FAQ Topic
KSA E-Invoicing
Frequently asked questions about ZATCA e-invoicing in Saudi Arabia.
Frequently asked questions
What is ZATCA e-invoicing?
ZATCA e-invoicing, also known as Fatoorah, is Saudi Arabia's electronic invoicing system introduced by the Zakat, Tax and Customs Authority (ZATCA). It replaces paper-based and manually generated invoices with structured electronic invoices that are created, stored, and exchanged through compliant electronic solutions. Under the system, an electronic invoice is generated in a structured format through an electronic solution. Simply scanning a paper invoice or converting it into a PDF does not make it an e-invoice. ZATCA e-invoicing applies to both tax invoices and simplified tax invoices, along with related credit and debit notes. The implementation is divided into two main phases. Phase 1 focuses on generating and storing compliant electronic invoices, while Phase 2 requires businesses to integrate their e-invoicing solutions with ZATCA's Fatoora platform. Businesses must therefore use an e-invoicing solution that meets ZATCA's technical, security, and invoice-format requirements. Platforms such as Complyance can help businesses manage compliant invoice generation and prepare their existing ERP or accounting systems for ZATCA integration. Key points ZATCA e-invoicing is also known as Fatoorah. It replaces paper and manually generated invoices with structured electronic invoices. PDF or scanned invoices alone are not considered e-invoices. The system covers tax invoices, simplified tax invoices, credit notes, and debit notes. Phase 2 requires integration with ZATCA's Fatoora platform.
What is the difference between ZATCA Phase 1 and Phase 2?
ZATCA e-invoicing is being implemented in two main phases. Phase 1, known as the Generation Phase, became mandatory on 4 December 2021. It requires taxpayers subject to the e-invoicing regulations to generate and store invoices and notes electronically using a compliant solution. Phase 1 focuses primarily on ensuring that businesses stop using handwritten invoices, text-editing tools, or spreadsheets as their invoicing system. The electronic solution must generate invoices with the required information and meet ZATCA's basic technical requirements, including QR code requirements for simplified tax invoices. Phase 2, known as the Integration Phase, started on 1 January 2023 and is being introduced gradually in waves. It adds more technical and business requirements. Businesses in each wave must integrate their e-invoicing solution with ZATCA's Fatoora platform, use the required invoice format, and include additional mandatory fields. The important difference is that Phase 1 is primarily about generating and storing compliant invoices, while Phase 2 is about integrating the business's e-invoicing system with ZATCA and enabling electronic transmission and validation through the required framework. Key points Phase 1: Generation and storage of compliant e-invoices. Phase 1 became mandatory on 4 December 2021. Phase 2: Integration with ZATCA's Fatoora platform. Phase 2 started on 1 January 2023 and is implemented in waves. Phase 2 introduces additional technical, security, and invoice-format requirements.
What is Wave 25 of ZATCA e-invoicing and who does it cover?
Wave 25 is the latest announced wave of ZATCA's Phase 2 e-invoicing rollout. ZATCA announced the criteria for Wave 25 on 24 July 2026. Wave 25 covers taxpayers whose revenues subject to VAT exceeded SAR 187,500 during any one of the years 2022, 2023, 2024, or 2025. Businesses that fall within this criterion are required to integrate their e-invoicing solutions with the Fatoora platform by no later than 1 February 2027. ZATCA has stated that it will notify the targeted taxpayers in this wave. The requirement is therefore based on the specified historical VAT-subject revenue criterion rather than simply looking at a business's current-year revenue. Businesses included in Wave 25 should use the time before the February 2027 deadline to assess their existing invoicing system, select a compliant solution, complete integration, test invoice flows, and ensure that their system meets ZATCA's Phase 2 requirements. Key points Wave 25 was announced on 24 July 2026. The threshold is more than SAR 187,500 in VAT-subject revenue. Revenue is assessed for 2022, 2023, 2024, or 2025. The integration deadline is 1 February 2027. Targeted taxpayers will be notified by ZATCA.
How do I know which ZATCA e-invoicing wave I'm in?
