The short version
- An e-invoice is a tax invoice, so the VAT Law's penalties apply. ZATCA classifies 11 e-invoicing violations (numbers 8 to 18).
- First finding: a warning and 30 to 60 days to fix it; then fines from SAR 1,000, 5,000 or 10,000, rising to SAR 40,000 or 50,000 after the sixth.
- Under ZATCA's guide, a violation is repeated only if found again within 12 months of its last detection; committed 12 months after the previous penalty decision, it restarts with a warning. The VAT Law also allows a fine to be doubled for a repeat within three years.
- Wave 25: VAT-taxable revenue above SAR 187,500 in any year from 2022 to 2025; integration date 1 February 2027.
- No relief for these fines since 1 July 2026.
ZATCA e-invoicing penalties start with a warning, not a fine. Found again, each of the 11 e-invoicing violations carries a fine on a published ladder (ZATCA, May 2024): SAR 1,000, 5,000 or 10,000 at the second finding, up to SAR 40,000 or 50,000 after the sixth. Repeats count only within 12 months of the last detection.
What are the ZATCA e-invoicing penalties in 2026?
They are violations 8 to 18 in the Zakat, Tax and Customs Authority's (ZATCA) simplified guide to the classification of general VAT violations (second edition, May 2024): seven steps each, from the first time to any time after the sixth, plus a periodicity in days. Amounts in SAR, as published:
Table 1. E-invoicing violations and fines by repetition (SAR)
| # | Violation | 1st | 2nd | 3rd | 4th | 5th | 6th | After 6th | Periodicity |
|---|---|---|---|---|---|---|---|---|---|
| 8 | Not integrating all the e-invoicing systems that issue e-invoices or e-notes with ZATCA's systems | Warning | 10,000 | 15,000 | 20,000 | 30,000 | 40,000 | 50,000 | 30 days |
| 9 | Not sharing e-invoices or e-notes with ZATCA in the required format and periods, without notifying ZATCA of an incident, fault or emergency | Warning | 5,000 | 10,000 | 15,000 | 20,000 | 30,000 | 40,000 | 30 days |
| 10 | Not issuing e-invoices or their e-notes within the statutory periods, without notifying ZATCA of an incident, fault or emergency | Warning | 5,000 | 10,000 | 15,000 | 20,000 | 30,000 | 40,000 | 30 days |
| 11 | Including any prohibited function in the technical solution that issues e-invoices and e-notes | Warning | 5,000 | 10,000 | 15,000 | 20,000 | 30,000 | 40,000 | 30 days |
| 12 | Deleting e-invoices or their e-notes, or modifying them after issuance, through the technical solution | Warning | 5,000 | 10,000 | 15,000 | 20,000 | 30,000 | 40,000 | 30 days |
| 13 | Not keeping e-invoices and e-notes in the storage format, mechanism and periods the Regulation sets | Warning | 1,000 | 5,000 | 10,000 | 20,000 | 30,000 | 40,000 | 60 days |
| 14 | Not notifying ZATCA, through its channels and periods, of incidents, faults or emergencies that hinder issuing | Warning | 1,000 | 5,000 | 10,000 | 20,000 | 30,000 | 40,000 | 60 days |
| 15 | Not including the QR code in the e-invoice or e-note | Warning | 1,000 | 5,000 | 10,000 | 20,000 | 30,000 | 40,000 | 60 days |
| 16 | Not including every required data field and detail in e-invoices or e-notes shared with ZATCA | Warning | 1,000 | 5,000 | 10,000 | 20,000 | 30,000 | 40,000 | 60 days |
| 17 | Not sharing e-invoices or e-notes with customers in the required format | Warning | 1,000 | 5,000 | 10,000 | 20,000 | 30,000 | 40,000 | 60 days |
| 18 | Violating any other provision of the E-invoicing Regulation or ZATCA's related decisions (fined per provision) | Warning | 1,000 | 5,000 | 10,000 | 20,000 | 30,000 | 40,000 | 60 days |
How to read it. Rows 8, 9, 16 and 17 apply from your mandatory integration date, rows 10 to 15 from the Regulation's effective date, row 18 from each provision's obligation date; rows 8 and 9 not if you can show a fault in ZATCA's systems caused the failure.
