ZATCA e-invoicing (Fatoora) for Saudi Arabia
QR-based VAT invoices, Phase 2 integration, and how Sum Cloud POS aligns with ZATCA’s developer and production endpoints — plus Saudi VAT rate setup (15% standard, zero-rated, exempt).
The Zakat, Tax and Customs Authority (ZATCA) runs Saudi Arabia’s electronic invoicing programme, commonly referred to as Fatoora. VAT-registered businesses must issue compliant e-invoices, often including a QR code on simplified tax invoices so buyers and ZATCA can validate key data. Technical and legal requirements evolve by phase and integration wave; always verify current rules on ZATCA’s official e-invoicing pages.
Phase 1 vs Phase 2 (high level)
| Topic | Phase 1 (simplified view) | Phase 2 (integration focus) |
|---|---|---|
| QR on invoice | Required for compliant simplified tax invoices; TLV-encoded fields for key invoice data. | QR extended with cryptographic content (e.g. hash/signature-related tags) so tampering is detectable — typically 9 TLV tags in integrated implementations. |
| Platform link | Generation & storage of e-invoices; QR for customer-facing validation. | Connectivity to ZATCA (clearance for many B2B flows, reporting for many B2C flows within defined time windows). |
| Format & security | Structured invoice data; QR as Base64 from TLV. | Typically UBL 2.1 XML, digital signatures (X.509), UUID per invoice, hashing per ZATCA specs. |
Wave deadlines and revenue thresholds are published by ZATCA and change over time. This page is an overview for POS buyers and integrators, not legal advice.
ZATCA QR code (TLV) — what it represents
ZATCA specifies a Tag-Length-Value (TLV) binary structure. The payload is Base64-encoded and rendered as a QR code on the printed or PDF invoice. Typical logical content includes:
- Tags 1–5 — Seller name, VAT registration number, invoice timestamp, invoice total (with VAT), VAT total amount.
- Tags 6–9 (Phase 2 style) — Cryptographic material such as invoice hash (e.g. SHA-256), ECDSA signature, public key, and certificate/stamp data — enabling verification that the invoice was issued correctly and not altered.
Exact tag ordering, lengths, and encoding must match ZATCA’s published implementation details (developer portal and integration guidelines). Consumer QR scanner apps and ZATCA tools decode this TLV to show invoice authenticity.
Saudi VAT rates in your POS (API-ready)
Sum Cloud POS’s backend supports company-scoped VAT rates independent of Pakistan FBR item rules. For Saudi Arabia, suggested presets include:
- Standard 15% VAT — tax category code
S(standard-rated supplies). - Zero-rated 0% — category
Z(e.g. certain exports / international supplies per law). - Exempt 0% — category
E(e.g. exempt supplies such as some financial or residential rent scenarios per law).
These align with common ZATCA / VAT categorisation patterns used alongside e-invoicing. Your tax adviser should confirm categories per transaction type.
Onboarding: CSID / PCSID and per-company setup
ZATCA’s sandbox is a shared environment for testing. Each taxpayer / POS unit must onboard to receive credentials such as:
- CSID (Compliance Stamp ID) — used as part of API client identity for compliance flows.
- PCSID (Production Cryptographic Stamp ID) — production cryptographic stamp / secret material as defined by ZATCA.
In Sum Cloud POS, per-company ZATCA settings (including credentials) are managed under company setup. Developers can configure integration defaults under the ZATCA Integration module. Validate flows in ZATCA’s sandbox before go-live.
Official ZATCA resources
- ZATCA Developer Portal
- ZATCA e-invoicing documentation
- ZATCA main site
- Detailed guideline PDF (e.g. e-invoicing detailed guideline) — download from ZATCA’s e-invoicing section for the latest PDF revision.
Pakistan FBR vs Saudi ZATCA
If you operate in Pakistan, see our FBR integrated POS page. FBR digital invoicing and ZATCA Fatoora are different regimes; Sum Cloud POS keeps VAT rate management separate from Pakistan item tax rules so GCC and KSA setups stay clean.