ZATCA & Shomoos Compliance for Hotels 2026 | Fandaqah

ZATCA & Shomoos Compliance for Hotels 2026 | Fandaqah

ZATCA and Shomoos Compliance for Hotels in 2026: How Fandaqah Keeps Saudi Properties Fully Compliant

The complete guide to ZATCA e-invoicing Phase 2, Shomoos guest registration, and how a Saudi-built hotel PMS turns both into automatic, everyday routines.

By the Fandaqah Team  |  Updated October 2026  |  Reading time: about 14 minutes

Every time a guest checks in to a hotel, resort, or furnished apartment in Saudi Arabia, two legal clocks start ticking. The first belongs to the Ministry of Interior's Shomoos system, which requires accurate guest registration. The second belongs to the Zakat, Tax and Customs Authority (ZATCA), which requires every invoice to follow strict e-invoicing rules. Miss either one, and your property is exposed to fines, failed inspections, and a lot of stressful paperwork.

That is why ZATCA and Shomoos compliance for hotels has moved from a back-office task to a front-desk priority. In 2026, with ZATCA's Phase 2 integration waves reaching more and more businesses and tourism in the Kingdom growing fast, hoteliers need systems that handle compliance in the background, without slowing down check-in.

In this guide, you will learn exactly what ZATCA e-invoicing Phase 2 and Shomoos require from hospitality businesses, how the two systems differ, and how Fandaqah, a hotel management system built for the Saudi market, connects both into one smooth workflow. You will also find real-world use cases, a detailed comparison, a demo checklist you can use to verify any vendor, and a FAQ that answers the questions hotel owners ask us most.

The short answer

Fandaqah ensures full compliance by generating ZATCA Phase 2 e-invoices (UBL 2.1 XML, cryptographic stamp, QR code, and hash chain) directly from each guest folio and sending them to the Fatoora platform automatically, while pushing guest check-in, room-change, and check-out data to Shomoos from the same reservation record. One entry at the front desk satisfies both authorities.

Why ZATCA and Shomoos Compliance Matters for Saudi Hotels in 2026

Saudi Arabia's hospitality sector is expanding at a pace few markets have seen. New hotels are opening in Riyadh, Jeddah, the Eastern Province, AlUla, and along the Red Sea coast, while Makkah and Madinah continue to welcome growing numbers of pilgrims. More guests mean more invoices and more registrations, and regulators have built digital systems to keep pace.

For a hotel, compliance is not a single obligation. It touches several departments at once:

  • Front office: collects guest identity data that Shomoos needs, and issues invoices at check-out.
  • Finance: must make sure every invoice, refund, and adjustment meets ZATCA e-invoicing rules and correct VAT treatment.
  • Management and owners: carry the legal risk if records are missing, late, or inaccurate.
  • Sales and corporate accounts: need valid B2B tax invoices that corporate clients can use for their own VAT returns.

When these tasks are spread across spreadsheets, separate portals, and manual uploads, errors are almost guaranteed during busy seasons. When they live inside one hotel PMS in Saudi Arabia that was designed around local regulations, compliance becomes a by-product of normal work.

Understanding ZATCA E-Invoicing Phase 2 for Hotels

ZATCA's e-invoicing program, known as Fatoora, replaces paper and handwritten invoices with structured electronic invoices that the authority can verify. It was introduced in two phases, and understanding the difference is the first step toward VAT compliance for hotels.

Phase 1 vs Phase 2 in plain terms

Phase 1 (Generation) started on 4 December 2021. It required businesses to issue invoices from a compliant electronic system, with a QR code on simplified invoices, and banned handwritten or easily edited invoices.

Phase 2 (Integration) began on 1 January 2023 and is being rolled out in waves, starting with the largest taxpayers and moving to smaller businesses based on revenue thresholds. In Phase 2, your invoicing system must connect directly to ZATCA's Fatoora platform and exchange invoices in a strict technical format. ZATCA notifies each taxpayer of its wave in advance, typically about six months before the integration deadline, so every hotel should check its status on the ZATCA portal.

Clearance vs reporting: which applies to your guests?

