ZATCA Electronic Invoicing (Fatoora) Technical Specification & Architecture Reference

1. Regulatory Framework & Two-Phase Mandate

Electronic invoicing in the Kingdom of Saudi Arabia—officially designated as the Fatoora (فاتورة) program—was established by the Board of Directors of the Zakat, Tax and Customs Authority (ZATCA) (formerly the General Authority of Zakat and Tax, GAZT) pursuant to Board Resolution No. (2-6-20) dated 19/04/1442 AH (4 December 2020). On 28 May 2021, ZATCA enacted the companion implementation statute, Controls, Requirements, Technical Specifications and Procedural Rules for Implementing the Provisions of the E-Invoicing Regulation.

The regulatory architecture applies to all resident VAT-registered taxpayers in Saudi Arabia (and third parties issuing tax invoices on their behalf) and is enforced in two sequential operational phases:

• Phase 1 — Generation Phase (مرحلة الإصدار والحفظ), effective 4 December 2021: Prohibits handwritten invoices and unformatted text editors. Mandates that all taxpayers generate and store electronic tax invoices, simplified tax invoices, and associated credit/debit notes using a compliant electronic invoicing system (EGS), including a Base64-encoded Tag-Length-Value (TLV) Quick Response (QR) code on simplified invoices containing five mandatory fiscal fields (Tags 1–5).
• Phase 2 — Integration Phase (مرحلة الربط والتكامل), effective 1 January 2023 in phased waves: Mandates direct cryptographic and API integration between each taxpayer's Electronic Invoice Generation Solution (EGS) unit and ZATCA's centralized Fatoora portal. Phase 2 enforces strict XML structural validation under OASIS Universal Business Language (UBL 2.1, ISO/IEC 19845:2015), tamper-evident invoice chaining via a SHA-256 Previous Invoice Hash (PIH), digital signing with an elliptic-curve Cryptographic Stamp Identifier (CSID), and four additional cryptographic QR tags (Tags 6–9).

2. Document Taxonomy & Clearance Models

Under Article 53 of the KSA VAT Implementing Regulations and the ZATCA E-Invoicing Data Dictionary, electronic fiscal documents are classified by two UBL attributes: cbc:InvoiceTypeCode (UN/CEFACT Code List 1001) and its seven-character subtype attribute name="NNPNESB".

3. OASIS UBL 2.1 XML & Hash Chaining (PIH)

Every Phase 2 electronic invoice is serialized as UTF-8 encoded XML (without Byte Order Mark, BOM) conforming to the OASIS UBL 2.1 schema (detailed UBL 2.1 XML guide). To prevent retroactive invoice deletion or sequence manipulation, each EGS unit maintains a strictly monotonic ledger anchored by three Saudi-specific business terms:

1. Universally Unique Identifier (UUID, KSA-1 / cbc:UUID): A RFC 4122 Version 4 UUID uniquely identifying the fiscal document across the national registry.
2. Invoice Counter Value (ICV, KSA-16): A sequential, non-resettable integer (1, 2, 3, ...) incremented per EGS unit for every generated fiscal document regardless of document type.
3. Previous Invoice Hash (PIH, KSA-13): The Base64-encoded SHA-256 digest of the immediately preceding XML invoice generated by the same EGS unit. For the first invoice (ICV = 1) on a new EGS device, the specification mandates the SHA-256 digest of the ASCII character "0":

<!-- Genesis Previous Invoice Hash (PIH for ICV = 1: Base64(Hex(SHA-256("0")))) -->
<cac:AdditionalDocumentReference>
  <cbc:ID>PIH</cbc:ID>
  <cac:Attachment>
    <cbc:EmbeddedDocumentBinaryObject mimeCode="text/plain">NWZlY2ViNjZmZmM4NmYzOGQ5NTI3ODZjNmQ2OTZjNzljMmRiYzIzOWRkNGU5MWI0NjcyOWQ3M2EyN2ZiNTdlOQ==</cbc:EmbeddedDocumentBinaryObject>
  </cac:Attachment>
</cac:AdditionalDocumentReference>

