ZATCA Compliance in Saudi Arabia | A Complete Guide for Foreign Businesses

Key Fact: Foreign companies conducting operations within Saudi Arabia need to adhere to the regulations of ZATCA. Non-compliance may result in the renewal of the CR, inability to participate in government tenders, and taxation penalties between 5% and 25%.

Introduction

In order for the foreign company to operate in Saudi Arabia successfully, gaining an investment license is not the final step. The company needs to stay compliant regarding taxation, invoicing, and reporting to the Zakat, Tax, and Customs Authority (ZATCA).

Established in May 2021 as a result of merging the General Authority of Zakat and Tax (GAZT) and the General Customs Authority, ZATCA acts as a single administrative power within the Kingdom responsible for collecting revenue, border customs, and monitoring digital transactions.

Why ZATCA Compliance Matters for Foreign Businesses in Saudi Arabia?

ZATCA compliance in Saudi Arabia does not merely amount to another accounting box for foreign investors to check because of how intertwined regulations are; the following are examples of how a lack of ZATCA compliance will adversely affect other functions:

• Commercial Registration (CR) Renewals: Tax liability disputes and non-filing of reports can prevent registration renewals.
• MISA Investment Licenses: Licensing by the Ministry of Investment depends on active and full compliance with tax regulations.
• Government Tenders: Participation in profitable government projects in Saudi Arabia necessitates ZATCA certification.
• Payroll & WPS: Compliance issues with tax accounting put bank functions and the Wage Protection System at risk.

This all-inclusive guide will provide you with a practical way forward regarding registration, CIT, VAT, WHT, the mandatory multi-stage Fatoora e-invoicing process, technical requirements and penalties involved, as well as implementation.

What Is ZATCA and What Does It Regulate?

Understanding ZATCA’s Role

ZATCA consolidates the Saudi tax system into one body. Through direct taxation, indirect taxation, customs control, and digitized transactions, ZATCA ensures comprehensive monitoring of commercial operations.

ZATCA strictly regulates the following 6 main pillars:

1. Zakat: Islamic assessment on ownership shares of Saudis and GCC nationals.
2. Corporate Income Tax (CIT): Direct income tax on the ownership share of foreigners.
3. Value Added Tax (VAT): Indirect consumption tax on supply chains.
4. Withholding Tax (WHT): Taxes on payments from Saudi establishments to non-resident service providers.
5. Customs: Tariffs and duties, and logistics at the borders.
6. E-Invoicing (Fatoora): Transaction digitization and real-time invoice filing.

Why ZATCA Compliance in Saudi Arabia Is Critical for Foreign Companies

Regulatory authorities in Saudi Arabia share platform data. If ZATCA marks the entity as not compliant, automatic holds will be placed by other departments in the government:

ZATCA Tax Non-Compliance Mark:

• Prevents Commercial Registration (CR) Renewals
• MISA Licenses Will Be Scrutinized
• Disallows the Entity to Tender Government Contracts
• Banks & Wage Protection System (WPS) Operations Will Be Suspended

Keeping immaculate tax and invoicing documentation will protect your corporate reputation, audit preparation, and license validity.

Key ZATCA Tax Obligations for Foreign Entities

VAT in Saudi Arabia

Value Added Tax applies to all business activities in relation to the supply of goods and services in the Kingdom:

• Standard Rate: 15%.
• Mandatory Registration Threshold: Applicable to those firms that have taxable supplies of more than SAR 375,000 during any one year.
• Voluntary Registration Threshold: Available for those organizations that incur or expect expenses of more than SAR 187,500.
• Non-Resident Entities: Those foreign organizations that make taxable supplies in Saudi Arabia without having any resident liable to make payments for such supplies will be compulsorily registered for VAT, irrespective of the threshold.

Corporate Income Tax vs. Zakat

Saudi tax law divides corporate tax liabilities strictly according to equity ownership:

Note: For joint ventures featuring mixed ownership, CIT and Zakat are calculated proportionally based on equity split.

Withholding Tax (WHT)

Saudi companies and their permanent establishments that make payments to non-residents for providing services are required to withhold Withholding Tax and pay it to ZATCA within the first 10 days of the following month after making payment.

