ZATCA Phase 2 E-Invoicing Explained: What Every Saudi Business Must Know

What Is ZATCA Phase 2?

ZATCA Phase 2 is the second stage of Saudi Arabia's mandatory e-invoicing programme, enforced by the Zakat, Tax and Customs Authority (ZATCA). Under Phase 2, every VAT-registered business in Saudi Arabia must connect its invoicing system in real time to ZATCA's Fatoorah portal and submit each tax invoice electronically before delivering it to the customer.

The Phase 2 requirement is not optional. Businesses that continue issuing paper invoices, PDF invoices, or invoices from non-certified systems after their mandated start date face financial penalties and the risk of having their invoices rejected by VAT-registered buyers who require ZATCA-cleared documentation for input tax credit claims.

This article explains exactly what ZATCA Phase 2 requires, who is affected, what the technical requirements are, how enforcement works, and what Saudi businesses need to do to comply — written from four years of implementing ZATCA Phase 2 Software for Saudi clients across retail, wholesale, restaurants, and auto workshops.

Background: Saudi Arabia's E-Invoicing Mandate

Saudi Arabia launched its national e-invoicing programme in December 2020 when ZATCA published the E-Invoicing Regulations under the VAT Law. The programme was designed to digitise and automate tax invoice flows across the Saudi economy, reduce VAT evasion, and align Saudi Arabia with international e-invoicing standards.

The programme was structured in two phases:

• Phase 1 — Generation phase (December 4, 2021): All VAT-registered businesses were required to generate and store e-invoices using an electronic system. Paper invoices were no longer acceptable. Invoices had to include a QR code (for B2C simplified invoices) and be stored in a structured format. No real-time integration with ZATCA was required at this stage.
• Phase 2 — Integration phase (January 1, 2023, rolled out in waves): VAT-registered businesses must integrate their e-invoicing systems with ZATCA's Fatoorah platform and submit invoices in real time. B2B invoices above SAR 1,000 require clearance from ZATCA before delivery to the buyer. All invoices must use UBL 2.1 XML format and carry a CCSID cryptographic stamp.

Phase 2 is being enforced progressively, starting with the largest taxpayers (those with annual revenues above SAR 3 billion in Wave 1) and moving through progressively smaller businesses in subsequent waves. By 2026, businesses with annual revenues as low as SAR 5 million are being onboarded.

Who Is Affected by ZATCA Phase 2?

Every VAT-registered business in Saudi Arabia that issues tax invoices will be required to comply with ZATCA Phase 2. The requirement applies regardless of business size, sector, or whether the business has a physical or online presence.

Businesses that are already subject to Phase 2 are those whose Wave announcement dates have passed. Businesses whose waves have not yet been announced are still required to prepare, as ZATCA's onboarding notifications often give only 6 months of lead time.

The following business types are all subject to ZATCA Phase 2 requirements:

• Retail stores — fashion, electronics, food retail, pharmacies, hardware stores
• Wholesale distributors — food and beverage, building materials, industrial supplies, auto parts
• Restaurants, cafes, and food service operators
• Auto workshops, car dealerships, and tyre shops
• Construction companies and contracting businesses
• Import and export trading companies
• Hotels, furnished apartments, and hospitality businesses
• Medical clinics, dental practices, and healthcare providers
• IT companies, consultancies, and professional service firms
• Agricultural producers and wholesalers
• Logistics companies and freight forwarders

Non-resident businesses supplying goods or services in Saudi Arabia, and businesses below the VAT registration threshold (SAR 375,000 annual revenue), are exempt from the e-invoicing requirement. All other VAT-registered entities are subject to Phase 2.

For a sector-specific breakdown of how Phase 2 affects F&B operators, see our ZATCA Phase 2 guide for restaurants.