<!-- Monotonic Invoice Counter Value (ICV) -->
<cac:AdditionalDocumentReference>
  <cbc:ID>ICV</cbc:ID>
  <cbc:UUID>1</cbc:UUID>
</cac:AdditionalDocumentReference>

To compute an invoice's canonical hash (KSA-14), the processor removes the <ext:UBLExtensions> block, the <cac:Signature> block, and the QR <cac:AdditionalDocumentReference> node via XPath filtering, applies W3C Canonical XML 1.1 (C14N11), hashes the resulting byte stream using SHA-256, and Base64-encodes the 32-byte binary digest.

4. Cryptographic Stamp Identifier (CSID) & Public Key Infrastructure

Unlike RSA-based e-invoicing regimes, ZATCA mandates Elliptic Curve Digital Signature Algorithm (ECDSA) over the secp256k1 curve (ASN.1 Object Identifier 1.3.132.0.10) with SHA-256 (`ecdsa-with-SHA256`). Each EGS unit undergoes a two-stage cryptographic onboarding lifecycle:

• Certificate Signing Request (CSR) Generation: The EGS generates a secp256k1 keypair locally and constructs a PKCS#10 CSR containing ZATCA-specific X.509v3 Subject Alternative Name (`SAN`) attributes: EGS Serial Number (`1-Vendor|2-Version|3-UUID`), 15-digit VAT Registration Number (`UID`), Invoice Type support mask (`1100` for both Standard and Simplified), Location/Branch address, and Industry category.
• Compliance CSID (CCSID): Using a 6-digit One-Time Password (OTP) generated in the Fatoora portal, the EGS submits the CSR to the ZATCA Compliance API and receives a short-lived Compliance CSID to execute mandatory compliance checks across standard, simplified, credit, and debit test payloads.
• Production CSID (PCSID): Upon passing compliance validation, ZATCA issues a Production X.509v3 certificate (`PCSID`) used to authenticate API requests (HTTP Basic Auth via BinarySecurityToken + Secret) and embed ETSI XAdES-EPES digital signatures inside <ext:UBLExtensions>.

5. Binary TLV QR Code Encoding (Tags 1–9)

ZATCA QR codes do not encode plain text or web URLs; they encode a binary Tag-Length-Value (TLV) byte array serialized into a Base64 string (see detailed TLV QR implementation notes). Each field consists of a 1-byte unsigned integer Tag (`0x01`–`0x09`), a 1-byte (or multi-byte length-prefixed) unsigned integer Length representing the exact byte count, and the raw Value bytes:

6. Phase 2 Integration Rollout Waves (Waves 1–24)

ZATCA notifies taxpayer cohorts at least six months prior to their mandatory Phase 2 integration enforcement window based on annual VAT-taxable revenue in Saudi Riyals (SAR):

7. Normative References & Standards

1. Zakat, Tax and Customs Authority (ZATCA): Electronic Invoicing Regulation, issued by GAZT Board Resolution No. (2-6-20) dated 19/04/1442 AH (4 December 2020), Riyadh, Kingdom of Saudi Arabia.
2. Zakat, Tax and Customs Authority (ZATCA): Controls, Requirements, Technical Specifications and Procedural Rules for Implementing the Provisions of the E-Invoicing Regulation, 28 May 2021 (and subsequent amendments).
3. Zakat, Tax and Customs Authority (ZATCA): Electronic Invoice XML Implementation Standard & Data Dictionary (vFATOORA) and Security Features Implementation Standards.
4. ISO/IEC 19845:2015 / OASIS UBL 2.1: Information technology — OASIS Universal Business Language version 2.1 (UBL v2.1), International Organization for Standardization / OASIS Open.
5. W3C XML-C14N11: Canonical XML Version 1.1, W3C Recommendation, 2 May 2008.
6. ETSI EN 319 132-1: Electronic Signatures and Infrastructures (ESI); XAdES digital signatures; Part 1: Building blocks and XAdES baseline signatures.