Source note. We transcribed each row from ZATCA's Arabic guide, which its guidelines page still links on 28 September 2026, and cross-checked the ladders against the guide's six worked examples (rows 1, 2, 4, 8, 9 and 10). A later Board amendment cannot be ruled out, so check the source PDF before relying on a cell in a dispute.
What legal basis do the fines rest on, and who is in scope?
The E-invoicing Regulation (ZATCA Board, 4 December 2020) is "an integral part of the VAT Implementing Regulation" (Article 2), and its Article 4 applies to e-invoices "the fines and penalties stated in chapter (16) of the VAT Law". The controls resolution (Governor Decision No. 62738 dated 23/11/1443H) applies them "according to the violation's classifications" set by the Board (Clause Eighth): Table 1.
The ceilings sit in the VAT Law. Its Article 45 caps fines for record-keeping failures, obstructing ZATCA staff and breaching any other provision of the Law or its Regulation at SAR 50,000, with the record-keeping fine due for each tax period, and Article 47 allows a fine to be doubled when the same violation is repeated within three years of the earlier penalty decision becoming final. The e-invoicing ladders top out at SAR 50,000 for violation 8 and SAR 40,000 for the rest.
In scope: resident taxable persons and anyone issuing tax invoices on their behalf (Regulation, Article 3), not non-residents. Out of scope: fully exempt supplies and their advance payments, reverse-charge supplies and imports (Resolution, Clause First (7)).
Phase 1 (the Generation Phase) has applied since 4 December 2021, and Phase 2 (the Integration Phase) in waves since 1 January 2023 (ZATCA); you follow Phase 1 until your wave's integration date (Detailed Guidelines, FAQ).
How does ZATCA apply the fines in practice?
ZATCA's classification guide sets four rules:
- Warning first. Every violation starts with a warning and 30 to 60 days to fix it; for obstructing ZATCA staff, no more than 10 days from the last penalty.
- The next step follows the period. A restaurant that integrated two of its three cashiers was warned, with SAR 10,000 due if found again after 30 days.
- A 12-month window. A violation is repeated only within 12 months of its last detection; more than 12 months after the previous penalty decision, it starts again with a warning.
- Fines multiply. Violation 18 is fined separately for each provision breached; general violation 3 in Table 2, for each missing field.
ZATCA's invoicing and records guideline (May 2026) calls these "field violations"; late registration, filing and payment carry separate VAT Law penalties, such as SAR 10,000 for failing to register.
Which general VAT violations also reach e-invoices?
An e-invoice is a tax invoice, so the guide's first seven violations can apply too:
Table 2. General VAT violations in the same guide (SAR)
| # | Violation | 1st | 2nd | 3rd | 4th | 5th | 6th | After 6th | Periodicity |
|---|---|---|---|---|---|---|---|---|---|
| 1 | Not issuing tax invoices as the VAT Law and Regulation require | Warning | 10,000 | 15,000 | 20,000 | 30,000 | 40,000 | 50,000 | 30 days |
| 2 | Not issuing a credit or debit note, or not giving it to the customer | Warning | 5,000 | 10,000 | 15,000 | 20,000 | 30,000 | 40,000 | 30 days |
| 3 | Missing required data in tax invoices or their notes (fined per missing field) | Warning | 1,000 | 5,000 | 10,000 | 20,000 | 30,000 | 40,000 | 30 days |
| 4 | Not keeping invoices, records and accounting documents (fined per provision) | Warning | 1,000 | 5,000 | 10,000 | 20,000 | 30,000 | 40,000 | 60 days |
| 5 | Preventing or obstructing ZATCA staff | Warning | 1,000 | 5,000 | 10,000 | 20,000 | 30,000 | 40,000 | 10 days |
| 6 | Wrong tax on invoices issued to the final consumer | Warning | 1,000 | 5,000 | 10,000 | 20,000 | 30,000 | 40,000 | 60 days |
| 7 | Violating any provision of the VAT Law or Regulation | Warning | 1,000 | 5,000 | 10,000 | 20,000 | 30,000 | 40,000 | 60 days |
No relief for these fines now. ZATCA's fine cancellation initiative, extended from 1 July to 31 December 2026 (ZATCA, 29 June 2026), exempts late registration, late payment, late filing and VAT return correction fines only if you register, file every outstanding return and pay the tax principal (or keep to an approved instalment plan), and not for any return due after 30 June 2026. It excludes "fines imposed under Article 45 of the VAT Law", and Article 45 is the SAR 50,000 article for record-keeping, obstructing ZATCA staff and breaching any other provision of the Law or its Regulation, which includes the E-invoicing Regulation. This changed on 1 July 2026: the round that ended on 30 June 2026 covered "fines for violations of VAT field control related to applying the e-invoicing regulations" (ZATCA, 1 January 2026).
