# When Is E-Invoicing Mandatory in Saudi Arabia? Phases, Deadlines and Penalties Through 2026 *The full timeline for every wave, the revenue threshold that triggers it, and the tiered financial penalties* > **In short:** Saudi e-invoicing explained: Phase One vs Phase Two, ZATCA integration waves 1–19+, the revenue threshold for each, and penalties from SAR 1,000 to 50,000. - **URL:** https://www.snad.io/en/blog/mata-tajib-faatura-iliktruniyya-marahil - **Arabic original:** https://www.snad.io/blog/mata-tajib-faatura-iliktruniyya-marahil - **Category:** Explainers — ZATCA & Tax - **Tags:** e-invoicing, ZATCA, Phase Two integration, Fatoora, Fatoora platform, VAT, tax compliance - **Published:** 2026-05-23 - **Updated:** 2026-08-02 - **Publisher:** Snad (snad.io) Every Saudi business registered for Value Added Tax (VAT) is required to issue electronic invoices — but the date that obligation bites depends on the size of your revenue. Phase One (electronic generation) has been mandatory for everyone since 4 December 2021. Phase Two (integration with the Fatoora platform over an API, with a cryptographic signature) is being rolled out in staged waves: it started with the largest taxpayers (SAR 3 billion in annual revenue) in January 2023 and steps down progressively to cover every business during 2025–2026. This guide sets out exactly when your business is caught, what the technical requirements are, what the penalties for non-compliance look like, and how to migrate safely before your deadline. Official source: the Zakat, Tax and Customs Authority (ZATCA) at zatca.gov.sa. ## The short answer: who has to issue e-invoices Every Saudi business registered for Value Added Tax (VAT) must issue electronic invoices, on the timetable below. **Phase One (generation) — in force since 4 December 2021** Every VAT-registered business, without exception, issues its invoices electronically through a system compliant with the Zakat, Tax and Customs Authority (ZATCA). Hand-written paper invoices are prohibited. **Phase Two (integration and linkage) — phased in through waves** - **Wave 1**: from 1 January 2023 — businesses with annual revenue above SAR 3 billion - **Wave 2**: from 1 July 2023 — revenue above SAR 500 million - **Wave 3**: from 1 October 2023 — above SAR 250 million - **Wave 4**: from 1 November 2023 — above SAR 150 million - **Wave 5**: from 1 December 2023 — above SAR 100 million - **Wave 6**: from 1 January 2024 — above SAR 70 million - **Wave 7**: from 1 February 2024 — above SAR 50 million - **Wave 8**: from 1 March 2024 — above SAR 40 million - **Wave 9**: from 1 June 2024 — above SAR 30 million - **Wave 10**: from 1 October 2024 — above SAR 25 million - **Wave 11**: from 1 November 2024 — above SAR 15 million - **Wave 12**: from 1 December 2024 — above SAR 10 million - **Wave 13**: from 1 January 2025 — above SAR 7 million - **Later waves**: step down to smaller thresholds (SAR 5 million, SAR 3 million, SAR 2 million and below) **In one sentence**: the smaller your annual revenue, the later your wave — but every business with taxable revenue will be brought in during 2025–2026. ## Phase One (generation): in force since 4 December 2021 Phase One has applied to every VAT-registered business since 4 December 2021. Here is what it demands. **1. Use a compliant electronic accounting system** Not allowed: hand-written ledgers, Excel, or printing an invoice out of Word. Required: a system that generates the invoice electronically in a prescribed format. **2. Mandatory invoice fields** - Seller's name, address and VAT registration number - Buyer's name and VAT registration number (tax invoices only) - Issue date and supply date - Description of the goods or services, quantities and price - Total before tax, tax rate (15%), tax amount, total including tax - QR code (on simplified invoices) **3. The two invoice types** - **Tax invoice**: issued when you sell to another business (B2B). Carries the buyer's VAT number. - **Simplified tax invoice**: issued when you sell to an end consumer (B2C). Must carry a QR code. **4. Invoice storage** Every electronic invoice must be retained for at least six years and be retrievable on demand for a ZATCA inspection. **5. What is prohibited** - Editing an invoice after it has been issued (you must raise a credit or debit note instead) - Deleting an issued