What Is Fatoorah and Why Did ZATCA Mandate It?
Fatoorah is the ZATCA (Zakat, Tax and Customs Authority) mandatory e-invoicing system in Saudi Arabia. It was rolled out from December 2021 in two phases. Phase 1 requires all VAT-registered businesses to issue electronic invoices in a specified format (simplified for B2C, standard for B2B/B2G). Phase 2 requires real-time transmission of invoice data to ZATCA's FATOORAH platform so the authority can verify transactions and combat VAT fraud.
For any Saudi Arabia market entry or existing business, e-invoicing is non-negotiable once you are VAT-registered. It affects how you generate, store, and report invoices and links directly to your ongoing compliance and VAT filing.
Who Must Comply With E-Invoicing?
All businesses and individuals registered for VAT in Saudi Arabia must comply with Phase 1. That means generating e-invoices (simplified or standard) in the required format from your first taxable supply. Phase 2 compliance is being rolled out in waves by annual revenue — ZATCA notifies each wave of the go-live date. Once your wave is called, you must integrate your billing system with ZATCA and transmit invoices in real time.
Phase 1 — Invoice Generation Requirements
Phase 1 (effective from 4 December 2021 for most) requires that every tax invoice or simplified tax invoice is issued in electronic form and contains the mandatory fields specified by ZATCA. Simplified invoices are used for B2C (consumer) sales; standard invoices are used for B2B and B2G. The invoice must include seller and buyer details, VAT number, line items, totals, and (for Phase 2 readiness) a QR code and UUID. Invoices can be generated from ERP, billing software, or a compliant point-of-sale system.
Phase 2 — Real-Time Integration With ZATCA
Phase 2 requires that each e-invoice is transmitted to ZATCA's platform in real time (or near real time) using the FATOORAH API. The taxpayer must obtain a CSID (Cryptographic Stamp Identifier) from ZATCA and integrate their system so that every invoice is signed and sent to ZATCA upon issuance. ZATCA returns a clearance status. Phase 2 is being rolled out in waves by annual revenue — the highest revenue taxpayers were required first (e.g. Wave 1: companies with revenue above SAR 3 billion, December 2022), with smaller businesses brought in over time. Check ZATCA's official wave list for your deadline.
Technical Requirements and Invoice Format (XML/PDF-A3)
Invoices must be generated in XML format conforming to ZATCA's schema. They must include a QR code, UUID, and (for Phase 2) a cryptographic stamp. A human-readable version can be in PDF-A3. The QR code encodes key invoice data so that ZATCA and buyers can verify authenticity. Your ERP or billing provider must support the ZATCA schema — major systems (SAP, Oracle, Zoho, and others) have developed compliant solutions. Custom systems require development to output the correct XML and call the ZATCA API.
Phase 2 Wave Schedule — Is Your Business In Scope?
ZATCA has published wave schedules based on annual revenue. Wave 1 (December 2022) targeted the largest taxpayers (e.g. revenue above SAR 3 billion). Subsequent waves lower the revenue threshold. Smaller businesses are brought into Phase 2 according to the published timeline — check ZATCA's portal and announcements for the current wave list and your company's mandatory integration date. Even if your wave has not yet been called, preparing your systems (Phase 1 compliant format, QR, UUID) reduces the effort when Phase 2 becomes mandatory.
| Wave | Revenue (indicative) | Phase 2 date (indicative) |
|---|---|---|
| Wave 1 | > SAR 3 bn | Dec 2022 |
| Later waves | Lower thresholds | Per ZATCA announcement |
How to Implement — Step-by-Step
Step 1: Ensure Phase 1 — your billing system must generate e-invoices in ZATCA format (XML, QR, UUID). Step 2: When your Phase 2 wave is announced, register on the ZATCA compliance portal and obtain your CSID (Cryptographic Stamp Identifier). Step 3: Integrate your ERP or billing system with the ZATCA API so that each invoice is signed and transmitted on issuance. Step 4: Test in ZATCA's sandbox/compliance environment. Step 5: Go live by the deadline. Many companies use a certified e-invoicing solution provider or their ERP vendor's ZATCA package to avoid building from scratch.
Penalties for Non-Compliance
ZATCA can impose fines for e-invoicing violations. Penalties may reach SAR 5,000–50,000 for non-compliance (e.g. failure to issue e-invoices, failure to integrate in Phase 2, or issuing invoices that do not meet the technical requirements). Repeat or serious violations can attract higher amounts. Stay on top of your wave and technical requirements; include Fatoorah in your compliance calendar.