← Blog Guides 8 min read · 10 September 2026

How to check that a supplier invoice is a valid Saudi e-invoice

A tray of supplier invoices being worked through, one lifted to a phone camera pointed at the QR code at its foot
These checks take a few minutes at the point of filing, and nothing at all at the point of inspection.

Every other guide here is written for the person issuing an invoice. This one is for the same person an hour later, working through the supplier invoices that arrived this month and deciding which support a claim for input VAT. You cannot validate someone else's document, but a few minutes at filing catches the two problems that cost a buyer money: the wrong kind of document, and one that does not carry your details.

Why this is the buyer's problem at all

Saudi e-invoicing has two documents. A standard tax invoice (B2B and B2G) is cleared by the Authority before the seller may hand it over, and carries the buyer's name, VAT number and address. A simplified tax invoice (B2C) goes to the buyer immediately, is reported within 24 hours, and carries no buyer block.

The consequence lands on you, not the seller: a VAT-registered buyer cannot deduct input VAT from a simplified invoice. When the company card pays and the supplier prints a simplified receipt, that document is not defective — it is the wrong one for your purpose. Ask, before paying if you can, for a standard tax invoice made out to the company, with your VAT number and address on it. Standard vs simplified settles which is owed.

The fastest check: scan the QR code

The QR code at the foot of a Saudi e-invoice is not a link. It is a Base64 string of TLV fields — tag, length, value — and the count tells you which phase produced it. Phase 1, mandatory since 4 December 2021, carries five: seller name, seller VAT number, timestamp, total with VAT, VAT total. Phase 2 adds the hash of the XML, the ECDSA signature and the public key of the stamp. Eight fields, not five.

Our QR code reader is free and needs no sign-in: drop in the supplier's PDF, an image or a screenshot, or point a phone camera at the code. Decoding runs inside your browser, so nothing is uploaded. Back come the phase and the five readable fields as the seller's system stored them, worth holding against the printed page, plus flags for a malformed seller VAT number, an invalid timestamp, or a VAT amount that is not 15% of the total — information rather than a fault, since exempt and zero-rated lines make it normal.

What to read off the page by eye

CheckWhat good looks likeWhy it matters
Your company nameThe registered name, not an employee'sAn invoice made out to a person is not made out to your business
Your VAT number and addressCorrect, on a standard invoiceA wrong one means a reissue, not a pen correction
Seller VAT number15 digits, first and last digit 3Malformed rejects at issuance (BR-KSA-40, error)
Seller name and addressRegistered name, six national address elementsIncomplete is a defect, not a rejection (BR-KSA-09, warning)
Invoice number, date, timeAll three, time includedThe time is its own field, and required (BR-KSA-70, error)
VAT shownTaxable amount, rate and VAT statedYou deduct a stated figure, not a derived one
The totalsLines, total before VAT, VAT, total with VATArithmetic that does not close means a hand-built document
A QR codePresent, and scannableA square that decodes to nothing is not a compliant QR

One line there is yours rather than theirs: no supplier can guess your VAT number. And a supplier still on Phase 1 is their compliance problem, not yours — Phase 2 arrives in waves. What matters to you is a standard tax invoice with your details on it.

What the check establishes, and what it does not

The scan tells youThe scan does not tell you
Which phase produced the documentThat the Authority cleared or received it
What the issuing system wrote into the codeThat those values match the underlying XML
That a signature and a public key are presentThat the signature is cryptographically valid

The right-hand column is where an honest check turns into an overclaim. Our reader labels a ninth field where one is present, the Authority's signature over the public key added when a standard invoice is cleared — but that too is read out of the document, not from the Authority. The scan is a filter for wrong-phase and wrong-shape documents, nothing more. Where an invoice must be certain, ask the supplier and treat zatca.gov.sa as the authority; the free VAT number lookup shows the establishment behind the number.

Common problems, and what to ask for

  • A simplified receipt where a standard invoice was needed. Ask for a standard tax invoice carrying your VAT number and address.
  • Your VAT number missing, or somebody else's. Send yours in writing, and ask for a corrected document.
  • The seller's number malformed. Often a commercial registration number printed in the VAT box.
  • No issue time, only a date. Minor alone, and a reliable sign of a document assembled by hand.
  • A PDF with no signed XML behind it. The six-year retention obligation, in the format issued, sits with the issuer — so ask.
  • Totals that do not add up. Do not reconcile it in a spreadsheet and file it anyway.

