Controls, Requirements, Technical Specifications and Procedural Rules for Implementing the Provisions of the E-Invoicing Regulation based on the decision of His Excellency the Governor - Decision No. (62738) dated 23/11/1443 H

First: Scope of the application

1. This Resolution, its attached Annexes (1) and (2) and the documents referred to in the Annexes which are an integral part thereof, are set to define the controls, requirements, technical specifications, or procedural rules required for the implementation of E-Invoicing Regulation provisions which are related to the following:

   1. The Generation of Electronic Invoices and Electronic Notes Phase, including provisions related to its processing, and record keeping of Electronic Invoices and Electronic Notes, which is applied to all Persons subject to the E-Invoicing Regulation effective 4^th of December 2021.

   2. The Integration Phase on the transmission of Electronic Invoices and Electronic Notes, and sharing them with the Authority, which shall be applied to all Persons subject to the E-Invoicing Regulation in phases starting from 1^st of January 2023, and according to the timelines to be determined pursuant to Clause (Sixth) of this Resolution.

2. Persons subject to Article 3 of the E-Invoicing Regulation shall be subject to this Resolution.

3. Electronic Invoices generated in accordance with the provisions of this Resolution, the timelines for implementing the requirements and details specified in Annexes (1) and (2) thereof, the Integration implementation phases as determined by the Authority and in the format referred to in Clause (Second) are the tax invoices that are considered for exercising the right of deduction referred to in Article 48, paragraph (1) of the Unified VAT Agreement in relation to transactions subject to Article 3 of E-Invoicing Regulation. In order to claim Input Tax Deduction, the electronic invoices and notes should be Cleared by or Reported to the Authority as per the Integration Phase requirements within this resolution starting from the date announced by the Authority in a subsequent resolution.

4. Electronic Invoices shall include Tax Invoices and Simplified Tax Invoices set forth under Article 53 of the VAT Implementing Regulation.

5. Transactions subject to Article 3 of the E-Invoicing Regulation include the cases for which tax invoices must be issued and set forth under Article 53 of the VAT Implementing Regulation, shall include the following:

   1. Supplies of taxable goods and services, either they are subject to the standard VAT rate or Zero rate;

   2. Export of goods and services from the Kingdom;

   3. Intra-GCC supplies in accordance with the Unified VAT Agreement, VAT Law and the VAT Implementing Regulation;

   4. Nominal supplies by the taxable person in accordance with the Unified VAT Agreement, VAT Law and VAT Implementing Regulation;

   5. Any payments related to supply of goods or services and received by the taxable person before the actual supply.

6. Transactions subject to Article 3 of the E-Invoicing Regulation include the cases for which notes must be issued as per the VAT Implementing Regulation.

7. Transactions set forth under Article 3 of E-Invoicing Regulation shall not include the following:

   1. Supplies fully exempted from VAT.

   2. Any payments related to supplies fully exempted from VAT and received by a taxable person before such supply.

   3. Supplies subject to VAT according to the Reverse Charge Mechanism.

   4. Import of goods to the Kingdom.

Second: Requirements and details for Generation of Electronic Invoices and Electronic Notes

The Electronic Invoices and Electronic Notes should be generated in a format that must be compliant with the requirements and details specified in Annexes (1) and (2), and in accordance with the timelines specified for the application of these requirements and details, subject to the following:

1. Electronic Invoices, whether they represent a Tax Invoice or a Simplified Tax Invoice, and their associated Electronic Notes, must be generated in a format that covers all details and fields required for each type of invoices as specified in Annex (2) and as per the timelines set forth under Annexes (1) and (2) of this Resolution.

2. All Electronic Invoices, whether they represent Tax Invoice or Simplified Tax Invoice, and their associated Electronic Notes, must be generated in XML format or PDF/A-3 format (with embedded XML) as per the timelines specified for application and set forth under Annexes (1) and (2) of this Resolution.

