Saudi Arabia E-Invoicing (Fatoorah): What Foreign Businesses Need to Know



Does my foreign company need to comply with the "Fatoora" e-invoicing system in Saudi Arabia?

The short answer is yes—if your company is registered for VAT in the KSA and has a "permanent establishment" (such as a local Commercial Registration or a physical office). Non-resident companies providing services from abroad without a local presence are generally exempt from direct e-invoicing requirements, though their Saudi clients may still need to apply the reverse charge mechanism.

In this guide, we will break down the technical and regulatory framework to help you understand:

• The critical distinction between requirements for resident vs. non-resident entities.
• The final timeline for Wave 24 (the last mandatory phase) ends in June 2026.
• Advanced technical specifications, including XML UBL 2.1 formats and cryptographic stamps.
• The operational differences between B2B (Standard) and B2C (Simplified) invoice workflows.
• Practical steps to choose a ZATCA-qualified solution provider to avoid heavy non-compliance penalties.

What Is Fatoorah and Why Does It Matter?

Fatoorah (meaning "invoice" in Arabic) is the electronic invoicing system launched by the Zakat, Tax and Customs Authority (ZATCA). Part of Saudi Arabia’s Vision 2030, it replaces paper-based invoicing with a unified, secure digital standard.

For foreign businesses, this matters because compliance is not optional. If you operate in the Kingdom, you must follow Saudi tax rules. Standardized electronic invoices prevent tampering, increase transparency, and streamline VAT collection.

Who Must Comply: Resident vs. Non-Resident

Your tax residency status determines your compliance obligations.

According to ZATCA, You're a resident taxable person if you have a permanent location in Saudi Arabia. This includes:

• Commercial registration.
• Physical office or address in the Kingdom.
• Ongoing business activities in the country.

Resident foreign businesses face the same requirements as Saudi companies. You must integrate your systems with the Fatoorah platform according to your Wave deadline.

Non-resident businesses work differently. If you provide goods or services to Saudi customers without a permanent presence in the Kingdom, you typically don't need to issue e-invoices directly to ZATCA. However, your Saudi customers might need to self-bill or use reverse charge for VAT compliance.

E-invoicing Stages (The Two Phases of Implementation)

ZATCA divided implementation into two phases, with stricter requirements as they go.

Phase 1: Generation Phase

Phase 1 started on December 4, 2021. It required businesses to:

• Stop using paper invoices.
• Generate electronic invoices through compliant systems.
• Include mandatory fields (VAT registration numbers, invoice dates, item descriptions, VAT amounts)

You didn't need to submit these invoices to ZATCA in real-time.

Phase 2: Integration Phase

Phase 2 began on January 1, 2023, and continues rolling out through 2026. This phase is much more demanding – it's where things get serious. You must:

• * Generate invoices in [Universal Business Language (UBL) 2.1 XML format or PDF/A-3 with embedded XML.
• Add a digital signature to every invoice using a Cryptographic Stamp Identifier from ZATCA.
• Integrate your systems directly with ZATCA's platform through APIs for real-time validation.

For B2B transactions, you submit invoices to ZATCA for clearance before delivering them to customers. ZATCA checks each invoice against tax requirements, and either approves it or sends back error messages.

For B2C transactions, you generate invoices with QR codes at the point of sale and report them to ZATCA within 24 hours.

Understanding the Wave-Based Rollout Schedule

ZATCA didn't require all businesses to comply at once. Instead, they used a wave-based rollout based on annual revenue.

Previous Waves

• * Wave 1 (January 1, 2023): Businesses with revenues over SAR 3 billion
• * Wave 2 (July-December 2023): Businesses between SAR 500 million and SAR 3 billion
• * Each wave after that lowered the threshold, bringing in smaller businesses
• * Wave 23 (January-March 2026): Businesses over SAR 750,000 in annual revenue
• **Wave 24: The Final Wave**

[Wave 24, announced in September 2025](https://www.ey.com/en_gl/technical/tax-alerts/saudi-arabia-announces-24th-wave-of-phase-2-e-invoicing-integration), is the final wave. It includes all VAT-registered businesses with revenues over SAR 375,000 during any of the calendar years 2022, 2023, or 2024.

The compliance window runs from April 1 through June 30, 2026.

This SAR 375,000 threshold (about USD 100,000) means almost all VAT-registered businesses must comply by mid-2026. If your business made this amount in any of those years, you fall within Wave 24 requirements.

ZATCA notifies businesses at least six months before their wave deadline. However, don't wait for notification – check your revenue figures now to make sure you have enough preparation time.