Phase 2 treats two invoice types differently, and hotels issue both every day:

  • Standard tax invoices (B2B and B2G): issued to companies and government bodies, such as a corporate client booking rooms for staff. These must be cleared by ZATCA in real time before you share them with the buyer.
  • Simplified tax invoices (B2C): issued to individual guests. These must be reported to ZATCA within 24 hours of being issued.
  • Credit and debit notes: refunds, discounts after check-out, and billing corrections follow the same clearance or reporting rule as the original invoice type.

What a ZATCA-compliant hotel invoice must contain

A Phase 2 e-invoice is much more than a PDF with your logo. Behind every printed invoice sits a structured file with security elements that prove it has not been altered:

  • UBL 2.1 XML format, the international structure ZATCA uses to read invoice data.
  • A unique identifier (UUID) and an invoice counter value for every document.
  • A cryptographic stamp created with a certificate (CSID) that your system receives when it is onboarded to Fatoora.
  • A hash of the previous invoice, which chains documents together so gaps or deletions can be detected.
  • A QR code carrying the seller name, VAT number, timestamp, invoice total, VAT amount, and security data.
  • Correct VAT at 15%, with clear line items for rooms, food and beverage, laundry, and other services.

Tip for hotel finance teams

Hotels often mix both invoice types inside a single stay: the room is paid by the guest's employer, while minibar and laundry charges are paid by the guest. A PMS that can split one folio into a cleared B2B invoice and a reported B2C invoice saves hours of manual corrections at month end.

Understanding Shomoos Guest Registration

Shomoos is the Ministry of Interior's electronic security system for accommodation facilities in Saudi Arabia. Its purpose is simple: authorities need to know who is staying where, and when. Hotels, resorts, furnished apartments, and other licensed lodging must register their guests through it.

Who must register in Shomoos?

Shomoos applies to licensed accommodation providers, including hotels of every star rating, serviced apartments, furnished units, resorts, and similar properties. Every guest is covered, whether they are a Saudi citizen, a resident with an Iqama, a GCC national, a tourist on an e-visa, or a pilgrim.

What data is required, and when?

At a minimum, properties record the guest's identity document details (national ID, Iqama, or passport and visa), nationality, room number, and check-in date, then update the record at check-out. Room moves, companions, and extensions should be reflected too. The safest practice is to register guests at the moment of check-in and close the record at the moment of check-out, because late or missing registrations are the most common Shomoos issue found during inspections.

Note

Shomoos rules are set by the Ministry of Interior and may be updated. Always confirm the latest requirements for your property type and city with the relevant authority. A good PMS keeps you aligned with these changes through regular updates rather than manual workarounds.

ZATCA vs Shomoos: Hotel Compliance at a Glance

Many hoteliers confuse the two systems because both are digital and both are mandatory. This table shows how they differ.

Aspect ZATCA e-invoicing Shomoos
AuthorityZakat, Tax and Customs AuthorityMinistry of Interior
PurposeTax transparency and VAT accuracySecurity and guest tracking
Triggered byInvoices, credit notes, debit notesCheck-in, room change, check-out
Key dataSeller and buyer VAT details, amounts, VAT, security elementsGuest ID, nationality, room, dates
TimingB2B cleared in real time; B2C reported within 24 hoursAt check-in and check-out (real time is best practice)
Main riskEscalating penalties, rejected invoices, VAT disputesViolations during inspections, licensing issues

How Fandaqah Ensures Full ZATCA E-Invoicing Compliance

Fandaqah treats e-invoicing as part of the guest folio, not as an export step. Here is what happens to every invoice, in order:

  • Step 1. One-time onboarding. Your property's Fandaqah environment is onboarded to ZATCA's Fatoora platform using the OTP you generate on the Fatoora portal. The system receives its cryptographic certificate (CSID), so every invoice it issues can be signed.
  • Step 2. Charges post to the folio. Room nights, F&B, laundry, parking, and extras post automatically with the correct VAT treatment at 15%. Corporate details, including the client's VAT registration number, are stored on the company profile.
  • Step 3. The right invoice type is chosen. Fandaqah identifies whether the bill goes to a VAT-registered company (standard invoice) or an individual guest (simplified invoice), and supports split folios when both apply.
  • Step 4. The e-invoice is built and signed. The system generates the UBL 2.1 XML, applies the UUID, counter value, previous-invoice hash, cryptographic stamp, and QR code.
  • Step 5. Clearance or reporting happens automatically. Standard invoices are sent for clearance before they reach the client; simplified invoices are reported within the 24-hour window. If the internet drops, invoices wait in a secure queue and are sent once the connection returns.
  • Step 6. Status is visible and archived. Each invoice shows its ZATCA status (cleared, reported, or needs attention), and the XML and ZATCA response are stored for audits and retention requirements.

