Zakat & ZATCA Business Compliance in Saudi Arabia: The 2026 Operating Guide

Most Saudi businesses do not fail compliance because they lack knowledge. They fail because compliance stopped being a form you file once a year and became a live data feed that ZATCA watches every day. A wrong VAT code sitting in a master record. A payment to a foreign supplier approved before anyone checked withholding tax. An e-invoice that clears late. Each of those is now visible almost immediately, and each carries a number attached to it in Saudi Riyals. 

This guide covers the full stack a company operating in the Kingdom has to hold together in 2026: Zakat, corporate income tax, VAT, e-invoicing under Fatoorah, withholding tax, RHQ incentives, penalties, and audit readiness. It is written for finance leaders, controllers, and founders who need to see how the pieces connect, rather than what each one means in isolation. 

The short version 

• ZATCA administers Zakat, corporate income tax, VAT, excise, customs and e-invoicing under one authority. 

• Zakat (2.5% of the Zakat base) generally applies to Saudi and GCC ownership. Corporate income tax (20% of adjusted net profit) generally applies to non-Saudi ownership. Mixed-ownership companies often calculate both. 

• VAT is 15% on standard-rated supplies. The risk is rarely the rate. It is invoice validity and input-VAT evidence. 

• E-invoicing is mandatory. Phase 2 integration now covers almost every VAT-registered business: Wave 24 (SAR 375,000 threshold) closed 30 June 2026, and Wave 25 (SAR 187,500 threshold) requires integration by 1 February 2027. 

• Withholding tax of 5% to 20% can apply to payments leaving Saudi Arabia. The costliest version of this mistake is catching it after the money has gone out. 

• Penalties escalate with repetition, and e-invoicing breaches reach SAR 50,000. 

Disclaimer: this is general guidance, not tax or legal advice. Your position depends on ownership, activity, residency, and structure. Confirm with official ZATCA guidance or a qualified adviser before acting. 

What is ZATCA, and why does it touch every part of the business?

ZATCA is Saudi Arabia's single revenue authority. It was formed in 2021 by merging the General Authority of Zakat and Tax with the customs authority, and it now oversees Zakat, income tax, VAT, excise, customs duties and the national e-invoicing system. Under Vision 2030, its mandate is explicitly digital: real-time invoice clearance, connected filings, and data-driven audits rather than paper-based ones. 

That consolidation is why compliance no longer sits in one accountant's inbox. Look at where each obligation actually starts. 

Sales sets VAT treatment the moment an invoice goes out. Procurement determines whether input VAT can be recovered through the supplier documents it accepts. Finance drives Zakat and corporate tax through the accounting records. Legal and operations create withholding tax exposure through the contracts they sign with non-residents.

By the time a return is filed, the decisions that determine whether it is correct were made weeks earlier, often by people who would not describe their job as a tax job. That is the idea worth holding onto. Saudi compliance is a framework, not a filing. If you still need your unified Zakat and Income number or ZATCA's current contact details, see our ZATCA contact and registration guide. 

The compliance stack at a glance 

Zakat or corporate income tax: which applies to you? 

Zakat generally applies to the Saudi and GCC-owned portion of a business, while corporate income tax applies to the non-Saudi-owned portion. A company with mixed ownership frequently has to calculate both, split according to its shareholding. 

Settle this question first, because the two are calculated on completely different bases. Zakat is not a tax on profit. It is charged at 2.5% on a Zakat base built from specific balance sheet items and adjustments, covering capital, retained earnings, certain provisions and related-party balances, with defined deductions. Corporate income tax works the way most finance teams expect a tax to work: 20% on adjusted net profit for the non-Saudi share.

The trap is assuming there is only one obligation. A joint venture with a Saudi partner and a foreign partner may owe Zakat on one share and income tax on the other. Before filing, re-confirm shareholding, residency, capital structure, retained earnings, related-party balances and which expenses are genuinely deductible. A change in the cap table quietly changes the filing category, and that change rarely gets flagged to finance on the day it happens. The rates and definitions above are set out in Saudi Arabia's Income Tax Law. Note that everything on this page is business Zakat — if you're calculating personal Zakat on money, gold, or Zakat al-Fitr instead, use our Zakat calculator instead. 

VAT: the 15% rate is the easy part 

The standard VAT rate is 15%. Compliance risk rarely comes from applying the rate. It comes from issuing valid tax invoices, classifying supplies correctly, and being able to prove every input-VAT deduction you claim. Use our VAT calculator to check any invoice or price instantly. 

