IT directors at European mid-market companies with subsidiaries in Saudi Arabia or the United Arab Emirates can no longer treat Gulf e-invoicing as a distant concern. Two deadlines converge in 2027: ZATCA Fatoora Wave 25, which reaches companies generating 187,500 SAR in VAT-taxable revenue (wise-hustlers.com), and the mandatory UAE e-invoicing programme for businesses exceeding 50 million AED in revenue from 1 January 2027 (e-invoicing.org). For a mid-market group whose ERP spans from Amsterdam or Munich to Riyadh or Dubai, this means two localisation projects running in parallel — with distinct technical architectures.
Context: The E-Invoicing Wave Across the Middle East
ZATCA: Saudi Arabia’s Tax Transformation Since 2021
ZATCA (Zakat, Tax and Customs Authority) is the Saudi fiscal authority managing VAT (introduced in 2018 at 5%, raised to 15% in 2020), Zakat (the Islamic levy on net assets of Saudi entities), and customs duties. Fatoora is the national e-invoicing platform developed by ZATCA under the Vision 2030 framework.
Deployment followed two distinct phases. Phase 1 (generation) came into force on 4 December 2021 for all resident VAT-registered businesses (amalerp.com). It mandates the creation of structured electronic invoices that cannot be modified after issuance, with a mandatory QR code containing five TLV-encoded fields on simplified invoices. Phase 2 (integration) started on 1 January 2023 (Wave 1) for the largest companies in the kingdom, progressively descending to Wave 25 with a final deadline of 1 February 2027.
UAE: Official 2026-2027 Roadmap
The UAE chose a different approach from Saudi Arabia: a decentralised model built on the Peppol network, with Accredited Service Providers (ASPs) certified by the Ministry of Finance. The programme officially launched its voluntary pilot phase on 1 July 2026. Companies with revenue exceeding 50 million AED must have contracted with an ASP before 31 October 2026 and go live by 1 January 2027 (e-invoicing.org). Smaller companies will follow from 1 July 2027.
Global Momentum and OECD Pressure
Both initiatives are part of a global trend: more than 80 countries have introduced or announced Continuous Transaction Controls (CTC) systems since 2019. OECD pressure on base erosion (BEPS project) has accelerated adoption across Gulf economies, which are diversifying revenue away from hydrocarbons. For European groups, this creates new complexity: ERP compliance rules that apply in Germany, France, or the Netherlands cannot be directly transposed to the Gulf — formats, protocols, and integration architectures differ significantly.
ZATCA Fatoora: Technical Requirements and Full Timeline
Phase 1 and Phase 2: Two Distinct Obligations
Phase 1 (generation) requires all invoices to be produced in a structured electronic format with no post-issuance modification. Simplified (B2C) invoices must carry a QR code with five encoded fields (TLV). Phase 1 compliance does not satisfy Phase 2 requirements: both sets of rules are cumulative, not substitutable.
Phase 2 (integration) adds a real-time interconnection obligation with the Fatoora platform via a REST API provided by ZATCA. Each company must obtain a CSID (Cryptographic Stamp Identifier) by enrolling on the Fatoora portal, then cryptographically sign each invoice and maintain a hash chain (UUID + counter + hash) guaranteeing sequence integrity (amalerp.com).
Waves 2023–2027: Who Is In Scope and at What Threshold
Phase 2 deploys in successive waves defined by VAT-taxable revenue. The first waves, active since 2023, covered large enterprises above several billion SAR. The pace accelerates through 2026–2027:
- Wave 23: threshold of 750,000 SAR, in force from 31 March 2026
- Wave 24: threshold of 375,000 SAR, in force from 30 June 2026
- Wave 25: threshold of 187,500 SAR (~€44,000), deadline 1 February 2027 (wise-hustlers.com)
An important detail: the Wave 25 threshold is assessed against any one of the four years 2022, 2023, 2024, or 2025. A single year exceeding the threshold brings the company into scope, even if subsequent years fall below. This means many commercial subsidiaries of European groups — even relatively small ones — will be caught.
