ZATCA E-Invoice Archiving: How Long to Keep Invoices, in What Format, and Where

For most Saudi businesses, the last few integration waves were about one question: are we connected to Fatoora yet? Once you are, a second question matters just as much: where will these invoices be in five or six years, when a ZATCA auditor asks for them? Archiving is not a casual backup. It is a legal obligation with a retention period, a format and a location, and it has its own line in ZATCA’s penalty table. This article pulls together what ZATCA’s official documents say about e-invoice archiving and turns it into a practical checklist.

What is the legal basis?

Clause Five of the E-Invoicing Implementation Resolution requires taxpayers to keep records and invoices in line with the record-keeping requirements of Article 66 of the VAT Implementing Regulation, in the format and for the periods set out in the Resolution’s annexes, and to provide them to ZATCA on request. The Resolution also requires the e-invoicing solution to protect invoices from alteration or deletion, to allow them to be saved and archived without an internet connection, and to support exporting them to an external archival system.

How long must you keep invoices?

According to ZATCA’s guideline on records and invoicing for VAT purposes:

In practice, an invoice issued in late 2026 cannot be discarded before the end of 2032 at the earliest, and real-estate-related records must be kept much longer. Relying on an old POS terminal or files scattered across staff laptops is a real risk.

In what format?

ZATCA’s Detailed Guidelines for E-Invoicing state that, in the integration phase, tax invoices are generated in XML or in PDF/A-3 with embedded XML. The point many businesses miss is that an ordinary PDF printout is not the original. The original is the structured file that carries the cryptographic stamp, the QR code and the hash chain. The guideline also describes archive file names starting with the VAT registration number followed by a timestamp, and the Resolution’s annex specifies names that include the VAT number, issue date and time and the invoice reference number.

Where: on-premises server or cloud?

The Detailed Guidelines allow invoices to be stored on an on-premises server in the Kingdom or in the cloud, provided cloud-hosted data can be reached by ZATCA through a direct link. The records guideline adds that electronic records must be accessible from a server or computer located in the Kingdom, protected by adequate controls against tampering, and kept in Arabic so they match the underlying records. Businesses using a centralised system abroad must make the data accessible through a permanent establishment in the Kingdom. The takeaway: ask your system vendor directly where the data lives and how ZATCA would access it.

What is the penalty for not archiving correctly?

ZATCA’s simplified guideline on classifying violations (2nd edition, May 2024) has a dedicated item for failing to save e-invoices and e-notes in the required format, mechanism and periods: a warning for the first violation with a 60-day correction period, then escalating fines on repetition starting at SAR 1,000 and reaching SAR 40,000. The same table has a separate item for deleting or editing invoices after issuance, with fines starting at SAR 5,000.

Common mistakes we see

• Switching systems without migrating the archive: prior years’ invoices are left on an old machine nobody maintains.
• Keeping only the PDFs emailed or sent to customers, without the signed XML files.
• Backups on the same server: one disk failure takes the data and the backup together.
• Cancelling an invoice by deleting it instead of issuing a credit note, which is a separate violation in ZATCA’s table.

Archiving checklist

1. Keep the original XML for every invoice and note, not only a PDF.
2. Make deletion and editing impossible after issuance; corrections go through credit or debit notes.
3. Set the retention period per record type: six years generally, longer for capital assets and real estate.
4. Confirm the storage location and ZATCA access, whether the server is yours or in the cloud.
5. Test retrieval: ask for a year-old invoice and time how long it takes to produce.
6. Back up off the server on a fixed schedule and test restores regularly.
7. Keep an audit trail of who changed what and when around each invoice.

How Riv-ERP helps

RivDesktop: your data on your server

RivDesktop is installed on your own server with a SQL Server database, so invoices stay under your control. When an invoice is posted, the system generates a digitally signed XML (UBL) file and QR code and safely maintains the invoice counter (ICV) and previous-invoice hash (PIH). For cleared tax invoices, the ZATCA-stamped file and QR replace the local copy. From the integration report you can export XML files for any period, and the system keeps a log of every data change (who and when) plus an event log. See the RivDesktop guide.

Riv-ERP Cloud: from the browser

Riv-ERP Cloud runs on Oracle Cloud servers with an Oracle database, with no server at your premises. It includes a screen for tracking invoices not yet uploaded to or rejected by ZATCA, plus accounting transaction audit, a log of deleted transactions and edit rights. If you are weighing on-premises against cloud storage, read our comparison of the two editions.

Note: this article is general guidance based on ZATCA documents published at the time of writing. Check the official texts or your tax adviser for your specific case.

Frequently Asked Questions