The 5-Step ZATCA Compliance Checklist for SMBs in Saudi Arabia



What Are ZATCA Compliance Requirements for Saudi Businesses?

Saudi business owners are legally responsible for every invoice they issue, and a non-compliant invoice exposes the business to ZATCA fines, rejected B2B transactions, and audit findings. Paper invoices, unapproved spreadsheets, and billing tools that ZATCA has not cleared lead to progressive fines of up to SAR 50,000 per violation, invoices that the Fatoora platform rejects, and, in severe cases, suspended taxpayer accounts.

ZATCA compliance requirements come down to four things: valid VAT registration, e-invoices that meet Phase 1 and Phase 2 rules, accurate periodic returns, and records kept for at least six years. This checklist maps each requirement to its deadline, its penalty, and the Wafeq guide that goes deeper, covers the latest wave deadlines, and shows how to connect your software to Fatoora.



What Does ZATCA Regulate, and Under Which Laws?

The Zakat, Tax and Customs Authority regulates VAT, zakat, income tax, excise tax, and customs, and it enforces the Fatoora e-invoicing regulation. ZATCA was established by Royal Decree No. A/133 in 2021, merging the General Authority of Zakat and Tax with Saudi Customs under one regulator.

The VAT Law was issued by Royal Decree No. M/113, and the Tax Procedures Law governs recordkeeping, audits, and penalties. The Fatoora regulation sits on top of these, and it is the part most small businesses feel first, because it changes how every invoice is created.

The legal background is covered in Understanding Saudi E-Invoicing Law, and the audit side in How to Prepare for ZATCA Audits.

What is the ZATCA Compliance map for an SMB?

An SMB’s ZATCA compliance map has seven parts: registration, Phase 1 invoices, Phase 2 integration, invoice content, VAT returns, records, and penalty management.

The table shows who each part applies to, the trigger or date to watch, and the Wafeq guide that goes deeper, so this page stays an overview, and the details live in one place.

Why Does Compliance Matter Beyond Avoiding Fines?

Compliance keeps your invoices accepted, your customers’ input VAT claims intact, and your business credible with corporate and government buyers. A B2B invoice that fails clearance cannot be delivered to the buyer, which can delay payment and complicate the buyer’s VAT recovery.

Step 1: Which ZATCA Requirements Apply to Your Business?

Three status checks decide your obligations: whether you are VAT-registered, whether you issue Phase 1-compliant invoices, and which Phase 2 wave you fall into. Run them in order, because each one depends on the one before. Most businesses can complete all three in under an hour with their VAT certificate and revenue figures to hand.

Check 1: Are You VAT-Registered, and Should You Be?

VAT registration is mandatory when taxable supplies exceed SAR 375,000 in a year, and voluntary registration is available from SAR 187,500. Your Tax Identification Number links your VAT registration to your commercial registration and appears on every invoice.

Confirm that your 15-digit VAT registration number is active and that your company name and address match your commercial registration. The full registration process, including non-resident rules, is in the: VAT registration guide, and the TIN guide explains how the number is issued.

Check 2: Are Your Invoices Phase 1-Compliant?

Phase 1, in force since 4 December 2021, requires every VAT-registered business to generate and store electronic invoices that meet ZATCA’s technical rules. Handwritten invoices and basic Word or Excel documents don't qualify, and simplified invoices must carry a QR code.

Phase 1 invoices are not sent to ZATCA in real time. They are generated in compliant software and stored, with the QR code encoding the seller, date, total, and VAT. For a plain-language overview, see: E-Invoicing in Saudi Arabia.

Check 3: Which Phase 2 Wave Are You In?

Phase 2 applies in waves by VAT-taxable revenue, and ZATCA notifies targeted taxpayers at least six months before their integration deadline. You are in a wave if your VAT-taxable revenue exceeded that wave’s threshold in any of its reference years.

Wave 25 is the newest and the lowest threshold so far, so many small businesses that were outside earlier waves are now in scope. Check your revenue against the table, then confirm in your ZATCA notification or your Fatoora account. Earlier waves are explained in: Which ZATCA wave am I in? and ZATCA Wave 24.

Businesses below the Wave 25 threshold are not yet in the Integration Phase, but they remain subject to Phase 1, and ZATCA has lowered the threshold wave after wave, so plan for eventual inclusion.

Step 2: What Must a ZATCA-Compliant Tax Invoice Display?