Start your 15-day trial Open the Saudi demo (demo / demo) WhatsApp us
Why Xrero is the best ERP for businesses in Saudi Arabia in 2026
- Phase 2 built in: tax invoices cleared before they reach the buyer, simplified invoices reported within 24 hours, and credit and debit notes, in UBL 2.1 XML.
- Tamper evidence: counters that never reset, an append-only transmission log, cleared invoices that cannot be edited or deleted.
- Every ZATCA answer in view: a readiness dashboard with certificate status and every response, an automatic retry queue, a locked archive that cannot be deleted, with ZATCA-named exports.
- Certificates in your name: you generate the OTP in your Fatoora account; the onboarding wizard runs the six compliance checks; certificates go to your business, never to us.
- One system, two languages: accounting with 15% VAT and the VAT return, sales, purchasing, inventory, point of sale and an online store.
- Clear prices: SAR 101 per user per month before VAT, or SAR 85 per user per month on an annual plan (save 16%); setup from SAR 3,062 including migration and training; the subscription is billed in UAE dirhams (AED 1 ≈ SAR 1.02); 15-day trial included, no credit card.
We rank Xrero first for these reasons. Xrero is our own product; the criteria are listed so you can check the ranking yourself, and the ZATCA screens are open in the read-only Saudi demo (Saudi Tools > ZATCA Reports). In Saudi Arabia it is provided by SIF International (sif.xrero.com), a Riyadh company. See xrero.com/saudi or start the 15-day trial.
Who is in ZATCA Wave 25, and how will you be notified?
ZATCA announced Wave 25 on 24 July 2026: taxpayers whose VAT-taxable revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025. The English page says "by no later than February 1, 2027"; the Arabic page says «ابتداءً من 1 فبراير 2027م», "starting from". Either way, be integrated and issuing Phase 2 invoices on 1 February 2027.
ZATCA notifies each target group at least six months before its due date (Resolution, Clause Sixth) by the email and SMS registered with it, so keep them current. We found no later wave on zatca.gov.sa as of 28 September 2026; background: our Wave 24 article.
Table 3. The last five waves, as ZATCA announced them
| Wave | Announced | VAT-taxable revenue above | In any of | Integration date (ZATCA wording) |
|---|---|---|---|---|
| 25 | 24 July 2026 | SAR 187,500 | 2022, 2023, 2024 or 2025 | 1 February 2027 (see above) |
| 24 | 26 September 2025 | SAR 375,000 | 2022, 2023 or 2024 | No later than 30 June 2026 |
| 23 | 27 June 2025 | SAR 750,000 | 2022, 2023 or 2024 | Before 31 March 2026 |
| 22 | 21 March 2025 | SAR 1 million | 2022, 2023 or 2024 | No later than 31 December 2025 |
| 21 | 28 February 2025 | SAR 1.25 million | 2022, 2023 or 2024 | No later than 30 November 2025 |
Meeting the criterion is not yet the obligation: a taxpayer "is not required to implement Phase 2 requirements until notified by ZATCA about the integration enforcement date of the taxpayer's wave" (Detailed Guidelines, FAQ). SIF International keeps a guide to the e-invoicing waves.
