Zakat, Tax and Customs Authority
Saudi Arabia's unified tax, zakat and customs authority — VAT, FATOORAH e-invoicing, customs single window, and zakat clearance in one Nafath-secured login.
On this page
Launched
May 2021 (merger of GAZT and Customs)
Operator
ZATCA — Zakat, Tax and Customs Authority
Cost
Free portal access; government fees and tax apply
Languages
Arabic, English
Overview
The Zakat, Tax and Customs Authority (ZATCA, zatca.gov.sa) is the Saudi authority that merged the General Authority of Zakat and Tax (GAZT) with the General Customs Authority in May 2021 to create a single regulator covering value added tax, zakat, corporate income tax for non-resident shareholders, excise tax, customs duties, and the FATOORAH e-invoicing programme. ZATCA is the second busiest Saudi government portal after Absher and handles every commercial flow that touches money: every B2B invoice in the Kingdom, every container at Jeddah Islamic Port, every quarterly VAT return, every annual zakat declaration, and every withholding tax payment on a cross-border service fee. For any business operating in Saudi Arabia, ZATCA is the unavoidable layer between revenue earned and revenue legally retained.
There are three distinct ZATCA tracks the resident or business will touch. The Taxpayer Portal at zatca.gov.sa is where VAT, zakat, withholding tax, and excise returns are filed; the FATOORAH platform is the e-invoicing integration surface where ZATCA-registered software submits B2B invoices for clearance and B2C invoices for reporting in near real time; and the Customs / FASAH single window is the import-export channel that handles declarations, harmonised tariff codes, and the SAR-denominated duty calculation against the Common GCC Customs Law. All three sit behind a single Nafath login keyed to the establishment's commercial registration number, with delegated access for the accountant, tax agent, and customs broker each holding their own Nafath-authenticated role.
The FATOORAH programme is the area where {year} will bring the most operational change. Phase 1 (Generation) has been mandatory for every VAT-registered taxpayer since 4 December 2021 — invoices must be issued from a ZATCA-compliant electronic system, stored in structured format, and carry a QR code on B2C simplified invoices. Phase 2 (Integration) is being rolled out in waves keyed to historic taxable turnover: Wave 23 captures taxpayers with SAR 750,000+ turnover in any year from 2022 to 2024 with a 31 March 2026 deadline, and Wave 24 captures taxpayers with SAR 375,000+ turnover across the same window with a 30 June 2026 deadline. Wave 24 effectively brings every VAT-registered SME into the integration regime; the SME population had been deferred since 2023 and the deferral ends in {year}.
VAT itself remains at 15% — the rate has been unchanged since the July 2020 tripling from 5%, and ZATCA has publicly confirmed that no rate change is on the {year} agenda. The bigger live issue is the SAR 375,000 registration threshold (mandatory above SAR 375,000 of annual taxable supplies; voluntary between SAR 187,500 and SAR 375,000) and the late-payment penalty regime: a 5% monthly penalty on unpaid VAT, a 20% penalty for incorrect returns, and a 50% penalty for tax evasion that ZATCA can stack. ZATCA's penalty amnesty (the Cancellation of Fines and Exemption of Financial Penalties Initiative) has been extended multiple times — most recently to 30 June 2025 — and may be extended again into {year}; the amnesty waives late-registration, late-filing, late-payment, and VAT-field-error penalties for taxpayers who file the underlying return and settle the principal.
Zakat is the parallel obligation that applies to Saudi and GCC-owned shares of an entity (and 100% of a wholly Saudi/GCC owned company), calculated at 2.5% of the zakat base under the bylaws issued by ministerial decision 2216. Non-Saudi shares of the same entity pay corporate income tax at 20%. For mixed-ownership companies the zakat and income tax declarations are filed in parallel on the same ZATCA portal, and the zakat certificate (Shahadat Al-Zakat) is the document that unlocks final payment under any government tender, supplier registration on the Etimad platform, and final exit visa filing for Saudi shareholders. The certificate is issued at the end of the assessment cycle once returns are filed and any balance is settled; the validity is one Hijri year.