A ZATCA-compliant invoice must show seller and buyer VAT details, a sequential number, issue date, itemized 15% VAT, totals, and a QR code. The exact fields depend on whether the invoice is a standard tax invoice for a business buyer or a simplified tax invoice for a consumer. Phase 2 adds technical fields that your software generates automatically.

The full field-by-field specification and ready formats are in the approved e-invoice template guide, and the QR code’s data structure is in QR Code Requirements for E-Invoices.

To check any invoice’s QR code, use ZATCA’s official app or Wafeq’s ZATCA QR scanner.



Which invoice practices does ZATCA prohibit?

ZATCA prohibits handwritten invoices, Word or Excel templates, non-sequential numbering, and editing or deleting an invoice after it has been issued. Mistakes must be corrected with a credit note or debit note that references the original invoice, never by changing it.

• Corrections: see How to Handle Credit Notes in KSA E-Invoicing.
• Contracting and advance payments: see Construction Progress Billing Under ZATCA.
• Online stores: see How to Integrate E-Commerce Platforms with ZATCA Fatoora.
• Common mistakes: see Common Electronic Invoicing Errors in Saudi Arabia.

Step 3: What Is the Difference Between Phase 1 and Phase 2 E-Invoicing?

Phase 1 requires generating and storing electronic invoices with QR codes, while Phase 2 requires connecting your system to ZATCA’s Fatoora platform. Phase 2 is the stage that changes your daily workflow, because each invoice is validated by ZATCA in real time or reported shortly after issue.

What Is the Difference Between B2B Clearance and B2C Reporting?

B2B invoices must be cleared by ZATCA before delivery to the buyer, while B2C invoices are reported within 24 hours of issue. Clearance is a check before you send; reporting is a notification after you issue.

If a cleared B2B invoice is rejected, the portal returns an error that must be fixed before the buyer receives it.

The causes and fixes are set out in: Why Is the Fatoora Portal Rejecting Your Invoices? and Fatoora Portal Direct Integration.

What Happens If the Internet Drops While You Are Invoicing?

A B2B invoice cannot be cleared offline, while B2C invoices have a 24-hour reporting window, so plan for connectivity and ask about retries. ZATCA expects businesses to remain responsible for compliance, and it asks them to report system malfunctions promptly.

If your system fails, notify ZATCA through its support line (19993) or by email, and keep a record of what happened. Businesses that communicate early and document their efforts generally face less severe consequences than those that stay silent.

How Do You Connect Your Software to the Fatoora Platform?

Connecting takes a few steps: open your software’s Fatoora settings, enter your company details, generate a one-time password on Fatoora, and confirm the connection. In Wafeq, go to Organization settings, scroll to Fatoora Portal Settings, and click Connect.

1. Enter your details. Wafeq asks for your ID information, business activity type, VAT registration details, and the address registered with ZATCA.
2. Onboard a device. Log in to the Fatoora portal, choose Onboard New Device, and generate the one-time password (OTP).
3. Paste and connect. Return to Wafeq, paste the OTP, and click Connect. You will see “Connected Successfully to Fatoora”.
4. Finalize invoices. When you finalize an invoice, Wafeq submits it to the Fatoora platform for clearance, and its status updates to Finalized.

Phase 2 connection in Wafeq requires the Plus, Premium, or Enterprise plan. For the common pitfalls, read:ZATCA Phase 2 Integration: 5 Steps to Avoid Onboarding Errors, and for businesses with several branches or point-of-sale devices, Managing ZATCA Tax Groups.

If you are changing providers, see How to Switch Accounting Software Without Breaking Your CSID.



Step 4: What Are the Penalties for Non-Compliance with ZATCA Regulations?

ZATCA e-invoicing penalties range from SAR 1,000 up to SAR 50,000 per violation, and most start with a warning and a three-month window to correct. Fines escalate when the same violation recurs within 12 months, and each violation type follows its own path. The summary below is a starting point, and the full breakdown is in the penalties guide.

Can Past ZATCA Penalties Be Waived?

Yes, ZATCA’s fines exemption initiative runs until 31 December 2026 and waives eligible past penalties if you register and file. To benefit, you must be registered with ZATCA, submit all outstanding returns, and pay the principal tax or agree to an approved instalment plan.

The extended initiative excludes tax evasion penalties, fines under Article 45 of the VAT Law, fines you already paid, and penalties tied to returns due after 30 June 2026. ZATCA has also said that any extension beyond 31 December 2026 will not cover fines on returns due after 30 June 2026, so staying current from now on matters more than relying on a waiver.

