ZATCA E-Invoicing (Fatoora) Saudi Arabia 2026 Guide

By Rozy — Business Consultant, Noble Core · Updated June 2026

This guide explains exactly how the Fatoora system works in 2026 — what e-invoicing is, the difference between Phase 1 and Phase 2, the current integration waves by revenue, the technical requirements (XML, QR code, cryptographic stamp), how to pick compliant software, the penalties, and how a brand-new company gets compliant from day one.

What is ZATCA e-invoicing (Fatoora)?

E-invoicing (الفوترة الإلكترونية) is the process of issuing, storing and exchanging invoices in a structured electronic format instead of on paper or as a simple PDF. In Saudi Arabia, the system is administered by ZATCA — the Zakat, Tax and Customs Authority — and the central government platform is called Fatoora.

Every business registered for Value Added Tax (VAT) in the Kingdom must issue tax invoices electronically through a compliant solution. The goals are to reduce the shadow economy, improve VAT collection, and digitise commercial transactions in line with Vision 2030. There are two invoice types you will hear about constantly:

• Standard tax invoice (B2B / B2G) — issued between businesses or to government. In Phase 2 these must be cleared by ZATCA before they are shared with the buyer.
• Simplified tax invoice (B2C) — issued to end consumers, typically at the point of sale. These must be reported to ZATCA within 24 hours and always carry a QR code.

You can review the official rollout and rules directly on the ZATCA portal at zatca.gov.sa.

It is worth being precise about the language. “Fatoora” is the name of ZATCA’s central integration platform and also the colloquial Arabic word for “invoice”. When people say “Fatoora compliance” they usually mean the full e-invoicing obligation: generating structured invoices, applying the right cryptographic and QR features, and — in Phase 2 — transmitting them to ZATCA. E-invoicing is not optional and it is not a separate tax; it is simply the legally required way to issue the VAT invoices you were already obliged to produce. A credit note, a debit note and a tax invoice are all covered, and each has its own mandatory data set.

Phase 1 (Generation) vs Phase 2 (Integration)

The single most important concept in Fatoora is the two-phase structure. Phase 1 made invoices digital; Phase 2 connects every business directly to ZATCA’s systems.

Phase 1 — the Generation phase

Phase 1 went live on 4 December 2021 for all taxpayers at once. It required businesses to stop using handwritten or basic word-processor invoices and instead generate and store invoices using a compliant electronic solution. Key Phase 1 requirements were a structured electronic invoice, mandatory fields (seller VAT number, timestamp, totals), tamper-resistant storage, and a QR code on simplified (B2C) invoices.

Phase 2 — the Integration phase

Phase 2 began on 1 January 2023 and is being rolled out in waves, group by group, based on annual revenue. In this phase, the taxpayer’s invoicing software must integrate with the Fatoora platform via API. Standard invoices are sent to ZATCA for clearance (approval) before being issued to the buyer, while simplified invoices are reported to ZATCA within 24 hours. Phase 2 also adds a cryptographic stamp, a UUID, an invoice hash, and an upgraded QR code.

Feature	Phase 1 (Generation)	Phase 2 (Integration)
Live from	4 December 2021	1 January 2023 (in waves)
Applies to	All VAT-registered taxpayers	Wave-by-wave by revenue
Connection to ZATCA	None required	Real-time API integration with Fatoora
Invoice format	Structured electronic (e.g. PDF/A-3, XML)	XML or PDF/A-3 with embedded XML
QR code	On simplified (B2C) invoices	On all invoices, with extra cryptographic data
Cryptographic stamp	Not required	Mandatory (ECDSA digital signature)
Clearance / reporting	Not required	Standard = clearance; simplified = reporting within 24h

The 2026 integration waves by revenue

ZATCA does not move every company into Phase 2 at the same time. Instead it announces waves, each defined by a VATable-revenue threshold, and notifies targeted taxpayers at least six months before their deadline. The thresholds have steadily dropped, pulling smaller businesses into Phase 2.

For 2026, the two key waves are Wave 23 and Wave 24:

Wave	VATable revenue threshold	Reference years	Integration deadline
Wave 22	Over SAR 1,000,000	2022, 2023 or 2024	Late 2025 / early 2026
Wave 23	Over SAR 750,000	2022, 2023 or 2024	31 March 2026
Wave 24	Over SAR 375,000	2022, 2023 or 2024	30 June 2026

Wave criteria and deadlines are set by ZATCA and can be extended or updated. Always confirm your wave, threshold and exact deadline on the official ZATCA portal or via the notification ZATCA sends to your registered contact.