Customs and excise round out the perimeter. Customs declarations on FASAH require a 12-digit HS code, an attested commercial invoice, the certificate of origin, and SADAD-paid customs duty calculated against the GCC tariff schedule (5% baseline, higher protected rates on cement, steel, dairy, and selected agriculture). Excise tax applies at 100% on tobacco and energy drinks and 50% on sweetened drinks, paid by the importer or manufacturer on a separate ZATCA filing. Withholding tax on cross-border payments to non-residents runs at 5% (technical services, royalties paid to related parties), 15% (royalties paid to unrelated parties, management fees), or 20% (dividends to non-resident shareholders without a tax treaty); the buyer is the withholding agent and the deadline is the 10th of the month following payment.
For an SME founder, an HR head running payroll, or an importer at Jeddah Port, the practical Wathim role is clarifying which threshold applies, which wave you fall into, which SADAD bill code settles which obligation, and what the Nafath-authenticated delegation chain looks like when an external tax agent is filing on your behalf. The ZATCA stack interacts with Qiwa (the GOSI-recorded payroll feeds zakat base calculation), Najiz (the commercial registration is the ZATCA TIN), Muqeem (foreign shareholder final exit is gated on the zakat certificate), and Nafath (every login and every signature). Saudi country-level walkthroughs are at our Saudi Arabia guide.
Services offered
VAT Registration and Returns
Register for VAT on the Taxpayer Portal when annual taxable supplies cross the SAR 375,000 mandatory threshold; voluntary registration is available from SAR 187,500. Returns are monthly for taxpayers above SAR 40 million annual supplies and quarterly for everyone else. The return is due by the last day of the month following the tax period, with VAT payable through SADAD bill code 020. Late filing triggers a SAR 1,000 minimum penalty plus 5% per month on unpaid VAT, capped at 25% of the underlying amount.
FATOORAH E-Invoicing
Phase 1 (generation) requires every VAT-registered taxpayer to issue invoices from compliant electronic software with QR codes on B2C simplified invoices. Phase 2 (integration) requires real-time clearance of B2B tax invoices and 24-hour reporting of B2C simplified invoices through the FATOORAH API, using a ZATCA-issued cryptographic stamp identifier. Wave 24 brings SAR 375,000+ revenue taxpayers into the integration regime by 30 June 2026. Non-compliant invoices are rejected at audit and cannot be used to recover input VAT.
Zakat Declaration
Saudi and GCC-owned shares of an entity pay zakat at 2.5% of the zakat base annually under ministerial decision 2216. The declaration is filed on the Taxpayer Portal within 120 days of the financial year-end, with the balance paid through SADAD. Once filed and cleared, ZATCA issues the Zakat Certificate (Shahadat Al-Zakat) — the document that unlocks Etimad supplier registration, government tender participation, and final exit visa filing for Saudi shareholders.
Customs Declarations (FASAH)
All imports and exports through Saudi sea, air, and land ports are declared through FASAH, the customs single window operated by ZATCA. Declarations require the 12-digit HS code, attested commercial invoice, certificate of origin, and bill of lading. Customs duty (5% baseline under the GCC Common Customs Law, higher for protected items) plus 15% VAT on the duty-inclusive value is calculated automatically and paid through SADAD. Held shipments at Jeddah, Dammam, and Riyadh Dry Port are cleared from the FASAH dashboard.
Excise Tax Filing
Excise applies at 100% on tobacco, electronic cigarettes, and energy drinks, and 50% on sweetened drinks. Importers and local manufacturers register separately for excise on the Taxpayer Portal and file bi-monthly returns. The excise is collected on first sale or import and passed through the supply chain; importers settle the excise via SADAD before customs release at the port.