VAT is the most visible tax because it appears on every invoice, contract and quarterly return. The audit exposure, though, usually sits on the input side. When you pay VAT on a business purchase, you can deduct it against the VAT you collect, provided the deduction is supported. If the invoice is invalid, the supplier was not properly registered, the purchase links to an exempt activity, or the business purpose is unclear, ZATCA can challenge it. 

Take a consulting firm. It can reasonably recover VAT on software subscriptions used to deliver taxable services, as long as the tax invoice is valid and the purpose is documented. The same firm claiming VAT on vague, mixed-use or thinly evidenced expenses is building audit risk directly into its own return. 

Four checks before claiming input VAT: 

• Is the tax invoice valid and complete? 

• Is the supplier VAT-registered where required? 

• Is the purchase tied to a taxable business activity? 

• Is the treatment supported in the accounting records? 

Strong VAT teams do not just file. They run these checks before the return is submitted, so the return summarises clean data instead of triggering a scramble to reconstruct it. ZATCA sets out the full deduction rules in its input tax deduction guideline, worth reading before a large or unusual claim. 

E-invoicing under Fatoorah 

Fatoorah is Saudi Arabia's mandatory e-invoicing system. Every resident VAT-registered business must issue invoices as structured electronic documents. Phase 1, covering generation, has been live since December 2021. Phase 2 connects your system directly to ZATCA and has been rolling out in turnover-based waves since 2023. For the complete registration-to-filing walkthrough, see our ZATCA e-invoicing and VAT compliance guide. 

This is where most day-to-day compliance effort now lives, so it is worth understanding properly. 

What counts as an e-invoice 

A Fatoorah e-invoice is not a scanned or PDF copy of a paper invoice. It is a tax invoice generated directly by a compliant system in a structured, machine-readable format, either XML or PDF/A-3 with the XML embedded. It carries fields a paper invoice never had: a UUID, a cryptographic stamp, a digital signature, sequential numbering and a QR code. Arabic is mandatory. Other languages may be added alongside it. For the field-by-field setup process, see our e-invoicing implementation guide. 

Standard and simplified invoices 

There are two invoice types, and choosing the wrong one is a common error.

Which one you issue depends on the transaction, not on preference. 

*Below SAR 1,000, a simplified invoice is permitted, but a buyer who needs to claim input VAT can require a standard one instead. 

Phase 1 and Phase 2 

Phase 1, the generation phase, began on 4 December 2021. Taxpayers had to start producing and storing invoices, credit notes and debit notes electronically through a compliant system. No integration with ZATCA was required at that stage. 

Phase 2, the integration phase, began on 1 January 2023. Taxpayers connect their systems to ZATCA's Fatoora platform through an API. Standard B2B and B2G invoices must be cleared by ZATCA in real time before they are shared with the buyer. Simplified B2C invoices must be reported within 24 hours. This phase adds the technical layer: UUID, digital signature, cryptographic stamp, invoice hash chaining, and UBL 2.1 XML. 

The wave rollout 

Phase 2 applies in waves, starting with the largest businesses and stepping down by turnover. ZATCA notifies each wave at least six months in advance. Three waves touch 2026: Wave 23 and Wave 24 have already closed, and Wave 25 — announced 24 July 2026 — is the one currently in scope.

.

One thing worth saying plainly, because it gets skipped in most guides: the majority of e-invoicing failures happen before the invoice is ever generated. If VAT codes are mismapped, customer records are incomplete, or invoice types are not set correctly in the ERP, the system will produce errors that look perfectly compliant, at scale, every day. Clean e-invoicing is a master data problem first and a technical problem second. 

Withholding tax, the obligation that hides inside payments.

Withholding tax applies when a Saudi resident business or permanent establishment pays certain Saudi-source income to a non-resident. Dividends, interest, royalties, management fees, and technical service fees are the common categories. Rates typically run from 5% to 20% depending on the payment type. 

WHT gets missed more often than any other obligation, because it does not surface at year-end filing. It surfaces at the moment of payment, in accounts payable, usually handled by people whose job is to get the supplier paid. 

The expensive version goes like this. The invoice is approved and paid in full, the foreign supplier receives 100%, and only later does someone realise tax should have been withheld. By then the Saudi company usually absorbs the cost itself, because there is no practical way to claw it back. 

