---
title: "Saudi Arabia — ZATCA Fatoora · clearance model"
description: "Saudi Arabia e-invoicing: ZATCA Fatoora real-time clearance live since 2021. Phase 2 integration rolling out in waves through 2026 (Wave 24 reaches taxpayers > SAR 375k by 30 June 2026)."
canonical: "https://docs.get-flowie.com/compliance/sa"
source: "https://docs.get-flowie.com/compliance/sa.html"
---

# Saudi Arabia — ZATCA Fatoora · clearance model

Compliance · 🇸🇦 Saudi Arabia Live mandate

# Saudi Arabia — ZATCA Fatoora · clearance model

Mandatory clearance via Fatoora portal · live since 2021 — regulator: [ZATCA · Zakat, Tax and Customs Authority](<https://zatca.gov.sa>). _Facts last refreshed: 2026-07-13._

Coverage model

Flowie operates a registered Peppol Access Point in this jurisdiction **directly** where we hold national accreditation, **or via a vetted local partner** registered with the in-country regulator where on-the-ground presence is required (KSeF, SDI intermediario, ZATCA service-provider, etc.). Either way, you call the same `POST /v1/documents/send`. 

## TL;DR

  * Saudi Arabia mandates **real-time clearance** through ZATCA's Fatoora portal — no clearance, no legal invoice.
  * **Phase 1 (Generation)** has applied to _all_ VAT taxpayers since December 2021; **Phase 2 (Integration)** rolls out in waves by turnover.
  * Wave 24 (announced 2025-10) brings every taxpayer with VAT-able revenue > **SAR 375,000** in 2022/2023/2024 into Phase 2 by **30 June 2026** — practically the whole VAT register.
  * Format: **UBL 2.1 with KSA-specific extensions** (TLV-encoded QR code, cryptographic stamp, hash chain).
  * Flowie integrates directly with Fatoora as an EGS (E-invoice Generation Solution); no Peppol wrapping.



## Deadlines

Date| Who| What  
---|---|---  
**2021-12-04**|  All VAT taxpayers| Phase 1 (Generation) — invoices must be issued in structured format with QR code.  
**2023-01-01**|  Wave 1 (turnover > SAR 3 bn in 2021)| Phase 2 integration with Fatoora live.  
**2024-2025**|  Waves 2–22| Phase 2 integration rolled out by descending turnover bands.  
**2026-03-31**|  Wave 23 (turnover > SAR 750k)| Phase 2 integration deadline.  
**2026-06-30**|  Wave 24 (turnover > SAR 375k)| Phase 2 integration deadline — captures essentially the full VAT register.  
  
## Background

Saudi Arabia operates the most ambitious continuous-transaction-control programme in the Middle East. ZATCA's **Fatoora** platform (literally 'invoice') went live in two phases: _Phase 1 (Generation)_ in December 2021 obliged every VAT-registered taxpayer to abandon free-form PDFs and issue invoices in a structured format with a QR code; _Phase 2 (Integration)_ from January 2023 plugs each taxpayer's billing system into Fatoora for real-time clearance (B2B and B2G) or near-real-time reporting (B2C, within 24 hours).

Phase 2 is rolled out by **waves** , each capturing taxpayers above a descending turnover threshold. By Wave 24 (June 2026), the threshold is SAR 375,000 — effectively the VAT registration floor — so the regime becomes universal.

Practically: Flowie's KSA endpoint signs the invoice with the seller's CSID-issued certificate, posts the JSON envelope to Fatoora, receives the cleared invoice with cryptographic stamp + UUID, and only then delivers the legal copy to the buyer. The QR code embedded in the printable invoice resolves to the Fatoora-side validation record.

