How Saudi Businesses Use iPaaS for ZATCA e-Invoicing and VAT Compliance

An iPaaS, short for Integration Platform as a Service, connects ERP, POS, accounting, and eCommerce systems to ZATCA so that invoices are generated, validated, and submitted in the required format. Instead of building and maintaining a separate connection for every application, businesses in Saudi Arabia manage e-invoicing and VAT compliance through one automated integration layer.

Every VAT registered business in Saudi Arabia now works under the e-invoicing rules set by the Zakat, Tax and Customs Authority (ZATCA). The rules keep expanding, wave by wave, and the technical requirements are precise. Invoices must follow a defined XML structure, carry cryptographic identifiers, and reach ZATCA within strict time limits. When invoice data sits across several disconnected systems, meeting those requirements by hand becomes slow and error prone. This guide explains what the rules require, how the integration actually works, and where an iPaaS fits in.

What is ZATCA e-Invoicing?

ZATCA e-invoicing, known locally as Fatoorah, is the mandatory digital invoicing framework introduced by the Zakat, Tax and Customs Authority of Saudi Arabia. It requires VAT registered businesses to create, store, and exchange invoices electronically in approved formats rather than on paper. The mandate took effect on 4 December 2021 and covers tax invoices, simplified invoices, and the credit and debit notes linked to them.

ZATCA describes the goals of the program as better reporting accuracy, more transparency in commercial transactions, and simpler audits. In practice, it means every invoice a business issues has to be produced by a compliant electronic system and, under Phase 2, shared with ZATCA itself.

ZATCA e-Invoicing and VAT Requirements

Which invoice types are covered?

ZATCA defines two invoice categories, and both extend to credit and debit notes:

• Standard tax invoice: used for business to business and business to government transactions and requires full invoice details, including the buyer VAT registration number.
• Simplified tax invoice: used for consumer transactions, typically below SAR 1,000, with a reduced field set and a QR code.

Invoices must be issued in Arabic. Other languages may appear alongside the Arabic text but cannot replace it.

How does VAT appear in e-invoices?

VAT in Saudi Arabia is currently 15 percent on most taxable goods and services. Each e-invoice must show the taxable amount, the VAT amount, and the supplier VAT registration number, and it must apply the correct VAT category code for standard rated, zero rated, and exempt supplies. Export sales and other zero rated transactions carry their own category codes, so systems need to classify each line item correctly before submission.

What are the archiving rules?

E-invoices must be retained in a secure digital format for at least six years under the VAT regulations, and records need to be stored on systems accessible from within the Kingdom. Invoices must stay unaltered and retrievable throughout the retention period. For some sectors and record types the retention period can be longer, so it is worth confirming the requirement for your industry with a tax adviser.

What happens if a business does not comply?

ZATCA applies penalties in tiers. Enforcement generally begins with a notice or warning and escalates for repeat violations, with published fines ranging from the low thousands of riyals up to SAR 50,000 depending on the violation type. Typical triggers include issuing invoices outside the approved format, missing VAT details, and failing to transmit invoices to ZATCA on time. The exact amounts and grace periods change over time, so the current schedule on the official ZATCA site is the reference point.

What are the ZATCA Phases?

ZATCA rolled out e-invoicing in two phases:

 Phase 2 introduces two distinct workflows. Standard tax invoices follow the clearance model: the invoice is submitted to ZATCA, validated, and returned with a cleared status before it can be shared with the buyer. Simplified tax invoices follow the reporting model: the invoice is handed to the customer right away and reported to ZATCA within 24 hours. Both workflows require invoices in the structured UBL 2.1 XML format, with PDF/A-3 as the human readable representation.

ZATCA Phase 2 Waves and Deadlines

ZATCA brings businesses into Phase 2 in waves based on annual VATable turnover, and it notifies each wave at least six months before the deadline. The rollout began in January 2023 with the largest businesses, those above SAR 3 billion in turnover, and has moved steadily down the turnover scale since.

The most recent milestones announced by ZATCA are Wave 23, which required businesses with VATable revenues above SAR 750,000 to complete their integration by 31 March 2026, and Wave 24, which extends the requirement to businesses above SAR 375,000 by 30 June 2026. At that threshold, nearly every VAT registered business in the Kingdom falls inside the mandate.

The practical takeaway: if your business has received a wave notification, or your turnover sits near the current threshold, the six month notice window is the time to prepare. Onboarding, certification, and testing each take time, and starting close to the deadline leaves little room to fix problems.

How Does ZATCA Phase 2 Integration Work?

Phase 2 is an API based integration between your invoicing systems and ZATCA. The onboarding sequence follows a defined path:

• Step 1. Generate a CSR: your solution creates a Certificate Signing Request for each device or system that issues invoices.
• Step 2. Pass compliance testing: ZATCA provides a sandbox environment where your solution must pass validation checks before certification.
• Step 3. Receive a CSID: on success, ZATCA issues a Cryptographic Stamp Identifier, the production certificate that authorises your system to submit invoices. Certificates are bound to specific devices and need secure storage and renewal.
• Step 4. Go live: cleared systems submit standard invoices through the clearance channel and report simplified invoices through the reporting channel.