ZATCA's Phase 2 waves are determined using specific criteria for targeted taxpayer groups. One of the main criteria used in recent waves is the taxpayer's VAT-subject revenue during specified historical years. ZATCA announces the selection criteria for each wave and directly notifies taxpayers who are targeted. For Wave 25, for example, ZATCA selected taxpayers whose VAT-subject revenue exceeded SAR 187,500 during 2022, 2023, 2024, or 2025. Therefore, businesses should not determine their wave only by looking at their current annual turnover. They should review ZATCA's announcement for the relevant wave, compare their VAT-subject revenue against the announced threshold and years, and check for an official notification from ZATCA. ZATCA has stated that taxpayers are notified of their Phase 2 wave at least six months before their integration date. This gives businesses time to prepare their e-invoicing solution and complete the required integration. Key points ZATCA announces the criteria for each Phase 2 wave. Wave selection can depend on VAT-subject revenue from specified historical years. ZATCA directly notifies targeted taxpayers. Businesses should check their ZATCA notifications and official wave announcements. ZATCA provides at least six months' notice for Phase 2 waves.
What is the SAR 187,500 threshold for ZATCA Phase 2?
The SAR 187,500 threshold is the revenue criterion ZATCA has used for selecting taxpayers for Wave 25 of Phase 2 e-invoicing. For Wave 25, ZATCA stated that the targeted group includes taxpayers whose revenues subject to VAT exceeded SAR 187,500 during 2022, 2023, 2024, or 2025. It is important to understand that this figure is specifically the Wave 25 selection threshold. It should not be confused with the mandatory VAT registration threshold or treated as a general ZATCA Phase 2 threshold that applies to every wave. For example, ZATCA used different revenue thresholds for previous waves. Wave 21 used SAR 1.25 million, Wave 22 used SAR 1 million, while Wave 25 uses SAR 187,500. This shows that the threshold can change from one wave to another. Businesses should therefore always check the specific ZATCA announcement for their wave instead of assuming that one revenue threshold applies to all Phase 2 taxpayers. Key points SAR 187,500 is the Wave 25 selection threshold. It refers to VAT-subject revenue, not simply total business revenue. The relevant years for Wave 25 are 2022 to 2025. The threshold is specific to Wave 25. Previous ZATCA waves used different revenue thresholds.
What happens if I missed my ZATCA integration deadline?
Penalties (ZATCA): Failure to comply with e-invoicing requirements can result in fines ranging from SAR 5,000 to SAR 50,000 per violation, along with potential additional penalties for repeated or continued non-compliance. Missing a ZATCA integration deadline does not mean that the business can simply wait for another wave or ignore the requirement. Once a taxpayer is targeted for Phase 2, it remains responsible for meeting the applicable e-invoicing requirements and integration obligations. If a business has missed its deadline, it should prioritize completing the integration as soon as possible and review its compliance position with ZATCA. The business should also make sure that its e-invoicing solution meets the Phase 2 technical and security requirements before continuing normal operations. ZATCA has established procedures for reporting technical incidents that prevent taxpayers from generating electronic invoices or notes. Where a genuine technical problem affects invoice generation, taxpayers can notify ZATCA through its failure-notification service and are expected to resume compliant invoice generation once the issue is resolved. Businesses should not assume that a technical issue or missed deadline automatically removes their compliance obligations. The appropriate response is to resolve the integration issue, document relevant problems, and address any applicable ZATCA requirements or penalties. A compliant e-invoicing platform such as Complyance can help businesses identify integration gaps, prepare their invoice data, and work toward completing ZATCA integration requirements. Key points Missing the deadline does not remove the Phase 2 obligation. Businesses should complete integration as soon as possible. Technical failures that prevent invoice generation should be reported to ZATCA where applicable. Keep records of technical issues and corrective actions. Use a compliant solution to address integration and technical gaps.
Will there be more ZATCA waves after Wave 25?
Yes. Wave 25 is not necessarily the end of ZATCA's Phase 2 rollout. ZATCA has stated that Phase 2 is being implemented gradually in waves and that taxpayers in subsequent waves will be informed directly at least six months before their integration date. This means businesses that were not included in Wave 25 should not assume that they are permanently outside the Phase 2 requirements. ZATCA has progressively lowered the revenue criteria used to identify targeted taxpayers across different waves. For example, earlier waves used thresholds in the millions of Saudi Riyals, while Wave 25 uses a threshold of more than SAR 187,500. The continued wave-based approach allows ZATCA to bring additional taxpayer groups into the integration phase over time. Businesses should therefore continue monitoring official ZATCA announcements even if they have not yet received a wave notification. Key points Wave 25 does not mean that Phase 2 is finished. ZATCA has confirmed that Phase 2 continues through successive waves. Future taxpayers will be notified at least six months before their integration date. Revenue thresholds have generally decreased across later waves. Businesses not yet notified should continue monitoring ZATCA announcements.