Read Also: Navigating Phase 2 of E-Invoicing with Wafeq: Ensuring Seamless Integration for Saudi Arabian Businesses

Technical Requirements You Need to Understand

Phase 2 compliance involves specific technical standards your invoicing system must meet.

1. Invoice Format

Invoices must use [UBL 2.1 XML format. This international standard ensures machines can read your invoices. Your invoices need specific fields for:

• Seller identification
• Buyer information
• Invoice dates
• Unique invoice numbers
• Line-item details
• VAT calculations

2. Digital Signature

Every invoice needs a digital signature. ZATCA gives you a Cryptographic Stamp Identifier after you complete onboarding. This CSID ties your digital signature to your specific invoicing device or system. The signature prevents tampering and proves the invoice came from you.

3. QR Codes

For B2C simplified invoices, QR codes must encode specific data using the Tag-Length-Value format with Base64 encoding. The QR code includes:

• Your VAT number.
• Invoice timestamp.
• Total amount.
• VAT amount.
• Invoice identifier.

The format is technical, but most certified e-invoicing solutions handle this automatically.

4. API Integration

You must connect with ZATCA's platform through APIs. Your system needs to connect to ZATCA's servers to submit invoices for validation.

• B2B invoices: Use compliance APIs for real-time clearance.
• B2C invoices: Report within 24 hours through reporting APIs.

ZATCA provides Software Development Kits, sandbox testing environments, and detailed technical documentation. The sandbox environment lets you test invoice submission without affecting your live business.

Most foreign businesses work with certified solution providers rather than building systems from scratch. This reduces technical complexity and ensures compliance. Plus, it saves a lot of headaches.

B2B vs B2C: Different Rules for Different Transactions

The requirements differ between business transactions and consumer sales.

• B2B Transactions (Business-to-Business) You issue standard tax invoices. These invoices must include the buyer's VAT registration number when the buyer is VAT-registered. How it works:

1. You submit each invoice to ZATCA through the clearance model.
2. ZATCA validates the invoice in real-time.
3. ZATCA checks that all fields are correct.
4. ZATCA verifies VAT calculations.
5. ZATCA confirms buyer information matches registered records

If validation passes, ZATCA applies its digital stamp and returns the cleared invoice to you. Only then can you deliver it to your customer. This clearance usually happens within hours, often much faster.

• B2C Transactions (Business-to-Consumer)

You issue simplified tax invoices. These don't require the customer's VAT number since most consumers aren't VAT-registered. You must include a QR code on every simplified invoice.

The key difference: B2C invoices don't need real-time clearance. You generate and deliver them immediately at the point of sale, then report them to ZATCA within 24 hours.

When to Use Each Type

Standard tax invoices are required when:

• Transaction values equal or exceed SAR 1,000.
• The buyer specifically requests one to claim VAT input credit.

For smaller transactions, you can use simplified invoices unless dealing with another VAT-registered business.

Foreign businesses need to set up their systems differently based on their main transaction types. A foreign consulting firm selling services to Saudi companies will mainly use the B2B clearance model. A foreign retailer with stores in Saudi Arabia will mainly use the B2C reporting model.

Your Implementation Roadmap

Implementing e-invoicing requires a step-by-step approach over several months.

Step 1: Business Assessment

• Determine if you're a resident for tax purposes.
• Calculate your VATable revenue for 2022, 2023, and 2024.
• Identify your applicable wave deadline.
• Review your current invoicing systems.

Step 2: Select an E-Invoicing Solution Provider

[ZATCA publishes a list of pre-qualified providers, though you're not limited to this list if your solution meets technical requirements.

Look for providers with:

• ZATCA compliance credentials.
• Experience with foreign businesses.
• Arabic and English language support.
• Local presence in Saudi Arabia.
• Clear pricing.

Popular solutions include:

• Major ERP vendors (SAP, Oracle, Microsoft Dynamics) with ZATCA-compliant modules.
• Regional providers like FatooraPlus, MyFatoorah, and EZ Integrated.
• Cloud-based subscription models (typically SAR 1,000 to SAR 4,000 annually for small to medium businesses)

Step 3: System Implementation

During implementation, you'll:

• Configure your system with your business details.
• Generate a Certificate Signing Request for ZATCA.
• Submit this through the Fatoora portal to receive your Cryptographic Stamp Identifier.
• * Integrate your system with ZATCA's APIs.

Step 4: Testing

Testing is critical. Use [ZATCA's sandbox environment to:

• Submit test invoices.
• Check XML structure.
• Validate QR code generation.
• Test digital signing.
• Confirm error handling.