Why built-in beats bolted-on

When e-invoicing lives inside the PMS, the invoice is created from the same data the guest sees at check-out. There is no copy-paste between systems, no second chance for a typo in a VAT number, and no gap between what the front desk charged and what ZATCA receives. That single source of truth is the foundation of reliable ZATCA e-invoicing for hospitality.

How Fandaqah Automates Shomoos Integration

The same reservation record that drives billing also drives guest registration. Fandaqah's Shomoos integration is designed around how front desks actually work in the Kingdom:

  • Capture once: guest identity details entered or scanned at check-in are validated for required fields before the guest receives a key.
  • Push automatically: the registration is sent to Shomoos as part of the check-in action, with no separate login or re-typing.
  • Stay in sync: room moves, companions, extensions, and early departures update the guest record so it always reflects reality.
  • Close cleanly: check-out closes the Shomoos record at the same moment the folio is settled.
  • Flag exceptions: a compliance dashboard highlights any registration that failed or is incomplete, so the duty manager can fix it before the shift ends.
"Compliance fails at the handoff. Every time guest data moves by hand from one screen to another, a mistake waits to happen. The safest hotels are the ones where the front desk enters data once, and the system takes care of every authority that needs it." Fandaqah product team

One Check-In, Two Compliance Tracks

Here is how a single guest stay moves through both systems inside Fandaqah, side by side.

Shomoos track

Arrival: ID captured and validated, guest registered.

During stay: room moves and companions updated.

Departure: registration closed at check-out.

ZATCA track

Arrival: billing profile set (guest or company VAT details).

During stay: charges posted with 15% VAT.

Departure: e-invoice signed, then cleared or reported.

Key Features and Benefits of a ZATCA-Compliant Hotel PMS

What does a hotel management system in KSA need in order to keep you compliant without adding work? These are the capabilities that matter most, and how each one helps your team:

  • Native ZATCA Phase 2 engine: XML, cryptographic stamp, QR code, and hash chain generated inside the PMS, so there is no third-party gap.
  • Automatic clearance and reporting: the system knows which rule applies to each invoice and meets the deadline for you.
  • Offline-safe queue: invoices are never lost if the connection drops during a busy check-out.
  • Split folios and city ledger: corporate, travel agency, and guest charges are billed correctly from the same stay.
  • Compliant credit notes: refunds and post-stay adjustments are issued as proper e-documents linked to the original invoice.
  • Bilingual invoices: clear Arabic and English invoices for local and international guests and corporate clients.
  • Automatic Shomoos registration: check-in, updates, and check-out synced with no second system to manage.
  • Compliance dashboard and alerts: one screen shows any invoice or registration that needs attention.
  • Audit trail and role permissions: every change is logged, and only authorized staff can issue credit notes or edit guest records.
  • Secure archiving: e-invoices and ZATCA responses stored and searchable for tax audits and record-keeping obligations.

The business benefit in one sentence

Automated ZATCA and Shomoos compliance turns two daily risks into zero extra clicks, which means faster check-outs, fewer finance corrections, calmer inspections, and more time for the guest in front of you.

Use Cases: How Compliance Looks Across Saudi Arabia

Compliance needs differ by city, season, and property type. Here is how automated e-invoicing and Shomoos integration support the Kingdom's main hospitality segments.

Makkah and Madinah hotels during Hajj and Umrah

Peak seasons bring hundreds of arrivals in a few hours, often in groups, with many passports and visas to register. Group check-in with bulk Shomoos submission keeps queues short, while group invoices billed to Umrah operators are issued as cleared standard invoices.