The pattern is clear: by mid-2026 the threshold reaches SAR 375,000, meaning the large majority of VAT-registered businesses in the Kingdom — including most SMEs — will be inside the Phase 2 integration regime. Later waves are expected to bring in the remaining smaller taxpayers, so any business above the VAT registration line should plan for Phase 2 rather than wait.

A few practical points about how waves work in practice. First, the threshold is tested against your VATable revenue in any one of the reference years (2022, 2023 or 2024) — so a single strong year can place you in an earlier wave. Second, the notification ZATCA sends is the official trigger, and it usually lands at least six months before your deadline; it is delivered to the contact details on your ZATCA file, which is exactly why keeping those details current matters. Third, once you are in a wave there is no going back to Phase 1 behaviour, even if your revenue later dips below the threshold. Because the thresholds keep stepping down, the safest assumption for any growing business is that Phase 2 is coming, and the only real question is which wave. Treating it as inevitable removes the temptation to delay software decisions until the last quarter before a deadline, when integration partners are busiest.

Technical requirements: XML, QR code and cryptographic stamp

Phase 2 invoices are not just “a nicer PDF”. They must meet strict technical standards so ZATCA’s systems can read, validate and stamp them automatically. The three pillars are the file format, the QR code, and the cryptographic stamp.

1. XML format

Invoices must be produced in XML based on UBL 2.1, or as a PDF/A-3 file with the XML embedded. The XML carries every mandatory field — seller and buyer details, VAT registration numbers, line items, VAT category and rate, totals, timestamp and a UUID (a unique universal identifier for each invoice).

2. The QR code

Every invoice must carry a QR code encoded in TLV (Tag-Length-Value) format and Base64. In Phase 1 the QR held five fields (seller name, VAT number, timestamp, invoice total, VAT total). In Phase 2 it expands to nine fields, adding the invoice hash, the ECDSA digital signature, the public key, and ZATCA’s certificate stamp. The printed QR code should be at least roughly 2×2 cm so it scans reliably.

3. The cryptographic stamp and CSID

Each Phase 2 invoice is digitally signed using a cryptographic stamp (an ECDSA digital signature of the invoice hash). To do this, the business onboards its invoicing solution with ZATCA and obtains a Cryptographic Stamp Identifier (CSID) — effectively a digital certificate that proves the invoice came from your registered system and was not altered. The hash is generated with SHA-256, and each invoice links to the previous one to form a tamper-evident chain.

It helps to understand the two transaction models in Phase 2. For a standard (B2B/B2G) invoice, the flow is “clearance”: your system generates the signed XML invoice, sends it to Fatoora, and ZATCA validates and returns a cleared copy with its own stamp before you share it with the buyer. The buyer effectively receives a ZATCA-cleared document. For a simplified (B2C) invoice, the flow is “reporting”: you issue the stamped invoice to the customer immediately at the point of sale, then report it to ZATCA within 24 hours. This is why retail and restaurant point-of-sale systems must be able to sign locally and queue reports, while accounting systems for B2B sellers must call the clearance API in near real time.

Getting a company set up correctly is part of the wider company formation in Saudi Arabia process, since e-invoicing registration follows your Commercial Registration and VAT registration.

Choosing ZATCA-compliant e-invoicing software

You cannot comply with Phase 2 using a plain accounting template — you need a solution that is technically capable of integrating with Fatoora and that has been onboarded with a CSID. When selecting software, check that it:

• Generates invoices in compliant XML / PDF-A3 with all mandatory fields and a UUID.
• Produces the Phase 2 QR code with all nine TLV tags.
• Supports the cryptographic stamp and can store and renew the CSID.
• Connects to the Fatoora platform API for clearance (standard) and reporting (simplified) in real time.
• Handles credit and debit notes and keeps tamper-resistant archives.
• Supports Arabic as the primary invoice language.

ZATCA does not certify a fixed “approved vendor” list in the way some assume; instead, the solution must pass ZATCA’s onboarding and compliance checks. Many SMEs use cloud accounting platforms with built-in ZATCA modules, while larger enterprises integrate ERP systems (such as SAP) through a middleware connector. Whatever you choose, run a test integration in ZATCA’s sandbox before your wave deadline.