Common WHT Rates include:

• Dividends & Interest: 5%
• Royalties: 15%
• Management & Consulting Fees: 20%
• Other Services: 5%–15% depending on specific classification

Double Tax Treaties (DTT)

There are more than 56 Double Tax Treaties (DTTs) in Saudi Arabia. Parent entities from treaty jurisdictions can claim tax exemptions or reduced WHT rates provided they submit a valid Tax Residency Certificate (TRC) along with treaty declaration forms to ZATCA.

Saudi Arabia’s Fatoora E-Invoicing Mandate

What Is Fatoora?

Fatoora is the national e-invoicing network in Saudi Arabia. Fatoora requires all physical invoices, handwritten receipts, and unstructured PDF/Word files to be completely banned from being used as a business expense.

Phase 1: Generation Phase (Effective Dec 4, 2021)

The first phase requires all taxpayers to generate structured invoices using compatible invoice billing software.

• Ban on any manual or unstructured invoice format.
• Requirement to generate structured XML/PDF-A3 (XML embedded) documents.
• Requirement to include vendor information, tax identification numbers (TIN), timestamp, and basic data in the QR Code.

Phase 2: Integration Phase (Phased Rollout from Jan 1, 2023)

The second phase requires the real-time integration of taxpayer ERP/POS systems with the national Fatoora Platform by ZATCA using standard APIs.

Clearance vs. Reporting: How Invoice Submission Works

Phase 2 Technical Requirements Foreign Businesses Must Understand

To run an e-invoicing system in Saudi Arabia at Phase 2, the parent company of the enterprise must configure its global/local ERP system (SAP, Oracle, NetSuite, Odoo) to be compliant with the technical requirements of ZATCA:

UBL 2.1 XML Standard

Invoices should follow the UBL 2.1 XML standard, based on the ZATCA schema dictionary.

Universal Unique Identifier (UUID)

Every e-invoice should contain a UUID (Universally Unique Identifier), which is created as a 128-bit number embedded in the invoice metadata in order to provide full traceability of the document worldwide.

SHA-256 Hashing

The ERP system should apply the cryptographic SHA-256 algorithm to transform the content of the invoice into a hash string in order to maintain the integrity of the document and prevent any post-issuance modifications of the document.

Previous Invoice Hash (PIH)

Every invoice issued should contain the SHA-256 hash of the previous invoice to create an unbreakable chain. Invoices cannot be backdated or added/omitted after the creation due to this.

Cryptographic Stamp Identifiers (CSID)

For communicating through ZATCA’s API, it is required for the ERP to obtain the following Cryptographic Stamp Identifiers:

• Compliance CSID (CCSID): It is obtained first to identify the capabilities of the system in ZATCA’s sandbox environment in compliance testing checks.
• Production CSID (PCSID): After passing the sandbox check, it enables live API production signing and clearing.

QR Codes and Cryptographic Stamping

The B2C invoices need to have the Base64-encoded QR codes that include essential validation fields, timestamps of invoices, and digital signatures to allow instant verification of their validity by the consumer and inspectors of ZATCA through scanning.

What Must Be in Place Before ZATCA Registration?

The tax registration is not an independent process. The foreign company needs to arrange its operational setup systematically, namely:

1. Secure Corporate Structure: Choose either a Limited Liability Company (LLC), Branch of Foreign Company, or Regional Headquarters (RHQ).
2. Obtain MISA Investment License: Obtain it from the Ministry of Investment of Saudi Arabia that allows foreign ownership authorization.
3. Obtain Commercial Registration (CR): Obtain it from the Ministry of Commerce, which is a legal entity ID.
4. Build Finance Infrastructure: Establish local Saudi bank accounts, set up IFRS-compliant accounting books, and configure compliant local payroll processes.

Cost of Non-Compliance: ZATCA Penalties and Operational Risks

ZATCA uses strict penalties to safeguard tax compliance and billing practices.

Field Violations: Warning Mechanism

As per the current grace policy, ZATCA has a notification process in case of initial field violations (for example, not displaying the VAT sign or minor mistakes in QR codes):

• First Offense: Formal warning and a 3-month grace period to rectify.
• Repeat Offenses: Escalating fines ranging from SAR 1,000 up to SAR 40,000.

