ZATCA’s e‑invoicing program, known as FATOORA, is now the standard for issuing VAT invoices in Saudi Arabia. This guide explains three things in plain language. Who qualifies as in scope. Which invoices qualify as valid. What it takes to qualify your invoicing solution so invoices clear or report correctly and are accepted for input VAT.
Who qualifies as in scope for FATOORA
- All VAT‑registered taxpayers resident in Saudi Arabia are in scope. Non‑resident taxpayers are excluded. Phase 1 has applied since December 4, 2021.
- Phase 2 integration is being enforced in waves. ZATCA provides at least six months’ notice to targeted taxpayers before their go‑live window.
- As of September 26, 2025, ZATCA’s 24th wave covered taxpayers whose revenues subject to VAT exceeded SAR 375,000 in 2022, 2023, or 2024. This means most standard VAT registrants are now required to integrate.
For company setup and VAT registration context, see Business Setup in Saudi Arabia. Step‑by‑Step Guide
Which invoices qualify as FATOORA compliant
ZATCA recognizes two invoice families under VAT. Standard tax invoices for B2B and B2G. Simplified tax invoices for B2C and certain low‑value supplies. Both must carry specific content and format.
Core format requirements
- Invoices and related notes must be generated in XML or PDF/A‑3 with embedded XML.
- QR code content is mandatory and expands in Phase 2. QR must follow the TLV Base64 structure with additional tags in Phase 2.
- Cryptographic stamp using a CSID links the invoice to an onboarded solution unit. For simplified invoices, the stamp is applied by the taxpayer’s EGS solution. The FATOORA platform does not stamp simplified documents.
Clearance versus reporting
- Standard invoices follow real‑time clearance. The invoice is validated by ZATCA before you share it with the buyer.
- Simplified invoices follow reporting. They must be reported to ZATCA within 24 hours of issuance.
Input VAT eligibility
To claim input VAT, the e‑invoice must have been cleared or reported according to Phase 2 rules for your wave. This is stated in the E‑Invoicing Implementation Resolution.
What does “solution qualification” really mean?
You do not have to buy from a vendor on a single official registry to be compliant. ZATCA publishes an indicative directory of solution providers who passed ZATCA’s qualification process, yet a taxpayer can be compliant even if their provider is not listed, as long as the solution meets the requirements.
Minimum capabilities your solution must demonstrate
- Onboarding to the FATOORA Portal and obtaining a Cryptographic Stamp Identifier (CSID) for each EGS unit. This uses the developer and FATOORA portal flow and APIs.
- Security features as per ZATCA standards. CSID‑based signing, QR generation, OAuth, hash requirements, and anti‑tamper controls.
- Correct XML and business rules as per the Detailed Technical Guidelines and XML Implementation Standard.
- Clearance and reporting integrations. clearance for standard invoices. 24‑hour reporting for simplified invoices.
Want us to check if your ERP or POS already qualifies. Request a 30‑minute ZATCA FATOORA readiness check and we will validate CSID onboarding, QR, XML, and the 24‑hour reporting flow.
Step‑by‑step. How to qualify your business and system
- Confirm your wave and deadline. ZATCA will notify at least six months in advance. Add integration to your project plan.
- Prepare master data. Arabic descriptions, VAT numbers, branch identifiers, tax treatments, and customer classifications aligned to VAT rules.
- Onboard your EGS unit(s). Use the FATOORA Portal to generate OTPs, raise the CSID request, and complete onboarding.
- Implement security features. Apply cryptographic stamping and QR code as specified.
- Integrate for clearance and reporting. Submit standard invoices for real‑time clearance. set automated 24‑hour reporting for simplified invoices.
- Archive correctly. Keep e‑invoices and records per VAT record‑keeping rules. minimum 6 years retention from the end of the tax period, with longer periods for certain capital assets.
Helpful readings from our blogs:
- Business Setup in Saudi Arabia. Step‑by‑Step Guide
- Government Relations and PRO Services
Documents and inputs you will typically need
- TIN and portal credentials, plus OTPs generated in the FATOORA portal during onboarding.
- EGS unit identifiers and a CSR to obtain your CSID.
- Sample XML invoices and notes for compliance checks in the developer portal and sandbox.
Security configuration for cryptographic stamping and QR, aligned to ZATCA standards.
Common pitfalls that break invoice qualification
- Sharing standard invoices with buyers before clearance. the invoice may be invalid.
- Missing the 24‑hour reporting window for simplified invoices.
- Using non‑compliant QR or skipping CSID‑based cryptographic stamping.
- Not archiving invoices according to VAT record‑keeping rules.
Frequently Asked Questions:
Who must comply with FATOORA now
All resident VAT‑registered taxpayers are in scope. Phase 2 is in waves with six‑month notice. The 24th wave reached those with VAT revenues over SAR 375,000 in 2022, 2023, or 2024.
What makes an invoice “qualified” for input VAT
It must follow the format rules, be cleared if it is a standard invoice, or reported within 24 hours if simplified. This is required to claim input VAT.
Do I need a “ZATCA‑listed” vendor
No. ZATCA’s list is indicative only. you are compliant if your solution meets the technical and security requirements.
What is CSID
The Cryptographic Stamp Identifier issued via the developer and FATOORA portals. it allows your solution unit to stamp invoices and identify your device.
Conclusion
If you are VAT registered in the Kingdom, FATOORA is part of day‑to‑day operations. Confirm your wave. onboard your EGS unit. apply the security features. then clear or report invoices correctly. When your invoices, systems, and archives meet these requirements, you are fully qualified to issue and receive VAT‑deductible e‑invoices.
Need a quick overview of where you stand? Request a short readiness brief and we’ll highlight the key steps and any gaps to address.
If your operations include factory or automation lines that integrate with ERP or POS, see How to Start an Automation Business in Saudi Arabia