invoice - Manipulating the issue date A business still writing paper invoices by hand after 4 December 2021 is committing a serious violation, with penalties starting at SAR 5,000. ## Phase Two (integration and linkage): the rollout waves Phase Two layers deeper technical requirements on top of Phase One. The core difference: **Under Phase One**: you generate the invoice electronically, then print it or send it to the customer. **Under Phase Two**: you generate the invoice, your system transmits it automatically to ZATCA's Fatoora platform, the platform registers it and stamps it with a unique cryptographic stamp and a sequential number, and only then does it reach the customer in an approved format. **What Phase Two requires** 1. **A direct API connection to the Fatoora platform** 2. **Invoices issued as XML compliant with UBL 2.1** 3. **An approved cryptographic signature** 4. **A unique identifier for every invoice (UUID + ICR + IRN)** 5. **A QR code compliant with TLV version 2** 6. **Immediate clearance confirmation from the platform (for B2B tax invoices)** **Why the rollout is staged in waves** ZATCA could not onboard a million businesses at once. The rollout started with the largest taxpayers (SAR 3 billion in annual revenue) and steps down progressively to the smallest. Every wave is given: - **six months' notice** before its mandatory date - intensive technical support during the notice period - a trial run in the sandbox environment **How do you find out which wave you are in?** ZATCA sends an official notification six months in advance to the email address and mobile number registered against the business. The notification states: - your wave number - the mandatory go-live date - the steps you need to take Do not wait for the notification. Check your status on the ZATCA portal regularly. ## Waves 1 to 19: the revenue threshold for each The full, officially published schedule of Phase Two waves: | Wave | Mandatory from | Annual revenue threshold | |---|---|---| | Wave 1 | 1 January 2023 | Above SAR 3,000,000,000 (SAR 3 billion) | | Wave 2 | 1 July 2023 | Above SAR 500 million | | Wave 3 | 1 October 2023 | Above SAR 250 million | | Wave 4 | 1 November 2023 | Above SAR 150 million | | Wave 5 | 1 December 2023 | Above SAR 100 million | | Wave 6 | 1 January 2024 | Above SAR 70 million | | Wave 7 | 1 February 2024 | Above SAR 50 million | | Wave 8 | 1 March 2024 | Above SAR 40 million | | Wave 9 | 1 June 2024 | Above SAR 30 million | | Wave 10 | 1 October 2024 | Above SAR 25 million | | Wave 11 | 1 November 2024 | Above SAR 15 million | | Wave 12 | 1 December 2024 | Above SAR 10 million | | Wave 13 | 1 January 2025 | Above SAR 7 million | **The waves expected next (2025–2026)** Waves 14 to 19 and beyond target businesses with smaller revenues (SAR 5 million, SAR 3 million, SAR 2 million, SAR 1 million), until every VAT-registered business is covered — and the mandatory VAT registration threshold is SAR 375,000 of annual revenue. **How is the "annual revenue threshold" measured?** From the VAT returns you have filed with the Authority. Revenue in the earlier years (2021, 2022 or 2023) determines your wave. **A new business with no filing history** Phase One applies from the date of registration. It moves into Phase Two once it crosses the threshold of a given wave. **Revenue that swings from year to year** The highest wave a business has qualified for is the one that applies. A business that exceeded SAR 30 million in 2023 but fell back to SAR 20 million in 2024 stays in Wave 9 — you do not move back down. ## Technical requirements for compliance **1. An approved digital certificate** Every business in Phase Two needs a cryptographic certificate approved by ZATCA. It is issued when you onboard through the Fatoora portal. **2. Encryption keys** A public key and a private key are used to sign each invoice digitally. Your accounting system applies them automatically. **3. A direct API integration with the Fatoora platform** Each invoice is transmitted to the platform immediately in the prescribed format. A tax invoice waits for clearance before it can be sent to the customer; a simplified invoice is reported within a set window. **4. Approved invoice formats** - **XML in UBL 2.1**: the original electronic invoice - **PDF/A-3 with embedded XML**: the human-readable copy for the