What is ZATCA Phase 2?
ZATCA (the Zakat, Tax and Customs Authority) rolled out Saudi Arabia's e-invoicing programme, FATOORA, in two phases. Phase 1 (Generation) went live in December 2021 and required every VAT-registered taxpayer to issue structured electronic invoices instead of PDF or paper. Phase 2 (Integration) started 1 January 2023 and adds a mandatory integration with ZATCA's central platform: invoices are cryptographically stamped, cleared or reported in near real time, and archived by the authority.
Every B2B (standard) invoice must be sent to FATOORA for clearance before it is delivered to the buyer, and every B2C (simplified) invoice must be reported within 24 hours of issuance.
Integration waves & deadlines
ZATCA notifies taxpayers in waves based on their annual VAT-taxable revenue. Wave 1 (revenue > SAR 3B) integrated on 1 January 2023; each subsequent wave lowers the threshold. Businesses receive at least six months' written notice before their onboarding date. The waves published so far cover taxpayers down to SAR 1.5M, and ZATCA has stated all remaining VAT-registered entities will be brought in by successive waves.
Technical requirements
- UBL 2.1 XML invoice format (or PDF/A-3 with embedded XML for simplified invoices).
- Cryptographic stamp signed with an onboarding CSID from ZATCA.
- UUID (RFC 4122) unique per invoice.
- Previous-invoice hash chained across the sequence.
- TLV-encoded, Base64 QR code with 5 (B2B) or 7 (simplified) required tags.
- Direct API integration with the FATOORA clearance and reporting endpoints.
QR code & UUID
Simplified (B2C) invoices must carry a TLV-encoded QR containing: seller name, VAT registration number, timestamp, invoice total (with VAT), VAT total, XML hash, cryptographic stamp and the stamp's public key. The QR must be scannable and printed clearly on the invoice.
Clearance vs reporting flow
Standard invoice is signed, sent to FATOORA, cleared, then delivered to the buyer with ZATCA's stamp.
Simplified invoice is issued to the buyer immediately with a QR code, then reported to FATOORA within 24 hours.
Penalties for non-compliance
ZATCA can impose SAR 1,000–40,000+ per violation for missing QR codes, non-compliant XML, failure to integrate, or tampering with issued invoices. Repeated violations escalate to suspension of tax certificates and criminal referrals.
Compliance checklist
- Confirm your integration wave and deadline in the ZATCA portal.
- Onboard your invoicing solution and obtain a CSID from ZATCA sandbox, then production.
- Emit UBL 2.1 XML with UUID, previous-invoice hash and cryptographic stamp.
- Render the TLV QR code on every simplified invoice.
- Clear B2B invoices in real time; report B2C invoices within 24 hours.
- Archive all XML invoices for at least 6 years.
Frequently asked questions
Do free-zone companies need to comply?
Yes — every VAT-registered taxpayer resident in Saudi Arabia is in scope regardless of free-zone status.
What if my ERP can't emit UBL XML?
GulfAccount can act as your ZATCA-compliant invoicing layer alongside any ERP through our API and CSV import.
Is GulfAccount ZATCA-approved?
Yes — GulfAccount implements ZATCA's technical specifications end-to-end, including CSID onboarding, XML signing and FATOORA integration.