Saudi Arabia’s Zakat, Tax and Customs Authority (ZATCA) is rolling out mandatory e-invoicing wave by wave, with Wave 24 pulling in businesses down to SAR 375,000 in VAT-taxable revenue by 30 June 2026. This guide explains the two phases of the Fatoora system, the current wave schedule, the technical spec every ERP must meet, and the penalty relief window that closes at the same June 2026 deadline.
What is ZATCA e-invoicing (Fatoora)?
ZATCA e-invoicing, marketed under the name Fatoora, is Saudi Arabia’s mandatory electronic invoicing system for all VAT-registered businesses. It replaces paper and free-form PDF invoices with structured XML documents that carry a QR code, a UUID, and — in Phase 2 — a cryptographic signature and a link to the previous invoice hash (ZATCA).
The system runs in two phases: a Generation phase that started on 4 December 2021 and applies to every VAT-registered business, and an Integration phase that started on 1 January 2023 and is being rolled out wave by wave based on annual VAT-taxable revenue.
What are Phase 1 and Phase 2 of Saudi e-invoicing?
Phase 1 (Generation) requires every VAT-registered taxpayer to issue structured electronic invoices from a compliant e-invoicing solution, store them electronically, and stop issuing handwritten or unstructured PDF invoices. Phase 1 applied to all businesses simultaneously from 4 December 2021.
Phase 2 (Integration) adds real-time or near-real-time connection to ZATCA’s Fatoora platform. Standard tax invoices (B2B) must be cleared by ZATCA before being shared with the buyer, while simplified tax invoices (B2C) must be reported to ZATCA within 24 hours of issuance. Phase 2 is being rolled out in waves; each wave is announced with at least six months’ notice.
Which ZATCA wave am I in?
The wave a business falls into is determined by its VAT-taxable revenue in 2022, 2023, or 2024 — the highest year triggers the earliest wave. Businesses above a wave’s revenue threshold must complete Phase 2 integration by that wave’s deadline.
| Wave | Revenue threshold (any of 2022–2024) | Integration deadline |
|---|---|---|
| Wave 22 | SAR 1 million | 31 December 2025 |
| Wave 23 | SAR 750,000 | 31 March 2026 |
| Wave 24 | SAR 375,000 | 30 June 2026 |
Wave 24 was announced on 26 September 2025 and pulls the majority of Saudi SMEs into Phase 2. ZATCA has confirmed it will continue rolling out subsequent waves down to smaller taxpayers, with each new wave giving at least six months of preparation time (EY tax alert).
What are the technical requirements for ZATCA Phase 2?
Every compliant Phase 2 invoice must be an XML file in the UBL 2.1 format, embedded with a QR code (Base64-encoded, TLV structure), a UUID, and a cryptographic stamp signed with a certificate obtained from the Fatoora Portal. Each invoice must also carry a hash of the previous invoice, creating a tamper-evident chain across a taxpayer’s issuance history.
Two invoice types with different flows must be supported:
| Invoice type | Use case | ZATCA flow |
|---|---|---|
| Standard Tax Invoice | B2B, B2G | Real-time clearance — invoice must be sent to Fatoora and cleared before delivery to buyer |
| Simplified Tax Invoice | B2C | Reporting within 24 hours — invoice issued to buyer immediately, reported to Fatoora afterwards |
Software vendors must onboard to the Fatoora Portal, obtain a Cryptographic Stamp Identifier (CSID), and pass ZATCA’s compliance tests before being certified. Businesses using a certified solution inherit that compliance; those on custom or legacy systems must complete the same technical onboarding themselves.
What are the penalties for missing ZATCA e-invoicing rules?
ZATCA applies fines from SAR 1,000 for a first offence up to SAR 50,000 for repeated violations under the VAT Law framework. Non-compliant invoices can be rejected in full, which blocks the buyer’s VAT deduction and can freeze receivables. In severe or repeat cases, businesses are excluded from government procurement.
ZATCA is currently running the Cancellation of Fines and Exemption of Penalties Initiative, which waives fines for taxpayers who voluntarily register, submit outstanding returns, or correct past e-invoicing errors — the initiative ends on 30 June 2026, aligning with the Wave 24 deadline. Businesses catching up on missed compliance should file within this window to avoid retrospective penalties (VATupdate).
How does ZATCA e-invoicing compare with UAE e-invoicing?
Both regimes converge on a similar architecture — clearance for B2B, reporting for B2C, and a national portal — but the UAE runs on the Peppol network with a mandatory Accredited Service Provider (ASP) layer, while Saudi Arabia runs a direct API connection to the Fatoora Portal. The UAE mandate applies to businesses above AED 50 million in revenue from 1 January 2027 (see our UAE e-invoicing guide), whereas ZATCA has already scaled its mandate down to SAR 375,000 — a very different depth of market coverage.
Cross-border businesses selling into both markets need to plan for two parallel technical integrations: an ASP-connected Peppol channel for the UAE and a Fatoora-connected XML channel for Saudi Arabia. Choosing an ERP or invoicing vendor certified for both is the practical path.
Sources
- ZATCA official rollout phases — ZATCA e-invoicing portal.
- Wave 24 threshold and deadline — VATupdate Saudi Arabia Wave 24 briefing.
- Wave announcement mechanics — EY tax alert on Wave 23.