Allow 4-6 weeks for thorough testing. Poor testing often leads to rejected invoices in production. I've seen businesses skip this step and regret it.

Step 5: Staff Training

Train your people on new processes. Finance, accounting, sales, and IT staff all need to understand:

• The new system.
• Their responsibilities.
• How to fix common issues.

Step 6: Go Live and Monitor

After going live, watch system performance closely:

• Track invoice acceptance rates.
• Review ZATCA error messages.
• Keep audit logs of all submissions.

The entire process usually takes 4-6 months from start to finish. Starting early gives you buffer time for unexpected technical challenges.

Penalties and Enforcement

ZATCA enforces e-invoicing requirements through financial penalties. Common Violations and Penalties:

• Failure to issue electronic invoices: SAR 5,000 to SAR 50,000.
• Missing mandatory information (VAT numbers, invoice sequential numbering): SAR 5,000 to SAR 50,000.
• Using non-compliant invoicing systems: SAR 5,000 to SAR 50,000.
• Missing QR codes on simplified invoices: Warnings first, then financial penalties for repeat violations.

Serious Violations:

• Deleting or changing invoices after issuance: SAR 10,000 and up.
• Failure to integrate by your wave deadline: Up to SAR 50,000

Other Consequences:

Beyond financial penalties, non-compliance can lead to:

• Suspension of commercial registration.
• Limits on obtaining business licenses.
• Problems with VAT return filing.
• Difficulties with visa sponsorships for foreign staff.

ZATCA has shown increasing strictness with each wave. Early waves often showed flexibility for technical errors. Later waves enforce requirements more strictly from day one.

Grace Period

ZATCA extended its "Fines Exemption Initiative" through June 30, 2026. This provides relief for procedural errors and late filings if you show good-faith compliance efforts. The grace period doesn't excuse tax evasion or intentional non-compliance.

Cost-Benefit Analysis

First-year implementation costs typically range from SAR 3,000 to SAR 7,000 for small to medium businesses. Ongoing annual costs run SAR 1,000 to SAR 3,000. These amounts are far lower than potential penalties, making timely compliance the smart choice.

Common Challenges Foreign Businesses Face

Foreign businesses face several practical obstacles during implementation.

• Technical Complexity XML schema validation, UBL specifications, digital signing, and encoded QR codes require technical expertise that many small businesses lack. If you don't have in-house IT resources, you'll depend heavily on your solution provider.
• Finding Qualified Solution Providers This can be challenging if you're new to Saudi Arabia's business environment. Some providers offer: - Inconsistent support quality. - Limited English documentation. - Insufficient expertise in specific technical issues.
• Cost Concerns While SAR 3,000 to SAR 7,000 isn't excessive for larger businesses, it's meaningful for small operations with tight margins. Foreign businesses operating across multiple countries face extra complexity in managing different e-invoicing systems at once.
• Business Process Changes Moving from manual invoicing to electronic generation requires: - Staff training. - Process redesign. - Quality assurance procedures Small foreign businesses with limited staff struggle to absorb these changes while keeping operations running.
• Data Security and Privacy ZATCA requires storing e-invoice data on servers within Saudi Arabia. This may conflict with data residency requirements in your home country for businesses subject to international regulations as GDPR.
• Common Technical Issues Many businesses report that ZATCA's error messages sometimes lack detail about what caused rejection. This forces trial-and-error debugging that takes time. - Incorrect XML structure. - Improper UTF-8 encoding of Arabic text. - Malformed encoding in QR codes. - Missing mandatory fields. - Incorrect tax classifications. - Configuration errors in digital signing.
• Unclear Requirements The requirement applies differently to resident versus non-resident entities in complex scenarios. Some foreign businesses with VAT registration but no commercial registration face uncertainty about their exact obligations. It's frustrating, but working with a local advisor usually clears things up.

Practical Guidance for Foreign Business Owners

Follow these steps to achieve compliance efficiently.

1. Confirm Your Residency Status If you have commercial registration and physical presence in Saudi Arabia, assume you're a resident and must comply. If you're truly non-resident, verify your exemption status with a local tax advisor.
2. Determine Your Wave Deadline Calculate your VATable revenues for 2022, 2023, and 2024. If you exceed SAR 375,000 in any year, you fall within Wave 24 and must comply by June 30, 2026. Don't wait for official notification.
3. Assess Your Current Systems Check if your existing ERP or accounting software can: - Generate UBL XML invoices. - Handle digital signing. - Create compliant QR codes. - Integrate with ZATCA's APIs. Many foreign businesses using major ERP systems can add ZATCA-compliant modules. Others need new solutions.
4. Select Solution Providers Carefully

• Request references from similar businesses.
• Verify ZATCA compliance credentials.
• Confirm English support availability.
• Establish clear service level agreements with defined timelines.

