ZATCA E-Invoicing (Fatoora) for E-commerce and Web Systems (2026)

ZATCA e-invoicing, known as Fatoora, is Saudi Arabia’s mandatory electronic invoicing system: VAT-registered resident businesses must issue invoices from a compliant electronic system, and in Phase 2 that system must connect to ZATCA’s Fatoora platform. Phase 1 (generation) has applied since 4 December 2021. Phase 2 (integration) is rolling out in waves by revenue, and Wave 25, announced on 24 July 2026, covers taxpayers with VAT-liable revenue above SAR 187,500 in any year from 2022 to 2025, with a deadline of 1 February 2027.

For online stores, ERPs and custom web systems, this means invoices are no longer just a PDF. Each one is structured XML data, signed, hashed, carries a QR code and is either cleared or reported to ZATCA. This guide explains what that requires and how to implement it. It is not legal or tax advice; confirm your obligations with ZATCA or a qualified tax adviser.

What is Fatoora?#

Fatoora is the name of ZATCA’s e-invoicing programme and of the portal (fatoora.zatca.gov.sa) where taxpayers onboard their invoicing solutions. ZATCA (the Zakat, Tax and Customs Authority) states in its e-invoicing FAQ that the rules apply to resident VAT-registered taxpayers, including those issuing invoices on behalf of suppliers, and that non-resident taxable persons are excluded.

An e-invoice is an invoice generated, stored and amended in a structured electronic format by a compliant system; handwritten or spreadsheet invoices do not qualify.

Phase 1: generation (since 4 December 2021)#

Phase 1 requires taxpayers to issue and store invoices and credit and debit notes from a compliant electronic solution, with the mandatory fields. According to ZATCA’s FAQ:

• Simplified tax invoices (mostly B2C) must show a QR code containing at least the seller’s name, VAT number, date and time, invoice total and VAT amount.
• No connection to ZATCA is needed in Phase 1.
• Some functions are prohibited, such as uncontrolled access, tampering with invoices or logs, and multiple invoice sequences.

Phase 2: integration, rolled out in waves#

Phase 2 became enforceable from 1 January 2023 and is applied to groups of taxpayers in waves, selected by VAT-liable revenue in specified reference years. ZATCA says it notifies each targeted taxpayer directly, at least six months before their integration date.

The thresholds have fallen steadily, from more than SAR 3 billion in Wave 1 to SAR 375,000 in Wave 24 and SAR 187,500 in Wave 25. For context, SAR 375,000 is Saudi Arabia’s mandatory VAT registration threshold and SAR 187,500 the voluntary threshold, according to accounting platform Wafeq. So Wave 25 reaches most VAT-registered small businesses, including many online stores.

Timeline table: key ZATCA e-invoicing dates#

Selected waves shown; dates are from ZATCA’s Wave 25 announcement and EY’s summary of all waves. Always check the notification ZATCA sends you for your exact date.

Clearance vs reporting: B2B and B2C invoices#

Phase 2 uses two models, set out in ZATCA’s E-Invoicing Detailed Guideline:

• Clearance (standard tax invoices, mainly B2B and B2G). The invoice must be sent to Fatoora in XML and cleared in real time before it is shared with the buyer. ZATCA applies its cryptographic stamp and returns the cleared invoice with its QR code.
• Reporting (simplified tax invoices, mainly B2C). Your solution signs the invoice with its own cryptographic stamp, gives it to the customer immediately, and uploads it to Fatoora within 24 hours of issue.

Most consumer orders in an online store are simplified tax invoices and follow the reporting model; a store that also sells to VAT-registered businesses needs both flows.

What a Phase 2 invoice contains#

• XML based on UBL 2.1. ZATCA’s XML Implementation Standard uses the UBL 2.1 invoice schema. Invoices can be stored as XML or as PDF/A-3 with the XML embedded, but clearance requires XML.
• Cryptographic stamp and CSID. A CSID (Cryptographic Stamp Identifier) is the certificate ZATCA issues to each invoicing solution unit. Simplified invoices are stamped by your system using it.
• Invoice hash and UUID. Each invoice carries a unique identifier and a hash that links it to the previous invoice, making the chain tamper-evident.
• QR code. For simplified invoices, the guideline requires a QR code with nine tags in TLV Base64 format.
• Tamper-resistant counter. The invoice counter cannot be reset or reformatted.
• Arabic. Saudi tax invoices must be issued in Arabic, with other languages allowed as translation, according to ClearTax’s VAT invoicing guide. Bilingual Arabic/English layouts are standard.

What it means for online stores#

An online store in scope cannot rely on a plugin that only generates a nice PDF. In practice it needs to:

• Generate the e-invoice automatically when an order is paid or fulfilled, depending on your tax point.
• Issue credit notes in the same compliant way for refunds and cancellations.
• Queue and retry reporting so that a connection failure does not push you past the 24-hour window.
• Capture the buyer’s VAT number at checkout when a business buys, so the order follows the clearance flow.
• Send the customer an invoice with the correct QR code by email, in their account area or by WhatsApp.

For WooCommerce, this usually means a dedicated ZATCA integration or connecting the store to a compliant accounting system. Our WooCommerce development team can review your current setup. For hosted platforms, check whether the platform itself, an app or your accounting system is the compliant invoicing solution. See our e-commerce services for the wider build.

ERPs and custom web systems#

If you run a custom system (Laravel, Node.js, ASP.NET Core or similar), it is your e-invoicing solution, and it must meet the technical standards itself. The typical integration steps are:

1. Map your invoice data to ZATCA’s mandatory fields and the UBL 2.1 XML structure.
2. Generate keys and a certificate signing request for each solution unit.
3. Get an OTP from the Fatoora portal and request a compliance CSID.
4. Pass the compliance checks by submitting sample invoices, credit notes and debit notes for the invoice types you issue.
5. Obtain the production CSID and switch to live clearance and reporting.
6. Monitor responses, warnings and rejections, and keep secure archives.

Develop and test against ZATCA’s sandbox and simulation environments before production. Plan for certificate renewal, multiple branches or devices, and secure key storage. This is the kind of work our web application development team handles for GCC clients from Amman.

Choosing a compliant e-invoicing solution#

ZATCA publishes a Solution Providers Directory of providers that have gone through its qualification process, grouped by Phase 1 and Phase 2. ZATCA states that the list is not an approval of any solution, and that taxpayers may use any provider, listed or not, provided the solution meets the requirements. When comparing options, ask:

• Does it support both clearance and reporting, plus credit and debit notes?
• Does it integrate with your store, ERP or POS through a documented API?
• How does it handle outages, retries and the 24-hour reporting rule?
• Where is invoice data stored and archived? Saudi Arabia’s Personal Data Protection Law became fully enforceable on 14 September 2024, according to Clyde and Co.
• Can it produce Arabic and bilingual invoice layouts?

Implementation checklist#

1. Check your revenue for each reference year and watch for ZATCA’s notification.
2. Audit how invoices are created today across store, ERP, POS and manual processes.
3. Decide: compliant third-party solution, or build the integration into your system.
4. Fix data quality: VAT numbers, addresses, product tax categories, rounding.
5. Test in sandbox and simulation, then onboard each solution unit in Fatoora.
6. Go live well before your deadline and monitor rejections daily at first.

Consult One builds and integrates e-commerce stores and custom web systems for Saudi and GCC businesses from our office in Amman, including ZATCA e-invoicing integration with your store or ERP. Tell us how you invoice today and we will propose a practical route. Get a free quote.

FAQ#