ZATCA Phase 2 E-Invoicing: What Saudi Businesses Must Know in 2026
ZATCA Phase 2 (Integration Phase) requires Saudi businesses to transmit every invoice electronically to ZATCA's Fatoora platform in real time for validation before it becomes legally valid. Unlike Phase 1, which allowed local e-invoice storage, Phase 2 mandates API integration with UBL 2.1 XML formatting, cryptographic stamping, and unique invoice identifiers. Businesses with annual taxable revenue exceeding SAR 750,000 in 2022, 2023, or 2024 must comply by March 31, 2026; those between SAR 375,000 and SAR 750,000 have until June 30, 2026.
The transition from paper-based invoicing to real-time government integration represents a fundamental shift in Saudi Arabia's tax administration. Phase 2 builds on the foundation of Phase 1, adding technical complexity and enforcement teeth. If you're running a retail store, restaurant, pharmacy, or any VAT-registered business in Saudi Arabia, understanding these requirements now will save you from penalties ranging from SAR 5,000 to SAR 50,000. (Similar regulatory shifts are happening globally — Pakistan's FBR digital invoicing system mirrors this approach.)
Phase 1 vs Phase 2 at a Glance
| Aspect | Phase 1 (Generation) | Phase 2 (Integration) |
|---|---|---|
| Implementation Date | December 4, 2021 | January 1, 2023 (wave-based) |
| Core Requirement | Generate e-invoices electronically | Integrate with ZATCA's Fatoora platform |
| ZATCA Connection | None required (local storage only) | Real-time API connection mandatory |
| Format | Structured e-invoice (PDF acceptable) | UBL 2.1 XML only |
| QR Code | 5 TLV tags (basic data) | 9 TLV tags (cryptographic data) |
| Digital Signature | Not required | X.509 certificate mandatory |
| Invoice ID | Invoice number sufficient | UUID + SHA-256 hash chain required |
| Approval Flow | Issue directly to customer | B2B cleared first; B2C reported within 24h |
| Penalty Enforcement | Limited enforcement | SAR 5,000–50,000 per violation |
The key difference: Phase 1 let you generate invoices offline and keep them on your system. Phase 2 treats ZATCA as a live participant in every transaction — your invoice isn't legal until ZATCA validates it.
Who Must Comply with Phase 2?
ZATCA rolled out Phase 2 integration in waves based on annual taxable revenue thresholds. The rollout started January 1, 2023, with the largest taxpayers and expanded progressively.
Wave-based timeline:
| Wave | Deadline | Annual Taxable Revenue Threshold |
|---|---|---|
| 1 | January 1, 2023 | Exceeding SAR 3 billion |
| 2 | July 1, 2023 | Exceeding SAR 500 million |
| 3 | October 1, 2023 | Exceeding SAR 250 million |
| 4–10 | 2024 | Progressive thresholds from SAR 150 million to SAR 25 million |
| 11+ | 2025–2026 | Below SAR 25 million (small and micro enterprises) |
Current status in 2026:
- Taxpayers with revenue exceeding SAR 750,000 during calendar years 2022, 2023, or 2024 must comply by March 31, 2026.
- Taxpayers with revenue between SAR 375,000 and SAR 750,000 in those years have until June 30, 2026.
ZATCA provides a minimum of six months' notice before your compliance deadline via portal notifications, email, and SMS. If you're VAT-registered and generating more than SAR 375,000 annually, Phase 2 integration is not optional.
Technical Requirements
Phase 2 introduces strict technical specifications that your POS or ERP software must meet. Here's what the system must handle:
UBL 2.1 XML Format Every invoice must be structured as a Universal Business Language (UBL) 2.1 XML document. PDF invoices or proprietary formats no longer qualify. The XML structure includes buyer and seller details, line items with VAT breakdown, totals, and compliance metadata.
Cryptographic Stamping Each invoice must be digitally signed using an X.509 certificate issued by ZATCA. During onboarding, you receive a Compliance CSID (Cryptographic Stamp Identifier) for sandbox testing, then a Production CSID once your software passes validation. The digital signature proves the invoice originated from an authorized device and hasn't been tampered with.