Clearance vs Reporting: Two Distinct Regimes
ZATCA distinguishes two integration regimes based on transaction type:
Clearance (B2B): the invoice must be submitted to the Fatoora platform and approved in real time before it is sent to the buyer. Without ZATCA validation, the invoice is not legally valid under Saudi law. This regime covers transactions between VAT-registered businesses.
Reporting (B2C): the invoice is delivered immediately to the customer, then transmitted to ZATCA within 24 hours. This simplified regime applies to end-consumer sales and simplified invoices.
For a mid-market group whose Saudi subsidiary sells to both local businesses and consumers (retail, distribution), both regimes coexist within the same ERP — requiring differentiated processing by transaction type.
ZATCA Format: UBL 2.1 and Technical Specifications
Phase 2 invoices must use UBL 2.1 (Universal Business Language) format, conforming to ZATCA business rules published in the BR-KSA specifications. Each invoice carries:
- A unique UUID generated by the issuer’s invoicing system
- A sequential counter (ICNUMBER) guaranteeing sequence continuity
- A cryptographic hash chained to the hash of the previous invoice (application-level blockchain)
- A digital signature via the establishment’s CSID
- A QR code encoding nine TLV fields (versus five in Phase 1)
This level of technical requirement means that unpatched or uncertified ERPs cannot produce Phase 2-compliant invoices from their standard billing module.
UAE E-Invoicing: Obligations and Architecture 2026–2027
MoF UAE Roadmap: Pilot July 2026, Go-Live January 2027
The UAE implementation follows a phased timeline controlled by the Ministry of Finance (MoF):
- 1 July 2026: voluntary pilot phase opens
- 31 October 2026: deadline for Phase 1 companies (revenue > 50M AED) to contract with an accredited ASP
- 1 January 2027: mandatory go-live Phase 1 (companies > 50M AED)
- 1 July 2027: extended deployment to other taxable businesses
- 1 October 2027: B2G (Business-to-Government) integration
An important caveat for IT directors: deadlines have already slipped once since the initial announcement. Practitioners recommend confirming current dates on the official UAE MoF website (mof.gov.ae) before locking in the project schedule.
Peppol DCTCE: The Chosen Protocol
The UAE adopted the five-corner Peppol model (DCTCE, Decentralized CTC and Exchange) as its exchange infrastructure. Invoices must use the PINT AE format (Peppol International invoice for UAE), a UBL 2.1 XML variant adapted for local requirements.
Unlike the centralised Saudi model, the UAE model decentralises exchange: issuer and recipient each rely on an accredited Peppol access point (ASP) to send and receive invoices. Tax data is then reported separately to the Federal Tax Authority. Peppol adoption is good news for European mid-market companies: Peppol connectors already deployed for Belgian, Dutch, or Norwegian compliance use the same network infrastructure, simplifying geographic extension.
Key Differences: UAE vs Saudi Arabia
| Criterion | Saudi Arabia (ZATCA) | United Arab Emirates (MoF) |
|---|---|---|
| Architecture | Centralised (Fatoora API) | Decentralised (Peppol 5-corner) |
| Format | UBL 2.1 BR-KSA | PINT AE (UBL 2.1) |
| Protocol | Proprietary REST API | Peppol DCTCE |
| VAT rate | 15% | 5% |
| Initial scope | B2B + B2C | B2B + B2G (B2C excluded) |
| Data residency | KSA in-country | Under definition |
| Phase 1 go-live | Progressive waves since 2023 | 1 January 2027 |
Groups active in both countries must manage two separate integration architectures within their ERP — requiring either two distinct localisation modules, or a third-party fiscal middleware capable of handling both protocols.