ZATCA Phase 2 Technical Requirements

The technical requirements of ZATCA Phase 2 are specific and non-negotiable. All requirements are defined in ZATCA's E-Invoicing Technical Specifications, which have been updated multiple times since 2021. Here is what your invoicing system must do to comply:

1. UBL 2.1 XML Invoice Format

All invoices under ZATCA Phase 2 must be encoded in Universal Business Language (UBL) 2.1 XML format. This is an international e-invoicing standard that ZATCA has adapted with Saudi-specific fields and requirements. The XML invoice must include all mandatory fields defined by ZATCA: seller's VAT number, buyer's VAT number (for B2B), invoice date, line items with individual VAT amounts, QR code data, and the digital signature.

Businesses cannot submit PDF invoices, Excel spreadsheets, or other formats. Only valid UBL 2.1 XML documents are accepted by the Fatoorah API.

2. Cryptographic Signing — CSID and CCSID

Every ZATCA Phase 2 invoice must carry a digital signature applied using a certificate issued by ZATCA. There are two types of certificates:

• CSID (Cryptographic Stamp Identifier): Used for Phase 1 compliance testing and initial Phase 2 onboarding. This is a temporary certificate that allows businesses to test their integration against ZATCA's sandbox before going live.
• CCSID (Cryptographic Stamp Identifier Seed): The production certificate used for all live Phase 2 invoices. CCSID certificates are issued per device (i.e., per POS terminal or invoicing unit) by ZATCA's Fatoorah portal through an automated registration process.

The registration process for CCSID certificates requires your invoicing software to send a Certificate Signing Request (CSR) to ZATCA's Compliance API, receive the CSID, run a compliance test, then call ZATCA's Onboarding API to exchange the CSID for the production CCSID. This process is entirely automated within StartPOS — Gulf Union Ozone's team handles it during onboarding. No manual interaction with ZATCA's developer portal is required from the business.

3. QR Code Requirements

Every Phase 2 invoice must include a QR code that encodes specific data in Base64 TLV (Tag-Length-Value) format. The required fields are: seller's name, seller's VAT registration number, invoice timestamp, invoice total (including VAT), VAT total, and a hash of the XML invoice. The QR code allows buyers and ZATCA auditors to verify invoice authenticity by scanning with any standard QR scanner or the ZATCA mobile app.

4. Real-Time Submission via Fatoorah API

Under Phase 2, invoices must be submitted to ZATCA's Fatoorah API at the time of issuance. There are two submission modes:

• Reporting mode: Used for B2C simplified invoices. The invoice is submitted to ZATCA and ZATCA stores it for audit purposes, but the invoice can be delivered to the customer without waiting for a ZATCA response. ZATCA accepts or rejects the invoice after the fact.
• Clearance mode: Used for B2B standard invoices above SAR 1,000. The invoice must be submitted to ZATCA and cleared before it is legally delivered to the buyer. ZATCA's response must be received and embedded in the invoice before delivery. This typically takes 1–3 seconds via the API.

Businesses that issue both B2C and B2B invoices must handle both modes. StartPOS applies the correct mode automatically based on whether the buyer provides a VAT number at checkout.

5. Anti-Tampering and Invoice Chaining

ZATCA Phase 2 invoices must use an anti-tampering mechanism. Each invoice carries a cryptographic hash of the previous invoice (creating a chain), and a hash of the current invoice's XML. This makes it impossible to modify, delete, or reorder invoices without detection. The CCSID certificate is bound to a specific device, so invoices issued on one device cannot be replicated on another.

Invoice Types Under ZATCA Phase 2

ZATCA Phase 2 recognises three primary invoice types, each with specific requirements:

Credit and debit notes must reference the original invoice number and be submitted using the same mode as the original invoice. A credit note reversing a cleared B2B invoice must also go through the clearance process.

ZATCA Phase 2 Rollout Timeline

ZATCA has enforced Phase 2 in waves, starting with the largest taxpayers and progressively including smaller businesses. Here is a summary of the main waves as of 2026:

ZATCA notifies businesses of their wave inclusion 6 months before their mandatory start date. Waiting for the notification before beginning preparation is not recommended — integration, testing, and CCSID registration require time, and businesses that miss their start date face immediate penalties.

