and with other bodies concerned with licensing and regulating activity. This integration gives the Authority a clearer picture of the taxpayer and their actual activity.

E-invoicing reinforces this integration, as it provides a reliable flow of transaction data that can be matched against other government sources. From the business’s perspective, this means that the accuracy of your data at the Authority is reflected in your image before the rest of the bodies, and vice versa.

This governmental interconnection raises the importance of precise compliance. A recurring error no longer stays within an isolated tax file; it may affect your wider dealings. A business that builds a clean record at the Authority thereby builds a solid foundation for its relationship with the entire government system.

How does a business deal with the Authority with confidence?

Dealing consciously with the Authority begins with realizing that it is a regulatory partner, not an adversary. The Authority provides guidance manuals, awareness platforms, and a digital assistant to answer inquiries. Making use of these official resources reduces ambiguity and protects the business from relying on inaccurate information.

The most important practical step is choosing an accounting system compliant with the Authority’s requirements from day one. Compliance built on a sound system is easier and less costly than trying to correct after a violation occurs. And a system such as an integrated accounting program handles the technical aspects of integration, freeing you to manage your business.

It is also advisable to follow the Authority’s official announcements periodically. Technical resolutions may be updated, and new waves are announced progressively. A business that builds a habit of regular follow-up always stays on the safe side of compliance.

A list of the Authority’s official resources

The Authority provides several official channels that are preferable to consult rather than untrusted sources. The most prominent are the Authority’s official website and its help center, the guidance manuals published in downloadable formats, the awareness kit that simplifies the requirements, in addition to the digital assistant for instant answers. Relying on these sources ensures the accuracy of your understanding of the requirements in force.

On the operational side, your accounting system remains your daily reference for applying these requirements in practice. The Authority sets the rule, and the system implements it. Combining following the Authority with adopting a compliant system gives you stable compliance over the long term.

How Qoyod helps you comply with the Authority’s requirements

Qoyod is a cloud accounting program compliant with Phase Two of e-invoicing. It integrates with the Fatoora platform and handles signing invoices, stamping them, and sending them to the Authority automatically in accordance with the approved technical specifications. This means you comply with the Authority’s requirements without needing technical expertise in the details of the integration.

Qoyod generates invoices in the required format, includes the mandatory elements such as the QR code and the unique identifier (UUID), and retains the linked chain of invoices. It also calculates value-added tax automatically on every transaction and prepares the tax-return data, reducing the likelihood of a discrepancy that might draw the Authority’s attention.

Qoyod’s role complements your role and does not replace it before the Authority. You are the one who registers your certificate and files your return, but Qoyod guides you at every step and automates the technical aspects. This turns compliance from a burdensome technical chore into a smooth process that happens in the background of your daily work.

Try Qoyod free for 14 days. No credit card required.

Frequently asked questions

What is the difference between the Zakat, Tax and Customs Authority and the Fatoora platform?
The Authority is a government body that sets the regulations, monitors compliance, and imposes fines. The Fatoora platform is the technical tool belonging to the Authority through which businesses connect their systems to clear and report invoices. The Authority is the body, and the platform is its executive means.

Does the Authority register my business for e-invoicing on my behalf?
No. The business is the one that connects the Cryptographic Stamp Identifier (CSID) through the platform. But a compliant accounting system guides you through this step and automates what follows in terms of signing and sending.

Where does the Authority derive its power to require me to adopt e-invoicing?
The power rests on the VAT Law and its executive regulation, then the E-Invoicing Regulation and the technical resolutions issued by the Authority. This tiered reference is the basis of the mandate.

When does my obligation to adopt e-invoicing begin?
It begins on the date of the Authority’s official notification to you, not on a date you set yourself. The Authority announces the waves progressively and notifies each group of taxpayers of its integration date.

What happens if I violate the Authority’s requirements?
The Authority has the power to impose graduated fines according to the type of violation and its recurrence, which may be preceded by a warning and a grace period for correction in some cases. The taxpayer has the right to file a grievance and object in accordance with the prescribed procedures.

Is compliance my responsibility or the accounting system’s responsibility?
Compliance is your responsibility before the Authority, but a compliant accounting system is the tool through which you achieve this compliance technically. Choosing a sound system greatly reduces regulatory risks.