Phases of Electronic Invoicing Implementation in Saudi Arabia

Phase 1: Electronic Invoice Issuance

Date and Scope

Phase 1 of electronic invoicing implementation began on December 4, 2021, and included all persons subject to the Electronic Invoicing Regulations. This phase represented a fundamental turning point in the Saudi tax system, where all companies transitioned from traditional invoicing to the electronic system.

Basic Requirements

Phase 1 requirements focused on the necessity of issuing all tax invoices and simplified tax invoices in electronic format, with the application of requirements for processing and storing electronic invoices and electronic notifications. It also required ensuring that invoices contain all mandatory fields specified in Annex 2 of the regulations, which include:

For Tax Invoices: • Invoice title (must be "Tax Invoice") • Invoice serial number • Invoice issuance date • Supplier name, address, and VAT registration number • Buyer name, address, and VAT registration number (if applicable) • Description of goods or services provided • Quantity and unit • Unit price • Total amount due (including VAT) • Applied VAT amount or exemption statement

For Simplified Tax Invoices: • Invoice title (must be "Simplified Tax Invoice") • Invoice serial number • Invoice issuance date • Supplier name and VAT registration number • Description of goods or services provided • Total amount due (including VAT) • Applied VAT amount or exemption statement • QR code

From a technical standpoint, this phase did not impose a specific format for invoices as long as all required data was available, but it required the invoice to contain timestamp details including date and time, in addition to exporting invoices to a local offline archive to ensure record retention.

QR Code in Phase 1

For simplified tax invoices, Phase 1 specified a set of basic information that the QR code must contain. These requirements included the following five elements:

1. Supplier name
2. Supplier VAT registration number
3. Invoice timestamp
4. Invoice total with VAT
5. Total VAT amount

Phase 2: Linking Electronic Invoicing Systems

Date and Phased Implementation

Phase 2 was launched on January 1, 2023, and was characterized by its implementation in phased stages according to target categories determined by the Authority. This phased approach allowed companies to gradually adapt to the new and more complex requirements.

The Authority determines target categories and phases for implementing electronic invoicing system linking, with notification to target categories at least six months before the specified linking date, providing sufficient time for preparation and compliance. Systems are linked using the Application Programming Interface (API) specified by the "FATOORA" platform.

Additional Requirements in Phase 2

Phase 2 witnessed significant development in technical requirements, where XML format became mandatory for creating and sending invoices and notifications, while PDF/A-3 format containing XML remained optional for sharing invoices with customers.

This phase also required issuing a Universally Unique Identifier (UUID) for each invoice or notification, using a non-tamperable counter that increases with each issued invoice, in addition to the ability to use an encryption method to create a hash function.

Cryptographic Stamp and Security

For simplified tax invoices, Phase 2 required a specific identifier for cryptographic stamps, with issuance and management of cryptographic stamps through the "FATOORA" platform, and protection of the signing key from extraction or transfer to ensure maximum security.

The QR code was developed in Phase 2 to include additional security elements that ensure a higher level of protection and reliability. These updates included three basic elements:

1. Hash function for XML invoice
2. Cryptographic stamp
3. Public key used to create the cryptographic stamp

Key Differences Between Invoice Types in Phase 2

With the implementation of Phase 2 of electronic invoicing, fundamental differences emerged in the way each type of electronic invoice is processed. These differences determine how to handle each invoice in terms of timing, security, and integration with the "FATOORA" platform. The following are the two main types and their characteristics:

1. Tax Invoice

The tax invoice is subject to the "clearance" mechanism by the Authority, meaning the necessity of real-time sending and receiving a response from the Authority before delivering the invoice to the customer. Cryptographic stamps are applied by the Authority after verifying data accuracy, ensuring a high level of reliability and security.

2. Simplified Tax Invoice

The simplified tax invoice follows the "reporting" mechanism within 24 hours of issuance, providing greater flexibility in timing. Cryptographic stamps are applied by the technical solution used, and invoice data is shared with the "FATOORA" platform in batch mode instead of real-time.

Obligations of Persons Subject to Electronic Invoicing

With the evolution of electronic invoicing implementation phases, the obligations of persons subject to the system also evolved, where each phase witnessed specific requirements that align with the required level of implementation and integration. The following are the basic obligations for each phase:

1. During Phase 1

Obligations during Phase 1 focused on issuing all invoices and notifications electronically, complying with technical requirements specified in Annex 1, and maintaining records and invoices according to legally specified periods.

2. During Phase 2

Obligations in Phase 2 evolved to include linking electronic invoicing systems with the "FATOORA" platform, using the specified API, registering units used in issuing simplified invoices, and maintaining the specific identifier for cryptographic stamps.

Prohibited Specifications

The Authority has imposed strict restrictions on technical solutions used in electronic invoicing to ensure security and compliance. These restrictions include:

• Security and Access: Prohibiting lack of access control or allowing access without login • Data Protection: Preventing modification or deletion of issued invoices • Sequencing: Not issuing more than one sequence for invoices • Encryption: Preventing extraction or transfer of the private key for cryptographic stamps • Time Integrity: Not allowing changes to the technical solution's time

Frequently Asked Questions

1. When did Phase 1 of electronic invoicing begin?

Phase 1 began on December 4, 2021, and included all persons subject to the Electronic Invoicing Regulations, focusing on electronic invoice issuance and local storage.

2. What is the basic difference between Phase 1 and Phase 2?

Phase 1 only required electronic invoice issuance with no connection to Authority systems, while Phase 2 requires full integration with the "FATOORA" platform through APIs.

3. Can small companies implement electronic invoicing gradually?

Yes, Phase 2 is implemented in phased stages according to target categories, with company notification six months before the specified linking date.

4. What is the XML format required in Phase 2?

XML format is mandatory for creating and sending invoices and notifications to the Authority, while PDF/A-3 format containing XML remains optional for sharing invoices with customers.

5. What is the difference between clearance and reporting mechanisms?

The clearance mechanism requires immediate approval from the "FATOORA" platform before delivering the invoice to the customer (for tax invoices), while the reporting mechanism allows sending invoices to the "FATOORA" platform within 24 hours (for simplified invoices).

6. What is the non-tamperable counter?

It is a secure sequential numbering system that increases with each issued invoice and cannot be modified or tampered with, ensuring tracking of all invoices and preventing manipulation.

Conclusion

The phases of electronic invoicing implementation in Saudi Arabia represent an advanced model for digital transformation in the tax sector. Through phased implementation and advanced technical requirements, the Authority aims to ensure full compliance and enhance transparency in the tax system.

This phased approach allowed companies to gradually adapt to new requirements, starting from simple electronic issuance to full integration with Authority systems. The result is a more transparent and efficient tax system that contributes to achieving the goals of Saudi Vision 2030 for digital transformation, providing a more reliable business environment with accurate commercial transactions.