The label on the invoice does not settle the treatment. A payment described as software licensing, technical support or management services still has to be assessed on what the money is actually for, where the service is used, the supplier's residency and any relevant treaty position. The fix is procedural rather than technical. Review non-resident payments before approval, while you still control the payment, and check the contract, residency, service type, place of use, and correct rate at that point. 

Foreign investors and RHQ incentives 

For most foreign-owned companies, corporate income tax is 20% of adjusted net profit. Qualifying Regional Headquarters entities can access a 0% rate on eligible RHQ income and 0% withholding tax on qualifying payments, but only for income that genuinely falls inside the incentive. 

Saudi Arabia introduced the RHQ programme to attract multinational groups to base their regional headquarters in the Kingdom. Per ZATCA's Regional Headquarters tax guideline, the incentive runs 30 years from the date the RHQ licence is granted, is renewable, and covers both income tax and withholding tax on qualifying items. It is a substantial benefit. It is also frequently misread as a blanket exemption, which is where companies get into trouble.

Not every income stream an RHQ earns is automatically exempt. Companies have to test qualifying activities, meet substance requirements and document related-party arrangements well enough to show which income sits inside the incentive and which sits outside it. Treat RHQ status as a tax position you can defend line by line. 

What non-compliance costs 

Penalties escalate with repetition. Early e-invoicing inspections usually open with a warning and a grace period. Persistent breaches climb into tens of thousands of Riyals, reaching SAR 50,000 per violation. 

ZATCA's approach is graduated. A first inspection typically produces a warning and a window of around three months to fix the issue. Continue past that and fines begin, rising with each repeat, as set out in ZATCA's own violations and fines schedule. 

For repeat violations, the escalation runs roughly SAR 1,000 for the second, 5,000 for the third, 10,000 for the fourth and 40,000 for the fifth. Violations found more than twelve months apart are generally treated as fresh offences and reset to a warning. The exact schedule matters less than the pattern behind it. ZATCA rewards prompt correction and punishes repetition. One live fact worth knowing while reading a penalty table:

ZATCA's Cancellation of Fines and Exemption of Financial Penalties Initiative is currently active, extended through 31 December 2026. It waives fines for late registration, late payment, and late filing across all tax types for businesses that register, file all outstanding returns, and pay the underlying tax owed — it does not cover tax-evasion penalties or Article 45 VAT Law fines. If you have exposure sitting on the books from an earlier period, this is the window to clear it before it reverts to full penalty enforcement. 

Audit readiness 

You can file every return on time and still be exposed if you cannot explain the numbers behind them. Audit readiness means holding the evidence trail that supports each position, ready to produce on request. For the fuller picture of audit prep, CFO reporting, and financial statement readiness, see our audit, CFO and financial statements guide. 

This is where strong finance teams separate themselves. A defensive tax posture is not an aggressive one. It is the ability to show why a position was taken and how it was supported. Work on the assumption that any material figure may need backing. 

A solid audit file usually holds: 

• Ownership and shareholding analysis, supporting the Zakat and income tax split 

• VAT reconciliations and input-VAT evidence 

• Zakat and corporate tax working papers 

• WHT review notes for non-resident payments 

• E-invoicing logs and clearance records 

• Contracts supporting related-party and cross-border treatment 

• Document retention procedures, with records kept in Arabic or bilingual form

If assembling that list at audit time feels like archaeology, the gap is process rather than tax knowledge. 

The pre-filing checklist 

Before each filing cycle, a finance team should be able to answer these without hesitating. 

• Have we confirmed whether the entity owes Zakat, income tax or both, at current shareholding? • Are VAT codes correctly mapped in the ERP or accounting system? 

• Do we have valid invoices and evidence behind every input-VAT claim? 

• Are non-resident payments reviewed for WHT before they are approved? 

• Are we integrated and clearing correctly under our Phase 2 wave? 

• Have we tested whether RHQ incentives apply only to eligible income? 

• Could we explain and support each tax position in a ZATCA review tomorrow? 

More than one uncertain answer usually points to a process gap. 

Compliance has become a systems problem 

Read back through this guide, and a pattern shows up. Almost every failure mode traces to a decision made upstream, in a different system or a different team, before anyone was thinking about tax. 

The e-invoice that cleared late started as bad master data. The disallowed input VAT started as a missing supplier document in procurement. The payment that should have been withheld started in an AP queue with no tax checkpoint in it. The wrong Zakat base started with a cap table change nobody passed to finance. 

