ZATCA Phase 2 E-Invoicing: Requirements and How to Comply
ZATCA Phase 2, the Integration Phase, requires VAT-registered businesses in Saudi Arabia to connect their invoicing systems directly to ZATCA’s Fatoora platform and exchange invoices as UBL 2.1 XML with cryptographic stamps, UUIDs and a compliant QR code. ZATCA notifies each taxpayer of their wave at least six months in advance.
Published: July 2026 | Last updated: July 2026 | Author: Bitrixme Compliance Team
Phase 1 vs Phase 2: Key Differences
ZATCA’s e-invoicing regulation was implemented in two phases. The first phase required businesses to generate and store e-invoices in any electronic format. The second phase requires full technical integration with ZATCA’s Fatoora platform. Understanding the difference is essential for planning your compliance timeline.
| Aspect | Phase 1 (Generate) – effective 4 Dec 2021 | Phase 2 (Integration) – rolling from 1 Jan 2023 |
|---|---|---|
| Core requirement | Generate and store e-invoices in any electronic format | Connect invoicing system to Fatoora platform via API |
| Technical interface required | No integration required | API integration with Fatoora for clearance and reporting |
| Data format | Any electronic format (PDF, image, text) | UBL 2.1 XML with cryptographic stamp and digital signature |
| QR code | Required (basic) | Required (9-tag TLV base64 format) |
| Real-time validation | No – invoices stored locally | Yes – invoices cleared or reported within 24 hours |
| Penalty exposure | Lower (primarily for non-generation) | Higher – SAR 5,000 to SAR 50,000 per violation |
Businesses that are Phase 1 compliant are not automatically Phase 2 compliant. The two phases are additive: Phase 2 builds on Phase 1 by adding real-time integration, cryptographic validation and structured data requirements that Phase 1 did not impose.
Who Is in Scope for Phase 2
Every VAT-registered business in Saudi Arabia is in scope for Phase 2. There are no exemptions by revenue, sector or legal form. The following categories are all required to comply:
- All taxpayers registered for VAT under the ZATCA VAT Law, regardless of annual revenue
- KSA branches of foreign entities that hold a VAT registration
- Taxpayers in all sectors including retail, manufacturing, financial services, healthcare, construction and professional services
- Taxpayers using a qualified Electronic Invoicing Service Provider (EGS provider) integrated on behalf of their clients
The scope includes both tax invoices (business-to-business, or B2B) and simplified tax invoices (business-to-consumer, or B2C). Both invoice types are subject to Phase 2 requirements, though they follow different validation processes as explained below.
The Wave System
ZATCA rolls out Phase 2 in waves based on annual VAT-taxable revenue. Each wave has its own compliance deadline, and ZATCA notifies affected taxpayers at least six months before their wave deadline. The wave system was designed to spread the integration workload across the taxpayer population and allow sufficient time for each group to prepare.
Wave thresholds have stepped progressively downward since Phase 2 began on 1 January 2023. The first wave captured the largest taxpayers, and subsequent waves have progressively lowered the revenue threshold to include smaller and smaller businesses. To confirm your wave, log into the ZATCA e-invoicing portal (Fatoora) using your VAT certificate credentials. Your wave number and deadline are displayed on the dashboard.
If you have not been notified of your wave, log into the Fatoora portal and check your dashboard. If no wave is displayed, contact ZATCA through the portal or call their taxpayer support line. Do not assume you are not in scope – all VAT-registered taxpayers are eventually included.
Clearance vs Reporting
Two distinct processes apply to e-invoices under Phase 2. The process depends on the type of invoice being issued.
Clearance applies to business-to-business (B2B) tax invoices where the buyer holds a valid VAT registration number. Reporting applies to simplified tax invoices, typically business-to-consumer (B2C) transactions, as well as B2B transactions below the threshold where the buyer does not require a full tax invoice. Your invoicing system must support both processes and correctly determine which applies to each transaction.
Technical Requirements
Phase 2 compliance requires your invoicing system to meet the following technical specifications. These are defined in ZATCA’s published e-invoicing guidelines and are mandatory for all integrated systems.
- UBL 2.1 XML format – All invoices must be structured according to the Universal Business Language 2.1 standard with ZATCA-specific extensions as defined in the ZATCA e-invoicing technical specification. XML schema definitions are published on the ZATCA developer portal.
- Cryptographic stamp (digital signature) – Each invoice must carry a cryptographic stamp that proves its integrity and origin. The stamp is generated using the private key associated with the CSID.
- CSID (Compliance Cryptographic Stamp Identifier) – Your system must obtain a CSID from ZATCA during the onboarding process. The CSID is a unique identifier that links your invoicing solution to your VAT registration and authorises it to submit invoices to Fatoora.
