ZATCA e-invoicing for coworking and business-center operators in Saudi Arabia

A member at your business center runs their own trading company. Their accountant just kicked your invoice back unpaid — no QR code, no Arabic line items, no VAT number they can reconcile against their own return. You're not being difficult, and neither are they. You just issued the same invoice template you've used since 2019, and Saudi Arabia quietly changed what a valid tax invoice looks like underneath you.

This happens constantly to coworking and business-center operators, and it has nothing to do with size. A single-location space in Jeddah with forty members is under the same generation-phase obligation as a five-location operator in Riyadh. What follows is what ZATCA actually requires of you as the operator, where coworking billing specifically breaks compliant invoicing, and why we route the cryptographic part of this through certified middleware instead of building it ourselves.

What ZATCA actually requires from a coworking operator

ZATCA (the Zakat, Tax and Customs Authority) requires every VAT-registered business in Saudi Arabia to issue electronic tax invoices, and a coworking or business-center operator is a normal VAT-registered business in the eyes of the regulation. It doesn't matter whether the taxable supply is a SAR 150 day pass, a twelve-month private office lease, or a virtual office subscription with mail forwarding bundled in. If money changes hands for a service and you're VAT-registered, it needs a compliant invoice behind it.

Two invoice types matter here, and most operators issue both without thinking about the distinction. A simplified tax invoice covers business-to-consumer sales — a freelancer walking in for a day pass, an individual booking a meeting room. It needs a QR code and doesn't require the buyer's details. A standard tax invoice covers business-to-business sales — a company renting a dedicated desk, a startup on a monthly membership plan — and it must carry the buyer's own VAT registration number. Get that second part wrong and your corporate members can't reclaim input VAT on what they paid you, which is exactly the scenario in the opening paragraph.

Phase 1 versus Phase 2 — the distinction operators keep missing

ZATCA rolled this out in two stages, and conflating them is the single most common mistake we see. Phase 1, the generation phase, has been mandatory since December 2021. It requires invoices to be produced by an electronic system rather than handwritten or typed freely, and every invoice must carry a QR code, be issued in Arabic, and include the VAT breakdown as a distinct line rather than a single all-in total.

Phase 2, the integration phase, is a different and heavier obligation. It requires your invoicing system to connect directly to ZATCA's Fatoora platform, and the invoice stops being a document and becomes a structured message: UBL 2.1 XML rather than a PDF, a UUID on every invoice, a cryptographic stamp, a TLV-encoded QR code, and a hash chaining each invoice to the one before it. Standard (B2B) invoices go through real-time clearance before they reach the buyer at all. Simplified (B2C) invoices are issued immediately but must be reported to ZATCA within 24 hours. ZATCA has been bringing taxpayers into Phase 2 in successive waves, working from the highest-revenue businesses downward, and it notifies each wave directly at least six months ahead of its integration deadline.

What a compliant invoice actually has to contain

Strip away the acronyms and a ZATCA-compliant tax invoice needs the following, every time, without exception:

• Seller's legal name and VAT registration number
• Buyer's VAT registration number, on standard (B2B) invoices only
• A sequential invoice number with no gaps — the numbering itself is checked
• Issue date and time, not just the date
• Each line item's VAT treatment shown separately, not folded into one total
• Subtotal, VAT amount, and total shown as distinct figures
• A QR code encoding the seller, VAT number, timestamp, invoice total, and VAT amount
• Arabic as the invoice language, with English permitted alongside it but not instead of it
• From Phase 2 onward, a cryptographic stamp and a hash referencing the previous invoice

That sequential numbering line is easy to skim past and expensive to ignore. Under Phase 2, each invoice's hash incorporates the hash of the invoice before it. Delete an invoice, renumber one out of order, or issue two invoices with the same number from different terminals, and the chain breaks. ZATCA's clearance system flags that. The fix when you've made a genuine mistake is a credit note against the original invoice, never a deletion or a silent renumber.

UAE versus KSA: what actually changes for a two-country operator

A growing number of our customers run one brand across Dubai and Riyadh, or are eyeing that expansion. Treating both countries under one invoicing template is the fastest way to fail an audit in whichever one you treat as the afterthought.

The UAE is developing its own e-invoicing framework, but it isn't the same regime as ZATCA and it isn't on the same clock. If you're building or buying software for both markets, the one non-negotiable is that VAT rate, currency, invoice language, and e-invoicing behaviour all have to be driven by which entity and which country issued the invoice — not by a single global template with a country flag stuck on top.

Why coworking billing breaks generic accounting software

Here's the part that's specific to this industry and not covered by any general ZATCA guide. A general accounting package has one real concept: an invoice line with a price and a tax code. Coworking billing has half a dozen concepts stacked on top of each other, and most of them get created outside the accounting system entirely — in a booking calendar, a membership tracker, or someone's memory.

Think about what a single member's month can actually contain. A base membership fee, billed monthly. Three meeting-room credits redeemed mid-cycle, each theoretically a separate taxable supply. A mid-month upgrade from hot desk to dedicated desk, prorated for the days remaining. A virtual office add-on with a mail-forwarding fee. None of that maps cleanly onto "one invoice line, one price, one tax code." Someone has to manually recode all of it into the accounting tool before a ZATCA-compliant invoice can even be generated — and every manual recoding step is a place where a line gets missed, a VAT treatment gets applied inconsistently, or an invoice goes out with a number that's out of sequence with the one before it.