Does ZATCA notify me before my integration deadline?
Yes. ZATCA has stated that taxpayers targeted for Phase 2 are notified directly and that taxpayers in upcoming waves will be informed at least six months before their integration date. For Wave 25, ZATCA announced that targeted taxpayers would be notified before they are required to integrate their e-invoicing solutions with the Fatoora platform by 1 February 2027. However, businesses should not rely exclusively on receiving a notification before beginning preparation. The wave criteria are publicly announced by ZATCA, and businesses can review those criteria in advance to understand whether they may fall within a targeted group. Early preparation is particularly important because businesses may need to update their ERP or accounting system, map invoice data, configure the e-invoicing solution, obtain the required credentials, test transactions, and complete the integration process before the deadline. Key points ZATCA directly notifies taxpayers targeted for Phase 2. Notifications are provided at least six months before the integration date. Wave criteria are publicly announced by ZATCA. Businesses should not wait for a notification before starting preparation. Early integration reduces the risk of last-minute technical issues.
What counts as VAT-subject revenue for a ZATCA wave threshold?
For ZATCA Phase 2 wave selection, the relevant criterion is revenue subject to VAT for the specific years identified in the wave announcement. This is different from simply looking at a company's total revenue or current-year turnover. Businesses need to consider the revenue that falls within the scope of VAT when assessing whether they meet a particular wave's threshold. For Wave 25, ZATCA specifically stated that the selection criterion is taxpayers whose revenues subject to VAT exceeded SAR 187,500 during 2022, 2023, 2024, or 2025. Because different waves can specify different years and thresholds, businesses should assess their revenue against the exact criteria published by ZATCA for the relevant wave. If there is uncertainty about whether a particular revenue stream is subject to VAT, businesses should review the applicable Saudi VAT rules and their tax records rather than automatically treating total company revenue as the wave-selection figure. Key points ZATCA uses VAT-subject revenue for wave selection. Total company revenue should not automatically be treated as the relevant figure. The applicable years depend on the specific ZATCA wave. Wave 25 considers 2022, 2023, 2024, or 2025. Wave 25 uses a threshold of more than SAR 187,500.
Do I still have to integrate if my revenue has since dropped below the threshold?
Generally, a later decrease in revenue does not by itself mean that a taxpayer selected for a ZATCA Phase 2 wave can ignore the integration requirement. ZATCA's wave-selection criteria are based on the specific historical revenue periods identified in each wave announcement. For Wave 25, for example, taxpayers are targeted if their VAT-subject revenue exceeded SAR 187,500 during 2022, 2023, 2024, or 2025. This means a business could have qualified based on revenue in one of those historical years and subsequently experience lower revenue. The later reduction does not automatically change the fact that the business was selected based on the published wave criteria. Businesses that have received a ZATCA notification should therefore not assume that a recent decline in revenue removes the integration obligation. If there is a specific change in the business's tax status or circumstances that could affect its obligations, the business should verify the position with ZATCA or a qualified Saudi tax adviser. Key points Wave selection is based on the specified historical revenue periods. A later decline in revenue does not automatically cancel the integration requirement. Wave 25 looks at VAT-subject revenue during 2022 to 2025. Businesses that have received a ZATCA notification should continue preparing for integration. Any change in tax status should be assessed separately with reference to the applicable ZATCA rules.
What is the difference between clearance and reporting under ZATCA?
