ZATCA Phase 2 in Saudi Arabia: The Business Guide to E-Invoicing Integration
ZATCA Phase 2 in Saudi Arabia: The Business Guide to E-Invoicing Integration
How the Kingdom’s “Integration Phase” works, who is in scope, what your systems must do, and how to comply without disruption.
Saudi Arabia’s e-invoicing (Fatoora) programme is one of the most ambitious digital tax transformations in the world. What began as a generation mandate in 2021 has evolved into a full, wave-by-wave integration of business invoicing systems with the Zakat, Tax and Customs Authority (ZATCA) — a cornerstone of Vision 2030’s digital economy agenda. For businesses operating in the Kingdom, Phase 2 is not an IT project; it is a core compliance obligation with real financial exposure. This guide breaks it down in plain business language.
1. From Generation to Integration: A Quick History
ZATCA launched the e-invoicing mandate in two phases. Phase 1, the “Generation Phase,” took effect on 4 December 2021 and required all resident taxpayers to generate and store tax invoices and notes through compliant electronic solutions, effectively ending manual and handwritten invoicing.
Phase 2, the “Integration Phase,” became enforceable on 1 January 2023 and is being rolled out in waves by taxpayer group. Unlike Phase 1 — where invoices were simply generated and stored locally — Phase 2 requires businesses to connect their e-invoicing solutions directly to ZATCA’s Fatoora platform and transmit invoice data in real time or near-real time.
2. What Phase 2 Actually Changes for Your Business
The shift from Phase 1 to Phase 2 is the shift from digitising paper to continuous transaction controls (CTC). Under Phase 2, every invoice is either cleared or reported to ZATCA electronically:
– B2B and B2G invoices (standard tax invoices): Must be submitted to ZATCA in XML format for prior clearance. ZATCA validates the invoice, applies its cryptographic stamp, and returns the cleared invoice to the seller for sharing with the buyer.
– B2C invoices (simplified tax invoices): Are issued directly to the customer with a Phase 2-compliant QR code and then reported to ZATCA within 24 hours of issuance.
Every Phase 2 invoice must carry a set of security features that Phase 1 did not demand:
| Requirement | What it means |
| UUID | A 128-bit universally unique identifier for every invoice. |
| Cryptographic stamp / CSID | The invoice XML is digitally signed using a Cryptographic Stamp Identifier (CSID) issued by ZATCA during onboarding. |
| XML format (UBL 2.1) | Invoices must be generated in XML (or PDF/A-3 with embedded XML) — plain PDFs and Excel files no longer qualify. |
| Phase 2 QR code | A Base64-encoded QR code containing the invoice’s digital signature on simplified invoices. |
| Sequential numbering & hash chaining | Invoice numbers must be sequential and each invoice cryptographically linked to the previous one, making tampering detectable. |
3. The Wave-Based Rollout: Is Your Business In Scope?
ZATCA rolls out Phase 2 in waves based on annual VAT-taxable revenue, notifying targeted taxpayers at least six months in advance. The programme started with the largest enterprises and has steadily descended the revenue ladder — by 2026 it is capturing small and medium businesses:
| Wave | Revenue threshold (approx.) | Integration deadline |
| Wave 1 | Above SAR 3 billion | 1 January 2023 |
| Wave 11 | Mid-tier groups | 1 Nov 2024 – 31 Jan 2025 |
| Wave 22 | SAR 1M – 1.25M | 1 January 2026 |
| Wave 23 | SAR 750K – 1M | 31 March 2026 |
| Wave 24 | ~SAR 350K – 750K | 30 June 2026 |
| Wave 25 | ~SAR 187.5K – 350K | 1 February 2027 |
Thresholds are generally assessed on taxable revenue in either of the preceding reference years stated in each wave announcement. Businesses below the current waves should not wait: the trajectory makes clear that eventually all VAT-registered taxpayers will be integrated.
4. Clearance vs. Reporting: Two Workflows to Understand
Clearance model (B2B/B2G): The seller’s e-invoicing solution (EGS) generates the XML invoice and sends it to the Fatoora platform before it becomes a valid tax invoice. ZATCA runs business-rule validation, stamps it cryptographically, and returns it cleared. The buyer then receives the cleared invoice with the QR code.
Reporting model (B2C): The simplified invoice is issued instantly at the point of sale with the seller’s own cryptographic stamp and QR code, and the EGS reports it to ZATCA within 24 hours. ZATCA does not stamp simplified documents.
The practical consequence is significant: invoicing becomes a system-to-system process, meaning spreadsheets, handwritten books, and non-integrated billing tools are no longer viable for in-scope businesses.
5. Your Phase 2 Compliance Checklist
1. Confirm your wave — check ZATCA notifications and your revenue thresholds; note that you receive at least six months’ notice.
2. Assess your current stack — ERP, POS, and billing systems must be capable of XML (UBL 2.1) generation and API integration.
3. Select a ZATCA-compliant EGS — your solution must support UUIDs, cryptographic stamps, QR codes, and sequential numbering.
4. Complete onboarding — generate a Certificate Signing Request (CSR), obtain your Compliance CSID (CCID) from ZATCA’s compliance portal, then your production CSID for live stamping.
5. Test in the sandbox — validate XML against ZATCA’s business rules before go-live.
6. Go live before your deadline — and update archiving processes, as e-invoices and notes must be retained per VAT law requirements.
6. The Cost of Non-Compliance
E-invoicing violations are penalised under the VAT law framework. Failing to issue electronic invoices starts at a fine of SAR 5,000, and violations such as missing QR codes on simplified invoices also attract fines. Penalties can escalate to SAR 50,000 per violation for record-keeping and documentation failures. Beyond fines, non-compliant businesses face reputational risk, blocked invoices with corporate customers, and exposure during ZATCA audits. In short: the cost of compliance is a fraction of the cost of violation.
7. The Strategic Upside: Beyond Compliance
Handled well, Phase 2 is an opportunity, not just an obligation. Automated, structured invoicing reduces manual errors, accelerates billing cycles, and improves cash-flow visibility. Real-time data exchange strengthens audit readiness and VAT accuracy, while digitisation cuts printing, storage, and processing costs. Most importantly, it aligns your operations with the Kingdom’s Vision 2030 digital-economy direction — positioning your business as a transparent, modern partner to government and enterprise customers alike.
Conclusion: Act Before Your Wave Arrives
ZATCA Phase 2 has moved from a large-enterprise programme to an SME reality, with waves continuing through 2026 and into 2027. The requirements — API integration, XML invoicing, cryptographic stamps, UUIDs, and QR codes — are non-negotiable technical standards, and the six-month notice window is shorter than most ERP upgrade cycles. The prudent move for every VAT-registered business in the Kingdom is to treat Phase 2 as a live workstream today: assess, select, integrate, and test well before your deadline. Compliance is the floor; digital maturity is the prize.
Disclaimer: This article is for general guidance only and reflects publicly available ZATCA information as of mid-2026. Always verify your wave, thresholds, and technical obligations on the official ZATCA portal or with a qualified tax advisor.