3. Electronic Invoices and their associated Electronic Notes shall contain a Cryptographic Stamp pursuant to what is specified in this Resolution, starting from the date determined by the Authority in accordance with the timelines specified in Annexes (1) and (2) of this Resolution. A Cryptographic Stamp, for the purposes of implementing this Resolution, means an electronic stamp which is created via cryptographic algorithms to ensure authenticity of origin and integrity of content of the data of the Electronic Invoices and their associated Electronic Notes, and to ensure verification of the identity of the issuer of those Invoices and Notes for the purpose of ensuring compliance with the provisions and controls of the VAT Law and its Implementing Regulation regarding the generation of tax Invoices and Notes. The Cryptographic Stamp must be generated as follows:

   1. With regards to Tax Invoices and their associated Notes which are generated electronically, the Authority shall - starting from the date which will be determined to oblige the persons subject to E-Invoicing Regulation to integrate with the Authority's systems - clear such Electronic Tax Invoices and their associated Electronic Notes in accordance with the mechanism determined by The Authority. The Authority has the power to revise, amend such mechanisms as well as ensure the adherence of the persons subject to E-Invoicing Regulation to it. Clearance means that the Authority shall verify that the Electronic Tax Invoices and their associated Electronic Notes transmitted to it by the persons subject to E-Invoicing Regulation fulfil the controls and details specified in this Resolution and Annexes (1) and (2) thereof. The Authority shall insert the Cryptographic Stamp only on the Invoices and Notes which fulfil the aforesaid controls and details as well as notify the issuers of such Invoices and Notes prior to sharing them with the customers.

   2. With regards to Simplified Tax Invoices and their associated Notes which are generated electronically, such Simplified Tax Invoices and their associated Electronic Notes must be reported to the Authority within a period which must not exceed 24 hours from its generation - in accordance with the mechanism determined by the authority — starting from the date which will be determined by the Authority to oblige the persons subject to E-Invoicing Regulation to integrate with the Authority's systems. The Authority has the power to revise, amend such mechanisms as well as ensure the adherence of the persons subject to E-Invoicing Regulation to it. Reporting is the process of sharing of the Simplified Tax Invoices and their associated Notes which are generated electronically- which include the Cryptographic Stamp as specified in Clause (Fourth) of this Resolution- with the Authority by the persons subject to E- Invoicing Regulation.

4. All Electronic Notes must satisfy all the requirements specified in Article 54 of the VAT Implementing Regulation, in addition to all requirements and details set forth under this Clause.

Third: The specifications and Requirements of E-Invoice Solutions for Electronic Invoices and Electronic Notes

1. The E-Invoice Solution used for generating Electronic Invoices and Electronic Notes must be compliant with the specifications and requirements set forth under the E-Invoicing Regulation, this Resolution, and Annexes (1) and (2) thereof. The E-Invoice Solution shall be considered as compliant after verifying its conformity to all specifications and requirements by the Authority, or a third party, or self-certified by the person subject to E-Invoicing Regulation, in accordance with mechanisms and requirements set out by the Authority.

2. In addition to the above-mentioned requirements in paragraph 1 of this Clause, the Compliant Solution must fulfill the following requirements:

   1. Electronic Invoices and Electronic Notes' formats and its sharing mechanism with customers

      1. The Compliant E-Invoice solution must be able to generate invoices and their associated notes in the XML format or PDF/A-3 format (with embedded XML) as per the requirements of Electronic Invoices formats specified in Annex (1) of this Resolution.

      2. Persons subject to E-Invoicing Regulation must share the Tax Invoice, or its associated Notes that has been electronically generated with customers.

      3. Persons subject to E-Invoicing Regulation must present to their customers a printed copy of the Simplified Tax Invoice or its associated Notes that has been generated electronically, such Simplified Tax Invoice or its associated Notes- upon the agreement between the transaction parties-may also be shared with customers in its electronic format or any other human readable format with customers.

