Compliance · 🇸🇦 Saudi Arabia Live mandate

Saudi Arabia — ZATCA Fatoora · clearance model

Mandatory clearance via Fatoora portal · live since 2021 — regulator: ZATCA · Zakat, Tax and Customs Authority. Facts last refreshed: 2026-05-05.

Coverage model

Flowie operates a registered Peppol Access Point in this jurisdiction directly where we hold national accreditation, or via a vetted local partner registered with the in-country regulator where on-the-ground presence is required (KSeF, SDI intermediario, ZATCA service-provider, etc.). Either way, you call the same POST /v1/documents/send.

TL;DR

Saudi Arabia mandates real-time clearance through ZATCA's Fatoora portal — no clearance, no legal invoice.
Phase 1 (Generation) has applied to all VAT taxpayers since December 2021; Phase 2 (Integration) rolls out in waves by turnover.
Wave 24 (announced 2025-10) brings every taxpayer with VAT-able revenue > SAR 375,000 in 2022/2023/2024 into Phase 2 by 30 June 2026 — practically the whole VAT register.
Format: UBL 2.1 with KSA-specific extensions (TLV-encoded QR code, cryptographic stamp, hash chain).
Flowie integrates directly with Fatoora as an EGS (E-invoice Generation Solution); no Peppol wrapping.

Deadlines

Date	Who	What
2021-12-04	All VAT taxpayers	Phase 1 (Generation) — invoices must be issued in structured format with QR code.
2023-01-01	Wave 1 (turnover > SAR 3 bn in 2021)	Phase 2 integration with Fatoora live.
2024-2025	Waves 2–22	Phase 2 integration rolled out by descending turnover bands.
2026-03-31	Wave 23 (turnover > SAR 750k)	Phase 2 integration deadline.
2026-06-30	Wave 24 (turnover > SAR 375k)	Phase 2 integration deadline — captures essentially the full VAT register.

Background

Saudi Arabia operates the most ambitious continuous-transaction-control programme in the Middle East. ZATCA's Fatoora platform (literally 'invoice') went live in two phases: Phase 1 (Generation) in December 2021 obliged every VAT-registered taxpayer to abandon free-form PDFs and issue invoices in a structured format with a QR code; Phase 2 (Integration) from January 2023 plugs each taxpayer's billing system into Fatoora for real-time clearance (B2B and B2G) or near-real-time reporting (B2C, within 24 hours).

Phase 2 is rolled out by waves, each capturing taxpayers above a descending turnover threshold. By Wave 24 (June 2026), the threshold is SAR 375,000 — effectively the VAT registration floor — so the regime becomes universal.

Practically: Flowie's KSA endpoint signs the invoice with the seller's CSID-issued certificate, posts the JSON envelope to Fatoora, receives the cleared invoice with cryptographic stamp + UUID, and only then delivers the legal copy to the buyer. The QR code embedded in the printable invoice resolves to the Fatoora-side validation record.

Format profile

UBL 2.1 with the KSA CIUS — Saudi-specific QR code (TLV-encoded), cryptographic stamp, previous invoice hash (chained).
Two invoice classes: Standard (B2B/B2G) requires clearance before issuance; Simplified (B2C) requires reporting within 24 h.
Seller must hold a CSID (Cryptographic Stamp Identifier) issued by ZATCA; the EGS uses it to sign every invoice.
Mandatory fields beyond EN 16931: cbc:UUID, cac:AdditionalDocumentReference for ICV (invoice counter) and PIH (previous invoice hash).

Required fields

seller.vatNumberstring (15 digits)required

KSA VAT registration number — starts with 3, ends with 03.
seller.crNumberstringrequired

Commercial Registration number; appears in PartyIdentification.
seller.csidstringrequired

Cryptographic Stamp Identifier issued by ZATCA — bound to the EGS device.
invoice.icvintegerrequired

Invoice Counter Value — monotonically increasing per EGS device.
invoice.pihstring (base64 SHA-256)required

Previous Invoice Hash — chains every invoice to the previous one.

Public sector (B2G)

Combined private + public flow — no dedicated B2G hub for this country.

B2B reporting / clearance

Fatoora — Real-time clearance for B2B/B2G; near-real-time reporting (24h) for B2C. Invoice not legally valid until cleared.

Lifecycle status	Reported as
`cleared`	ZATCA validation passed; UUID + cryptographic stamp returned. Invoice may be delivered to buyer.
`rejected`	Validation failed; correct and resubmit. Original invoice never legally existed.
`reported`	B2C simplified invoice acknowledged within the 24h window.

Error codes

Code	Meaning	Fix
`BR-KSA-01`	QR code missing or malformed.	Ensure the TLV QR is generated with all 9 mandatory tags and base64-encoded.
`BR-KSA-08`	Invoice counter (ICV) not monotonically increasing.	ICV must increment by 1 per invoice on the same EGS device — never reset.
`BR-KSA-29`	Previous invoice hash (PIH) does not match the chain.	PIH must equal the SHA-256 base64 of the previous cleared invoice's signed XML.

Testing in sandbox

What you want to test	How
KSA happy path	Sender VAT `300000000000003`, recipient any KSA tax-registered entity in Flowie sandbox.
Force clearance rejection	Send with `simulateCompliance: "reject_KSA_BR_29"`.

FAQ

Do I need ZATCA accreditation as a software vendor?

You don't need ZATCA accreditation per se, but the EGS (your billing system) must pass ZATCA's compliance test in the Fatoora simulation portal and be onboarded with a CSID. Flowie ships pre-onboarded EGS profiles that you bind to your seller registration in one call.

Is Peppol used in Saudi Arabia?

No. KSA does not use Peppol — ZATCA operates its own clearance network. Flowie still exposes the same JSON to you; we adapt to Fatoora behind the scenes.

References

Primary sources (government / regulator / standards body):

ZATCA · Zakat, Tax and Customs Authority — Tax authority owning Fatoora.
ZATCA · E-Invoicing roll-out phases — Official wave-by-wave timeline.
Fatoora · simulation portal — Production / simulation portal for EGS onboarding.

Industry analyses (vendor trackers — useful for cross-referencing):

EY · Saudi Arabia Phase 2 Wave 23 — Industry analysis — wave criteria.
Sovos · Saudi Arabia e-invoicing — Industry tracker — KSA CIUS / Phase 2.