Saudi E-Invoicing (Fatoorah): Scope, Phases and Compliance

What Fatoorah Requires

Saudi e-invoicing combines a tax-document obligation with controls over the system that creates the document. A readable invoice is only part of the evidence. The business must also establish that the right document was generated, preserved and, when its integration date applies, cleared or reported through FATOORA.

The framework has two stages. Phase 1 began on 4 December 2021. Phase 2 began on 1 January 2023 and applies progressively to targeted groups. Read the E-Invoicing Regulation together with the Implementation Resolution, its two annexes and the VAT Implementing Regulations. The Arabic legislation controls where the English translation differs.

Who Is Subject and Which Transactions Are Included

Article 3 of the E-Invoicing Regulation addresses resident taxable persons and parties issuing invoices on their behalf; non-resident taxable persons are excluded. Transaction scope is a separate question. Registration does not turn an exempt transaction into a taxable supply.

Implementation Resolution First 5–7 makes the following distinction:

A business making both taxable and exempt supplies must classify its transactions correctly. A zero VAT amount alone does not identify the legal treatment: zero-rating and exemption have different consequences. See tax invoice requirements for the underlying VAT rules.

Phase 1 and Phase 2 Compared

Annex One separates the original generation requirements from the additional integration requirements. Annex Two specifies when individual fields become mandatory, conditional or optional.

Phase 1 prohibited anonymous access, operation with default passwords, absence of user session management and specified invoice/log tampering capabilities. The prohibition table also distinguishes later controls: export of stamping keys and software time-change capabilities are listed in its Phase 2 column. A historical review must use the applicable column rather than apply every later feature retrospectively. The Phase 1 guide explains this distinction.

Identify Your Integration Date

Implementation Resolution Sixth requires targeted groups to receive at least six months’ notice. Review the actual notification and the relevant announcement, including all specified reference years; a fall in current turnover does not erase an earlier integration obligation.

ZATCA’s 24 July 2026 announcement sets Wave 25 at VAT-subject revenue exceeding SAR 187,500 in any of 2022, 2023, 2024 or 2025, with integration by 1 February 2027. Earlier deadlines remain relevant to taxpayers already targeted. This threshold is an integration selection criterion, not a replacement for VAT registration tests. The Wave 25 guide explains the year-by-year assessment.

Select the Invoice Type Before Configuring the Workflow

Standard tax invoices generally serve business and other recipients specified in VAT Implementing Regulations Article 53(1). Simplified invoices generally serve consumers, with the low-value option and exclusions governed by Article 53. Credit and debit notes follow the relevant invoice type and Article 54.

The SAR 1,000 rule concerns the value of a supply for the permitted simplified-invoice option. It is not an annual invoice-count exemption. Apply the current Article 53 conditions, including restrictions on using simplified invoices for the relevant cross-border supplies. Our invoice-type guide covers that decision in more detail.

Do not assume that a correctly issued simplified invoice can never support input-tax recovery. Article 49(7) expressly includes it among the alternative evidence routes. Recovery still depends on eligible expenditure, the applicable evidence and integration requirements; an ordinary consumer receipt is not automatically sufficient.

Clearance, Reporting and Input VAT

For standard documents, the normal Phase 2 route is submission for clearance before sharing with the buyer. FATOORA validates the submission and applies ZATCA’s cryptographic stamp and QR information. The seller’s own stamp is not a universal mandatory preliminary step for every standard invoice.

For simplified documents, the compliant solution applies the taxpayer’s stamp, supplies the invoice to the customer and reports it within 24 hours of generation. ZATCA does not add a clearance stamp to those reported documents. Technical Guideline 4.3 explains the two routes and distinguishes accepted documents, accepted documents with warnings and rejected documents.

Resolution First 3 links the deduction evidence to the relevant requirements and their implementation dates. A supplier’s rejection or missing clearance is therefore material. However, a technical warning does not justify a blanket claim of permanent loss of input tax. Examine the applicable integration obligation, corrected document and VAT Article 49 evidence. Supplier output VAT also remains due according to the transaction; a technical failure does not cancel the taxable supply.

The clearance and reporting guide explains the operating routes. For incidents, use the qualified outage procedures in the Phase 2 guide, rather than an unconditional rule allowing uncleared invoices after a fixed waiting period.

Map EGS Units and Use the Portal for Its Documented Purpose

A Cryptographic Stamp Identifier, or CSID, links an EGS unit to its identity and permitted functions. Count units by their generation, signing, sequence and sending architecture. Counting screens or branch names alone can produce the wrong answer.

Technical Guideline 3.5 describes central servers, smart tills that sign and send independently, branch servers and terminals that cannot sign. An independently signing POS needs its own credential in the described scenario. A terminal using a server to perform those functions may not. Branch signing servers and a separate sending server can have distinct credential needs. These are official architecture scenarios, not a rule that every physical till always needs its own CSID.

Detailed Guideline 2.8 describes the FATOORA portal’s onboarding and identifier-management functions. The reviewed official material does not establish a general direct invoice-generation service for businesses issuing fewer than 1,000 invoices a year. Small businesses should select a compliant solution and establish its integration capability when required; portal access itself is not evidence of an alternative compliance route. See solution requirements.

Preserve the Archive and Resolve Incidents

Resolution Fifth refers to VAT Implementing Regulations Article 66. Ordinary records must generally be kept for at least six years from the end of the relevant tax period. Capital-asset records have a longer rule tied to the adjustment period plus five years. Preserve the applicable electronic records, access and audit trail after any system migration.

Cloud storage is subject to Article 66’s access and other conditions, as well as applicable Saudi requirements. Neither outsourcing nor FATOORA’s acceptance of a submission transfers the business’s record-keeping responsibility. Resolution Seventh 5 also requires notification of relevant incidents and their resolution, followed by prompt generation and integration of affected documents as applicable.

Penalties and the Current Waiver Position

ZATCA’s current Arabic classification guide distinguishes integration failures, invoice-sharing failures and other breaches, with different warnings, repeat amounts and intervals. A single generic fine does not describe every case. Use the penalties guide to identify the actual category and recurrence history.

The current initiative runs to 31 December 2026, but ZATCA’s 29 June 2026 announcement expressly excludes VAT Law Article 45 fines. Ministerial Decision 1117 specifies the covered relief and conditions. Businesses must not assume that historical e-invoicing violations receive blanket relief merely because an initiative remains open. Review the actual fine and decision separately from principal tax.

A Practical Review Sequence

Dariba’s recommended review starts with the legal and transaction facts: taxpayer status, supply treatment, invoice type and actual integration date. Finance should then reconcile those decisions with the vendor’s document fields, unit architecture, response handling and archive.

Test standard clearance and simplified reporting separately. Retain the submitted XML, responses, warnings, rejection handling and incident evidence. Investigate a discrepancy between sales, generated invoices, FATOORA submissions and the VAT return rather than treating platform acceptance as completion of the tax review. These are practical control recommendations; they do not constitute certification of a particular software implementation.