A ZATCA-compliant e-invoicing solution must be tamper-resistant: no anonymous access or default passwords, a full activity log that cannot be changed, no deletion or editing of issued invoices, an invoice counter that cannot be reset, accurate timestamps, a hash chain linking each invoice to the previous one, and protected cryptographic stamping keys. In Phase 2 it must also connect to Fatoora, generate XML, and every invoicing device must be onboarded.
Prohibited functions (Phase 1 and Phase 2)
ZATCA’s guideline lists functions an e-invoicing solution must not have:
| Prohibited function | What it means |
|---|---|
| Anonymous access | Every user must log in with a unique login and password or biometrics |
| Default passwords | No factory or default password; users must reset the password on first use |
| No session management | All user activity in the invoicing process must be logged, from login onwards |
| Altering or deleting invoices | Issued invoices and notes can never be changed or deleted; cancel only by credit note |
| Changing logs | System logs must not be modifiable |
| Inaccurate timestamps | Users must not be able to change the date or time to create false documents |
| Non-sequential logs | Entries are linked with the previous invoice hash so the order can’t change |
| Invoice counter reset | The invoice counter must never be resettable |
| More than one sequence per unit | Each unit keeps one chain linked by the previous invoice hash |
| Time changes during issuing (Phase 2) | The software time must not be changeable while issuing |
| Exporting stamping keys (Phase 2) | The private key of the cryptographic stamp must not be exportable |
Anti-tampering and security
- Tamper-proofing: the solution must prevent and detect tampering with invoices or the solution itself.
- Counter protection: the invoice counter value must be protected from users.
- Date protection: resetting the system date must not be possible for users.
- Access control: users only get access to the functions their role needs.
- Stamping keys: the private key is generated by the solution, can’t be viewed or copied, and should be protected in a software or hardware key vault.
- Offline archive: the solution must protect invoices from alteration or undetected deletion and allow archiving in XML even without internet.
Phase 2 technical requirements
| Requirement | Tax invoices | Simplified invoices |
|---|---|---|
| Format | XML (or PDF/A-3 with embedded XML) | XML (or PDF/A-3 with embedded XML) |
| Cryptographic stamp | Applied by ZATCA at clearance | Applied by your solution |
| Device registration | Onboarded on Fatoora | Onboarded on Fatoora |
| UUID and hash | Included in every invoice | Included in every invoice |
| Connectivity | Real-time clearance via API | Reporting via API within 24 hours |
Every device issuing invoices under the same VAT number must be onboarded, and each onboarded unit keeps its own invoice chain.
Storage, cloud and exports
- Invoices can be stored on premises in Saudi Arabia or in the cloud, provided ZATCA can access them through a direct link for audits.
- The system must allow exporting invoices to an external archive.
- Stored invoice files should be named VAT number + timestamp + invoice reference number.
- See how long to keep invoices.
Checklist when choosing e-invoicing software
- Does it issue both standard and simplified invoices, credit and debit notes?
- Can you see onboarding with a Fatoora OTP, a cleared B2B invoice and a reported B2C invoice?
- Is it impossible to edit or delete issued invoices?
- Is there a full audit log of user actions?
- Does it print in Arabic with the QR code?
- Can you export all your data at any time?
LUBA ERP follows these rules: secure sign-in, a full audit trail, no editing or deleting of Phase 2 documents, protected counters and hash chain, encrypted keys and full data export. See LUBA ERP ZATCA e-invoicing software or go back to the ZATCA e-invoicing rules guide.
Sources
Frequently asked questions
What makes an e-invoicing system ZATCA compliant?
It must generate e-invoices with the required fields, be tamper-resistant, log all user activity, prevent editing or deletion of issued invoices, keep a non-resettable counter and hash chain, and in Phase 2 integrate with Fatoora for clearance and reporting.
What are ZATCA prohibited functions?
Anonymous access, default passwords, missing session logs, altering or deleting invoices, modifying logs, inaccurate timestamps, non-sequential logs, counter reset, more than one sequence per unit, time changes and exporting stamping keys.
Can I use a cloud e-invoicing system?
Yes. ZATCA allows cloud solutions, provided ZATCA can access the data through a direct link for audits. Other regulations such as NCA controls may also apply.
Does each POS or device need to be registered?
Yes. Every device issuing invoices under the same VAT number must be onboarded on the Fatoora portal.
Can an invoice be issued in Excel or Word?
No. Invoices must be generated by a compliant e-invoicing solution. Paper or scanned invoices are not e-invoices.
Do I need internet to issue e-invoices?
The solution must be able to connect to the internet to clear or report invoices in Phase 2. Simplified invoices can be issued offline and reported within 24 hours once connected.