Withholding Tax
Cross-border payments to non-resident service providers attract withholding tax at 5% (technical services, royalties between related parties), 15% (royalties between unrelated parties, management fees, dividends), or 20% (dividends to non-treaty residents). The Saudi payer is the withholding agent — deduct, file, and remit the tax through ZATCA by the 10th of the following month, then issue the WHT certificate to the foreign supplier so they can claim treaty relief in their home jurisdiction.
Tax Clearance Certificates
ZATCA issues several certificates that gate other government processes: the Zakat Certificate for Saudi/GCC-owned companies, the VAT compliance certificate, the tax residency certificate (for Saudi-domiciled entities claiming treaty relief abroad), and the customs broker licence. Each is requested through the Taxpayer Portal and issued in 1 to 5 working days; validity is typically one Hijri year for zakat and one Gregorian year for tax residency.
Penalty Amnesty and Voluntary Disclosure
The Cancellation of Fines and Exemption of Financial Penalties Initiative has been extended several times — most recently to 30 June 2025 — and is expected to be extended into {year}. The amnesty waives late-registration, late-filing, late-payment, and field-error penalties on the condition that the underlying return is filed and the principal tax is paid. Voluntary disclosure outside the amnesty still attracts the standard 5%–20% penalty band but avoids the 50% evasion penalty if filed before ZATCA opens an audit.
How to access ZATCA
- 1
Register the establishment on the Taxpayer Portal
Visit zatca.gov.sa and select the Taxpayer Portal. Sign in with the establishment owner's Nafath credentials; ZATCA reads the commercial registration number from the linked Najiz record and pre-populates the company profile. Complete the bank account details, the authorised signatory, and the VAT registration form if turnover crosses SAR 375,000. The Tax Identification Number (TIN) is issued instantly and becomes the reference for every future filing.
- 2
Authenticate via Nafath and delegate roles
Every action on ZATCA requires a Nafath face-scan. Delegate sub-roles to your accountant (filing), tax agent (representation in audits), customs broker (FASAH submissions), and the authorised signatory (zakat certificate issuance). Delegation is via the Taxpayer Portal > User Management; the delegated user authenticates with their own Nafath. External tax agents must hold a ZATCA-issued tax agent licence to act in representation.
- 3
Enrol in FATOORAH e-invoicing if VAT-registered
Generate the Cryptographic Stamp Identifier (CSID) on the FATOORAH platform once you know which Wave applies. Connect your ERP or invoicing software to the ZATCA FATOORAH API using the production certificate; B2B invoices clear in real time and B2C invoices report within 24 hours. If you are not yet in an integration wave, the Phase 1 generation requirement still applies — issue invoices from compliant software with QR codes on B2C.
- 4
File returns on the cycle that applies to you
VAT: quarterly returns for taxpayers under SAR 40 million annual supplies, monthly above that, due the last day of the month following the period. Zakat: annual within 120 days of financial year-end. Excise: bi-monthly. Withholding tax: monthly by the 10th. Customs: per declaration on FASAH. Set calendar reminders 7 days before each deadline; late filing penalties start the day after the due date.
- 5
Settle balances via SADAD and download certificates
ZATCA generates a SADAD bill (code 020 for VAT, 010 for zakat, separate codes for excise and withholding) with a single-use reference. Pay through any Saudi bank app or ATM; ZATCA confirmation typically posts within an hour. Once the return is settled and cleared, download the Zakat Certificate or VAT compliance certificate from the Certificates tab — keep copies for Etimad, bank credit applications, and final exit filings.
Troubleshooting
The errors residents hit most often on ZATCA, and the fix that works.
The signatory's Iqama must be linked to a Saudi SIM registered in their own name. Move the SIM into their Iqama at STC, Mobily, or Zain with Iqama and passport, then re-enrol on the Nafath app. If the signatory is a non-resident director without an Iqama, delegate the role to a Saudi resident director or licensed tax agent via the Taxpayer Portal.