There are broadly three routes to a compliant setup. A cloud accounting platform with a native ZATCA module is the fastest and cheapest path for most small and medium businesses; the vendor maintains the integration as ZATCA updates its standards. An ERP plus middleware approach suits larger groups that already run SAP, Oracle or Microsoft Dynamics and need e-invoicing to sit inside existing finance processes. A fully in-house build against ZATCA’s published technical guidelines is possible but rarely worth it for anyone except very large enterprises with strong engineering teams, because the cryptographic, QR and clearance logic must be maintained as the rules evolve. Whichever route you take, budget time for onboarding, sandbox testing and staff training, and confirm the vendor handles credit/debit notes, multi-branch operations and Arabic-first formatting. A good question to ask any vendor is how quickly they shipped updates when ZATCA last changed its requirements — that responsiveness is what keeps you compliant over time.

Penalties for non-compliance

ZATCA enforces e-invoicing actively, and the penalties scale with the severity and repetition of the violation. Reported fines for e-invoicing and VAT-related breaches generally range from SAR 5,000 to SAR 50,000, and ZATCA often issues a warning for a first, minor violation before escalating. Common penalised issues include:

• Not issuing invoices in the required electronic format.
• Missing or non-compliant QR codes or mandatory fields.
• Failing to integrate with Fatoora by your wave deadline.
• Deleting or altering invoices after issuance, or failing to store them properly.
• Not reporting simplified invoices within the required 24-hour window.

Beyond fines, a non-compliant invoice may not be accepted by your B2B customers, which can stall payment. Treat the wave deadline as a hard commercial date, not just a tax formality. Confirm current penalty schedules on the ZATCA portal, as ZATCA periodically updates its enforcement approach.

It is also useful to understand how ZATCA tends to escalate. For first-time or genuinely minor slips, the authority commonly issues a notification and a short window to correct the issue before any monetary penalty applies. Repeated or deliberate violations — for example, continuing to issue non-compliant invoices after a warning, or tampering with stored records — sit at the higher end of the range and can recur per breach. Because invoices are now cleared or reported to ZATCA close to real time, discrepancies are visible to the authority far sooner than in the paper era, so the practical lesson is to fix problems immediately rather than hope they go unnoticed. Keeping a clean, complete and uneditable archive of every issued invoice is the single best protection during any review or audit.

How a new company complies with Fatoora from day one

If you are forming a company in Saudi Arabia in 2026, e-invoicing is not an afterthought — it is part of becoming operational. A new business should sequence it like this:

1. Complete formation first. Obtain your MISA investment licence (for foreign investors) and your Commercial Registration through the Ministry of Commerce / Saudi Business Center.
2. Register for VAT with ZATCA. VAT registration is mandatory once your taxable supplies exceed the threshold, and voluntary below it. Your VAT number is central to every invoice.
3. Select compliant invoicing software that already supports Phase 2.
4. Onboard with Fatoora. Generate your CSID and complete the integration and compliance checks in ZATCA’s portal.
5. Test, then go live. Issue test invoices in the sandbox, confirm clearance and reporting work, then start issuing live e-invoices.

Because a new company is starting fresh, it is far simpler to launch directly on a Phase-2-ready solution than to retrofit later. If you are still mapping your licence and registrations, our guide to the MISA license in Saudi Arabia explains the upstream steps that precede VAT and e-invoicing.

A common question from founders is whether a brand-new company must integrate with Fatoora on day one. In practice, your obligation depends on your VAT status and the wave criteria, but the smart approach is to assume Phase 2 from the start: pick software that is already integrated, so that the very first invoice you issue is fully compliant. This avoids a costly migration once your revenue crosses a threshold, removes the risk of issuing non-compliant invoices to your earliest customers, and means your finance processes, QR codes and cryptographic stamping are correct before volume builds. For most new ventures, the incremental cost of starting on a compliant cloud platform is small relative to the cost and disruption of fixing it later — and it presents a clean, professional image to B2B clients who increasingly expect a ZATCA-cleared invoice. Aligning formation, VAT registration and e-invoicing into one onboarding sequence is the cleanest way to launch.

Common mistakes to avoid

• Waiting for the notification before preparing. ZATCA notifies you six months ahead, but software onboarding and testing take time — start early.
• Assuming a PDF is enough. A plain PDF is not a Phase 2 e-invoice; you need compliant XML, a UUID and a cryptographic stamp.
• Forgetting the QR code on B2C invoices, or using a Phase 1 five-field QR after moving to Phase 2.
• Editing or deleting issued invoices. Corrections must be made via credit or debit notes, not by altering the original.
• Missing the 24-hour reporting window for simplified invoices.
• Ignoring CSID renewal, which can quietly break your integration when the certificate expires.
• Confusing your wave threshold — verify your exact VATable revenue against the official wave criteria rather than guessing.