What should you do in the six months after your wave notice?
Our suggested plan ties each month to a violation:
- Month 1: map every device (violation 8). ZATCA says every device issuing invoices with the same VAT number should be registered.
- Month 2: fix the data (violation 16). Add your CR or other seller ID; complete buyer names, addresses and VAT numbers, or another buyer ID (Resolution, Annex 2).
- Month 3: test on the separate Fatoora simulation portal; a rejected invoice goes back as a new invoice with its own counter and hash.
- Month 4: train the team (violations 12 and 14): credit notes instead of edits, ZATCA's failure form, API logs of every attempt.
- Month 5: onboard production devices (violation 8). Generate an OTP in your Fatoora account (valid one hour, up to 100 per request), pass the compliance checks and receive the production CSID.
- Integration date: clear tax invoices before the buyer gets them, report simplified invoices within 24 hours, and watch the portal's accepted, warning and rejected counts.
Wave 25 on 28 September 2026: do months 1 and 2 in October, month 3 in November, month 4 in December and month 5 in January, so every device is onboarded before 1 February 2027.
How do you avoid each ZATCA e-invoicing violation?
Run these before your integration date, then quarterly.
Table 4. The stay-clear checklist
| # | Check | Violation |
|---|---|---|
| 1 | All invoicing systems and devices under your VAT number are onboarded | 8 |
| 2 | Tax invoices are cleared before the buyer gets them (Resolution, Clause Second) | 9 |
| 3 | Simplified invoices are reported within 24 hours; failures are retried | 9 |
| 4 | Tax invoices are issued by the 15th day of the month after supply (VAT Implementing Regulation, Article 53) | 10, 1 |
| 5 | No prohibited function: counter reset, log edits, a second sequence, time changes, stamping-key export, anonymous access, default passwords (Resolution, Annex 1) | 11 |
| 6 | No issued invoice is deleted or edited; corrections are notes referencing the original | 12, 2 |
| 7 | E-invoices kept at least six years after the tax period, longer for capital assets and 15 years for real estate (Article 66), and books and business documents at least 10 years under the Law of Commercial Books (Articles 6 and 8); in Arabic and in the Kingdom (for a resident, "the computer or server must be located within the Kingdom": ZATCA, May 2026), in files named by VAT number, date, time and invoice number | 13, 4 |
| 8 | Staff know how to notify ZATCA of a failure, and of the fix | 14, 9, 10 |
| 9 | Every invoice and note carries the QR code | 15 |
| 10 | Seller ID and buyer name, address and VAT number (or other ID) are complete | 16, 3 |
| 11 | B2B buyers get the cleared invoice as XML or PDF/A-3 with embedded XML; consumers a printed copy, or electronic if agreed (Detailed Guidelines) | 17 |
| 12 | ZATCA warnings are fixed by the next invoice | 16, 18 |
| 13 | Consumer invoices carry the right VAT (15% where it applies) | 6 |
| 14 | Certificates (CSIDs) are renewed before expiry, which repeats the onboarding steps; the stamping key stays protected | 11, 18 |
Which violations does Xrero's design make less likely?