## Format profile

  * **UBL 2.1 with the KSA CIUS** — Saudi-specific QR code (TLV-encoded), cryptographic stamp, previous invoice hash (chained).
  * Two invoice classes: **Standard (B2B/B2G)** requires clearance before issuance; **Simplified (B2C)** requires reporting within 24 h.
  * Seller must hold a **CSID** (Cryptographic Stamp Identifier) issued by ZATCA; the EGS uses it to sign every invoice.
  * Mandatory fields beyond EN 16931: `cbc:UUID`, `cac:AdditionalDocumentReference` for ICV (invoice counter) and PIH (previous invoice hash).



## Required fields

  * seller.vatNumberstring (15 digits)required

KSA VAT registration number — starts with 3, ends with 03.

  * seller.crNumberstringrequired

Commercial Registration number; appears in `PartyIdentification`.

  * seller.csidstringrequired

Cryptographic Stamp Identifier issued by ZATCA — bound to the EGS device.

  * invoice.icvintegerrequired

Invoice Counter Value — monotonically increasing per EGS device.

  * invoice.pihstring (base64 SHA-256)required

Previous Invoice Hash — chains every invoice to the previous one.




## Public sector (B2G)

_Combined private + public flow — no dedicated B2G hub for this country._

## B2B reporting / clearance

**Fatoora** — Real-time clearance for B2B/B2G; near-real-time reporting (24h) for B2C. Invoice not legally valid until cleared.

Lifecycle status| Reported as  
---|---  
`cleared`| ZATCA validation passed; UUID + cryptographic stamp returned. Invoice may be delivered to buyer.  
`rejected`| Validation failed; correct and resubmit. Original invoice never legally existed.  
`reported`| B2C simplified invoice acknowledged within the 24h window.  
  
## Error codes

Code| Meaning| Fix  
---|---|---  
`BR-KSA-01`| QR code missing or malformed.| Ensure the TLV QR is generated with all 9 mandatory tags and base64-encoded.  
`BR-KSA-08`| Invoice counter (ICV) not monotonically increasing.| ICV must increment by 1 per invoice on the same EGS device — never reset.  
`BR-KSA-29`| Previous invoice hash (PIH) does not match the chain.| PIH must equal the SHA-256 base64 of the previous cleared invoice's signed XML.  
  
## Testing in sandbox

What you want to test| How  
---|---  
KSA happy path| Sender VAT `300000000000003`, recipient any KSA tax-registered entity in Flowie sandbox.  
Force clearance rejection| Send with `simulateCompliance: "reject_KSA_BR_29"`.  
  
## FAQ

### Do I need ZATCA accreditation as a software vendor?

You don't need ZATCA accreditation per se, but the EGS (your billing system) must pass ZATCA's compliance test in the Fatoora simulation portal and be onboarded with a CSID. Flowie ships pre-onboarded EGS profiles that you bind to your seller registration in one call.

### Is Peppol used in Saudi Arabia?

No. KSA does not use Peppol — ZATCA operates its own clearance network. Flowie still exposes the same JSON to you; we adapt to Fatoora behind the scenes.

## References

**Primary sources** (government / regulator / standards body):

  * [ZATCA · Zakat, Tax and Customs Authority](<https://zatca.gov.sa>) — Tax authority owning Fatoora.
  * [ZATCA · E-Invoicing roll-out phases](<https://zatca.gov.sa/en/E-Invoicing/Introduction/Pages/Roll-out-phases.aspx>) — Official wave-by-wave timeline.
  * [Fatoora · simulation portal](<https://fatoora.zatca.gov.sa>) — Production / simulation portal for EGS onboarding.



**Industry analyses** (vendor trackers — useful for cross-referencing):

  * [EY · Saudi Arabia Phase 2 Wave 23](<https://www.ey.com/en_gl/technical/tax-alerts/saudi-arabia-announces-23rd-wave-of-phase-2-e-invoicing-integration>) — Industry analysis — wave criteria.
  * [Sovos · Saudi Arabia e-invoicing](<https://sovos.com/vat/tax-rules/saudi-arabia-e-invoicing/>) — Industry tracker — KSA CIUS / Phase 2.