What not to ask for

Do not ask a supplier to edit or delete an invoice they have already issued: a cleared or reported document cannot be withdrawn, and the request puts them in a worse position than the mistake did. The correction is a second document referencing it — a credit note (381) if the amount falls, a debit note (383) if it rises, with a reason and a reference. The reason is required (BR-KSA-17, error); a missing reference comes back as a warning alongside acceptance (BR-KSA-56), a gap nobody notices for a year. Credit and debit notes walks the path. VAT itself falls due at the earlier of supply, invoice or payment, so a correction adjusts that event rather than moving it.

If you have just recognised your own invoices

Most people who get this far recognise their own documents somewhere in the table: no issue time, a district missing from the address, a buyer block copied off an email signature. The requirements checklist is the same list from the issuing side, with the rule behind each field.

If you would rather not maintain that yourself: ZATCA Tools connects to Fatoora in minutes with one OTP, signs every invoice with a compliant QR code, clears standard invoices and reports simplified ones, and keeps the signed XML downloadable for six years. Rejections arrive with the official code and a link to its guide — 135 documented, two dozen in full. It also issues quotations, credit and debit notes, receipt vouchers, statements and per-branch devices. Integrations: WooCommerce, Shopify, n8n, WHMCS, a REST API and a Partner API. It is not an accounting system. Free during the launch period, starting at 50 invoices and expanding — start here.

Frequently asked questions

Can I deduct input VAT from a simplified tax invoice? +
No. A VAT-registered buyer cannot deduct input VAT from a simplified invoice, which is why the standard invoice carries your VAT registration number and address and the simplified one does not. If a supplier gives your business a simplified receipt for a business purchase, ask for a standard tax invoice made out to the company. The document is not defective in itself; it is the wrong kind of document for your purpose.
How can I tell whether a supplier is on Phase 2? +
By the QR code on their invoice. A Phase 1 code carries five fields: the seller name, the seller VAT number, the timestamp, the total with VAT and the VAT total. A Phase 2 code adds three more: the hash of the XML, the ECDSA signature and the public key of the stamp. Scan it with the free QR code reader and count what comes back. Whether they have reached their wave is their obligation and not yours; Phase 2 arrives in waves, and wave 25 covers taxable revenue above 187,500 SAR in any of 2022 to 2025, integrating from 1 February 2027.
Does scanning the QR code prove the invoice was accepted by ZATCA? +
No, and this is the limit worth being clear about. The code tells you what the issuing system wrote into it and which phase produced it. It is not a confirmation from the Authority that the document was cleared or reported, and reading it does not check the signature cryptographically, which needs the full signed XML rather than the code alone. If you need certainty about a specific document, ask the supplier for it and take the question to zatca.gov.sa.
The supplier invoice does not show my VAT number. What do I ask for? +
A corrected document from the supplier. On a standard invoice the buyer VAT number and address are required, and a missing or wrong one is not something either of you can fix by editing the PDF. Once a document has been cleared or reported it is corrected by a credit note that references it, followed by a correct invoice. Give the supplier your registration number and national address in writing so the reissue is right the first time.
The seller VAT number on the invoice is not fifteen digits beginning and ending with 3. What does that mean? +
That number is malformed. BR-KSA-40 carries the severity error, so an invoice presenting a seller VAT number in that shape would be rejected rather than accepted with a note. If you are holding such a document, one of a few things is true: it never went through Phase 2 at all, the number was typed onto the page separately from the one inside the file, or what you are looking at is a commercial registration number rather than a VAT registration number.
Do I have to keep the XML of invoices I receive? +
The e-invoicing obligation to retain a document for six years in the format in which it was issued sits with the issuer, so it is the supplier who must keep the signed XML of what they sent you. Keep whatever you were given with your own VAT records, and if you ever need the underlying signed file for a specific invoice, ask the supplier for it. A PDF is what a human reads; the XML is what carries the signature and the fields an inspector checks.
Can I ask a supplier to delete or re-send an invoice they got wrong? +
No. An invoice that has been cleared or reported cannot be edited and cannot be deleted, and asking for that puts the supplier in a worse position than the error did. The correction is a second document: a credit note (381) if you now owe less, a debit note (383) if you owe more, each carrying a reason and a reference to the original invoice. Credit and debit notes covers the whole path.
Ready to connect your business?

Connecting is free and takes under five minutes.

Start for free