What e-invoicing non-compliance costs in the GCC

Every e-invoicing business case we are shown contains a slide about penalties. Almost none of them distinguish between a penalty an authority has actually published and a penalty somebody assumed by looking at the country next door. In the GCC that distinction is not academic, because the region divides cleanly in two.

The UAE has published a schedule: six violations, each with an amount, in a Cabinet Decision. Saudi Arabia fines e-invoicing violations through ZATCA under a documented warning-first escalation ladder. Oman, Bahrain, Qatar and Kuwait have published no e-invoicing penalty amounts at all — in Oman's case, despite a mandate wave that starts next month.

Everything below is sourced to the authority that published it. Where a number comes from somewhere other than the regulator, we say so in the line where it appears.

The comparison

The UAE: the provider decision is itself the obligation

Cabinet Decision No. 106 of 2025 was issued on 9 October 2025 and took effect on 15 October 2025. It annexes a table of six violations. Read the first line carefully, because it is the one most business cases miss:

The first violation is not about invoices. It is about not having appointed a provider, and it accrues at AED 5,000 a month whether or not you have issued a single document. In the UAE the procurement decision has become the compliance obligation. A six-month provider selection that runs past your deadline costs AED 30,000 before anyone has looked at your master data.

That reframes the ASP choice from a purchasing exercise into a dated one. It is also why the questions worth asking are the ones about exit rather than the ones about features — we set those out in the ASP lock-in questions and in the ASP selection scorecard.

Two further points that are easy to get wrong. First, the penalties do not apply to voluntary early adopters: Article 2 excludes anyone issuing, transmitting, sharing, exchanging or reporting electronically on a voluntary basis. Going early is not penalised. Second, recipients are in scope, not only issuers — two of the six violations attach to the receiving party. Buyers who assume e-invoicing is a seller's problem are reading only two thirds of the table.

The structure of these amounts is worth noticing in its own right. Per-document penalties are capped monthly; notification failures are per-day and uncapped. The UAE has priced silence more aggressively than it prices error. If your operating model has a weak point, make sure it is not the part that tells the Authority something has broken.

Saudi Arabia: correctable, but it compounds

ZATCA operates a different philosophy. Since 30 January 2022, field violations begin with a notice rather than a fine, and the taxpayer is given a period of up to three months to correct the violation. Fines escalate only on repetition:

That ladder covers failure to issue a tax invoice, failure to include all required elements in an invoice or credit and debit note, failure to keep invoices and records for the retention period, failure to issue or provide credit and debit notes, incorrect calculation of tax due, and violations of any other provision of the VAT law or its regulations. It explicitly does not cover tax evasion, failure to file, late filing, failure to pay, or manipulation of returns — those sit outside the field-violation regime entirely and are treated far more severely.

Alongside that ladder, ZATCA announced e-invoicing-specific fines ahead of the December 2021 Phase 1 go-live: non-issuance or non-archiving of electronic invoices from SAR 5,000, and deletion or amendment of an electronic invoice after issuance from SAR 10,000, both with a ceiling of SAR 50,000; a missing QR code on a simplified invoice, a missing buyer VAT registration number, and failure to notify ZATCA of a malfunction each begin with a warning. Sourcing note: ZATCA's original announcement page is no longer resolving at its published URL, so the figures in this paragraph are taken from Deloitte Middle East's contemporaneous summary rather than from a currently live primary page. Treat them as well-attested rather than as something we have verified against a live authority source today.

The practical read on Saudi Arabia is that a first mistake is survivable and a systemic one is not. A validation defect that fires on every invoice is not one violation discovered once — it is the same violation found repeatedly across inspections, climbing the ladder each time. Which is why rejection handling matters more than rejection avoidance: what determines your exposure is whether a failure is caught and corrected, not whether it happened.

Oman: a mandate arriving ahead of its own rules

Oman is the interesting case, and the one where invented numbers do the most damage. The Oman Tax Authority has published the Fawtara phase structure — Phase 1 in August 2026 covering one hundred large VAT-registered companies, Phase 2 in February 2027, Phase 3 in August 2027, and a Phase 4 for government entities in February of a year it has not named. It has published no penalty amounts. Its position is that penalties will apply in accordance with regulations, and the enabling e-invoicing regulation has not been issued.

So Phase 1 begins before the detailed rules are public. Every rial figure circulating in vendor material is advisory commentary, not the Authority's. If a business case you have been given contains an Omani penalty number, ask which OTA document it came from; there is not one.

The mistake this invites is treating unpublished as unenforced. The obligation is real and dated regardless of whether the fine schedule is public, and the enabling regulation can arrive with retroactive effect on conduct from the phase start. Planning to a published fine is a way of deciding how much compliance to buy. In Oman that option is not available, so the only defensible posture is to be compliant on the date rather than priced against a penalty you cannot see. We covered what else is and is not confirmed in Oman Fawtara Phase 1: what the OTA has not published.

Bahrain, Qatar and Kuwait

Bahrain. The National Bureau for Revenue has been designing a national B2B e-invoicing system and consulting with large businesses, but no mandate, no dates and no penalty framework have been published. There is nothing yet for penalties to attach to.

Qatar. The Cabinet approved a draft e-invoicing law and its executive regulations on 6 May 2026, prepared by the Ministry of Finance with the General Tax Authority, and the GTA has been running a pilot with a group of large entities since late 2025. The draft still has to complete the legislative process and be published in the official gazette. No implementation timeline and no penalty schedule have been issued.

Kuwait. No e-invoicing mandate, and no VAT in force to hang one on. Kuwait is a watching brief, not a planning horizon.

What to actually do with this

Three things follow from the table, and none of them is "budget for fines".

Stop pricing compliance against penalties. In four of six GCC states you cannot, because no number exists. In the two where you can, the amounts are small relative to the cost of the programme — AED 5,000 a month is not what makes a UAE mandate expensive. The real cost of non-compliance is operational: invoices that will not clear, customers who will not pay against a document their own system rejects, and a remediation project run at speed under a deadline you have already missed.

Treat the provider decision as dated, not open-ended. The UAE has written that into law explicitly. Everywhere else the same logic applies informally, because onboarding, testing and ERP integration take months and cannot be compressed by paying a fine. Work back from the phase date, not forward from your procurement cycle.

Assume the unpublished regimes will look like the published ones. Not because that is guaranteed, but because it is the only assumption that is cheap to be wrong about. If you build to the UAE's structure — a nominated provider, documents in the right format on time, and a working channel for reporting failures — you are substantially ready for a regime whose amounts have not been announced yet.

If you want a view of your own position first, the E-Invoicing Readiness Assessment scores mandate coverage, data custody and master-data readiness in about five minutes.

Sources

Last verified 29 July 2026. Mandate regimes move; if you are reading this materially later, check the primary sources rather than this page.

We publish corrections rather than quietly editing. If you believe a figure here is wrong, or you hold an authority document we have not seen, tell us and we will check it and say so.