Business hotels in Riyadh and the Eastern Province

Corporate guests need valid tax invoices their companies can use to recover VAT. Real-time clearance with the buyer's VAT number makes the invoice usable immediately, and split billing separates company-paid rooms from personal extras.

Furnished apartments and serviced residences

Long stays, monthly billing, and frequent extensions are common in furnished units. Shomoos compliance for furnished apartments depends on keeping each extension and occupant change up to date, and on issuing periodic invoices correctly throughout the stay.

Resorts in AlUla, the Red Sea, and Abha

International leisure travelers arrive with tourist e-visas and spend on experiences, dining, and spa services. Accurate passport registration and detailed, bilingual invoices protect the property and give guests a premium experience.

Multi-property hotel groups

Groups need each property to be onboarded correctly under the right VAT registration and need head office to see compliance status across the portfolio. A central dashboard shows every property's invoice and registration health in one place.

Real-World Scenarios: Before and After Automation

The scenarios below are illustrative and reflect common situations Saudi properties describe when moving from manual processes to an integrated PMS.

A 120-room hotel in Jeddah

Before: invoices typed in a separate system at night; VAT numbers sometimes mistyped; corrections took days.

After: invoices generated from the folio at check-out, corporate invoices cleared instantly, and the night audit focuses on revenue, not fixes.

A furnished apartment operator in Riyadh

Before: Shomoos updated by hand after extensions, with records occasionally left open after guests left.

After: extensions and check-outs sync automatically, and the dashboard flags any open record before an inspector does.

Comparison: Manual Processes vs Standalone Tools vs Fandaqah

Choosing the best ZATCA-compliant hotel software in Saudi Arabia starts with understanding the three common approaches.

Capability Manual or legacy Standalone e-invoice tool Fandaqah PMS
Phase 2 invoices from the folioNoNeeds data exportYes, automatic
Clearance and 24-hour reportingManual uploadYesYes, with offline queue
Split folios and city ledgerSpreadsheetsLimitedBuilt in
Shomoos registrationSeparate portalNot coveredSynced at check-in and check-out
Data enteredTwo or three timesTwiceOnce
Compliance dashboardNoneInvoices onlyInvoices and registrations
Peak-season riskHighMediumLow

How to Verify Compliance in a Fandaqah Demo

Claims are easy to make. Evidence is better. Whether you are evaluating Fandaqah or any other system, ask to see these things live during your demo:

  • A cleared standard invoice with ZATCA's clearance response stored against it.
  • A simplified invoice's QR code scanned with a phone, showing the seller name, VAT number, timestamp, total, and VAT amount.
  • The UBL 2.1 XML file behind an invoice, including its hash and stamp.
  • A credit note issued against an existing invoice and linked to it.
  • A split folio producing one company invoice and one guest invoice from the same stay.
  • A Shomoos registration created at check-in and closed at check-out, with its sync status visible.
  • The compliance dashboard showing how a failed submission is flagged and resolved.

Tip for owners

Bring your finance manager and front office manager to the demo. The finance manager should check invoice structure and VAT logic, and the front office manager should time a full check-in and check-out to confirm compliance does not slow the desk down.

Future Trends: Compliance, Vision 2030, and the Smart Hotel

Saudi Vision 2030 places tourism at the center of economic diversification, with a national target of 150 million visits a year by 2030 and major destinations such as Diriyah, AlUla, the Red Sea, and NEOM attracting new hotel investment. A digital-first government is a second pillar of the vision, and both ZATCA's Fatoora program and Shomoos are clear examples of it. Here is what hoteliers should prepare for:

  • Wider Phase 2 coverage: as integration waves continue, smaller hotels and apartment operators will need Fatoora-connected systems, not just compliant-looking PDFs.
  • More connected reporting: regulators increasingly expect data to flow directly from operating systems, including tourism statistics reported to the Ministry of Tourism.
  • Digital identity at check-in: ID scanning and digital identity verification will make guest registration faster and more accurate.
  • Cloud-first operations: cloud PMS platforms make regulatory updates instant across every property, instead of waiting for local installations.
  • AI-assisted audits: smart alerts that detect unusual refunds, missing registrations, or VAT mismatches before they become problems.