Major Non-Field Violations

Major tax defaults incur mandatory financial penalties:

• Failure to Register for VAT: SAR 10,000 flat fine.
• Late Tax Return Filing: 5% to 25% penalty based on total expected tax liability.
• Late Payment of Tax: 5% surcharge on unpaid tax for every 30 days of delay.
• E-Invoicing Non-Compliance: Up to SAR 50,000 for deliberate non-issuance, altering, and failure to archive compliant XML files.

Record-Keeping Requirements

Statutory tax laws require all entities to keep all their books of account, ledger postings, import documents, tax invoices, and XML data files for at least 6 to 7 years for statutory ZATCA audit purposes.

Beyond Fines: Commercial & Operational Risks

Some of the disruptions resulting from non-compliance include:

• Suspension of CR status and inability to conclude contracts.
• Cancellation or failure to renew MISA foreign investment licenses.
• Inability to bid on Saudi government procurement portals (etimad).
• Disqualification from issuing work visas and monthly payroll payments.

How Arnifi Helps Foreign Businesses Manage Saudi Corporate Compliance

Expanding internationally requires proper execution of corporate law, tax regulations, and software implementation. Arnifi offers solutions for foreign companies for corporate entry into foreign markets:

• Entity Incorporation & MISA Licensing: Entity setup, document translation, and MISA license applications.
• Tax & Accounting Management: VAT registration, local tax representative representation, CIT/WHT return filing, and bookkeeping services.
• Visa & Operational Support: Governance post-incorporation, government relations officer (GRO) services, and visa support.
• Technology-Enabled Expansion Tools: Cost calculators, organograms, and compliance tools for international teams expanding.

Step-by-Step ZATCA Compliance Roadmap for Foreign Businesses

Follow this practical checklist with 12 steps when starting your business in Saudi Arabia:

• Step 1: Determine the corporate ownership structure and choose the appropriate ISIC codes for your business.
• Step 2: Get the MISA foreign investment license.
• Step 3: Apply for the Commercial Registration (CR) at the Ministry of Commerce.
• Step 4: Determine the local sales forecast and apply for VAT registration on ZATCA’s portal (mandatory/voluntary).
• Step 5: Set up CIT/Zakat and Withholding Tax accounts.
• Step 6: Appoint an authorized Saudi Tax Representative (if your entity operates as a non-resident supplier).
• Step 7: Purchase/configure your accounting software or ERP able to produce UBL 2.1 XML documents.
• Step 8: Configure the mandatory fields in Phase 2: UUID generation, SHA-256 hashing, PIH chaining, and cryptography.
• Step 9: Do the sandbox verification of compliance on ZATCA’s developer portal to receive a Compliance CSID (CCSID).
• Step 10: Upgrade the CSID into a Production CSID (PCSID) and use API endpoints in production mode.
• Step 11: Implement monthly WHT reporting (due by the 10th) and periodic VAT return submissions.
• Step 12: Introduce automated backups of all digital documents for a 7-year retention period.

ZATCA Compliance Summary Checklist

Conclusion: Build Compliance Into Your Saudi Expansion Strategy

ZATCA compliance in Saudi Arabia is not something that can be thought of as a peripheral aspect of accounting. In a digitally-integrated regulatory regime, such as today’s, tax compliance, business licensing, and banking functions are interconnected.

It becomes possible for foreign companies to ensure their continuity of business as well as build a platform for further development in the Kingdom by integrating Saudi ZATCA compliance into their Saudi market entry approach from the start.

Frequently Asked Questions (FAQs)

1. What is ZATCA in Saudi Arabia?

ZATCA stands for Zakat, Tax and Customs Authority in Saudi Arabia, the government department that collects and assesses taxes, implements customs regulations, and enforces the requirement of e-invoicing.

2. Is ZATCA compliance in Saudi Arabia mandatory for foreign companies?

Yes. All legal persons, branches, and foreign firms carrying on any taxable business in Saudi Arabia have to adhere to ZATCA regulations.