   2. Electronic Invoices and Electronic Notes' Content

      The Compliant E-Invoice solution must be able to generate Electronic Invoices and Electronic Notes which include all the data fields required in addition to all requirements and other details specified in this Resolution and Annexes (1) and (2) thereof, for each Invoice or Note based on its type or nature, and including all taxable supplies and set forth under Clause (First) of this Resolution.

   3. Data and Information Security Requirements:

      1. The Compliant E-Invoice solution must be tamper-resistant and include a mechanism, which prevents tampering and reveals any tampering attempts that might occur by the user or any third party in accordance with the specifications and requirements specified by the Authority. The Authority has the power to verify the conformity of the E-Invoice solution to the specifications and requirements in accordance with the verification mechanism set forth under Clause (Fourth) of this Resolution.

      2. The Compliant E-Invoice solution must be able to protect the generated electronic Invoices and Electronic Notes from alteration or deletion, and contain some functionalities which enable the person subject to E-invoicing Regulation to save Electronic Invoices and Electronic Notes and archive them in the format as specified in Annexes (1) and (2) of this Resolution without the need for internet connection and in accordance with the specifications, requirements and timelines specified in Annex (1) of this Resolution.

      3. The Compliant E-Invoice solution must be able to generate a Universally Unique Identifier (UUID) in addition to the Electronic Invoice sequential number which identifies and distinguish each VAT Tax Invoice, Simplified Tax Invoice, and their associated notes in accordance with the specifications, requirements and timelines specified in Annex (2) of this Resolution. This shall be for each Electronic Invoice or Electronic Note generated by such E-Invoice Generation Solution, as per the requirements and timelines specified in Annexes (1) and (2) of this Resolution.

      4. The Compliant E-Invoice solution which is used for generating Simplified Tax Invoices and their associated Notes, must be able to generate a Cryptographic Stamp for each Electronic Invoice or Electronic Note. Such Cryptographic Stamp must have an identifier as per the requirements and timelines specified in Annexes (1) and (2) of this Resolution, and requirements and mechanisms set forth under Clause (Fourth) of this Resolution.

      5. The Compliant E-Invoice solution must be able to generate a Hash for each generated Electronic Invoice or Electronic Note within the sequence of the Electronic Invoices and Electronic Notes. The Hash of the Electronic Invoice is then embedded in the next Electronic Invoice in the sequence. This Hash is used to protect the sequence of Invoices from tampering whether by deletion or replacement. Hash is an enciphered text obtained by applying a one way algorithm upon data which prevents the return to the original data or amending or tampering it as specified in Annex (1) of this Resolution.

      6. The Compliant E-Invoice solution must be able to generate a QR code which is a type of matrix barcode, with a pattern of black and white squares that is machine readable by a QR code scanner or the camera of smart devices in order to enable basic validation of Electronic Invoices and Electronic Notes (Referred to as "QR Code") as specified in Annex (1) of this Resolution.

      7. The Compliant E-Invoice solution must have a tamper-resistant Electronic Invoice counter that cannot be reset or reformatted. The counter must increment for each generated Electronic Invoice or associated note and the Compliant Solution must record the value of this counter in each Electronic Invoice or associated Notes in the field indicated in Annex (2).

   4. Integration requirements:

      1. The approved formats for all Electronic Invoices and Electronic Notes for Integration shall be XML format as referred to in this Resolution.

      2. The Compliant E-Invoice solution must be able to connect to an internet connection and integrate with external systems by using Application Programming Interface (API) specified by the Authority and published on its website.

   5. Prohibited functions

      1. The Compliant E-Invoice solution shall not have the prohibited functionalities as specified in Annex (1) of this Resolution.