Penalties for Non-Compliance

ZATCA has published a clear penalty schedule for e-invoicing violations. The penalties apply per violation and are not capped — a business issuing 100 non-compliant invoices per day is subject to 100 violations per day.

Beyond financial penalties, non-compliant invoices are rejected by VAT-registered buyers — since those buyers cannot claim input VAT credit on invoices that lack a ZATCA clearance stamp. This creates a commercial pressure beyond the regulatory requirement: if your B2B customers cannot recover VAT on your invoices, they will move their business to a compliant supplier.

For the full penalty schedule including appeal procedures and how to file an objection with ZATCA, see our ZATCA Phase 2 penalties guide.

How to Choose ZATCA Phase 2 Software

Not all software marketed as "ZATCA Phase 2 Software" meets ZATCA's technical requirements. Before selecting a solution, evaluate it against these criteria:

Certification and Rejection Rate

The most important question is whether the software has been used in live production with zero ZATCA invoice rejections. A 0% rejection rate means the software's XML generation, cryptographic signing, and API integration are all correct. Ask the vendor for documented evidence — not just a claim. Gulf Union Ozone's StartPOS has maintained a 0% rejection rate across all 47+ Saudi business deployments to date.

Handles All Three Invoice Modes

Your software must support simplified invoicing (B2C reporting), standard invoicing (B2B clearance), and credit/debit notes. Many simpler ZATCA solutions support only B2C simplified invoices — businesses with B2B customers will find they cannot issue cleared invoices for their largest accounts.

Real-Time Submission with Queuing

The Fatoorah API is occasionally unavailable due to ZATCA maintenance or infrastructure issues. Your software must queue unsubmitted invoices and retry automatically — not require staff to manually resubmit. This is particularly important for high-volume businesses where manual recovery of failed submissions is impractical.

Arabic Language Support

ZATCA requires specific Arabic fields on all invoices. Beyond the legal requirement, your staff who operate the POS system daily are likely Arabic speakers. A bilingual Arabic/English interface — with all POS functions operable in Arabic — is not optional for most Saudi businesses.

ZATCA Compliance Update Service

ZATCA has updated its technical specifications, API requirements, and certificate formats multiple times since Phase 2 launched. Your software vendor must maintain a compliance update service that patches the software as ZATCA changes its requirements — at no additional cost. A one-time purchase of software without an ongoing update commitment leaves you vulnerable to future non-compliance as ZATCA evolves its standards.

For a structured evaluation framework covering all 11 criteria you should apply when comparing vendors, read our ZATCA Phase 2 software buyer's guide. For a direct comparison of the top six certified systems on the market, see best ZATCA Phase 2 software Saudi Arabia — or compare specific vendors: StartPOS vs Rewaa · StartPOS vs Foodics.

Pricing Model

Subscription-based ZATCA POS software typically charges SAR 200–450 per user per month. A 5-user business pays SAR 12,000–27,000 per year, indefinitely. StartPOS uses a one-time license model: SAR 7,500–15,000 for the license and SAR 1,200–2,400 per year for hosting and compliance updates. The total 5-year cost of a subscription competitor is SAR 60,000–135,000 for the same business. The total 5-year cost of StartPOS Starter is SAR 13,500 (SAR 7,500 + SAR 1,200 × 5).

What Gulf Union Ozone's ZATCA Phase 2 Software Includes

StartPOS by Gulf Union Ozone covers the complete ZATCA Phase 2 compliance stack plus the operational tools your business needs day-to-day:

• Real-time ZATCA Fatoorah API integration (reporting and clearance modes)
• CCSID device registration and certificate management
• UBL 2.1 XML invoice generation for all invoice types
• QR code generation with ZATCA-mandated TLV data
• Cryptographic signing and anti-tampering invoice chain
• Automatic retry and queuing for Fatoorah API downtime
• 7-year tamper-proof invoice archive
• Bilingual Arabic/English POS interface
• AI Arabic assistant for sales queries, stock lookups, and ZATCA status
• Multi-branch management from a single dashboard
• Inventory management with automatic deduction per invoice
• Purchase order management and supplier invoicing
• ZATCA compliance update service included in annual hosting fee

Frequently Asked Questions About ZATCA Phase 2

When did ZATCA Phase 2 start?