Every compliant invoice carries a set of technical identifiers: a UUID that uniquely identifies the document, a digital signature, a cryptographic stamp, an Invoice Counter Value (ICV) that increments with every invoice, and a Previous Invoice Hash (PIH) that chains each invoice to the one before it. The hash chain makes records tamper evident, because changing any historical invoice breaks the chain. Simplified invoices also embed a QR code that ZATCA applications can scan and verify.

Building this pipeline separately for every ERP, POS, and eCommerce application is a heavy engineering task. An integration platform consolidates it: one layer manages certificate lifecycles, formats invoices into compliant XML, and routes each transaction from any connected system through the correct ZATCA channel.

Why Does ZATCA Reject Invoices?

When ZATCA validates a submitted invoice it can return a cleared status, a rejection with reasons, or a warning that requires correction. The most common rejection causes are structural:

• A broken invoice hash chain, usually a missing or mismatched Previous Invoice Hash
• Invalid or missing VAT category codes on line items
• Malformed QR code data on simplified invoices
• Duplicate invoice counter or sequence values
• Missing mandatory fields, such as the buyer VAT registration number on standard invoices

Rejections matter because a standard invoice cannot be legally shared with the buyer until it clears, which interrupts the order to cash cycle. Validating invoices against ZATCA field, format, and calculation rules before submission catches these issues while they are still correctable.

What is iPaaS and How Does It Help with ZATCA Compliance?

An iPaaS is a cloud platform that connects business applications and moves data between them through prebuilt connectors and configurable workflows. For ZATCA compliance, it acts as the single pipeline between the systems that create sales transactions and the authority that validates them. APPSeCONNECT applies this model with an added layer of AI assisted validation and monitoring.

One data layer across ERP, POS, CRM, and eCommerce

Invoice data usually originates in several places: an ERP for wholesale orders, a POS for store sales, an eCommerce platform for online orders. An iPaaS synchronises customer details, invoice lines, and VAT data across these systems so ZATCA submissions draw from one consistent record rather than several conflicting ones. This is the same foundation that supports ERP, eCommerce, and CRM integration more broadly.

Automated VAT calculation and pre-submission validation

The platform applies Saudi VAT rules to each transaction and checks invoices against ZATCA format and field requirements before they are sent. Errors in category codes, totals, or mandatory fields surface before submission instead of coming back as rejections.

Real time submission to ZATCA

Invoices are converted into the required XML structure and transmitted through ZATCA integration channels as transactions occur. Standard invoices go through clearance and simplified invoices are reported within the 24 hour window, without anyone having to trigger submissions manually.

Certificate management across devices and entities

Each invoice issuing device or unit carries its own CSID certificate. Businesses running many stores, warehouses, and sales channels end up managing a fleet of certificates with different renewal dates. A central integration layer keeps these certificates organised, which is difficult to do when every system connects to ZATCA on its own.

Audit ready archiving

The platform keeps logs of invoice creation, validation, submission, and clearance responses, and retains records in line with the six year requirement. When an audit request arrives, records are searchable and complete rather than scattered across systems.

Room to grow

Because connectors and workflows are configurable, adding a new sales channel, entity, or application extends the existing compliance pipeline instead of requiring a new integration project. Transaction volumes can grow without changing how compliance works.

ERP Compliance Requirements Beyond ZATCA

ZATCA is rarely the only framework a finance team answers to. Companies operating across borders also deal with financial reporting standards such as IFRS, data protection rules such as the Saudi Personal Data Protection Law (PDPL) and the GDPR, and internal control expectations in group reporting. The common thread is data quality: every framework depends on complete, consistent, and traceable records. An integration layer that synchronises data between ERP and connected applications serves all of these needs at once, because the same clean data that satisfies ZATCA also feeds accurate financial statements and defensible audit trails.

What is Next for Tax Compliance in Saudi Arabia?

Saudi Arabia continues to digitise its regulatory environment under Vision 2030. For compliance teams, three developments stand out:

• Continued wave expansion: ZATCA keeps announcing new Phase 2 waves, bringing smaller businesses into the integration mandate on a regular schedule.
• Data protection alongside tax rules: the PDPL adds obligations around how customer and financial data is stored and processed, which intersects with invoice archiving decisions such as data residency.
• More automation in compliance itself: validation, anomaly detection, and reporting are moving from manual review toward automated checks built into transaction workflows, and regulatory technology is increasingly bundled into ERP and integration platforms.

The direction is consistent: more real time reporting, more structured data, and less tolerance for manual processes. Systems chosen today should be able to absorb new validation rules and reporting requirements without a rebuild.

Getting Started

If your business runs on separate ERP, POS, accounting, or eCommerce systems and a Phase 2 deadline is approaching, the first step is an honest map of where invoices are created and how they currently reach ZATCA, if they do at all. From there, an integration platform can bring those flows into one compliant pipeline. You can explore the APPSeCONNECT platform, browse the library of prebuilt integrations, or schedule a demo to see how a ZATCA workflow is set up end to end.