      2. The Compliant E-Invoice solution must not be able to generate more than one sequence of Electronic Invoices and Electronic Notes issued through each of the units within the E-Invoice Solution used. For the purposes of this Resolution, a Unit is the key component of the E-Invoice Solution that generates the tamper-proofing features of the sequence of Electronic Invoices by inserting a Hash on the Electronic Invoice or Electronic Note, in addition to including the Hash of the previous Electronic Invoice or Electronic Note in a sequence of Electronic Invoices and Electronic Notes, generates the Cryptographic Stamp for Simplified Tax Invoices and their associated Electronic Notes, and contains a Cryptographic Stamp Identifier for each Cryptographic Stamp as specified in Annex (1) and Annex (2) of this Resolution.

Fourth: Requirements and mechanisms for verifying the conformity of E- Invoice Solutions, Issuance of Cryptographic Stamps, and Cryptographic Stamp Identifiers.

The Authority shall determine the special mechanism for verifying the conformity of E-Invoice Solutions to the specifications and requirements referred to in Clause (Third) of this Resolution, it shall also determine the requirements and mechanisms for issuing Cryptographic Stamps referred to in Clauses (Second) and (Third) of this Resolution, in addition to determining the requirements of The Cryptographic Stamp Identifiers which is issued as a result of registering the units used for generating Simplified Tax Invoices and their associated Electronic Notes with the Authority, which are referred to in Clause (Third), sub-clause (2/c/4) of this Resolution.

Fifth: Keeping of records, Electronic Invoices, Electronic Notes and its associated data

Persons subject to the E-Invoicing Regulation must keep records, Electronic Invoices, Electronic Notes, and their associated data in a way that is compliant with the format and timelines specified in Annexes (1) and (2) of this Resolution and in accordance with the record-keeping requirements set forth under Article 66 of the VAT Implementing Regulation, Persons subject to the E-Invoicing Regulation are obliged to provide the Authority with all records, Electronic Invoices, Electronic Notes or data upon its request for the purpose of verifying the validity of Electronic Invoices and Electronic Notes, and verify their compliance with the provisions of the Unified VAT Agreement, VAT Law, the VAT Implementing Regulation and the E- Invoicing Regulation.

Sixth: Integration

The Integration phases implementation, transmission of Electronic Invoices and Electronic Notes, and sharing them with the Authority, shall be implemented through phases starting from 1^st of January 2023, as follows:

1. The Authority shall determine the targeted groups and phases of Integration for the persons subject to E-Invoicing Regulation. The Authority shall notify each target group with the implementation procedures for the integration with its systems at least (6) months prior to the due date;

2. Persons subject to the E-Invoicing Regulation must integrate their systems with the Authority's systems by using an Application Programming Interface "API" in accordance with the timelines, targeted groups, and implementation phases of Integration with the Authority's systems.

In addition to Integration requirements specified in Clause (Third), Sub-Clause (2/D), additional details related to Integration and its implementation phases and timelines will be determined through a subsequent resolution(s) from the Governor based on the powers set forth in Article 6, Paragraph (b) of the E-Invoicing Regulation.

Seventh: Obligations of the Persons Subject to the E-Invoicing Regulation

Taking into consideration all the obligations set forth under the Unified VAT Agreement, VAT Law and the VAT Implementing Regulation, all persons subject to the E-Invoicing Regulation as specified in Article 3 thereof must adhere to the controls and obligations stipulated in such regulation and this Resolution, and in particular, adhere to the following:

1. Generate all tax invoices and notes that must be issued within the timelines specified in the VAT law, in an electronic form starting from the day following the expiration date of the grace period specified in Article 7, paragraph B of the E-Invoicing Regulation.

2. Comply with all the provisions set forth under the E-Invoicing Regulation in addition to the controls, requirements, technical specification and procedural rules specified in this Resolution and Annexes (1) and (2) thereof, and any subsequent resolutions for E-Invoicing.

3. Adhere to the specified timelines for compliance with the specifications and requirements of Electronic Invoices and Electronic Notes as per the details and timelines specified in this Resolution and Annexes (1) and (2) thereof.

4. Adhere to the record keeping requirements of Electronic Invoices, Electronic Notes and its associated data referred to in Clause (Fifth) of this Resolution, and any other requirements as per the applicable laws and regulations.