UUID and Hash Chain Every invoice requires a globally unique identifier (UUID) — a 128-bit number that ensures no two invoices share the same ID. Additionally, each invoice includes a SHA-256 hash of the previous invoice, creating an immutable chain. This makes it impossible to insert or delete invoices from your transaction history without breaking the chain.
Enhanced QR Code Phase 2 QR codes encode nine TLV (Tag-Length-Value) fields, up from five in Phase 1:
- Seller name
- VAT registration number
- Invoice timestamp (ISO 8601 format)
- Invoice total (including VAT)
- VAT amount
- Invoice hash (base64-encoded)
- ECDSA signature
- Public key
- Certificate signature
Customers and ZATCA auditors can scan the QR to verify invoice authenticity instantly.
API Integration with Fatoora Your software must connect to ZATCA's Fatoora platform endpoints for real-time clearance (B2B invoices) or reporting (B2C invoices). The API accepts UBL 2.1 XML, validates it, and returns a clearance status or error code. Rejected invoices cannot be delivered to the buyer until corrected and resubmitted.
The Fatoora Portal: How Integration Works
Fatoora is ZATCA's centralized e-invoicing validation platform. Here's how businesses integrate:
1. Software Selection Choose a ZATCA-compliant POS or ERP system. ZATCA maintains an approved solutions directory on zatca.gov.sa. Verify your software vendor appears on the list or provides a compliance certificate. For a detailed evaluation framework, see our ZATCA-approved POS software guide.
2. Developer Portal Registration Register your business on ZATCA's developer portal. Submit your VAT registration number, commercial registration details, and software vendor information. ZATCA issues a Compliance CSID for sandbox testing.
3. Sandbox Testing Configure your software to connect to ZATCA's sandbox environment. Submit test invoices covering all scenarios: standard B2B sales, simplified B2C receipts, credit notes, debit notes, export invoices. ZATCA provides a compliance checklist — your software must pass all validation rules.
4. Compliance Validation Once sandbox tests pass, request formal compliance validation. ZATCA reviews your test results and software configuration. Upon approval, they exchange your Compliance CSID for a Production CSID.
5. Production Cutover Switch your software to production endpoints. From this moment, every invoice you issue is transmitted to ZATCA. B2B invoices wait for clearance; B2C invoices are reported within 24 hours. For detailed onboarding workflows and API endpoint configuration, see our Fatoora portal integration guide.
Clearance vs Reporting Model
ZATCA uses two workflows depending on the invoice type:
Clearance (Standard Tax Invoices): For B2B and B2G transactions, your system submits the invoice to ZATCA in real time. ZATCA validates it and returns a "Cleared" status within seconds. Only then can you deliver the invoice to the buyer. If ZATCA rejects it (due to missing fields, incorrect VAT calculation, or hash chain errors), you must fix and resubmit before delivery.
Reporting (Simplified Tax Invoices): For B2C transactions (retail sales, restaurant bills, pharmacy receipts), you issue the invoice to the customer immediately, then report it to ZATCA within 24 hours. ZATCA validates asynchronously. If rejected, you must issue a corrected invoice and notify the customer.
The clearance model ensures B2B invoice accuracy before delivery; the reporting model balances compliance with customer experience — shoppers don't wait for ZATCA approval at the checkout counter.
Penalties for Non-Compliance
ZATCA enforces Phase 2 requirements with financial penalties escalating on repeat violations:
| Violation | First Offense | Repeat Offense |
|---|---|---|
| Not issuing e-invoices | SAR 5,000 | Up to SAR 50,000 |
| Missing mandatory fields | Warning + correction period | SAR 10,000 |
| Not integrating with ZATCA | Warning | Up to SAR 50,000 |
| Tampering with invoices | SAR 10,000 | Up to SAR 50,000 |
Persistent non-compliance can result in business suspension. ZATCA's enforcement arm conducts random audits and cross-references your reported invoices against VAT returns. Discrepancies trigger investigations.