ZATCA Phase 2 began on January 1, 2023 for the first wave of taxpayers (businesses with annual revenues above SAR 3 billion). Subsequent waves have been onboarded every few months since. By 2026, businesses with annual revenues as low as SAR 5 million are being required to integrate. ZATCA has indicated that all VAT-registered businesses will eventually be required to comply.

What is the Fatoorah portal?

The Fatoorah portal is ZATCA's technical platform for receiving, validating, and archiving e-invoices. It is accessed via REST API by certified e-invoicing software like StartPOS. There is a sandbox environment for testing and a production environment for live invoices. Businesses do not interact with the Fatoorah portal directly — this is handled by the ZATCA Phase 2 Software.

Do I need ZATCA Phase 2 Software if I use an accounting system like Zoho or QuickBooks?

Standard accounting software packages are typically not ZATCA Phase 2 certified. If Zoho Books, QuickBooks, or similar platforms offer a ZATCA Phase 2 integration, it must be specifically certified and must produce ZATCA-compliant UBL 2.1 XML invoices with the correct CCSID signing. Many accounting platforms offer ZATCA integrations via third-party connectors — evaluate whether the full chain (accounting system + connector + Fatoorah API) has been live-tested with a 0% rejection rate before relying on it.

Can I still use paper receipts alongside ZATCA Phase 2 e-invoices?

Yes, with qualifications. Thermal receipt printers that print the ZATCA QR code and invoice number are acceptable for B2C transactions. The underlying invoice must still be generated and submitted to ZATCA electronically — the printed receipt is a customer-facing representation of the e-invoice, not the invoice itself. Businesses may not issue paper invoices that are not backed by a submitted electronic invoice.

What happens if the ZATCA Fatoorah API is unavailable when I try to submit an invoice?

ZATCA allows a grace period for invoices submitted after temporary system outages. The recommended practice — and what StartPOS does automatically — is to queue unsubmitted invoices locally and retry as soon as the API becomes available. Invoices must still be submitted within ZATCA's defined tolerance period. Businesses whose software does not have auto-retry functionality risk accumulating unsubmitted invoices during every Fatoorah outage. For a full breakdown of all Fatoorah API error codes and what each means for your submission, see our ZATCA Phase 2 invoice rejection reasons guide.

How are credit notes handled under ZATCA Phase 2?

Credit and debit notes must reference the original invoice, be encoded in UBL 2.1 XML format, signed with the same CCSID as the original invoice, and submitted via the same mode as the original invoice. A credit note against a B2B cleared invoice must itself go through the clearance process. Credit notes that are not submitted to ZATCA are not compliant, even if the business has already issued the original invoice correctly.

Summary

ZATCA Phase 2 is a mandatory, comprehensive e-invoicing requirement that affects every VAT-registered business in Saudi Arabia. The technical requirements — UBL 2.1 XML, CCSID signing, real-time Fatoorah API submission, and anti-tampering chains — cannot be met by most off-the-shelf accounting packages without purpose-built ZATCA integration.

The safest path to compliance is a certified ZATCA Phase 2 Software with a documented zero-rejection history, support for all three invoice modes, automatic queuing and retry, and an ongoing compliance update service as ZATCA evolves its standards.

Gulf Union Ozone's StartPOS meets all of these requirements — with a 0% rejection rate across 47+ Saudi business deployments, a 24–48 hour go-live timeline, and a one-time license model that eliminates the indefinite cost of subscription-based ZATCA POS software.