ediverse

Type to search across standards, messages, tools and glossary.

ediverse Explore the platform

Spotlight PEPPOL BIS Billing 3.0 The EU e-invoicing mandate is here — France Sept 2026, Belgium Jan 2026, Germany 2025.

— 01

Foundations

— 02

Standards

— 03

Flagship messages

— 04

Tools

— May 15, 2026 · 8 min read

Saudi e-invoicing: ZATCA phases, FATOORA, integration

Saudi Arabia has rolled out, in five years, one of the most structured e-invoicing schemes in the world. Phase 1 mandatory since December 2021, Phase 2 integration rolling out in waves since January 2023: a tour of a framework combining real-time clearance, cryptographic signature and tailored UBL.

ZATCA, the unified tax authority

ZATCA — Zakat, Tax and Customs Authority — is the Saudi public body created in May 2021 by merging the GAZT (General Authority of Zakat and Tax) and the GAC (General Authority of Customs). It reports to the Ministry of Finance and oversees the VAT introduced in 2018 at a standard rate of 15% (raised from 5 to 15% in July 2020 following the drop in oil revenue). VAT-invoice dematerialisation is part of its modernisation plan: E-Invoicing Regulation published on 4 December 2020, phased into force across two phases.

Phase 1 — Generation Phase (4 December 2021)

Phase 1, the Generation Phase, came into force on 4 December 2021. It required every VAT-liable taxable person established in Saudi Arabia to generate invoices electronically in a structured format. Concretely, the issuer must:

  • produce an electronic invoice in XML (UBL 2.1) or in PDF/A-3 with embedded XML;
  • embed a QR code on B2C invoices (simple TLV in Phase 1) carrying five minimum fields: seller name, VAT number, issue date and time, total amount including VAT, and VAT amount;
  • store the invoice in electronic form for the legal retention period (6 years for VAT records);
  • ban any manual edit of an invoice after issuance — any correction must go through a credit or debit note, never through reissuance.

At this stage, the invoice is not sent to ZATCA in real time; it is merely generated in a normalised form. The Phase 1 goal is to standardise the format before integration into the ZATCA backend.

Phase 2 — Integration Phase (since January 2023, in waves)

Phase 2, the Integration Phase, started on 1 January 2023 for the first wave of taxable persons (VAT-taxable revenue above SAR 3 bn in 2021). It introduces technical integration with ZATCA's FATOORA platform and mandates a clearance model in real time for B2B invoices and a reporting model within 24h for B2C invoices.

Phase 2 rolls out in successive waves, announced by ZATCA roughly 6 months in advance, each wave targeting a lower revenue threshold. By 2026, more than twenty waves have been announced, gradually covering the full taxable-persons base in the country. The typical observed rhythm: one wave entering into force every two or three months.

XML structure: tailored UBL 2.1

The mandated technical format is UBL 2.1 with restrictions and extensions defined by ZATCA in its E-Invoicing Resolution and Detailed Technical Guidelines. The XML root is Invoice for an invoice, and CreditNote or DebitNote for credit or debit notes.

Three elements make a ZATCA invoice specific compared with generic UBL 2.1:

  • a mandatory ProfileID with a fixed ZATCA value (reporting:1.0 for B2C, tax-invoice:1.0 for B2B);
  • an InvoiceTypeCode with a special name attribute encoding ZATCA flags over four characters (0100000 for standard B2B, 0200000 for simplified B2C, etc.);
  • a cryptographic UBLExtensions extension carrying the invoice's XAdES signature, the base64 TLV (Tag-Length-Value) QR code, and the SHA-256 hash of the previous invoice for the ZATCA chain.

Signature, certificate and chain

Every Phase 2 invoice must carry a XAdES-BES signature compliant with the ZATCA profile. The certificate used is issued by the FATOORA Enterprise Identity Service after taxpayer onboarding. Onboarding goes through a CSR (Certificate Signing Request) emitted from the invoicing system and submitted to FATOORA; FATOORA returns the signed certificate, valid for 1 year and revocable.

The hash of the previous invoice forms a cryptographic chain within the sequence: invoice N carries the SHA-256 of invoice N-1, preventing any silent insertion or removal of an invoice in the sequence. ZATCA can audit the sequence by requesting the ICV (Invoice Counter Value) hash at any time.

TLV QR code and mobile lookup

The mandatory QR code is encoded in TLV (Tag-Length-Value) with nine tags defined by ZATCA in Phase 2 (five in Phase 1): seller name (tag 1), VAT number (tag 2), timestamp (tag 3), total including VAT (tag 4), VAT amount (tag 5), XML hash (tag 6), XAdES signature (tag 7), certificate public key (tag 8), ECDSA signature of the key (tag 9). The whole is base64-encoded and compressed to fit inside a QR code readable by ZATCA's official mobile application ("FATOORA Lookup").

The mobile app lets a consumer instantly authenticate an invoice by scanning its QR code, and report it if non-compliant — a consumer-scale anti-fraud tool for VAT.

Credit and debit notes

Corrections in Saudi Arabia must go through notes: CreditNote to partially or fully cancel an invoice (refund, return, commercial discount), DebitNote to increase an invoice (additional charges, penalties, price adjustment). Every note must reference the original invoice through cac:BillingReference/cac:InvoiceDocumentReference/cbc:ID and carry its own ZATCA profile, signature and QR code.

Credit and debit notes are also subject to clearance or reporting depending on their B2B or B2C nature. A B2B note goes through the real-time clearance flow, like the invoice it corrects.

Integrating FATOORA: technical path

The integration path is documented in the Onboarding and Integration Guidelines published by ZATCA. The main steps on the software vendor side:

  • Onboarding: generate a CSR from the invoicing module, send it to FATOORA via the /compliance/csids API with a One-Time Password (OTP) supplied by the taxpayer from its ZATCA portal. Retrieve the issued certificate.
  • Compliance check: submit a set of test invoices (standard tax invoice, simplified tax invoice, credit note, debit note) to FATOORA via /compliance/invoices. ZATCA validates module conformance.
  • Production: once compliance check is passed, the taxpayer is authorised to submit real invoices via /invoices/reporting/single (B2C) or /invoices/clearance/single (B2B).
  • Renewal: certificates expire after 1 year and must be renewed via /csid/renew.

A reference model for the Middle East

The ZATCA approach — real-time B2B clearance, 24h B2C reporting, XAdES signature, SHA-256 chain, TLV QR code — has become a regional reference. The United Arab Emirates (FTA), Bahrain, Jordan and Egypt announced in 2025 and 2026 models inspired by the same scheme. The initial investment for a software vendor is significant (typically 6 to 12 months of work: cryptographic chain, certificate management, ZATCA compliance), but the model is technically coherent and the official documentation is high quality.

For European vendors deploying a multi-jurisdiction module, ZATCA is often the first non-EU country tackled after the EU stack (PEPPOL, XRechnung, Factur-X). See also the EU e-invoicing roadmap 2025-2030 for contrast with the ViDA decentralised model.