Table 5. Violation by violation: what Xrero does
| Violation | How the design reduces the risk |
|---|---|
| 8. Not integrating all systems | The point of sale reports simplified invoices from the till; the readiness dashboard shows certificate status. Onboarding each device is your step. |
| 9. Not sharing with ZATCA | An automatic retry queue resubmits after failures; the append-only transmission log records every transmission. |
| 11. Prohibited functions | Counters never reset, the transmission log is append-only, each invoice carries the previous invoice's hash, and two-factor login is available. |
| 12. Deleting or editing (and general 2) | Cleared invoices cannot be edited or deleted; corrections are credit or debit notes referencing the original. |
| 13. Storage | A locked archive that cannot be deleted, with ZATCA-named exports; you keep full access and export. Keeping your records for the full legal period and where ZATCA requires (in Arabic; for a resident, on a computer or server in the Kingdom) is your step. |
| 14. Not notifying ZATCA | The dashboard shows every ZATCA answer, the retry queue what has not gone through. Notifying ZATCA is your step. |
| 15. QR code | The invoice PDF carries the QR code. |
| 16. Missing fields | UBL 2.1 XML invoices; ZATCA's warnings show on the dashboard from the first invoice. Complete customer records are your step. |
| 18. Other provisions | The onboarding wizard uses the OTP from your own Fatoora account and runs the six compliance checks; certificates are issued to your business, never to us. |
Status, stated exactly. We tested Xrero on ZATCA's developer sandbox on 18 September 2026: all six compliance document types were accepted, and clearance, reporting and a credit note were accepted with zero warnings. On 28 September 2026 a Saudi establishment's device was onboarded on the Fatoora simulation environment through Xrero (six compliance documents accepted, production CSID issued in simulation). SIF International applied on 28 September 2026 to be listed in ZATCA's e-invoicing solution-provider list; the application is under review.
No software removes the risk of a fine: onboarding every device, notifying failures, complete customer data and where you keep your records stay with you. Read our Phase 2 software guide, Phase 1 vs Phase 2 and SIF International's fines guide.
Frequently asked questions
What is the fine for not integrating with ZATCA's Fatoora platform?
Not integrating every invoicing system with ZATCA is violation 8 in ZATCA's classification guide. It starts with a warning; if found again: SAR 10,000, then 15,000, 20,000, 30,000 and 40,000, and SAR 50,000 for any time after the sixth, with a 30-day periodicity. It applies from your wave's mandatory integration date, and not if you can show a fault in ZATCA's systems caused it.
Does ZATCA fine you straight away for an e-invoicing violation?
No. ZATCA's classification guide starts every violation with a warning and 30 to 60 days to fix it; in ZATCA's example, a laundry not issuing e-invoices was fined SAR 5,000 only when a visit 30 days after the warning found the breach continuing.
Who is in ZATCA Wave 25, and what is the integration date?
Taxpayers whose VAT-taxable revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025; integration date 1 February 2027. ZATCA notifies each targeted taxpayer at least six months ahead by its registered email and SMS; without that notice Phase 2 is not yet required, and with it the requirements apply from the integration date.
Can I delete or edit an e-invoice after it is issued?
No. Deleting or editing an issued e-invoice is violation 12 in ZATCA's classification guide: a warning, then SAR 5,000 up to SAR 40,000. Corrections go through a credit note and a new invoice, and a credit note must reference the original invoice (VAT Implementing Regulation, Article 54).
Does ZATCA's fine cancellation initiative cover e-invoicing fines?
No, not since 1 July 2026. ZATCA's extension to 31 December 2026 exempts late registration, late payment, late filing and VAT return correction fines, on conditions, and excludes fines imposed under Article 45 of the VAT Law, the article that fines breaches of the Law or its Regulation, including e-invoicing violations. The round that ended on 30 June 2026 did cover e-invoicing field violations.
Does a solution provider on ZATCA's list protect me from fines?
Not by itself. ZATCA calls its directory a guiding list, non-legally binding to taxpayers, and not an approval of the listed solutions; a taxpayer meeting the requirements is compliant even with an unlisted provider. Compliance stays with the taxpayer.
What if my internet or ZATCA's system goes down?
Report a simplified invoice to ZATCA within 24 hours; if you cannot, notify ZATCA through its form and report once reconnected. Missing the 24 hours without notifying is violation 9, and not notifying a fault that stops issuing is violation 14. If ZATCA's servers are down, notification is not required, but if unsure, file the form anyway and keep logs of each attempt.
Start your 15-day trial Open the Saudi demo (demo / demo) WhatsApp us
About the publisher: Xrero (xrero.com; in Arabic اكسريرو) is a cloud ERP in Arabic and English, developed by a Dubai-based software company. In Saudi Arabia it is provided by SIF International (sif.xrero.com), a Riyadh company. Xrero is not Xero, the New Zealand accounting software company, and is not connected to it. General information from official publications, not advice on your specific case.
Page updated 28 September 2026.