Clearance and reporting apply to different types of e-invoices. Clearance applies to standard Tax Invoices, generally used for B2B transactions. The invoice is submitted to ZATCA through the integrated solution, where ZATCA validates it against the applicable requirements. If it passes the required checks, ZATCA applies its cryptographic stamp and returns the cleared invoice information. The cleared invoice can then be issued to the buyer. Reporting applies to Simplified Tax Invoices, generally used for B2C transactions. These invoices are generated and issued by the taxpayer first, then submitted to the Fatoora platform for reporting within 24 hours. ZATCA validates the submitted document and returns an acceptance, warning, or rejection response. The key difference is therefore that clearance happens before a standard invoice is finalized for the buyer, while reporting happens after a simplified invoice is issued. Key points Standard Tax Invoice = Clearance. Simplified Tax Invoice = Reporting. Clearance is required before issuing the cleared standard invoice. Simplified invoices must be reported within 24 hours. ZATCA applies its cryptographic stamp to cleared standard invoices.
How long do I have to report a simplified invoice to ZATCA?
A Simplified Tax Invoice must be reported to ZATCA within 24 hours of its issuance. The taxpayer generates the simplified invoice through its compliant e-invoicing solution, including the required cryptographic stamp and QR code. The invoice is then transmitted to the Fatoora platform through the Reporting API. This is different from the clearance process for standard Tax Invoices. A simplified invoice is not sent to ZATCA for clearance before it is issued to the customer. Key points Reporting deadline: within 24 hours of issuance. Applies to Simplified Tax Invoices and associated notes. Submission is made electronically through the Reporting API. The submitted invoice must be in the required structured format. Rejected submissions need to be corrected and resubmitted according to ZATCA requirements.
What is the Fatoora platform?
Fatoora is ZATCA's e-invoicing platform used to connect taxpayers' compliant e-invoicing solutions with ZATCA during Phase 2 of Saudi Arabia's e-invoicing programme. Businesses do not normally create every invoice manually inside Fatoora. Instead, their compliant Electronic Generation Solution (EGS) integrates with ZATCA's platform through the prescribed APIs. Depending on the invoice type, Fatoora performs functions such as clearance or reporting, validates submitted documents, returns API responses, and supports the onboarding and certificate processes required for integration. ZATCA also provides tools such as the Integration Sandbox, SDK, and web-based validator to help taxpayers and solution providers test their implementations. Key points Fatoora is ZATCA's e-invoicing platform. Businesses integrate their compliant EGS with Fatoora. Standard invoices go through clearance. Simplified invoices are reported. Fatoora provides validation and API responses. ZATCA's testing toolkit supports integration testing.
Does ZATCA approve every invoice before I can send it to my customer?
No. The answer depends on the type of invoice. For a standard Tax Invoice, the invoice goes through ZATCA's clearance process. The taxpayer submits it through its integrated solution, and ZATCA validates it before the cleared invoice is issued to the buyer. For a Simplified Tax Invoice, there is no pre-clearance. The seller generates and provides the invoice to the customer and then reports it to ZATCA within 24 hours. It is therefore incorrect to describe ZATCA as approving every invoice before a customer receives it. Key points Standard Tax Invoice: clearance before final issuance. Simplified Tax Invoice: issued first, then reported. Simplified invoices are not individually pre-approved by ZATCA. The taxpayer remains responsible for ensuring that its invoices comply with the applicable requirements.
What happens if Fatoora is down when I need to issue an invoice?
ZATCA's guidance provides procedures for technical incidents and temporary connectivity problems. For example, if ZATCA's servers are temporarily unavailable during a B2B clearance attempt, the taxpayer can continue with the transaction under the prescribed contingency approach, retain evidence and records, and continue attempting to connect to ZATCA. Once the connection is restored, the invoice must be submitted for clearance and the compliant cleared invoice issued. For a failure in the taxpayer's own e-invoicing solution that prevents invoice generation, ZATCA requires the taxpayer to notify the Authority through the designated failure-notification process and notify ZATCA once the issue has been resolved. The important point is that an outage does not remove the taxpayer's obligation to clear or report the affected invoices. The outstanding transactions must be processed once the system becomes operational. Key points ZATCA has procedures for temporary technical failures. Taxpayers should retain evidence of connectivity or system problems where relevant. A taxpayer-side system failure must be notified to ZATCA. Outstanding invoices must be cleared or reported once the system is operational. Do not treat an outage as a permanent exemption from e-invoicing requirements.
What is a CSID in ZATCA e-invoicing?