5. Allocate Time for Testing

• Develop realistic test scenarios covering all your transaction types.
• Use ZATCA's sandbox environment extensively.
• Fix issues systematically before production.

6. Train Your Staff Thoroughly Everyone involved in invoicing needs to understand:

• New processes.
• Their responsibilities.
• How to fix problems.

7. Plan Your Timeline If you're in Wave 24, you need to be fully operational by April 1, 2026, at the latest. Starting in late 2025 or early 2026 provides enough time for the typical 4-6 month implementation cycle.

8. Use ZATCA Resources

• Use the Developer Portal for technical documentation.
• Contact the call center (19993) for specific questions.
• Join community forums to learn from other businesses.

What Happens After June 2026

Wave 24 is the final mandatory wave, covering almost all VAT-registered businesses. After June 30, 2026, ZATCA expects full compliance.

Don't expect extensions or grace periods beyond June 2026. ZATCA has shown commitment to complete coverage by this date. The three-year Phase 2 rollout provided businesses plenty of preparation time.

Enforcement will likely become stricter after the final wave deadline passes. With most businesses already compliant from earlier waves, ZATCA will have less tolerance for remaining non-compliant businesses.

Operational Benefits

The system creates benefits beyond regulatory compliance:

• Complete audit trails of all business transactions.
• Less manual paperwork and filing requirements.
• Fewer invoice errors through real-time validation.
• Standardized documentation that simplifies tax filing.

For foreign businesses seeking to build credibility in Saudi Arabia, e-invoicing compliance shows operational quality to customers, suppliers, and government authorities.

Global Alignment

The system also aligns Saudi Arabia with [global standards for transparent, real-time tax reporting. Similar frameworks exist across the European Union, Latin America, and Asia. Foreign businesses implementing ZATCA compliance gain experience with modern e-invoicing that's becoming standard internationally.

FAQs about Electronic invoicing for foreign companies in Saudi Arabia

Do non-resident foreign businesses need to comply with Fatoorah?

Non-resident businesses without permanent locations in Saudi Arabia are usually exempt from direct e-invoicing requirements. However, if you're VAT-registered in the Kingdom or have commercial registration, you must comply as resident businesses. Your Saudi customers might need to self-bill for transactions with non-resident suppliers.

What's the difference between Phase 1 and Phase 2 compliance?

Phase 1 required generating electronic invoices, but didn't require real-time submission to ZATCA. Phase 2 requires XML format invoices, digital stamps, QR codes, and direct connection with ZATCA's platform for real-time clearance (B2B) or 24-hour reporting (B2C).

How much does e-invoicing implementation cost for small businesses?

Small to medium foreign businesses typically face first-year costs of SAR 3,000 to SAR 7,000. This includes software licensing, implementation services, and staff training. Ongoing annual costs run SAR 1,000 to SAR 3,000. These costs are much lower than potential penalties for non-compliance.

Can I use my existing accounting software for ZATCA compliance?

It depends on your current software. Major ERP systems like SAP, Oracle, and Microsoft Dynamics offer ZATCA-compliant modules. Many regional accounting solutions also provide ZATCA integration. However, basic accounting software or spreadsheet-based invoicing typically won't meet Phase 2 requirements without major upgrades or replacement.

What happens if I miss my wave deadline?

Missing your wave deadline triggers immediate non-compliance. ZATCA can assess penalties ranging from SAR 5,000 to SAR 50,000 depending on violation severity. You may face commercial registration suspension, business license limits, and difficulties filing VAT returns. The penalties can add up quickly, making timely compliance critical.

How long does implementation typically take?

Complete implementation from initial assessment to production usually requires 4-6 months. This includes solution selection (1-2 months), system configuration and integration (2-3 months), thorough testing (4-6 weeks), and staff training. Starting early provides important buffer time for unexpected technical challenges.

Do I need separate systems for B2B and B2C transactions?

No, you don't need separate systems. However, your e-invoicing solution must support both transaction types since they follow different models. B2B invoices require real-time clearance by ZATCA, while B2C invoices follow a 24-hour reporting model. Most certified solution providers handle both transaction types in one platform.

What if my business operates across multiple countries with different e-invoicing requirements?

Many international businesses face this challenge. You'll need to manage compliance with multiple systems at once. This might require multiple invoicing systems, dual-system configurations, or selecting enterprise solutions that support multiple country-specific requirements. The complexity makes working with experienced, international solution providers especially valuable.