The Cryptographic Stamp Identifier is either not yet issued or has been revoked. On the FATOORAH portal > Onboarding, request a new CSID — it requires Nafath signature from the authorised signatory and an OTP sent to the registered TIN mobile. Once issued, install the certificate on every device that submits invoices; each device needs its own CSID.
Check three layers in order: SADAD payment status (must show 'paid' not 'pending'), GOSI clearance (unpaid social insurance blocks the certificate), and Najiz commercial registration validity (an expired CR blocks the certificate). Fix each layer and the certificate posts within 24 hours.
Open the declaration on FASAH and file an amendment with the corrected 12-digit HS code. ZATCA recalculates the duty automatically; pay any difference through the new SADAD reference. If the inspection finds the goods materially different from the declaration, expect a re-classification fine of 1% to 100% of the duty value depending on intent.
The closing balance of one return must match the opening of the next. The most common cause is a corrective journal posted to a prior period after the return was filed. Reopen the prior return through Voluntary Disclosure, reconcile to the trial balance, and refile both periods in sequence.
Settle the principal liability through SADAD; the SAMA freeze is lifted within 48 hours. For liabilities above SAR 50,000, file a payment-in-instalments request on the Taxpayer Portal before settlement to spread the load over up to 24 months — ZATCA approval usually arrives in 10 working days and lifts the Iqama block at the Muqeem layer.
The certificate is only generated after the monthly WHT return is filed and the deducted amount is settled. If the return is filed but the certificate is missing, confirm the supplier's name, country, and amount in the return match the underlying invoice; mismatches block certificate generation. Refile the return with the corrected lines if needed.
Frequently asked questions
Rejection codes on the FATOORAH integration API fall into three families. The 400-series (validation) means the XML structure or a mandatory field is wrong — most common cause is a missing buyer VAT number on a B2B invoice above SAR 1,000, an incorrect VAT category code, or a UUID that does not match the previous invoice hash. The 401-series (authentication) means the cryptographic stamp identifier (CSID) is expired, revoked, or does not match the one registered against your TIN — re-onboard the device on the FATOORAH portal. The 500-series (server) is transient; resubmit after 5 minutes. Until the invoice clears, it cannot be used by the buyer to recover input VAT, so reissue from your ERP rather than manually editing the rejected XML. ZATCA's FATOORAH sandbox at sandbox.zatca.gov.sa is the safe place to test each rejection code before pushing to production.
Late filing of a VAT return triggers a flat SAR 1,000 minimum penalty plus 5% per month on unpaid VAT, capped at 25% of the underlying amount. Late payment runs a separate 5%-per-month line on the unpaid principal. If your missed return falls inside the Cancellation of Fines and Exemption of Financial Penalties Initiative window — currently extended to 30 June 2025 and likely to extend further into {year} — file the missing return on the Taxpayer Portal, pay the principal VAT through SADAD, and the late-filing and late-payment penalties are automatically waived. Penalties for VAT-field errors (incorrect input claims) are also covered, but the 50% evasion penalty is not. Check the amnesty status before filing — if it has lapsed, the cheapest route is voluntary disclosure before ZATCA opens an audit, which avoids the evasion-grade penalties.
The Zakat Certificate (Shahadat Al-Zakat) is issued automatically on the Taxpayer Portal once the most recent annual zakat return is filed and the assessed amount is settled through SADAD. For Saudi and GCC-owned entities the certificate is mandatory for Etimad supplier registration, government tender bids, final payments under existing government contracts, and the final exit visa of a Saudi shareholder. If the certificate is not appearing in your portal, three causes account for almost every case: the prior-year return is not filed, the SADAD payment is sitting in pending status, or the GOSI cross-check has flagged unpaid social insurance contributions. Settle each layer and the certificate is issued within 24 to 72 hours. Validity is one Hijri year from issue.