A Cryptographic Stamp Identifier (CSID) is a cryptographic certificate associated with an Electronic Generation Solution Unit. It provides the electronic identity used by the EGS for authenticated communication with ZATCA and for cryptographically stamping applicable invoices. ZATCA's technical guidance describes the CSID as a credential used for authenticated signing and encryption of communication. The CSID is associated with an individual EGS or solution unit rather than simply being a general certificate for an entire company. The onboarding process therefore captures information about the particular solution unit, including its identifier, serial number and location. Key points CSID means Cryptographic Stamp Identifier. It is a cryptographic certificate. It identifies an EGS or solution unit. It supports authenticated communication with ZATCA. It is used for cryptographic stamping of applicable Simplified Tax Invoices. CSIDs are part of the Reporting and Clearance API authentication process.
What is the difference between a Compliance CSID and a Production CSID?
The Compliance CSID is an intermediate certificate used during onboarding, while the Production CSID is used for the live production environment. After the taxpayer's EGS submits its Certificate Signing Request, ZATCA provides a Compliance CSID. The EGS then completes the required compliance checks. Once the onboarding requirements are successfully completed, the EGS can obtain its Production CSID. The Production CSID is subsequently used to authenticate the EGS when communicating with ZATCA's production environment. In other words, the Compliance CSID is part of the onboarding and compliance-testing stage, while the Production CSID is the credential used for live production integration. Key points Compliance CSID = intermediate onboarding credential. Production CSID = live production credential. Compliance checks are performed using the Compliance CSID. The Production CSID is issued after successful completion of the required process. A taxpayer's EGS uses the Production CSID for production communication with ZATCA.
How do I generate a CSR for ZATCA onboarding?
A Certificate Signing Request (CSR) is generated by the taxpayer's Electronic Generation Solution as part of the onboarding process. The CSR contains information that identifies the EGS and taxpayer. ZATCA's technical documentation includes fields such as the solution-unit name or asset tracking number, EGS serial information, VAT or Group VAT Registration Number, organization information, invoice type/functionality, and the location of the branch, device, or solution unit. The EGS submits the CSR to ZATCA after obtaining the required OTP. ZATCA then uses the CSR as part of the process for issuing the Compliance CSID. Because CSR generation is tied to the EGS's technical configuration, businesses normally generate it through their compliant e-invoicing solution rather than manually creating a certificate request in the Fatoora website. Key points CSR means Certificate Signing Request. It is generated by the EGS. It identifies the solution unit and taxpayer. The CSR includes the VAT or Group VAT Registration Number and solution/location information. An OTP is required as part of the CSR submission process. A successful CSR submission leads to issuance of a Compliance CSID.
How long is the ZATCA Fatoora OTP valid?
The Fatoora OTP is valid for one hour according to ZATCA's technical documentation. The OTP is generated through the Fatoora onboarding process and is used as part of the CSR submission and certificate onboarding flow. ZATCA also states that OTPs are obtained through the Fatoora portal, rather than through an API. If the OTP expires before the CSR process is completed, the taxpayer must obtain a new valid OTP. Key points Fatoora OTP validity: 1 hour. OTP is used during the onboarding/CSR process. ZATCA states that OTPs are obtained through the portal. An expired OTP can cause CSR submission failure. Up to 100 OTPs can be requested at once according to ZATCA's technical guidance.
How do I onboard multiple branches or devices with ZATCA?
ZATCA's onboarding model is based on EGS or solution units. A taxpayer can therefore have multiple onboarded EGS units associated with its VAT registration. Each solution unit is identified through information included in its CSR, such as its common name or asset tracking number, serial information, organization unit, and the location of the relevant branch, device, or solution unit. The Fatoora portal provides a list of the taxpayer's onboarded EGS units. Each unit goes through the required certificate process and receives its applicable CSID. For businesses operating multiple branches, POS devices, or invoice-generation systems, the exact technical architecture should be designed so that each EGS unit is correctly identified and its invoices are generated and submitted through the compliant integration. Key points Multiple EGS units can be onboarded under a taxpayer. Each unit has identifying information in its CSR. Branch/device/location information can form part of the EGS identity. CSIDs are issued for the relevant EGS units. Fatoora provides a view of the taxpayer's onboarded EGS units. Businesses with many branches or devices should structure the onboarding around their actual invoice-generation architecture.
