- Description
- Actions
- Workflows
- Documents
Clearance & Reporting Guide
View guide ›
| Developer | Invopop |
| Category | Government |
| Scope | B2B, B2G, B2C |
| Country | Saudi Arabia |
| System | FATOORA (ZATCA) |
- Clearance of standard tax invoices (B2B, B2G).
- Reporting of simplified tax invoices (B2C).
- ZATCA onboarding: OTP, compliance checks, and production CSID provisioning.
- UBL 2.1 with KSA extensions, ICV/PIH chaining, and the Phase 2 QR code.
FAQ
Invoicing questionsHow does Invopop decide between clearance and reporting?
How does Invopop decide between clearance and reporting?
From the GOBL invoice type. Simplified invoices (B2C) are reported to ZATCA; all standard invoices (B2B and B2G) are cleared.
When do I submit a standard invoice (clearance) to Invopop?
When do I submit a standard invoice (clearance) to Invopop?
Before you share it with the buyer. Standard invoices follow the clearance model: Invopop submits the invoice to ZATCA in real time, ZATCA validates it and applies its cryptographic stamp, and the cleared document is returned. Only that cleared version is legally valid and shareable — so the invoice must go through Invopop before you send it on to the buyer.
When do I submit a simplified invoice (reporting) to Invopop?
When do I submit a simplified invoice (reporting) to Invopop?
Within 24 hours of issuing it. Simplified invoices follow the reporting model, so you can give the invoice to the customer straight away at the point of sale — it does not need ZATCA validation first, and you can share it before it ever reaches Invopop. You then have up to 24 hours from issuance to submit it to Invopop, which forwards it to ZATCA immediately when the workflow runs.
Do I need to build the ICV/PIH chain myself?
Do I need to build the ICV/PIH chain myself?
No. Invopop calculates the Invoice Counter Value (ICV) and Previous Invoice Hash (PIH) internally on every submission. You only see them reflected in the generated invoice XML.
How is the invoice chain created?
How is the invoice chain created?
ZATCA requires every document a party issues to form a single, unbroken cryptographic chain. Invopop maintains one chain per party and environment (sandbox simulation/developer vs. production are separate sequences), so each registered CSID has its own continuous counter. Two values link it together:
- ICV starts at
1for the first document and increments by exactly1for every document that follows. - PIH of the first document is the hash of the value
0— the base case defined in ZATCA’s data dictionary. Every document after that sets its PIH to the hash of the immediately preceding document.
- Document type does not split the chain. Standard invoices, simplified invoices, credit notes, and debit notes all share one sequence.
- Rejected documents still occupy their slot. A document that ZATCA rejects keeps its ICV and hash; the next document chains off it, not off the last accepted one.
hash(invoice 2) as its PIH and ICV = 3:| Document | ICV | PIH points to | ZATCA result |
|---|---|---|---|
| Invoice 1 | 1 | hash of 0 (base case) | Accepted |
| Invoice 2 | 2 | hash(Invoice 1) | Rejected |
| Invoice 3 | 3 | hash(Invoice 2) | Accepted |
| Credit note 4 | 4 | hash(Invoice 3) | Accepted |
Where do I find the cleared invoice?
Where do I find the cleared invoice?
In the Files section of the silo entry. After a successful submission the final XML is attached as
invoice.xml — for standard invoices this is the ZATCA-cleared, stamped document. The QR code is also stamped onto the document.What do I need to onboard a party with ZATCA?
What do I need to onboard a party with ZATCA?
A workspace with the Saudi Arabia app enabled, and an
org/party (the supplier) carrying:- a Saudi VAT registration number,
- an identity of type
CRN,MOM,MLS,700,SAG, orOTH, and - a complete national address (building number, postal code, district, street, additional street, and country).
1000 standard / 0100 simplified / 1100 both), branch name, registered address, and business category — plus the FATOORA OTP.How long is the OTP valid?
How long is the OTP valid?
1 hour from when it is generated in the FATOORA portal. If it expires, generate a new one and re-enter it in the wizard.
What is the difference between Developer and Simulation sandbox modes?
What is the difference between Developer and Simulation sandbox modes?
In Developer mode the OTP is not validated (any placeholder works) and you can only send invoices from ZATCA’s fixed test VAT
399999999900003. In Simulation mode the OTP must be real and you can send from any registered party.Can I test in Simulation without a real FATOORA account?
Can I test in Simulation without a real FATOORA account?
No. Simulation requires a real FATOORA account and taxpayer to generate a valid OTP. Use Developer mode if you want to test the flow without a real account.
🇸🇦 Invopop resources for Saudi Arabia
🇸🇦 Invopop resources for Saudi Arabia
| Compliance | Compliance timeline |
| Apps | |
| Guides | Registration Clearance & Reporting |
| FAQ | Saudi Arabia FAQ |
| GOBL | |
| GitHub | gobl.sa.zatca |
Participate in our community
Ask and answer questions about the Saudi Arabia app →