- UUID – A universally unique identifier for each invoice, generated according to the UUID v4 standard. The UUID must be unique across all invoices issued by the taxpayer.
- 9-tag TLV base64 QR code – The QR code on printed and displayed invoices must encode nine specific data fields in the TLV (Tag-Length-Value) base64 format. These fields include seller name, VAT number, timestamp, invoice total, VAT total, and cryptographic stamp.
- Invoice hash and chain – Each invoice must include its own SHA-256 hash and the previous invoice’s hash to create a tamper-evident chain. This prevents any invoice from being modified or deleted without breaking the chain.
The 24-Hour Reporting Window
Simplified tax invoices must be reported to Fatoora within 24 hours of issuance. This is a real requirement with real consequences. The 24-hour window applies from the moment the invoice is issued to the buyer, not from the end of the business day. Invoicing systems must therefore maintain a stable internet connection or have a queuing mechanism that clears pending invoices as soon as connectivity is restored.
The Onboarding Process
- Confirm your wave deadline on the Fatoora portal at zatca.gov.sa
- Select a qualified EGS provider (if not integrating directly with the Fatoora API)
- Obtain a CSID by registering your invoicing solution with Fatoora and completing the compliance validation
- Perform technical integration and API testing in the Fatoora sandbox environment, including clearance and reporting flows
- Pass ZATCA compliance validation in the production environment
- Begin live clearance and reporting of invoices
Choosing an EGS Provider
- ZATCA pre-qualification status – Only ZATCA-approved providers can issue compliant e-invoices. Check the current list on the ZATCA portal before engaging any provider.
- Integration with your existing ERP or accounting system – The provider must support direct integration with your current invoicing software, whether it is SAP, Oracle, Microsoft Dynamics, or a local ERP system.
- Clearance and reporting capability – The provider must support both B2B clearance and B2C reporting flows, with the ability to automatically determine which applies.
- Archiving capability – The provider must retain all e-invoice records for the mandatory 6-year retention period as required by ZATCA regulations.
- Cost structure – Compare per-invoice pricing, monthly subscription fees and implementation costs. Volume-based pricing is standard for high-transaction businesses.
Penalties for Non-Compliance
Readiness Checklist
- Confirmed your wave number and integration deadline on the ZATCA Fatoora portal
- Selected a qualified EGS provider or initiated direct API integration development
- Upgraded invoicing system to generate UBL 2.1 XML with cryptographic stamp and digital signature
- Implemented 9-tag TLV base64 QR code generation on all printed and displayed invoices
- Obtained CSID from ZATCA
- Tested clearance flow in Fatoora sandbox environment with at least one successful test
- Tested reporting flow in Fatoora sandbox environment with at least one successful test
- Configured 24-hour reporting mechanism with offline queuing for simplified invoices
- Trained invoicing and finance staff on new e-invoicing procedures
- Confirmed record archiving solution meets 6-year retention requirement
FAQ
Which ZATCA wave are we in?
Log into the Fatoora portal using your VAT certificate credentials. Your wave number and integration deadline are displayed on the dashboard. ZATCA notifies taxpayers at least six months before their wave deadline.
What is the difference between clearance and reporting?
Clearance applies to B2B tax invoices – the invoice is sent to Fatoora, validated and cryptographically stamped before it reaches the buyer. Reporting applies to simplified tax invoices – the invoice is sent to the buyer immediately and reported to Fatoora within 24 hours.
How long does ZATCA Phase 2 integration take?
Integration typically takes 6 to 16 weeks depending on complexity. Direct API integration with an existing ERP takes longer. Using a qualified EGS provider can reduce this to 4 to 8 weeks.
Do I need an EGS provider or can I integrate directly?
Both options are permitted. Direct integration is feasible for organisations with in-house development capability and an ERP that supports UBL 2.1. Most mid-size businesses use a qualified EGS provider to avoid the development and compliance burden.
What happens if we miss the Phase 2 deadline?
Penalties for failure to integrate by the wave deadline range from SAR 5,000 to SAR 50,000 per violation, and non-compliant invoices issued after the deadline continue to incur penalties. You should integrate as soon as possible even if the deadline has passed.
Do foreign companies with a KSA branch need to comply?
Yes. Any VAT-registered entity in Saudi Arabia, including foreign companies with a KSA branch, is in scope for Phase 2. The obligations apply regardless of whether the entity is headquartered outside the Kingdom.
Related Reading
Get a free ZATCA wave assessment. Contact Bitrixme or message us on WhatsApp.
