ZATCA e-invoicing explained

In Saudi Arabia every invoice, credit note and debit note must be an e-invoice: a signed electronic document that ZATCA (the Zakat, Tax and Customs Authority) receives through its Fatoora platform. For your branches in Saudi Arabia the system does this by itself each time you issue a document. Branches in other countries are not affected.

Clearance and reporting

Until a standard invoice is cleared, its print has no QR code and says Not yet cleared by ZATCA: not to be given to the buyer as a tax invoice. Which customers get which kind: see Choose a simplified or a standard (B2B) invoice.

Devices and certificates

ZATCA wants to know which unit signed each document. Each Saudi branch therefore has at least one e-invoicing device with its own ZATCA certificate. You add and onboard devices in Settings → E-invoicing (ZATCA):

1. In the Fatoora portal (fatoora.zatca.gov.sa) choose Onboard new solution unit/device and copy the 6-digit one-time password (OTP). It is valid for one hour.
2. Type the OTP and press Request: the system asks ZATCA for a compliance certificate.
3. Run the checks: test documents for every type the device issues are signed and checked by ZATCA. All must pass.
4. Get it: the production certificate arrives and the device shows Ready.

Start with the Developer sandbox or Simulation environment to try; Production needs an OTP from the real Fatoora portal.

Certificates expire. When one gets close (30 days by default), the device shows Renew soon, the Dashboard shows an alert and a high-priority task Renew the e-invoicing certificate of … is created. To renew, get a new OTP in the Fatoora portal with Renew existing cryptographic stamp identifier and press Renew certificate. If ZATCA refuses a device's credentials, the device shows Problem and stops signing until you renew or onboard it again.

When e-invoicing starts

A Saudi branch starts with e-invoicing off. It turns on by itself when the branch's Production device finishes onboarding; a ready sandbox or simulation device never turns it on. Invoices issued before that are not e-invoices (not required): they get no ZATCA status and are never sent later. If someone turns the switch off, it stays off until someone turns it on again. While e-invoicing is on and no device is ready, new invoices wait as ZATCA: Pending and are sent in order once a device is ready.

When several devices are ready, production signs before simulation, and simulation before sandbox. A document stays with the device, and the environment, that signed it.

The counter and the chain

Each device numbers the documents it signs with a counter (shown as ICV) and links each document to the one before it with a hash. This chain shows ZATCA that nothing was removed. A rejected document keeps its place in the chain; its corrected version is a new document with a new UUID and the next counter. The invoice number you see never changes. For the same reason, invoices, credit notes and debit notes are never deleted or voided: you correct them with a credit or debit note.

The QR code

The QR code holds the seller's name, VAT number, the date and time of issue, the total with VAT, the VAT total and the electronic signature, so the invoice can be checked by scanning it.

When ZATCA cannot be reached

If ZATCA is down or slow, the document stays ZATCA: Pending and the system tries again by itself, first after a minute, then at longer intervals up to 6 hours, about 15 times over a day and a half. After that it shows ZATCA: Not sent. Documents still pending after 12 hours, and every rejected or not-sent one, appear in the alert on the Dashboard and on The E-invoices screen.

Who does what

• Issue invoices and credit notes: issue documents and see their ZATCA status.
• Set up and send e-invoices (ZATCA): send again, correct and send as a new document, and manage devices. The Owner, Manager and Finance roles have both by default.