What Is Fatoora? Saudi Arabia's E-Invoicing Platform, Explained

Fatoora is the platform, not the rule

Two things share the name. The rule is ZATCA's E-Invoicing Regulation and the Implementation Resolution under it. Fatoora is the system that gives it effect: ZATCA's Detailed Guidelines call it the portal "through which Tax Invoice, Simplified Tax Invoice, and electronic credit/debit note data is received".

You touch two surfaces. The portal is where a taxpayer logs in with ERAD credentials, onboards each invoicing device, generates one-time passwords, renews or revokes certificates, and sees a rolling twelve-month count of documents accepted, accepted with warnings and rejected. The APIs are what your software talks to, invoice by invoice, after onboarding. Your till is not "on Fatoora" in general: each unit registers individually, with its own credential.

The two phases

Phase 1, Generation, started on 4 December 2021: invoices and notes produced and stored through compliant electronic solutions rather than by hand, with a QR code on simplified invoices. Nothing is transmitted. The invoice never leaves your system.

Phase 2, Integration, started on 1 January 2023 and is rolling out in waves. It adds Phase 2 technical and business requirements and connects your solution to ZATCA's systems. Invoices must be XML, or PDF/A-3 with the XML embedded, and carry a cryptographic stamp, a UUID, a hash chained to the previous document, and a tamper-resistant counter.

Clearance and reporting are not the same thing

This distinction decides how your tills and your sales ledger behave, and it is routinely blurred.

	Clearance	Reporting
Applies to	Standard tax invoices (B2B, B2G)	Simplified tax invoices (B2C)
When	Before the invoice reaches the buyer	Within 24 hours of generation
Who stamps it	ZATCA applies its stamp and QR code	You stamp and add the QR before submitting
What you hand over	The cleared document ZATCA returns	The invoice you already issued
If ZATCA rejects it	Not a valid tax invoice; reissue	Invalid; correct by credit note and reissue

Clearance is synchronous and blocking: an uncleared standard invoice is not a valid tax invoice, so a B2B sale waits on an API response. Reporting is asynchronous. Article 2(3/B) of the Implementation Resolution states that simplified invoices and their notes "must be reported to the Authority within a period which must not exceed (24) hours from its generation". Most retailers issue both, so one ERP runs two flows against two endpoints.

Which wave you are in

Phase 2 arrives by revenue threshold, and the thresholds keep falling. ZATCA gives each wave at least six months' notice. The most recent is Wave 25: taxpayers whose VAT-subject revenues exceeded SAR 187,500 in 2022, 2023, 2024 or 2025 must integrate no later than 1 February 2027. At that threshold the mandate has effectively reached the whole VAT-registered base. Waves are cumulative: once in, you stay in.

[NEEDS SOURCE: Wave 24's threshold and deadline, widely reported as SAR 375,000 for 2022 to 2024 with a 30 June 2026 date. ZATCA's announcement page did not resolve at the time of writing. Confirm your wave against the notification ZATCA sent you, not a published table.]

What a compliant Phase 2 invoice carries

• XML in UBL 2.1, per ZATCA's Electronic Invoice XML Implementation Standard, or PDF/A-3 with that XML embedded.
• UUID, "a 128-bit number, generated by an algorithm chosen to make it unlikely that the same identifier will be generated by anyone else", separate from your invoice number.
• Invoice hash (SHA-256, base64), each one "embedded in the next Electronic Invoice in the sequence", and an invoice counter value from "a tamper-resistant Electronic Invoice counter that cannot be reset or reformatted".
• Cryptographic stamp, ECDSA on curve P-256 with SHA-256, using the private key paired with your CSID.
• QR code: five TLV tags in Phase 1 (seller name, seller VAT number, timestamp, total with VAT, VAT amount), nine in Phase 2, adding the XML hash, the signature, the public key, and for simplified invoices ZATCA's own signature.
• Seller and buyer details, line items, VAT category and rate, and totals, per Annex 2 of the Resolution.

What happens if you do not comply

ZATCA has published the violations and fines. Not issuing electronic invoices "begins with a fine of SR 5,000". Deleting or amending one after issuance "begins with a fine of SR 10,000". Three others, a missing QR code on a simplified invoice, a missing buyer VAT registration number, and failure to notify ZATCA of a malfunction, "start with warning the facility upon such cases".

[NEEDS SOURCE: the escalation ladder for repeat e-invoicing violations within twelve months. ZATCA states fines "are applied according to the type of violation and the number of repetitions" but does not print the tiers in the news release.]

The fines exemption initiative extended to 31 December 2026 covers late registration, late payment, late filing and return corrections. E-invoicing violations are not named in it.

Related terms

• ZATCA: the Zakat, Tax and Customs Authority, owner of the regulation, the Fatoora platform and the certificate authority behind it.
• EGS: E-Invoice Generation Solution, "the compliant solution which is used for generating Electronic Invoices and Electronic Notes". Each unit onboards separately.
• CSID: Cryptographic Stamp Identifier, the certificate binding an EGS unit to your VAT registration. Valid up to 60 months.
• Standard vs simplified tax invoice: B2B and B2G invoices carry full buyer details and are cleared; B2C invoices generally omit them (except private education and healthcare for Saudi citizens) and are reported.
• ICV and PIH: invoice counter value and previous invoice hash, the chained fields that make the sequence tamper-evident.

FAQ

Is Fatoora the same as ZATCA? No. ZATCA is the authority; Fatoora is the platform it operates, comprising the taxpayer portal and the clearance and reporting APIs.

Do I still need Phase 2 if I only sell to consumers? Yes, once your wave arrives. A pure B2C retailer runs reporting rather than clearance, but still needs an onboarded EGS, a CSID, XML generation, the hash chain and the nine-tag QR code.

Does clearance mean ZATCA has approved my VAT treatment? No. Clearance confirms the document passed schema, business rule and cryptographic validation. It is not a ruling on the rate you charged, and it does not close the invoice to audit.

Where a system helps

The work is not the API call. It is keeping the counter, the hash chain and the certificate correct across every till and back-office instance at once, and knowing within minutes when one stops being accepted. An ERP that treats each till as its own EGS unit, and queues rather than drops documents when Fatoora is unreachable, removes most of the reconciliation. See RetailOS for SMB ERP.

Related reading: "ZATCA Phase 2 Integration: Onboarding, Clearance and the Errors That Block Invoices" (KB-014).

Sources

• ZATCA, E-Invoicing overview
• ZATCA, E-Invoicing roll-out phases
• ZATCA, E-Invoicing Implementation Resolution, English (PDF)
• ZATCA, E-Invoicing Detailed Guidelines (PDF)
• ZATCA, E-invoicing Detailed Technical Guidelines (PDF)
• ZATCA, Wave 25 taxpayer selection criteria
• ZATCA, Electronic Invoice XML Implementation Standard, 19 May 2023 (PDF)
• ZATCA, Electronic Invoice Security Features Implementation Standards, 19 May 2023 (PDF)
• ZATCA, Fatoora Portal User Manual (PDF)
• ZATCA, violations and fines related to e-invoicing
• ZATCA, extension of the fines exemption initiative to 31 December 2026