Key takeaways for 2026

ZATCA e-invoicing through Fatoora is now a settled, two-phase reality. Phase 1 made invoices digital; Phase 2 connects you to ZATCA in real time with XML, a nine-field QR code and a cryptographic stamp. In 2026, Wave 23 (over SAR 750,000, deadline 31 March 2026) and Wave 24 (over SAR 375,000, deadline 30 June 2026) bring most VAT-registered businesses into integration. For a new company, the path is simple: form the entity, register for VAT, choose Phase-2-ready software, onboard with Fatoora, test, and go live — well before your wave deadline.

Frequently Asked Questions

What is ZATCA e-invoicing (Fatoora) in Saudi Arabia?

Fatoora is Saudi Arabia’s mandatory electronic invoicing system, run by ZATCA (the Zakat, Tax and Customs Authority). Every VAT-registered business must issue tax invoices through a compliant electronic solution instead of paper or basic PDFs. It runs in two phases — Generation (since December 2021) and Integration (since January 2023) — with invoices sent to ZATCA’s Fatoora platform in Phase 2.

What is the difference between Phase 1 and Phase 2 of ZATCA e-invoicing?

Phase 1 (Generation), live from 4 December 2021, required businesses to create and store invoices electronically with a QR code on B2C invoices. Phase 2 (Integration), live from 1 January 2023 in waves, requires real-time API connection to ZATCA’s Fatoora platform, XML format, a UUID, a cryptographic stamp, an upgraded nine-field QR code, and clearance or reporting of invoices.

Which ZATCA Fatoora wave applies to my business in 2026?

In 2026, Wave 23 covers taxpayers with VATable revenue above SAR 750,000 in 2022, 2023 or 2024, with an integration deadline of 31 March 2026. Wave 24 covers those above SAR 375,000 in the same years, with a deadline of 30 June 2026. ZATCA notifies each taxpayer at least six months before their deadline — confirm your wave on the ZATCA portal.

What is the revenue threshold for ZATCA Phase 2 in 2026?

By mid-2026 the threshold reaches SAR 375,000 in VATable revenue (Wave 24, deadline 30 June 2026), down from SAR 750,000 for Wave 23 (deadline 31 March 2026). This means most VAT-registered businesses, including the majority of SMEs, fall within Phase 2 integration in 2026. Thresholds are based on revenue in 2022, 2023 or 2024.

What are the technical requirements for a ZATCA Phase 2 e-invoice?

A Phase 2 e-invoice must be in XML (UBL 2.1) or PDF/A-3 with embedded XML, carry a UUID, and include a TLV-encoded, Base64 QR code with nine fields. It must be digitally signed with a cryptographic stamp (an ECDSA signature of the SHA-256 invoice hash) using a CSID obtained from ZATCA, and integrated with the Fatoora platform for clearance or reporting.

What software do I need to comply with ZATCA Fatoora?

You need an e-invoicing solution capable of producing compliant XML/PDF-A3 invoices with a UUID, generating the nine-field Phase 2 QR code, applying the cryptographic stamp using a CSID, and integrating with the Fatoora API for clearance and reporting. SMEs often use cloud accounting platforms with ZATCA modules; larger firms integrate ERPs like SAP. Always test in ZATCA’s sandbox before going live.

What are the penalties for not complying with ZATCA e-invoicing?

Penalties for e-invoicing and related VAT violations generally range from SAR 5,000 to SAR 50,000, depending on the breach and whether it is repeated. ZATCA often issues a warning for a first minor violation before escalating. Common issues include missing QR codes, non-compliant formats, failing to integrate by the wave deadline, and altering or deleting issued invoices. Confirm current schedules on the ZATCA portal.

How does a new company in Saudi Arabia comply with Fatoora?

A new company should first complete formation (MISA licence and Commercial Registration), then register for VAT with ZATCA, select Phase-2-ready invoicing software, onboard with Fatoora to obtain a CSID, run test invoices in the sandbox, and then go live issuing compliant e-invoices. Starting directly on a Phase 2 solution is far simpler than retrofitting compliance later.