Wave 24 of the FATOORAH integration phase applies to VAT-registered taxpayers whose taxable turnover in any of 2022, 2023, or 2024 exceeded SAR 375,000. The integration deadline is 30 June 2026. The threshold check is on any one of the three years, not the latest — many SMEs that dropped below SAR 375,000 in 2024 still qualify if they crossed it in 2022 or 2023. Once notified by ZATCA you have 6 months to onboard a compliant solution, complete CSID issuance on the FATOORAH portal, and start clearing B2B invoices in real time and reporting B2C invoices within 24 hours. Wave 24 effectively brings every VAT-registered business into the integration regime, so plan procurement of a ZATCA-certified solution provider before the {year} rush.
A Saudi-registered entity owned partly by Saudi or GCC nationals and partly by non-GCC foreigners files both declarations on the same ZATCA portal in parallel. The Saudi and GCC ownership share pays zakat at 2.5% of the zakat base (net working capital and adjusted equity under ministerial decision 2216). The non-GCC ownership share pays corporate income tax at 20% of taxable profit. The split is by shareholding percentage and is calculated automatically once the shareholder register matches the Najiz commercial registration. Both declarations are due within 120 days of the financial year-end. Wholly Saudi or GCC-owned companies file only zakat; wholly foreign-owned (Premium Residency or MISA-licensed) companies file only income tax.
Mandatory registration is required only when taxable supplies cross SAR 375,000 in any rolling 12-month period. Voluntary registration is available from SAR 187,500. Below SAR 187,500 you are out of scope. Voluntary registration is worth considering if you make B2B sales — most VAT-registered buyers prefer suppliers who can issue a tax invoice they can recover input VAT against, and you become eligible to recover the 15% input VAT on your own purchases. The trade-off is the quarterly return-filing obligation and the FATOORAH integration that catches you in Wave 24 from 30 June 2026 onward. If you sell mainly to consumers (B2C), voluntary registration usually costs more than it saves.
Open the FASAH dashboard inside the Taxpayer Portal and find the declaration by container number or bill of lading. The hold reason appears in the timeline. The four most common reasons are: HS code mismatch (the declared 12-digit code does not match the inspected goods — file an amendment with the correct code), missing certificate of origin (re-issue from the exporter's chamber of commerce, embassy-attested for non-GCC origins), duty not paid (a SADAD reference is generated on declaration; pay through your bank), or SFDA / SASO standards conformity certificate missing (for food, cosmetics, electronics — file the relevant Saber certificate through the linked Saber platform). Once cleared, the port releases the shipment within 24 hours.
After the monthly withholding tax return is filed and the deducted amount is settled through SADAD by the 10th of the following month, the Taxpayer Portal generates a downloadable WHT certificate per supplier. The certificate carries the foreign supplier's name, the gross amount, the WHT rate (5%, 15%, or 20%), and the deducted tax — the foreign supplier needs this to claim a foreign tax credit or treaty relief in their home country. Issue it within 30 days of payment. If you forgot to deduct WHT on the original invoice, you cannot retroactively shift the burden onto the supplier — the Saudi payer becomes liable for the full tax plus penalty under article 68 of the Income Tax Law.
Most entertainment, staff meals, and personal-use items are blocked from input VAT recovery under the VAT Implementing Regulations article 50. Specifically blocked: restaurant meals and entertainment for clients, hotel rooms for personal travel, private vehicle leases, household goods, and any expense without a valid tax invoice. Staff training, business travel airfare, business mobile phones, and office supplies are recoverable. The single most common audit adjustment ZATCA makes on input VAT is rejecting client-entertainment claims that should have been blocked at source. Build the recovery rules into your ERP at invoice booking time rather than relying on the year-end clean-up.
ZATCA allows two routes for correcting a filed VAT return. If the correction is below SAR 5,000 net VAT impact, adjust on the next return by adding a corrective line in the same VAT category — no separate filing required. If the impact exceeds SAR 5,000 or relates to an earlier year, file a Voluntary Disclosure through the Taxpayer Portal within 20 days of discovering the error. Voluntary disclosure before ZATCA opens an audit caps the penalty at the standard late-payment band (5% per month on unpaid VAT) and avoids the 50% evasion penalty. Keep the supporting workings — ZATCA can request the trial balance and the original supplier invoices that triggered the correction.