More end-of-month review will not fix any of that, because by month-end the errors are already sitting in the data. The durable fix is to move the controls upstream, to the moment the invoice, purchase order, or payment is created, and to keep a record of how each position was decided. 

That shift, from periodic filing to continuous control, is what Saudi finance teams are working through in 2026. It is also where an agentic layer earns its place. Greenloom puts a team of specialist AI agents on top of the ERP you already run, whether that is SAP, Odoo, Zoho, or Tally, or Dynamics 365. The agents validate VAT coding, flag withholding tax on non-resident payments before approval, keep e-invoicing master data clean, and hold a memory of every decision for audit. No migration, no replacement system.

Your ERP, now with a whole team inside it, watching the same data ZATCA does. If your compliance still runs as a monthly catch-up, that is the thing worth changing, with us or without us. See how Greenloom handles ZATCA compliance inside your ERP 

Frequently asked questions 

What is the corporate income tax rate in Saudi Arabia in 2026? 

For most foreign-owned businesses, or the non-Saudi share of a mixed company, corporate income tax is 20% of adjusted net profit. Some sectors and structures follow different rules, so confirm your specific position. 

What is the difference between Zakat and income tax in Saudi Arabia? 

Zakat generally applies to Saudi and GCC ownership at 2.5% of the Zakat base. Income tax generally applies to non-Saudi ownership at 20% of adjusted net profit. Mixed-ownership companies often calculate both, split by shareholding.

What is the VAT rate in Saudi Arabia? 

The standard rate is 15% on standard-rated supplies. Beyond the rate, businesses must manage invoice validity, input-VAT evidence, exempt and zero-rated treatment, and correct filing periods. 

What are ZATCA Phase 2 e-invoicing requirements? 

Phase 2 requires taxpayers to connect their e-invoicing systems to ZATCA's Fatoora platform through an API, clear standard invoices in real time, report simplified invoices within 24 hours, and include a UUID, digital signature, cryptographic stamp and sequential numbering in UBL 2.1 XML. 

Who falls under Wave 25, and by when? 

Wave 25 covers resident VAT-registered businesses whose VAT-taxable revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025. ZATCA announced the wave on 24 July 2026 and set an integration deadline of 1 February 2027. Wave 24 (SAR 375,000 threshold) closed 30 June 2026 and is no longer the active wave. 

When does withholding tax apply in Saudi Arabia? 

It applies when a Saudi resident business or permanent establishment makes certain Saudi-source payments to a non-resident, such as royalties, management fees, dividends, interest or technical service fees. Rates commonly range from 5% to 20%. 

Are RHQ companies exempt from corporate tax? 

Qualifying RHQ entities can access 0% income tax on eligible RHQ income and 0% withholding tax on qualifying payments for a defined incentive period. Eligibility, economic substance and income classification still have to be demonstrated. Not all income automatically qualifies. 

What are the penalties for e-invoicing non-compliance? 

They range from warnings for minor issues, such as a missing QR code on a simplified invoice, up to SAR 50,000 for failing to issue, archive or correctly amend e-invoices. Repeat violations escalate in steps. 

Official sources 

• ZATCA official portal 

• ZATCA E-Invoicing (Fatoorah) 

• ZATCA e-invoicing roll-out phases 

• ZATCA Income Tax Law 

• ZATCA input tax deduction guidance 

• ZATCA Regional Headquarters guidance 

• ZATCA e-invoicing violations and fines schedule 

• ZATCA penalty waiver initiative (current, extended to 31 Dec 2026) 

This guide is updated as ZATCA publishes new waves and controls. For a company-specific review, consult a qualified Saudi tax adviser. 

Editor's note: article copy is unchanged from the original document. Three green boxes above mark exactly where each infographic goes. The three PNG files (einvoicing-wave-rollout-timeline.png, compliance-obligations-origin-map.png, wht-payment-checkpoint.png) are separate files delivered alongside this PDF, for you to drop into the CMS at the marked positions. Flagged separately: the Wave 24 deadline (30 June 2026) stated in this document had already passed as of today; this has now been corrected throughout to Wave 25 (SAR 187,500 threshold, 1 February 2027 deadline, announced 24 July 2026) as part of this SEO/AEO pass — including the wave table, the FAQ, and a flag on the IMG-01 timeline graphic, which still needs to be regenerated to match. Re-verify against zatca.gov.sa before publishing regardless, since a further wave could be announced before this goes live.