ERP Impact: What to Activate or Integrate
SAP S/4HANA: SAP Document Compliance for KSA
SAP provides a native localisation for Saudi Arabia in SAP S/4HANA through the SAP Document Compliance component (formerly “Electronic Documents for Saudi Arabia”). This module covers UBL 2.1 BR-KSA-compliant file generation, real-time clearance integration with the Fatoora API, and CSID management (SAP Help Portal). For complex scenarios (multi-entity, BR-KSA-08 management for multi-branch organisations), partners such as Sovos, TrustWeaver, and Pagero offer ZATCA-certified add-ons complementing the native solution.
For the UAE, SAP is preparing a PINT AE localisation: companies in scope for UAE Phase 1 must verify patch availability for their S/4HANA release before end of 2026.
Oracle ERP Cloud and Microsoft Dynamics 365
Oracle ERP Cloud includes a Saudi Localization module with Fatoora integration for public cloud deployments. For Microsoft Dynamics 365 Finance, ZATCA compliance relies on third-party add-ons: Avalara, Pagero, TrustWeaver, and other ISVs offer ZATCA-certified connectors compatible with Dynamics 365.
For both platforms, the UAE situation mirrors SAP: PINT AE localisations are in certification, and mid-market companies targeting the 1 January 2027 UAE go-live must confirm with their vendor that the patch will be available before October 2026.
ZATCA Certification: The Role of Accredited Solution Providers
ZATCA maintains a register of “ZATCA Accredited Solution Providers” — editors and integrators whose solutions have been tested and certified on the Fatoora platform. For a company choosing a third-party connector rather than its ERP’s native localisation, selecting a provider listed in this register is mandatory. A non-accredited connector, even if technically functional, exposes the company to invoice rejection risk on the platform.
Compliance Architecture: ERP Integration and Archiving
Fatoora REST API: Real-Time Clearance Flow
Phase 2 integration relies on two primary endpoints of the Fatoora API: the clearance endpoint (for B2B invoices, synchronous validation before delivery to the buyer) and the reporting endpoint (for B2C invoices, asynchronous submission within 24 hours). Error handling is critical: a ZATCA rejection (non-compliant format, expired CSID, invalid hash) blocks the billing flow, and therefore potentially customer payment. ERP teams must implement a documented correction and resubmission process — distinct from the standard invoice correction workflow.
Mandatory Archiving: 7 Years, In-Country for KSA
Saudi regulations require retention of signed XML invoices for 7 years. The data residency rule (National Cybersecurity Authority, NCA) requires that tax data be hosted in data centres located within Saudi Arabia. For mid-market companies whose ERP is hosted in a European cloud, this means either a KSA-localised archiving module (offered by SAP, Oracle, and some local ASPs), or regular exports to a third-party KSA fiscal vault.
For the UAE, data residency rules are still being finalised by the MoF — monitor this before defining the final archiving architecture.
ZATCA/UAE Compliance Checklist for IT Directors
Six points to verify before closing out the project:
-
ERP version and localisation patch: confirm with your vendor that your release includes a Phase 2-compliant KSA/UAE module and obtain the delivery date for the UAE PINT AE patch.
-
Select a ZATCA-accredited provider: if using a third-party connector, verify its listing in the official ZATCA Accredited Solution Providers register.
-
Test in the Fatoora sandbox: ZATCA provides a simulation environment before production go-live. Test at minimum three scenarios: standard B2B clearance, B2C reporting, and rejection handling with resubmission.
-
Train accounting teams: a ZATCA rejection blocks payment. Training teams on the most common error codes (expired CSID, invalid hash, missing mandatory field) avoids production support escalations.
-
Enable timestamped XML archiving: verify that your archiving solution stores signed XML files (not associated PDFs) and that it is hosted in-country for KSA.
-
Align IT and Tax on clearance vs reporting thresholds: the boundary between B2B (clearance) and B2C (reporting) transactions is not always clear-cut in hybrid business models. Map flows with the tax team before go-live.
For broader context on fiscal digitalisation across Europe, read our mandatory e-invoicing guide for European ERPs, our Peppol interoperability guide for ERP teams, and our review of France’s first month of mandatory e-invoicing.