customer - **A two-dimensional QR code**: embedded in both **5. Testing in the sandbox environment** Before you go live in production you must test the system in the sandbox and obtain a compliance pass. **6. Continuous connectivity with the platform** A stable internet connection is required. A business that is unable to transmit its invoices to the platform for more than 24 hours must notify ZATCA. **Choosing a technical solution** A business has three options: 1. **A ready-made cloud solution (such as Snad)**: already connected to the Fatoora platform, certificate handled for you, maintenance and updates included. The fastest and cheapest route for small and medium businesses. 2. **An on-premise accounting system with integration bolted on**: requires custom development. Higher cost, slower to deliver. 3. **A global ERP (SAP, Oracle) with a ZATCA connector**: for large enterprises. Substantially more expensive. For companies below SAR 100 million in revenue, the ready-made cloud solution is the obvious choice on both cost and speed. ## The tiered financial penalties The Zakat, Tax and Customs Authority applies a tiered penalty regime that varies by the type of violation and how often it is repeated. **Phase One penalties** - **Failure to issue an electronic invoice**: SAR 5,000 to SAR 50,000 (doubled on repetition) - **Deleting or amending an issued invoice**: SAR 10,000 to SAR 50,000 - **Omitting mandatory data fields**: SAR 1,000 to SAR 5,000 **Phase Two penalties** - **Failure to transmit the invoice to the Fatoora platform**: SAR 5,000 to SAR 50,000 - **Failure to apply the cryptographic signature**: SAR 10,000 to SAR 50,000 - **Omitting the QR code from a simplified invoice**: SAR 1,000 to SAR 5,000 - **Using a non-approved system**: SAR 5,000 to SAR 25,000 **Penalties on the underlying VAT** - **Late payment of VAT**: 5% of the tax amount for every month of delay (subject to a cap) - **Failure to file a return**: SAR 1,000 for the return itself, plus 25% of the tax due - **Manipulating VAT to avoid payment**: up to 300% of the evaded tax, plus criminal prosecution **Penalties escalate with repetition** First violation: the bottom of the range. Second violation within three years: double the first penalty. Third violation: double the second, plus temporary suspension of the activity. **ZATCA inspections** The Authority can ask, without warning, for copies of invoices covering any period. Being unable to produce them is treated as non-compliance and penalised accordingly. **Your right to object** A business may object to a penalty within 30 days through the Authority's portal. Well-founded objections are accepted roughly 30–50% of the time. ## How Snad connects you to the Fatoora platform in 24 hours Snad is approved by the Zakat, Tax and Customs Authority for both Phase One and Phase Two. The onboarding runs like this: - **Day 1 — register the business**: enter the basics (Commercial Registration number, VAT number, business details). Automated verification against the Authority's portal. - **Day 1 — issue the digital certificate**: Snad requests the certificate from the Fatoora portal, receives it, and attaches it to your account automatically. No technical knowledge needed on your side. - **Day 1 — test in the sandbox**: issue three to five test invoices, confirm the platform accepts them, and obtain the compliance pass. - **Day 2 — go live**: switch on the production environment. Your first real invoice is transmitted and cleared within minutes. **What comes built in with e-invoicing on Snad** - **Automatic issuance on every sale** — from sales, from the POS, or from manual invoicing - **Cryptographic signing and transmission to the platform** with no manual step - **QR codes and document retention** handled automatically for six years - **Credit and debit notes** whenever an invoice needs to be corrected - **Compliance reports** ready for an Authority inspection at any time - **Support for both simplified and tax invoices**, with the system telling them apart automatically - **Live status for every invoice** (sent, cleared, rejected) with alerts the moment one is rejected **Regulatory updates** ZATCA issues periodic updates to the technical standards. Snad updates the system automatically and you never notice the change. The 30-day free trial is long enough to switch e-invoicing on fully and issue dozens of real invoices. ## A practical summary for business owners Six rules for getting e-invoicing compliance right: 1. **Do not wait for the official notification of your wave.