We've watched this play out with an operator who ran bookings in one system and invoicing in another. A member upgraded plans on the 14th of the month. The booking system logged it correctly. The accounting tool, fed manually at month-end, billed the new rate from the 1st because nobody told it otherwise. That's not a ZATCA violation by itself, but it's the kind of discrepancy that turns a routine audit into a long one, because now every invoice from that operator gets a second look.

Coworking-native platform versus general accounting tool

This is also where the honest comparison with Arabic accounting-first tools matters. Products like Qoyod are genuinely strong at what they're built for — general VAT accounting with ZATCA awareness baked in — and if all you need is to invoice a fixed set of services every month, one of them will serve you fine. The gap opens once your billing has moving parts that only exist in coworking: credits, day passes, prorated upgrades, and virtual office subscriptions that bundle several services under one recurring charge.

None of this means the accounting-first approach is wrong. It means it's solving a different problem — general ledger accuracy — while coworking operators need the billing logic and the compliance logic to come from the same source of truth as the booking calendar and the membership record. Bolt one onto the other and you've recreated the manual recoding step that causes the discrepancies in the first place.

Why we use certified middleware instead of building the cryptography ourselves

Phase 2 compliance isn't just a data format problem. It requires onboarding a compliance CSID (a cryptographic identity issued by ZATCA), managing the keys tied to it, generating a cryptographic stamp on every invoice, and keeping pace with ZATCA's own schema and API changes as they evolve. That's a specialised, security-sensitive discipline with its own certification process, and it has almost nothing to do with running a coworking space's bookings and memberships well.

So we don't build it. Maktaby's invoicing engine generates the invoice content — the correct line items, VAT treatment, buyer and seller detail, sequencing — from the same booking, membership, and virtual office records the rest of the platform runs on. That invoice is then handed to Wafeq, ZATCA-certified middleware, which handles the cryptographic stamping and the clearance or reporting call to Fatoora.

Certified middleware isn't a corner we cut. It's a system we chose not to reinvent, because key custody and schema churn are exactly the kind of risk you don't want sitting inside a coworking platform's core codebase.

Where operators get this wrong

• Treating a PDF with a QR-code image pasted onto it as compliant. The QR code has to be generated by a compliant e-invoicing solution as part of the invoice's structured data, not added as a decoration afterward.
• Assuming Phase 1 compliance covers Phase 2. They're separate obligations tested separately, and your wave notification arrives on ZATCA's schedule, not on a vendor's roadmap.
• Ignoring a ZATCA wave letter because "we're too small." Wave thresholds have moved down over time, bringing progressively smaller taxpayers into Phase 2.
• Not capturing a corporate member's VAT number at onboarding, then chasing it down after the invoice is already issued and needs a correction.
• Deleting or renumbering a wrongly issued invoice instead of raising a credit note, which breaks the sequential hash chain Phase 2 relies on.
• Running SAR and AED invoices through one currency-agnostic billing engine that treats VAT rate as a manual field instead of a jurisdiction setting.

Which wave you are in, and what the current thresholds are

ZATCA publishes the selection criteria for each wave, so this is knowable rather than mysterious. What it assigns you to depends on your own VAT-registered revenue in the qualifying years, and ZATCA notifies each wave directly at least six months before its integration date. As of September 2026 the two waves that matter to an operator of this size are these:

Wave 25 is the one most coworking operators should be reading. ZATCA announced its criteria on 24 July 2026 and halved the threshold to SAR 187,500 — low enough that a single-location space with a few dozen members is very likely inside it. If your VAT-subject revenue crossed SAR 187,500 in any of 2022 through 2025, the working assumption should be that you are in scope with an integration deadline of 1 February 2027, and the question is what your invoicing system does about it rather than whether it applies.

None of that replaces confirming your own position. ZATCA notifies targeted taxpayers directly, its notification is authoritative in a way a published criterion is not, and an accountant who knows your filings can tell you in a minute what a threshold table cannot. Use the figures above to know whether to start the conversation, not to end it.

Getting your coworking space audit-ready

1. 1Confirm VAT registration status and jurisdiction configuration for every location you operate, separately — don't assume one setting covers a multi-city footprint.
2. 2Capture every corporate member's VAT registration number at onboarding, before the first invoice goes out, not after.
3. 3Route every billing type — day passes, credits, prorated upgrades, virtual office subscriptions, PRO service milestones — through one invoicing engine with one sequence.
4. 4Verify Arabic text and a valid QR code appear on every invoice issued to a Saudi entity, without exception.
5. 5Confirm your provider's Phase 2 clearance runs through certified middleware, and ask which one by name.
6. 6Set invoice retention to a minimum of six years for KSA (five for UAE) with no hard-delete path, including for cancelled bookings or terminated memberships.
7. 7Reconcile your invoice number sequence monthly and investigate any gap immediately, rather than at year-end.

None of this is exotic once it's built into the platform generating your invoices in the first place. It becomes a genuine operational burden the moment it's bolted onto a booking system that was never built to think in VAT terms — which is the situation most Saudi coworking operators are quietly running today, whether or not they've thought about it in those terms yet.