Hotels that build on a compliance-ready platform today will adapt to each new rule with an update, while hotels relying on manual work will face a new project every time regulations change.

Frequently Asked Questions About ZATCA and Shomoos Compliance for Hotels

What are the ZATCA e-invoicing requirements for hotels in 2026?

Hotels in their Phase 2 wave must issue invoices from a system connected to ZATCA's Fatoora platform. Each invoice needs UBL 2.1 XML, a UUID, a cryptographic stamp, a previous-invoice hash, and a QR code. Standard B2B invoices are cleared in real time, and simplified B2C invoices are reported within 24 hours.

What is Shomoos, and is it mandatory for hotels in Saudi Arabia?

Shomoos is the Ministry of Interior's electronic system for registering guests at accommodation facilities. It is mandatory for licensed hotels, resorts, and furnished apartments, which must record each guest's identity details, room, and stay dates, and keep the record updated through check-out.

How do I integrate my hotel PMS with ZATCA Phase 2?

You generate an OTP on the Fatoora portal and use it to onboard your PMS, which then receives its cryptographic certificate (CSID). With Fandaqah, this is a guided one-time setup per property, after which every invoice is signed and sent automatically.

How can I register hotel guests in Shomoos automatically?

Use a PMS with built-in Shomoos integration. In Fandaqah, guest details captured at check-in are validated and sent to Shomoos as part of the check-in action, then updated for room changes and closed at check-out, without a separate login.

What happens if the internet goes down during check-out?

Fandaqah stores invoices in a secure queue and submits them to ZATCA as soon as the connection returns, so simplified invoices stay inside the 24-hour reporting window and no invoice is lost.

How can hotels avoid ZATCA penalties?

Issue every invoice from a Phase 2-connected system, apply 15% VAT correctly, issue proper credit notes for refunds, meet clearance and reporting deadlines, and archive invoices securely. Automating these steps inside your PMS removes the manual errors that cause most violations.

Does Fandaqah work for furnished apartments and small hotels?

Yes. Fandaqah supports hotels, resorts, serviced apartments, and furnished units, including long stays, extensions, and periodic billing, so smaller operators get the same ZATCA and Shomoos automation as large properties.

Is ZATCA compliance the same as Shomoos compliance?

No. ZATCA compliance covers tax invoices and VAT, while Shomoos compliance covers guest registration for security purposes. They are run by different authorities, but in Fandaqah both are driven by the same reservation and folio data.

Conclusion: Make ZATCA and Shomoos Compliance Automatic

In 2026, ZATCA and Shomoos compliance for hotels is no longer optional, and it is no longer something a busy front desk can manage by hand. ZATCA e-invoicing Phase 2 demands signed, structured invoices that are cleared or reported on time. Shomoos demands accurate guest registration from arrival to departure. Both depend on clean data captured once and shared correctly.

Fandaqah brings these obligations into one Saudi-built hotel PMS: invoices are generated from the guest folio and sent to Fatoora automatically, guest registrations are pushed to Shomoos from the same reservation, and a single dashboard shows anything that needs attention. The result is a property that stays compliant through Hajj crowds, corporate peaks, and long-stay seasons, while your team focuses on hospitality instead of paperwork.

See ZATCA and Shomoos compliance working on your own property

Book a free Fandaqah demo and watch a full check-in, invoice clearance, and check-out happen live.

Book a free demo Explore Fandaqah features

Tags

ZATCA and Shomoos compliance for hotels, ZATCA e-invoicing Phase 2, Shomoos integration, hotel PMS Saudi Arabia, Fatoora portal, VAT compliance for hotels, hotel management system KSA, e-invoicing for hospitality, Shomoos guest registration, ZATCA compliant hotel software, how to integrate hotel PMS with ZATCA Phase 2, how to register hotel guests in Shomoos automatically, ZATCA e-invoicing requirements for hotels in 2026, how to avoid ZATCA penalties for hotels, Shomoos compliance for furnished apartments, best ZATCA compliant hotel software in Saudi Arabia, Vision 2030 hospitality, Fandaqah

More posts
Affiliate Pro