** Start preparing six months before the date you expect to be caught. A last-minute migration creates technical problems that end up costing you in fines. 2. **Choose a system approved by ZATCA.** The list of approved systems is published on zatca.gov.sa. Never pick an unapproved system, however cheap it looks. 3. **Train your administrative team before you migrate** — accountants, sales staff, POS cashiers. E-invoicing changes parts of their daily routine. 4. **Keep local backups** of every invoice alongside the cloud copy. That protects you if anything ever goes wrong with your provider. 5. **Watch your acceptance rate on the platform.** The benchmark is 99% or better. When an invoice is rejected, fix the cause immediately (missing data, a wrong code). 6. **Never tamper with issued invoices** — no deleting, no amending, no delayed issuance. ZATCA runs automated detection, and the penalties are severe. **The bottom line on timing** Every VAT-registered Saudi business will reach its Phase Two deadline during 2025–2026. The smart move is to start preparing now: - assess your current system - choose an approved solution - train the team - test in the sandbox - go live at least a month before your wave Waiting means risking SAR 5,000–50,000 in penalties and, worse, days of disrupted sales when an unplanned migration goes wrong. ## Frequently asked questions ### Who is covered by Phase One of e-invoicing? Every VAT-registered Saudi business, without exception, since 4 December 2021. Businesses that are not registered (below SAR 375,000 of annual revenue) are not covered. Voluntary registration is available from SAR 187,500. ### When do the Phase Two waves end? The waves keep stepping down until they cover every VAT-registered business. The main waves are expected to be complete during 2026, at which point everyone above SAR 375,000 in annual revenue will be fully subject to Phase Two. ### What is the difference between a tax invoice and a simplified invoice? A tax invoice is issued to a business buyer (a company or establishment), carries the buyer's VAT registration number, and must be cleared by the Fatoora platform before it is handed to the buyer. A simplified invoice is issued to an end consumer (an individual), does not need the buyer's VAT number, and must carry a QR code. ### What do I do if the Fatoora platform rejects my invoice? Read the rejection reason in the platform's report (missing data, a wrong VAT number, an invalid format). Fix the cause and resubmit. The window for resubmission is limited — typically 24 hours. A good accounting system flags the rejection and alerts you immediately. ### Do I need a permanent internet connection to issue electronic invoices? Under Phase Two, yes. A tax invoice has to be cleared by the platform before it can be handed to the customer. A simplified invoice can be issued offline and reported to the platform later within a set window. A stable connection is a basic operating requirement. ### Do violations that predate my go-live date count against me? No. ZATCA applies penalties from the mandatory date of your business's wave onwards. Violations that occurred before that date are not counted. But from day one of your obligation, every non-compliant invoice is a separate violation. ### Is a cloud system better than an on-premise one? For small and medium businesses (under SAR 100 million in revenue): yes, cloud is far better — cheaper, faster, maintained for you, continuously updated. For large enterprises with strict security constraints, an on-premise system with a ZATCA connector may be required, but it needs a dedicated technical team to maintain it. --- ## About the publisher **Snad (سند)** — a private Saudi software company based in Riyadh, founded 2025. Legal form: Sole proprietorship. Commercial registration: 7038154642 VAT number: 310959226500003 Only official domain: snad.io > Snad is a private commercial business-management platform. It is not a > government body, not a bank, and not a government services portal, and it > is not affiliated with any government entity. Any site or app with a > similar name is unrelated to Snad.