ZATCA Phase 2 e-invoicing: what Saudi businesses need to know

If you run a VAT-registered business in Saudi Arabia, e-invoicing (Fatoorah) is no longer optional — and Phase 2 is the part that actually changes how your systems work. This is a plain-language walkthrough of what Phase 2 means, what it requires, and how to get ready without the last-minute scramble.

First, a quick recap: Phase 1 vs Phase 2

ZATCA rolled out e-invoicing in two phases:

• Phase 1 — Generation. Live since late 2021. You must issue tax invoices electronically from a compliant system — no more handwritten or free-text PDF invoices — each carrying the required fields and a QR code on simplified invoices.
• Phase 2 — Integration. The bigger step. Your invoicing system must connect directly to ZATCA's Fatoora platform, and invoices follow a strict technical format with cryptographic stamps and anti-tampering controls.

What Phase 2 actually requires

At a technical level, a Phase 2-compliant invoice and system must support:

• Integration with ZATCA — your billing/ERP system exchanges invoices with the Fatoora platform via API.
• The right format — invoices generated as XML, or PDF/A-3 with embedded XML.
• A cryptographic stamp & UUID — each invoice is uniquely identified and tamper-evident.
• A cryptographic stamp identifier (CSID) — obtained when you onboard your solution with ZATCA.
• A hash and QR code — chaining invoices and enabling verification.

Clearance vs reporting — the key distinction

Phase 2 treats two invoice types differently, and this trips a lot of businesses up:

• Standard tax invoices (B2B / B2G) must be cleared — sent to ZATCA in near-real-time and validated before you share them with the buyer.
• Simplified tax invoices (B2C) are reported to ZATCA, typically within 24 hours of issue.

In practice this means your point-of-sale or billing flow has to talk to ZATCA as part of issuing the invoice — not as an afterthought at month-end.

Who's affected, and when?

Phase 2 is being enforced in waves, based on a business's annual VAT-eligible revenue. The earliest waves covered the largest taxpayers; each subsequent wave brings in smaller revenue bands, so the net keeps widening over time.

The important part for planning: ZATCA notifies each business of its wave and go-live date in advance (historically with around six months' notice). If you've been notified, the clock is running. If you haven't yet, you almost certainly will be — so getting ready early is simply cheaper than reacting.

Your Phase 2 readiness checklist

1. Confirm your wave. Check whether ZATCA has notified you of an integration date.
2. Use a compliant solution. Make sure your accounting/ERP or POS supports Phase 2 — Zoho, QuickBooks, Odoo and SAP all have compliant paths when configured correctly. (See our guide on choosing and implementing accounting software.)
3. Onboard with ZATCA. Generate your cryptographic stamp identifier and register your devices/solution units.
4. Test in the sandbox. Validate clearance and reporting flows before go-live, not after.
5. Train your team. Whoever issues invoices needs to understand the new flow so nothing gets stuck.

Common mistakes we see

• Treating Phase 2 as a one-time IT task instead of an ongoing invoicing change.
• Assuming "we have e-invoicing" (Phase 1) means Phase 2 is handled — it isn't.
• Leaving onboarding and sandbox testing until the week before the deadline.
• Configuring the software but never reconciling cleared invoices back to the books.

Done right, Phase 2 is a setup project followed by a smooth, automatic flow. Done late, it stalls your invoicing — and in Saudi Arabia, that means it stalls your cash. The businesses that handle it best treat it as part of a well-run monthly finance function, not a fire drill.

This article is general information, not tax or legal advice, and ZATCA's rules and timelines are updated periodically. Always confirm your specific obligations against the latest ZATCA guidance or with your advisor. Digits provides e-invoicing setup and compliance support but does not act as the regulator.

← Back to Insights