3. What is the VAT registration threshold in Saudi Arabia?

Compulsory VAT registration is required for entities whose taxable supplies exceed SAR 375,000. However, voluntary registration is allowed for entities having taxable supplies over SAR 187,500. In case non-residents carry out any taxable supplies without resident tax liability, they have to get registered anyway.

4. What is the corporate tax rate for foreign-owned companies in Saudi Arabia?

The CIT rate for foreign ownership in Saudi companies is at 20% based on the adjusted taxable net profits.

5. What is the difference between Zakat and corporate income tax in Saudi Arabia?

Zakat is a 2.5% assessment of the net wealth/ Zakat base of Saudi and GCC nationals. The CIT, on the other hand, is 20% of net profits attributable to foreign or non-Saudi shareholders.

6. What are the Saudi Arabia withholding tax rates for foreign companies?

Some examples of the Saudi withholding tax rates for foreign companies include 5% of dividends, interests, and international transfers; 15% for royalties and 20% for management/consultancy services provided by non-residents.

7. What is Fatoora in Saudi Arabia?

Fatoora is the Saudi e-invoicing initiative that mandates all businesses to create, process, and store transactional invoices in electronic format.

8. What is the difference between Fatoora Phase 1 and Phase 2?

Fatoora Phase 1 involves the automatic creation and archiving of invoices that cannot be manually drafted. Phase 2 requires system-to-system API integration between corporate ERPs and ZATCA to clear or report the invoices.

9. What is ZATCA e-invoice clearance?

The clearance process involves B2B and B2G tax invoices. The invoices must be uploaded, verified, and cryptographically stamped by ZATCA to be issued electronically to the customer.

10. What is ZATCA e-invoice reporting?

This involves B2C simplified tax invoices. Retailers issue invoices directly to the consumers via point-of-sale systems and must upload invoice information to ZATCA within 24 hours.

11. What is a CSID in ZATCA e-invoicing?

CSID stands for Cryptographic Stamp Identifier. It is an electronic certificate provided by ZATCA to authenticate an ERP system belonging to a business organization.

12. What is the Previous Invoice Hash (PIH)?

PIH refers to including a cryptographic SHA-256 hash of the previous invoice in each e-invoice; this creates an immutable chain that deters backdating and manipulation.

13. What technical standard does ZATCA use for e-invoices?

UBL 2.1 XML schema syntax is the technical standard used by ZATCA for generating electronic invoice files.

14. What are the penalties for ZATCA non-compliance?

These include fixed SAR 10,000 fines for failing to register, additions between 5%-25% for late filing of returns, 5% per month on late tax payment, and fines between SAR 10,000 and SAR 50,000 for e-invoicing violations.

15. How long should businesses keep ZATCA records?

The law mandates that taxpayers maintain comprehensive accounting books, records, and XML e-invoices for a minimum of 6 to 7 years.

16. Do foreign businesses need a Saudi tax representative?

Foreign suppliers without a permanent establishment in the Kingdom of Saudi Arabia must designate a duly authorized Saudi Tax Representative for managing local tax obligations.

17. Can ZATCA compliance affect Commercial Registration renewal?

Yes. Non-conformity or the existence of tax liabilities can lead to blocking the renewal of the Commercial Registration and MISA licensing.

18. How can foreign companies prepare for ZATCA Phase 2?

Businesses need to conduct an audit of their ERP systems, apply the UBL 2.1 format, configure cryptographic hashing, register themselves on the ZATCA Fatoora portal, and perform sandbox testing to obtain the production CSID credentials.

19. How can Arnifi help with ZATCA compliance in Saudi Arabia?

Yes. Arnifi provides services for the whole process of business setup in Saudi Arabia, including company incorporation, MISA licensing, CR registration, VAT/CIT tax setup, and bookkeeping compliance.

20. What should a foreign company do first when entering Saudi Arabia?

The first step would be to form their legal structure, then obtain a MISA license, get CR registration, do ZATCA tax registration, and finally set up local bookkeeping with e-invoicing software.

References

• ZATCA Official Portal (Zakat, Tax and Customs Authority)
• Ministry of Investment Saudi Arabia (MISA)
• ZATCA Fatoora Developer & E-Invoicing Portal
• Saudi Ministry of Commerce (MC)