Real-world enforcement: ZATCA issues warnings for first-time technical errors (incorrect QR format, missing hash), but intentional violations — issuing paper invoices post-deadline, backdating transactions, or manipulating invoice chains — draw immediate fines. The hash chain architecture makes tampering evident, so corrections must happen through proper credit/debit notes, not by editing historical records.
How to Choose a ZATCA-Compliant ERP/POS
Not all accounting software or POS systems support Phase 2 integration. When evaluating solutions, verify these capabilities:
API Integration The system must connect to ZATCA's clearance and reporting endpoints in real time. Ask vendors: "Does your software transmit invoices to Fatoora automatically, or do I export files manually?" Manual exports fail Phase 2 requirements.
Arabic Language Support Invoices must render as fully Arabic (right-to-left) tax invoices with all mandatory fields in Arabic. English translations can appear alongside, but Arabic is primary.
QR Code Generation The system should generate the nine-field TLV QR code automatically on every invoice. Customers and auditors must be able to scan and verify instantly.
XML Export and Validation Verify the software generates valid UBL 2.1 XML. Some vendors offer "ZATCA-ready" systems that produce XML but fail ZATCA's sandbox tests due to schema errors or missing cryptographic fields.
Real-Time Clearance for B2B For businesses selling to other companies, the software must wait for ZATCA clearance before printing or emailing the invoice to the buyer. Systems that "queue" invoices for batch submission fail clearance requirements. Vertical-specific industries like pharmacies have additional ZATCA compliance requirements — see our pharmacy POS software ZATCA guide for details.
Compliance Certificate Ask the vendor for their ZATCA compliance certificate or check ZATCA's approved solutions directory. Compliance claims without proof are red flags.
EloERP's ZATCA Phase-2 module automates Fatoora-cleared, QR-stamped Arabic tax invoices directly from the POS with cryptographic stamp, UUID, and hash handled automatically. Invoice clearance or reporting occurs in real time as transactions are issued, supporting both B2B clearance and B2C reporting modes. The platform generates fully Arabic (right-to-left) tax invoices with scannable QR codes and includes sandbox testing capability before production deployment. See EloERP pricing for ZATCA-compliant plans, or book a demo to see the integration in action.
Get ZATCA-ready — try EloERP free for 14 days. No credit card required. Start your free trial →
Sources
- ZATCA Official E-Invoicing Introduction: https://zatca.gov.sa/en/E-Invoicing/Pages/default.aspx
- ZATCA Phase 2 Roll-out Phases: https://zatca.gov.sa/en/E-Invoicing/Introduction/Pages/Roll-out-phases.aspx
- EY Global Tax Alert — Saudi Arabia 23rd Wave Phase 2 E-Invoicing Integration: https://www.ey.com/en_gl/technical/tax-alerts/saudi-arabia-announces-23rd-wave-of-phase-2-e-invoicing-integration
- LookPOS ZATCA Phase 2 Complete Guide 2026: https://lookpos.com/blog/zatca-phase-2-guide.html
- Qeemah Cloud — ZATCA Phase 2 E-Invoicing Requirements Complete 2026 Guide: https://qeemahcloud.com/en/blog/complete-zatca-phase-2-einvoicing-requirements-guide/
- Out2Sol Global — ZATCA E-Invoicing Phase 2 Integration Explained: https://out2sol.global/blog/zatca-e-invoicing-phase-2-integration-explained/
- Tally Solutions — ZATCA E-Invoicing Phase 2 Compliance Checklist for Saudi Businesses: https://tallysolutions.com/mena/saudi-vat/zatca-e-invoicing-phase-2-compliance-checklist-for-saudi-businesses/
- Maas Consult — What is ZATCA Phase 2? Complete Guide for Saudi Businesses (2026): https://maasconsult.co/what-is-zatca-phase-2-complete-guide-businesses/
- ClearTax Saudi Arabia — ZATCA Wave 24 E-Invoicing Announcement: https://www.cleartax.com/sa/zatca-wave24-einvoicing-in-saudi-arabia
- EloERP ZATCA E-Invoicing Compliance Page: https://eloerp.net/compliance/zatca-e-invoicing