Saudi E-Invoicing (Fatoorah): The Complete Business Compliance Guide

Fatoorah is Saudi Arabia’s mandatory electronic invoicing system, introduced by ZATCA under the E-Invoicing Regulation issued in December 2020. It requires all VAT-registered resident taxpayers to generate, store, and — from Phase 2 onwards — transmit invoices electronically through a ZATCA-compliant system. The regulation covers Tax Invoices (B2B), Simplified Tax Invoices (B2C), and their associated credit and debit notes.

The name simply means “invoice” in Arabic. But behind it sits a compliance framework far more demanding than the word suggests. Fatoorah is not about producing a digital PDF instead of a paper document — it mandates specific XML formats, mandatory data fields, cryptographic stamps (tamper-evident digital seals), QR codes, and in Phase 2, real-time connectivity between your invoicing system and ZATCA’s FATOORA platform.

The E-Invoicing Regulation applies to all resident taxable persons registered for VAT in Saudi Arabia, and to any third party issuing invoices on behalf of a resident taxable person. There are no industry or sector exemptions. Non-resident taxpayers without a Saudi establishment are outside scope.

If your business is VAT-registered, Fatoorah applies — there is no opt-out and no size exemption for Phase 1. The only variable is timing: which wave determines your Phase 2 integration deadline.

Phase 1 (Generation Phase), effective 4 December 2021, required all VAT-registered taxpayers to switch from paper or unstructured digital invoices to electronically generated invoices produced by a compliant EGS. No specific format was mandated. No connection to ZATCA’s systems was required. But the tamper-proofing rules applied in full from day one — no invoice deletion, sequential counters, session logging, unique login credentials.

Phase 2 (Integration Phase), rolling out in waves from January 2023, requires real-time API connectivity between your invoicing system and ZATCA’s FATOORA platform. Tax Invoices (B2B) must be cleared by FATOORA before being shared with the buyer. Simplified Tax Invoices (B2C) are shared immediately and reported to FATOORA within 24 hours. Format is now mandatory XML (UBL 2.1) or PDF/A-3 with embedded XML.

ZATCA rolls out Phase 2 in waves, each targeting taxpayers in a specific revenue band. The rollout began in January 2023 at the SAR 3 billion threshold and has progressively expanded. Wave 24, announced September 2025, brings the threshold down to SAR 375,000 — bringing thousands of SMEs into mandatory scope for the first time. ZATCA must notify businesses at least six months before their integration deadline.

Every transaction requires either a Tax Invoice or a Simplified Tax Invoice. The classification flows from the nature of the transaction — not preference — and determines the Phase 2 compliance model for that invoice.

Credit notes and debit notes follow the type of the original invoice they are issued against. A credit note against a Tax Invoice must go through clearance. A credit note against a Simplified Tax Invoice follows the reporting model.

Clearance (Tax Invoices): Your EGS generates the invoice in XML, applies your cryptographic stamp using your CSID, assigns a UUID and Previous Invoice Hash, then transmits to FATOORA via API. FATOORA validates the invoice, applies ZATCA’s stamp, and returns the cleared XML. You then share the cleared document with the buyer. An uncleared Tax Invoice is legally invalid — the buyer cannot claim input tax on it.

Reporting (Simplified Tax Invoices): Your EGS generates and stamps the invoice, you share it with the customer immediately, then transmit the XML to FATOORA within 24 hours. The 24-hour window is absolute — it does not pause for weekends, public holidays, or connectivity issues. Automated reporting with retry logic is the only reliable solution at any meaningful transaction volume.

Your E-Invoice Generation Solution must generate XML invoices in UBL 2.1, assign a UUID to every invoice, apply a cryptographic stamp using ECDSA with your CSID private key, embed the Previous Invoice Hash, generate a 9-field TLV QR code, and connect to FATOORA via API. It must also exclude all prohibited functionalities.

Prohibited functionalities (active from Phase 1): anonymous or default-password access, invoice deletion or alteration after generation, log modification, inaccurate timestamps, invoice counter reset, multiple invoice sequences from one unit, and export of the cryptographic stamp private key.

Onboarding requires accessing the FATOORA portal, generating an OTP per EGS unit, entering it in your system to receive a CSID, and testing in ZATCA’s sandbox before going live. A CSID is required per unit — not per business. A business with 10 POS terminals needs 10 CSIDs.

ZATCA has announced an important accommodation for businesses issuing fewer than 1,000 invoices per year: these taxpayers can generate e-invoices directly through ZATCA’s own online Fatoora portal — without integrating their internal ERP or billing system with the platform.

Under this route, the taxpayer logs into the FATOORA portal using ERAD credentials and generates invoices manually through the portal interface. ZATCA’s system handles XML generation, cryptographic stamping, UUID assignment, clearance, and reporting within the portal environment. The taxpayer downloads the cleared invoice and shares it with the buyer.

• Treating Phase 1 as finished business. ZATCA auditors examine historical records going back to December 2021. Non-compliant Phase 1 invoices — generated by a Word template, produced by a system with prohibited functionalities, missing QR codes on simplified invoices — are invalid VAT documents. The exposure has not expired.
• Confusing “compliant software” with compliant deployment. A software version that supports Phase 2 is not compliant unless it is correctly configured, every EGS unit is onboarded with its own CSID, and clearance/reporting are actually occurring. Software compliance and deployment compliance are different things.
• Not onboarding every EGS unit. One CSID per business is a common misconception. One CSID per unit is the requirement. Invoices stamped with the wrong or absent CSID are non-compliant — regardless of their content.
• Sharing Tax Invoices before clearance. A workflow that dispatches the invoice on generation — before the clearance response is received — is issuing legally invalid VAT documents on every B2B transaction. This is the single most commercially damaging error because it also puts your buyer’s input tax deduction at risk.
• Missing the 24-hour reporting window. Manual batch reporting that depends on staff availability will miss this window systematically over weekends, public holidays, and holidays. Automated reporting is not optional for any meaningful B2C volume.

E-invoicing penalties are applied under the VAT Law framework, with violation classifications set by ZATCA Board resolutions. The key principle: penalties accumulate across assessment periods. A business that fails to integrate with FATOORA is not facing a single fine — it faces exposure for each period of continued non-compliance.

ZATCA processed over 8.2 billion e-invoices in 2025 — a 64% increase from 2024. The data flowing through FATOORA gives ZATCA near-real-time visibility into which businesses are issuing invoices, at what volumes, and whether those invoices are passing clearance. The ability to detect non-compliance without a field audit has never been stronger.