ZATCA E-Invoicing Guide for Saudi SMEs (2026)

1. What is ZATCA e-invoicing?

ZATCA e-invoicing (الفوترة الإلكترونية) is Saudi Arabia's mandatory electronic invoicing system, introduced by the Zakat, Tax and Customs Authority (هيئة الزكاة والضريبة والجمارك). It requires all VAT-registered businesses to generate invoices in a specific digital format and share them with ZATCA's central system — called Fatoora (فاتورة) — in real time.

This isn't just about sending PDFs by email. ZATCA e-invoicing requires invoices to be structured in a specific XML format (UBL 2.1), signed with a cryptographic certificate, stamped with a QR code, and in Phase 2, transmitted directly to ZATCA's API within seconds of creation.

The goal of the system is to reduce tax fraud, improve VAT collection, and create a transparent digital economy — key pillars of Saudi Arabia's Vision 2030.

2. Who needs to comply?

All businesses registered for VAT in Saudi Arabia must comply with e-invoicing requirements. VAT registration is mandatory for businesses with annual taxable revenue exceeding SAR 375,000. If your business crosses this threshold, you are required to:

• Issue all tax invoices in the ZATCA-approved electronic format
• Archive all e-invoices for at least 6 years
• In Phase 2: integrate directly with ZATCA's Fatoora platform

Businesses below the SAR 375,000 threshold are not required to register for VAT, but if you are growing toward this threshold, now is the time to prepare. Many businesses choose to voluntarily register for VAT at SAR 187,500 in revenue.

Non-resident businesses making taxable supplies in Saudi Arabia are also subject to VAT and e-invoicing requirements.

3. The ZATCA waves explained

ZATCA is rolling out Phase 2 (real-time integration) in waves, based on business annual revenue. Each wave sets a specific deadline for a group of businesses. Here is the wave timeline:

• Phase 1 — December 4, 2021: All VAT-registered businesses must generate e-invoices (no real-time transmission required yet)
• Wave 1 — January 1, 2023: Businesses with > SAR 3 billion annual revenue
• Wave 2 — July 1, 2023: Businesses with > SAR 500 million annual revenue
• Waves 3-23 (2023-2025): Progressively lower revenue thresholds
• Wave 24 — June 30, 2026: Businesses with annual revenue between SAR 375,000 and SAR 1.5 million — this is where most Saudi SMEs fall

If your business has annual revenue above SAR 375,000, you must be fully integrated with ZATCA's Fatoora system by June 30, 2026. This is not optional.

4. Phase 1 vs Phase 2: What's the difference?

ZATCA e-invoicing has two phases with very different technical requirements:

Phase 1 — Generation Phase (since December 2021)

• Generate invoices with a QR code (TLV-encoded, containing seller name, VAT number, timestamp, invoice total, VAT amount)
• Store invoices electronically for at least 6 years
• No real-time transmission to ZATCA required
• Invoices can be in XML or PDF/A-3 format

Phase 2 — Integration Phase (your deadline is Wave 24)

• Full UBL 2.1 XML format required for all invoices
• Cryptographic digital signatures using ZATCA-issued certificates (CSID)
• Real-time clearance: tax invoices transmitted to ZATCA Fatoora API and cleared before sending to customer
• Reporting invoices (simplified) reported within 24 hours
• Unique invoice counter and hash chain for audit trail
• ZATCA can reject non-compliant invoices in real time

Phase 2 is significantly more technical than Phase 1. Without a platform like Imtisal, implementing Phase 2 requires hiring software developers or purchasing expensive ERP software.

5. Technical requirements

The ZATCA Fatoora system has strict technical specifications. Here is what your invoices must include:

• XML format: UBL 2.1 (Universal Business Language) conforming to ZATCA's technical specifications document
• Digital signature: XML DSig using a Certificate Signing Request (CSR) approved by ZATCA's Compliance Invoice Signing Infrastructure (CISI)
• QR code: TLV-encoded base64 containing 5 data fields: seller name, VAT registration number, timestamp, invoice total, VAT amount
• Hash chain: Each invoice references the hash of the previous invoice, creating an immutable audit trail
• Invoice counter: Sequential counter (ICV) maintained per device/solution
• UUID: Universally unique identifier for each invoice

Important: You do not need to understand any of this to use Imtisal. Our platform handles all technical requirements automatically — you just fill in the invoice details.

6. What are the penalties?

Non-compliance with ZATCA e-invoicing carries significant financial penalties. Here is the penalty structure:

• First violation: Warning
• Second violation: Fine between SAR 1,000 and SAR 5,000
• Third and subsequent violations: Fine between SAR 5,000 and SAR 50,000
• Fraudulent invoices: Up to SAR 100,000 per violation plus potential criminal prosecution

ZATCA can audit your invoices at any time and cross-reference them against your VAT returns. Discrepancies trigger automatic alerts in their system. In 2025, ZATCA issued enforcement actions against over 2,000 businesses for e-invoicing non-compliance.

Beyond financial penalties, non-compliance can result in delays in processing your VAT refunds, difficulty obtaining government contracts, and reputational damage with business partners.

7. How to get started with Imtisal

Getting ZATCA-compliant with Imtisal takes less than 2 hours:

• Step 1: Sign up for Imtisal (takes 5 minutes)
• Step 2: Enter your Commercial Registration number and VAT registration number
• Step 3: Imtisal automatically configures your account for ZATCA compliance based on your wave assignment
• Step 4: Create your first invoice using our simple form — we handle the XML, digital signatures, QR code, and Fatoora submission
• Step 5: Receive ZATCA's clearance confirmation in real time

8. Frequently asked questions

Do I need to buy special hardware or software?

No. Imtisal is a cloud-based platform accessible from any browser. No hardware, no installation, no ERP system required.

Can I import my existing customers and products?

Yes. Imtisal allows you to import customer and product data via CSV. You can also add them manually.

What happens if ZATCA rejects an invoice?

Imtisal will show you the exact rejection reason from ZATCA in plain language, with guidance on how to fix it. You can correct and resubmit within seconds.

Do I need a separate device for each branch?

Imtisal handles multi-branch scenarios. Each branch can have its own invoice counter and device ID within your account.

What about credit notes and debit notes?

Yes, Imtisal supports debit notes (DN) and credit notes (CN) as required by ZATCA — including linking them back to the original invoice.

Can I issue invoices in foreign currencies?

Yes. Imtisal supports multi-currency invoicing. All invoices are converted to SAR equivalent for VAT purposes as required by ZATCA.

What if ZATCA's system is down?

ZATCA allows offline invoice generation during system outages, with batch submission when connectivity is restored. Imtisal handles this automatically.

How long does it take to get ZATCA certification?

With Imtisal, the CSID (Compliance Solution Identifier) onboarding process is automated and typically takes under 1 hour.

Is VAT on my Imtisal subscription recoverable?

Yes. Imtisal issues ZATCA-compliant invoices for all subscription fees. The 15% VAT charged is fully recoverable as input tax in your VAT return.

What if I missed the deadline?

Getting compliant immediately is always better than waiting. ZATCA's enforcement is progressive — the sooner you comply after a missed deadline, the lower your potential penalty exposure. Contact us and we'll help you get compliant as fast as possible.