ZATCA Phase 2 Explained: What Saudi Businesses Need to Know

Saudi Arabia's e-invoicing programme, known as FATOORA, is run by the Zakat, Tax and Customs Authority (ZATCA). It is being introduced in two phases. Phase 1 changed how invoices are produced. Phase 2 changes how they are shared with ZATCA, and it requires real integration between your systems and ZATCA's platform.

ZATCA publishes detailed rules, technical specifications and wave deadlines, and updates them from time to time. This article is general information, not tax advice. Confirm the requirements that apply to you with ZATCA or your tax advisor.

Phase 1 vs Phase 2

	Phase 1: Generation	Phase 2: Integration
Started	December 2021	January 2023, in waves
Applies to	All VAT-registered persons	Taxpayers selected in each wave
What changes	Invoices generated and stored electronically by a compliant solution	Systems connect to FATOORA; invoices are cleared or reported
Format	Electronic invoice; QR code on simplified invoices	UBL 2.1 XML with cryptographic stamp and QR code

Who must comply with Phase 2, and when?

ZATCA rolls out Phase 2 in waves. Each wave targets taxpayers whose taxable revenue exceeded a set threshold in a reference period, and ZATCA notifies selected taxpayers in advance of their integration deadline.

If you have received a notification, your deadline is fixed. If you have not, it is still wise to prepare: the thresholds have come down wave by wave, bringing more businesses into scope.

Clearance and reporting

Phase 2 treats the two main invoice types differently.

Standard tax invoices (B2B): clearance

A standard tax invoice must be sent to ZATCA and cleared before it is shared with the buyer. ZATCA validates it, stamps it and returns the cleared invoice. Only then is it issued to your customer.

Simplified tax invoices (B2C): reporting

A simplified tax invoice is issued to the customer immediately, then reported to ZATCA within 24 hours. This keeps retail checkouts fast while still giving ZATCA visibility.

Credit and debit notes follow the same model as the invoice they relate to.

Technical requirements in plain language

A Phase 2 compliant solution must, among other things:

Produce UBL 2.1 XML. Every invoice, credit note and debit note is generated in a structured XML format.
Hash and chain invoices. Each invoice includes a hash of the previous one, so documents cannot be altered or deleted unnoticed.
Apply a cryptographic stamp. Invoices are signed using keys linked to the device or unit that issued them.
Generate the required QR code. Buyers and ZATCA can use it to verify the invoice.
Onboard each device. Every invoicing unit is registered with ZATCA to obtain a Cryptographic Stamp Identifier (CSID), using a one-time password from the FATOORA portal.
Connect to ZATCA's APIs. Submit invoices for clearance or reporting and handle rejections and warnings.

How to prepare: a practical plan

1. Confirm your deadline and scope

Check your notification, then list every system that issues invoices: ERP, POS counters, e-commerce, branches and any manual processes.

2. Assess your current systems

Decide whether each system can be upgraded, needs an integration layer, or should be replaced. In most cases, an integration layer added to your existing ERP or POS is the fastest route.

3. Build and map

Generate compliant XML, hashes, stamps and QR codes from your existing invoice data. Pay attention to buyer VAT numbers, addresses and product data, which are the most common causes of rejection.

4. Onboard and run compliance checks

Onboard your devices in ZATCA's simulation environment and pass the compliance checks before requesting production credentials.

5. Go live and monitor

Switch to live clearance and reporting, and monitor rejections closely in the first weeks.

Start at least three to four months before your deadline. Data clean-up, testing with branches and staff training all take longer than the technical build.

Common pitfalls

Incomplete buyer data for B2B invoices, leading to clearance rejections.
Forgetting some invoicing points, such as a branch, a web shop or a manual credit-note process.
No plan for outages, especially for simplified invoices that must still be reported within 24 hours.
Treating it as an IT-only project. Finance, sales and branch staff all need to understand the new process.

How we can help

We make existing ERP and POS systems Phase 2 compliant: assessment, XML and QR generation, cryptographic stamping, device onboarding, compliance checks and go-live support, with Arabic and bilingual invoice formats.