What Is Fatoora? The ZATCA E-Invoicing System

What is Fatoora?

Fatoora — Arabic for "invoice", and written FATOORA or Fatoorah by the authority itself — is Saudi Arabia's mandatory e-invoicing programme, run by ZATCA, the Zakat, Tax and Customs Authority. The name covers both the programme and the platform: every resident VAT-registered business must issue structured electronic invoices, and taxpayers brought into Phase 2 must connect their systems to ZATCA's FATOORA platform for clearance and reporting.

It runs on the Kingdom's own national infrastructure, not Peppol, and it has expanded from simple invoice generation into full real-time integration for a growing population of taxpayers.

If continuous transaction controls (CTC) are new to you, the Oman Fawtara 5-corner model is a useful companion — a neighbouring GCC CTC regime built on different rails. This guide focuses on the Saudi specifics.

Who runs it, and what it's called

E-invoicing in Saudi Arabia is administered by ZATCA — the Zakat, Tax and Customs Authority — under the brand FATOORA (Fatoorah, Arabic for "invoice"). It applies to resident VAT-registered businesses and is delivered in two phases.

Phase 1 vs Phase 2

Phase 1 — the Generation phase (from 4 December 2021)

Every resident VAT-registered taxpayer must generate and store electronic invoices in a structured, tamper-resistant form, instead of handwritten or simple PDF invoices. Simplified (B2C) invoices must carry a QR code. There is no direct connection to ZATCA at this stage — the obligation is to produce compliant invoices and keep them.

Phase 2 — the Integration phase (from 1 January 2023)

Phase 2 adds direct integration between the taxpayer's system and ZATCA's FATOORA platform. It is rolled out in waves defined by VAT-liable revenue — ZATCA announces each wave and notifies affected taxpayers, at least six months ahead. Waves 1 to 24 (revenue above SAR 375,000) have all passed; the last deadline was 30 June 2026. Wave 25, announced on 24 July 2026, takes every taxpayer whose VAT-liable revenue exceeded SAR 187,500 in any of 2022, 2023, 2024 or 2025, with integration by 1 February 2027 (ZATCA, 24 July 2026). Non-resident taxable persons are outside the regulation.

The clearance and reporting models

Phase 2 is where Saudi Arabia's CTC model becomes concrete, and it splits by invoice type:

This is the crucial distinction. A standard invoice is not valid until ZATCA has cleared it — the authority sits in the transaction. A simplified invoice is issued to the consumer immediately and reported shortly after. Getting this routing wrong is a common implementation failure.

What a compliant invoice contains

ZATCA specifies both the format and the security features. A Phase 2 invoice is XML (built on a UBL 2.1-based implementation standard, or PDF/A-3 with embedded XML) and must carry:

• A UUID and the mandatory VAT fields.
• A cryptographic stamp and the previous-invoice hash (PIH), chaining invoices together.
• A QR code encoding the required elements.

Because these are hard rules enforced by the platform, the discipline is the same as any CTC regime: validate before submission. The general failure modes are catalogued in invoice validation errors you can prevent.

ZATCA is not Peppol — and why that matters

Unlike Oman (PINT OM over Peppol) or the EU (BIS Billing 3.0 over Peppol), ZATCA runs its own platform and its own format. There is no four-corner network, no SMP/SML discovery, no AS4 transport — the taxpayer integrates directly with FATOORA. For the distinction between network and format in general, see Peppol vs PINT.

The practical consequence for any business operating across the GCC: you cannot standardise on one national platform. A Saudi entity needs FATOORA; an Omani entity needs PINT OM; a UAE entity needs PINT-AE. This is exactly the case for a single integration that abstracts every mandate — the model set out in the multi-country e-invoicing API.

Choosing a provider

ZATCA lets taxpayers use any solution that meets the e-invoicing requirements, and publishes an indicative directory of qualified solution providers. The selection criteria are broadly the same as anywhere — compliance, integration quality, security and support — and are covered in how to choose a Peppol Access Point (the principles transfer even though ZATCA itself isn't Peppol). To see where Saudi Arabia sits in the wider wave of 2026 mandates, use the e-invoicing mandates 2026 tracker.

For where GoRoute itself stands, our Saudi Arabia e-invoicing page says it plainly: the ZATCA integration is in development on ZATCA's developer sandbox, it is not live, and no date is promised.

A readiness checklist

• [ ] Confirm your wave and integration date (ZATCA notifies affected taxpayers).
• [ ] Produce XML invoices to ZATCA's implementation standard.
• [ ] Route standard invoices for clearance, simplified for 24-hour reporting.
• [ ] Implement the cryptographic stamp, PIH chaining, UUID and QR code.
• [ ] Validate every invoice before submission; block on errors.
• [ ] Persist ZATCA responses and identifiers against each source invoice for audit.

How GoRoute helps

GoRoute (POP000991) is a certified Peppol Access Point and SMP. Across the GCC it runs Oman's PINT OM programme today; its integration with Saudi Arabia's FATOORA — a non-Peppol platform — is in development on ZATCA's developer sandbox, and no date is promised. If you're planning a GCC-wide rollout rather than a Saudi-only project, the architecture to build toward is one REST API with validation before submission, and the honest sequencing today starts with Oman. For the Saudi position on its own, see Saudi Arabia e-invoicing: ZATCA Fatoora. Book a demo or read the multi-country e-invoicing API.

Sources: ZATCA E-Invoicing (FATOORA); ZATCA roll-out phases; ZATCA, wave 25 announcement, 24 July 2026; ZATCA E-Invoicing Detailed Guidelines; ZATCA solution providers directory.