In this article
If your shop, cafe or pharmacy prints a receipt for a walk in customer, that paper is a simplified tax invoice, and the ZATCA QR code requirements apply to every copy of it. The code is not decoration. It is the part of the invoice a customer or an inspector can scan to read the sale back and confirm it came from a registered seller.
This guide covers what the QR code must contain today, what changes when your business joins Phase 2 of e-invoicing, and how to check your own receipts in a few minutes without opening a technical standard.
What counts as a simplified tax invoice
A simplified tax invoice is the invoice issued mostly for business to consumer sales, with the fields set out in Article 53(8) of the VAT Implementing Regulations and Annex 2 of the E-Invoicing Resolution. Supermarket receipts, cafe receipts, pharmacy receipts and workshop receipts are all simplified tax invoices.
You may also issue a simplified tax invoice for a business to business sale when the value of the taxable supplies is less than 1,000 SAR. That limit applies only to the B2B choice. For consumer sales you can issue a simplified tax invoice at any value, including sales above 1,000 SAR.
One difference matters for the QR code. A standard tax invoice for a business buyer does not need a QR code in the generation phase, while a simplified tax invoice does. In Phase 2 the Fatoora platform adds the cryptographic stamp and the QR code when it clears a standard tax invoice, but for a simplified invoice your own system has to stamp it and apply the code before the customer leaves the counter.
The five fields every QR code must carry
Since 4 December 2021, the start of the generation phase, the QR code on a simplified tax invoice must carry five fields. ZATCA lists them in its security features implementation standards, each with a tag number.
| Tag | Field |
|---|---|
| 1 | Seller name |
| 2 | VAT registration number of the seller |
| 3 | Timestamp of the invoice (date and time) in line with ISO 8601, for example 2022-02-21T12:13:57Z |
| 4 | Invoice total (with VAT) |
| 5 | VAT total |
Those five values are what a customer sees after scanning the code in the ZATCA app. If the seller name in the code is a trade name while the VAT registration number belongs to a different entity, or the total in the code does not match the printed total, the invoice is wrong even though the paper looks fine.
Two details catch businesses out. The timestamp is a full date and time at the moment of generation, not a date alone. The VAT total is the tax amount and not the rate, so a 100.00 SAR sale at the standard rate of 15% carries an invoice total of 115.00 and a VAT total of 15.00.
What Phase 2 adds: nine tags in TLV format
From 1 January 2023, in waves by targeted taxpayer group, the integration phase adds four more tags. The QR code on a simplified tax invoice then carries nine tags, encoded in TLV (tag, length, value) and converted to Base64, with up to 700 characters.
| Tag | Field added in Phase 2 |
|---|---|
| 6 | Hash of the XML invoice |
| 7 | ECDSA signature of the XML hash |
| 8 | ECDSA public key extracted from the signing private key |
| 9 | For simplified tax invoices and their associated notes, the ECDSA signature over that public key |
Tags 6 to 9 turn the code from a summary into evidence. Tag 6 ties the code to one exact XML document, tags 7 and 8 let a verifier check the seller's signature, and tag 9 ties the signing key back to the certificate issued during onboarding. That key pair comes with your cryptographic stamp identifier, so understanding what a CSID is is the step before you worry about QR codes.
How the QR code is actually built
You will not write the encoder yourself, but knowing the order of operations helps you tell a compliant receipt from a broken one. The standard is specific about it.
- Start with the required values and an empty byte array.
- For each value write the tag in one byte, then the length as an unsigned 8 bit integer in one byte, then the value as UTF-8 bytes.
- For tag 6 the length is the 32 bytes of the SHA-256 hash.
- Encode the finished byte array in Base64 to get an ASCII string.
- Create the QR image from that Base64 string.
Two failure modes come from skipping that encoding. A code holding plain text instead of a Base64 TLV string may open in a phone camera yet fail in the ZATCA app, which is the test that counts. A code printed too small, or on a thermal roll that fades in a week, becomes a problem the moment somebody cannot read it. Details of the required structure are published by ZATCA in the e-invoicing security requirements.
Wave 25 brings shops and cafes into Phase 2
Many businesses that issue simplified tax invoices all day have stayed in the generation phase so far. That changes with the twenty fifth wave. ZATCA has announced that taxpayers whose revenues subject to VAT exceeded 187,500 SAR during 2022, 2023, 2024 or 2025 must integrate with the Fatoora platform by no later than 1 February 2027.
At that threshold the wave reaches small retailers, cafes, salons, clinics and workshops. For the cashier nothing changes. Behind the counter three things have to start working: the system generates the invoice as XML, it stamps the XML with the cryptographic stamp identifier issued by ZATCA, and the invoice is reported to the Fatoora platform within 24 hours of generation. Reporting is submitted in XML format, not as PDF/A-3.
Simplified invoices are reported, not cleared. The customer gets the printed invoice immediately, and the file travels to ZATCA afterwards, within that 24 hour window. Standard tax invoices for business buyers work the other way round, because they go to Fatoora for clearance before they reach the buyer.
A five point check on your own receipts
Take a receipt printed this morning, open the ZATCA app, and work through this list for each register.
- Scan the code. The app should show the seller name, the VAT registration number, the timestamp, the total with VAT and the VAT amount.
- Compare those values with the printed ones. They have to match to the halala.
- Confirm the VAT registration number belongs to the entity making the sale, not to a sister company or a branch registered separately.
- Check that the timestamp shows a date and a time, and that the time is correct. A register that lost its clock after a power cut will quietly print the wrong hour on every invoice.
- If you are already in the integration phase, open your reporting log and look for invoices rejected by Fatoora or still queued after 24 hours.
Keep one scanned example per register in a folder with the date. When a question comes up months later, a saved example answers it faster than any specification.
Where Daftarix fits
Daftarix is built for Phase 1 and Phase 2. It issues standard and simplified invoices, adds QR codes on simplified invoices, produces XML in UBL 2.1, applies the cryptographic stamp, and connects to Fatoora so standard invoices go through clearance and simplified invoices are reported within 24 hours. Amounts are handled in SAR with 15% VAT, and documents print in Arabic and English. The feature list is on the ZATCA e-invoicing page.
If you want to see your own receipt layout and its QR code checked before your wave date, book a demo and bring a sample receipt with you.
Frequently asked questions
Does every receipt need a QR code?
Every simplified tax invoice does. Since 4 December 2021 a QR code carrying the five basic fields is part of a compliant simplified tax invoice. A standard tax invoice issued to a business buyer does not require a QR code in the generation phase.
Can I print the QR code on a separate slip?
No. The code belongs on the invoice itself, and the invoice has to be given to the buyer immediately in a printed copy. By agreement with the buyer you may share it electronically or in another human readable format instead, but the code stays part of the document.
What should I do if a QR code will not scan?
Treat it as a defect in the invoice and fix it at the register. Note that once an invoice has been issued it cannot be modified or deleted, so a sale that has to be corrected is handled with a credit note and a new invoice, not by editing the original.
Do I need a different QR code in Phase 2?
The content changes, not the place on the paper. You keep the same five fields and add tags 6 to 9, which depend on the XML invoice, the hash and your stamping key, so the code can only be produced by a system that generates XML and stamps it.
Is the 24 hour reporting window counted from the sale or from the end of the day?
From the generation of the invoice. Each simplified tax invoice has its own 24 hour window starting when it is issued, which is why reporting is best left running continuously rather than as a nightly batch.