Because Article 45 fines are excluded, do not assume that past e-invoicing violations will be waived. Confirm your own position with ZATCA or an adviser, and read E-Invoicing Fines in Saudi Arabia for the penalty structure.

Step 5: How Long Must You Keep Records, and in What Format?

ZATCA expects businesses to keep tax records, invoices, and supporting documents for at least six years after the relevant financial year. E-invoices must be stored in a format that cannot be altered, typically XML or PDF/A-3 with embedded XML, and must be accessible whenever ZATCA asks.

• Sales and purchase invoices, credit notes, and debit notes.
• VAT returns and payment confirmations.
• General ledger, trial balance, bank statements, and reconciliations.
• Contracts, purchase orders, delivery notes, and payroll records.
• Import and export documents and customs records, if you trade internationally.

Store records in a secure archive in Saudi Arabia or an approved cloud server, with backups. The audit preparation guide lists the records auditors request most, and Post-Integration Audits explains which indicators to monitor after you go live.

Step 6: How Do You Keep VAT Returns Accurate and On Time?

Reconcile your e-invoices with your VAT report before every filing, because ZATCA already holds your invoice data and can spot differences. That makes accurate VAT coding at the time of entry the single best protection against filing errors.

Wafeq generates your VAT return automatically in your tax authority’s format, ready for submission, and calculates VAT on sales and purchases as you record them. For how the process compares across the region, see Comparison of VAT Return Filing Processes in Saudi Arabia, the UAE, and Bahrain. If you have overpaid input VAT, VAT Refund Conditions for Businesses in Saudi Arabia explains how to claim. For zakat and income tax, see: What Does Corporate Tax Management Include?

Actionable Checklist: How to Make Your SMB ZATCA Compliant

Make your SMB compliant in five steps: audit your VAT registration, replace unapproved tools, connect to Fatoora, train your team, and automate your VAT returns. Work through the list in order, and keep a dated note of each step in case ZATCA asks.

Read Also:

Compliance with ZATCA stops being stressful when you reduce it to a short list: stay registered, issue invoices from approved software, connect to Fatoora when your wave arrives, file accurate returns, and keep your records.

Most penalties that are described in this guide come from skipped basics, such as editing an invoice, missing a QR code, or ignoring a wave deadline, and not from complex tax positions. With Wave 25 setting the threshold at SAR 187,500 and 1 February 2027 as the next deadline, the sensible move is to choose software now, test it on real invoices, and train your team before the pressure builds. Wafeq automates the technical parts so you can run the business.

FAQs about ZATCA Compliance requirements

Is ZATCA e-invoicing mandatory for all small businesses in Saudi Arabia?

Phase 1 e-invoicing applies to every VAT-registered business, while Phase 2 integration applies in waves, and Wave 25 reaches businesses above SAR 187,500. That means most small VAT-registered businesses are now in scope or about to be, so prepare even if your wave has not been announced.

Can I use Microsoft Excel or Word to create ZATCA-compliant e-invoices?

No, invoices created in Excel, Word, or PDF editors do not meet ZATCA requirements, because they cannot produce secure, tamper-proof, structured files. ZATCA expects software that generates QR codes, prevents editing after issue, and, in Phase 2, produces signed XML.

How do I know which ZATCA Phase 2 wave my business belongs to?

Check your VAT-taxable revenue against each wave’s threshold, then confirm in your ZATCA notification or your Fatoora account. ZATCA notifies targeted taxpayers at least six months before their deadline. Wave 25 applies if your VAT-taxable revenue exceeded SAR 187,500 in any of 2022 to 2025.

What is a CSID, and do I need one?

A CSID is the cryptographic stamp identifier that authenticates your system to ZATCA, obtained when you onboard a device on Fatoora. In Wafeq, the connection flow handles this when you paste the one-time password from the Fatoora portal.

What if I need to change accounting software after connecting to Fatoora?

You can switch software, but you must plan the move so that your CSID, invoice counter, and hash chain are not broken. Follow the guide on switching accounting software without breaking your CSID before you cancel your old system.

Does Wafeq support ZATCA Phase 2 on every plan?

No, connecting to ZATCA Phase 2 in Wafeq requires the Plus, Premium, or Enterprise plan, so check your plan before your deadline. Wafeq is a ZATCA-compliant e-invoicing solution supporting both Phase 1 and Phase 2, and pricing is on its Saudi pricing page.