5. Notify the Authority through the means specified by the Authority of any incidents, technical error or emergency matters which hinder the generation of Electronic Invoices or Electronic Notes, or hinder the integration of E-Invoicing. The Authority may determine the procedure which should be taken after the validation of such incident, technical error or emergency matter as per its policies. Persons subject to the E-Invoicing Regulation must notify the Authority in the event of the disappearance of such incident, technical error or emergency matter. Persons Subject to the E- Invoicing Regulation shall resume generation of Tax Invoices and associated Notes, and any Invoices or Notes for Transactions conducted during such incidents, technical error or emergency matters electronically, and integrate them with the Authority according to Integration obligations promptly as soon as such incident, technical error or emergency matter that prevented the Generation or Integration of The Electronic Invoices or The Electronic Notes is fixed.

6. Not to use any E-Invoice Solution which is not compliant with the specifications and requirements referred to in Clause (Third), and in accordance with the timelines and controls specified in this Resolution and Annexes (1) and (2) thereof.

7. Register the units used for generating Simplified Tax Invoices and their associated Electronic Notes as part of the E-Invoice solution with the Authority, in accordance with the mechanisms and controls referred to in this Resolution and any subsequent resolutions.

8. Preserve the Cryptographic Stamp Identifiers and its associated components in a safe way, and protect them from copying or illegal use, and not use them for purposes other than those which they are intended for.

9. Integrate the E-Invoice solution of the persons subject to the E-Invoicing Regulation with the Authority's systems starting from the date specified in this Resolution and any subsequent resolution in this regard.

10. Sharing the Electronic invoices and the notices associated thereto with the Authority shall be in XML format as of the dates specified for the Integration implementation and according to the timelines specified by the Authority.

Eighth: Closing Provisions

1. The Authority may authorize one or more entities to perform the verification procedures for the E- Invoice Generation Solution in order to ensure its conformity to the specifications and requirements as per Clause (Third), and verify the fulfillment of the requirements and mechanisms for issuing Cryptographic Stamps referred to in Clauses (Second), (Third), and (Fourth) of this Resolution. Such entity shall verify the conformity of each E-Invoice Generation Solution to the specifications and requirements specified in this Resolution and Annexes (1) and (2) thereof.

2. Penalties and fines set forth under the VAT Law shall be applied on persons violating the E- Invoicing Regulation and this Resolution, according to the violation's classifications specified in the relevant Board of Directors' resolutions.

Ninth: Enforcement and Obligation

1. Persons subject to the E-Invoicing Regulation shall comply with the specifications and requirements set forth in this Resolution starting from the day following the expiration date of the grace period as per Article 7, paragraph B of the E-Invoicing Regulation, taking into consideration the specified timelines for the implementation and compliance with each of the specifications and requirements as specified in Annexes (1) and (2) of this Resolution.

2. This Resolution shall come into force and take effect as of the date of its publication in the Official Gazette.

Annexes

Annexures (1) and (2) below are concerned with specifying the details of the functional and technical requirements and specifications necessary to implement the rules and regulations of the electronic invoicing resolution and the relevant decisions, which will be implemented in two main stages:

• The first stage: Generation of Electronic Invoices and Electronic Notes, including provisions related to its processing, and record keeping, effective 4^th of December 2021.

• The second stage: Integration phase, transmission of Electronic Invoices and Electronic Notes, and sharing them with the Authority for each target group based on the implementation waves announced by the Authority for the integration with the ZATCA.

Annex (1)

Technical Requirements of E-invoice Generation Solutions

This annex contains the following requirements details and shall be reviewed and updated periodically by the Authority.

1. Electronic Invoice requirements covering types of invoices, invoice formats and invoice structure.

2. Security and stamps requirements covering cryptographic stamping, hashing, etc.

3. Data and connectivity requirements of the E-Invoice Generation Solutions for Electronic Invoices and Electronic Notes.

4. Prohibited capabilities and functions.