Excise applies at 100% on tobacco, electronic cigarettes, and energy drinks, and at 50% on sweetened drinks (including most soft drinks and flavoured juices with added sugar). The importer pays the excise on first import through a separate ZATCA filing — the customs declaration on FASAH calculates excise, customs duty (5% under GCC tariff), and 15% VAT on the duty- and excise-inclusive value. Local manufacturers pay on first release from the factory. Excise is passed through the supply chain on the commercial invoice but is not separately recoverable as input — it is a final tax. Excise returns are filed bi-monthly through the Taxpayer Portal.
Yes, under the Tax Collection Procedures issued in 2020 ZATCA can request SAMA to freeze the Saudi bank accounts of a taxpayer with confirmed unpaid tax liabilities, after a 20-day notice period. For sole-proprietor establishments the owner's personal accounts can also be frozen. The Iqama and final exit of the Saudi or expat owner can be flagged through Muqeem — the final exit screen returns a generic block until ZATCA confirms clearance. The fix is settling the principal (the freeze is lifted within 48 hours of SADAD confirmation) and, if applicable, filing a payment-in-instalments request through the Taxpayer Portal for liabilities above SAR 50,000.
Yes, services to a customer in another GCC state with a fully implemented VAT regime (Bahrain, UAE, Oman) are intra-GCC supplies but are currently treated as exports under transitional rules — zero-rated for Saudi VAT, with the customer accounting for VAT in their home country under reverse charge. The transitional rule applies until the GCC-wide electronic services system is fully operational, which has been pending since 2018. Issue a zero-rated tax invoice with the customer's foreign VAT number, document the export evidence (contract, payment received from overseas account, service delivery records), and claim input VAT on related costs. Services to Kuwait and Qatar (no VAT regime) are also zero-rated as exports.
The annual zakat return is due within 120 days of the financial year-end — so 30 April for taxpayers on a 31 December year-end. Late filing triggers a 1% per month penalty on the unpaid zakat capped at 25%, plus a 5% monthly late-payment penalty on the unpaid principal. The Zakat Certificate cannot be issued until the return is filed and settled, which blocks Etimad supplier status, government tender participation, and final exit for Saudi shareholders. If you have missed the deadline, file immediately through the Taxpayer Portal — the penalty amnesty has historically covered late zakat filings and is expected to be extended into {year}.
Guides from the blog
Walkthroughs that use ZATCA
Step-by-step guides for the most common transactions on this portal.
GCC
GCC Family Sponsorship Salary Requirements 2026: All 6 Countries, Honest Thresholds
Salaries to bring family to the GCC range from KWD 800 in Kuwait to QAR 10,000 in Qatar. Country-by-country verified thresholds, sponsor-parents rules, what counts as salary, worked examples, and the data conflict around Oman.
GCC
Certificate Attestation for the GCC (2026): Country-by-Country Playbook, Apostille vs Full Chain
Three GCC countries now accept apostille (Saudi, Bahrain, Oman); three still need the full notary-MEA-embassy-MOFA chain (UAE, Qatar, Kuwait). Real costs, realistic timelines, the rejection traps, and worked examples per country.
GCC
GCC Overstay Fines Compared (2026): All 6 Countries, Real Rates, Honest Gaps
UAE AED 50/day, Qatar 90-day grace then QAR 10/day, Oman OMR 10/day from day one. The full breakdown of overstay fines, grace periods, and how to check and pay across all six GCC countries, with worked examples and honest UNVERIFIED flags.
Stuck on a ZATCA transaction?
If the portal will not cooperate, our desk can take the filing from here. Free guidance call to start, fixed desk fee to engage.