ZATCA Phase 2 for Pharmacies in Saudi Arabia

Pharmacies in Saudi Arabia face a ZATCA Phase 2 compliance challenge that no other retail sector encounters: a single customer basket can contain items at two completely different VAT rates, drug product codes mandated by a separate regulatory body (SFDA), and supplier invoices that require B2B clearance before goods can legally be transferred. A generic ZATCA guide cannot tell you how to handle this. This one can.

The structural complexity is real. A prescription dispensing counter issues zero-rated invoices for regulated medicines and 15% VAT invoices for over-the-counter products — sometimes in the same transaction. Hospital supply chains require ZATCA clearance mode before bulk drug deliveries can proceed. Insurance-covered prescriptions need the insurer's VAT number on the invoice. Credit notes for returned medications must themselves be submitted to ZATCA. And each physical dispensing terminal — whether your pharmacy has one or twelve — requires its own government-issued CCSID certificate.

This guide maps every one of these scenarios explicitly, covers Wave 24 thresholds, explains the correct VAT coding for every product category a Saudi pharmacy typically carries, and shows you how pharmacy-specific software handles the entire compliance stack.

Why Pharmacies Have Unique ZATCA Phase 2 Challenges

When ZATCA's Phase 2 mandate is discussed in general terms, the focus is on invoice format, digital certificates, and API submission timelines. For most retailers — a clothing store, an electronics shop, a supermarket selling standard goods at 15% VAT — those are the core concerns. For pharmacies, the compliance picture is significantly more layered.

Prescription drugs are zero-rated, not exempt. Saudi Arabia's VAT regulations zero-rate human medicines (أدوية), medical devices listed under the ministerial exemption schedule, and baby formula (حليب الأطفال). Zero-rated is a legally distinct category from exempt: the pharmacy charges 0% VAT on qualifying items but can still reclaim input VAT on the procurement costs for those product lines. Your ZATCA invoice XML must correctly code these items with a zero-rate indicator — not a standard rate, and not an exemption code. An invoice that applies 15% to a prescription medicine is a compliance error that will surface in a ZATCA audit.

OTC products carry the standard 15% VAT rate. Vitamins, cosmetics, baby care products that are not classified as medical devices, non-prescription topical treatments, and diagnostic accessories all attract standard VAT. A pharmacy that sells both prescription antibiotics and vitamin supplements is selling two tax categories out of the same counter, and both must be correctly coded in every invoice.

SFDA drug codes must appear on invoices for traceable products. The Saudi Food and Drug Authority (SFDA) maintains a drug registry with GS1-based barcodes for all regulated pharmaceutical products. For traceable drug products, the SFDA product code is a required field in the ZATCA invoice line item — it is how the government links the sale of a regulated medicine to the approved product register. A pharmacy's POS must store SFDA codes in the product master and populate them in the invoice XML automatically at the point of sale.

Supplier invoices for drug procurement are B2B clearance transactions. When your pharmacy buys stock from a pharmaceutical distributor — Al-Dawaa, Nahdi's wholesale arm, or any licensed drug importer — those procurement invoices are B2B standard tax invoices above SAR 1,000 and require ZATCA clearance before the supply can proceed. Your supplier's system handles the clearance, but your own system for issuing invoices to hospital clients and insurance providers must apply the same clearance logic.

Multiple dispensing terminals each require their own CCSID device. A pharmacy group with a central dispensary, three retail branches, and a hospital supply desk has five physical dispensing points. Under ZATCA Phase 2, each of those locations requires its own cryptographic certificate (CCSID). There is no shared device model — the certificate is tied to the specific hardware at that location, and invoices issued at that terminal are signed with that terminal's private key.

ZATCA Phase 2: How It Applies to Pharmacies Differently

ZATCA Phase 2 requires real-time electronic submission of every tax invoice to ZATCA's Fatoorah portal via API, with digital signatures applied by a government-issued CCSID certificate on each invoicing device. For most businesses, this is a straightforward overlay on existing invoicing. For pharmacies, the overlay touches three regulatory systems simultaneously: ZATCA's e-invoicing mandate, the Saudi VAT Law's healthcare exemption schedule, and the SFDA drug product registry.

Zero-Rated vs Standard Rate: the Coding That Cannot Be Wrong

The ZATCA UBL 2.1 XML invoice format includes a tax category code field for each line item. For a pharmacy, the correct codes are:

• Z — Zero-rated: Human medicines (prescription drugs), medical devices on the ministerial exemption list, baby formula. Tax amount = 0, but the line item must explicitly carry the Z code — it cannot be left blank or coded as exempt.
• S — Standard rate (15%): All other pharmacy products — OTC drugs, vitamins, cosmetics, baby care, diagnostic accessories, food items processed beyond the basic food exemption.
• E — Exempt: Not the correct code for prescription medicines under Saudi VAT. Do not use the exempt code for zero-rated healthcare items — the two categories have different VAT reclaim implications for the pharmacy and different audit treatment by ZATCA.

The practical implication is that every product in your pharmacy's catalogue must be assigned the correct tax category in your POS system before ZATCA Phase 2 go-live. A product master that applies a default 15% VAT rate to all SKUs will produce compliant invoices for OTC goods and non-compliant invoices for prescription medicines simultaneously — and the non-compliant line items will be recorded in ZATCA's system under your VAT registration number.

SFDA Codes in Line Items for Traceable Drug Products

SFDA-registered drugs carry a GS1-compliant barcode that uniquely identifies the product, manufacturer, and batch within Saudi Arabia's drug supply chain. For traceable pharmaceutical products, ZATCA's invoice specifications require this SFDA product identifier to appear in the invoice line item. This serves a dual regulatory purpose: ZATCA uses it for tax audit trail purposes, and SFDA uses the aggregated invoice data across the Kingdom as a drug supply chain monitoring tool.

The consequence for pharmacy POS systems is that the product master must store the SFDA code field separately from the internal SKU, and the invoice generation engine must populate the correct XML element (the item identification field) with the SFDA code at the time of invoicing. A POS system without an SFDA code field in its product master cannot produce a fully compliant pharmacy invoice for traceable drugs — regardless of whether its ZATCA integration is otherwise correct.

Hospital and Clinic Supply: B2B Clearance Mode

When a pharmacy supplies medications to a hospital, clinic, or any other VAT-registered healthcare provider, the transaction is a B2B standard tax invoice. Under ZATCA Phase 2, any B2B invoice above SAR 1,000 must be submitted to ZATCA in clearance mode — meaning the invoice is sent to ZATCA's Fatoorah API, ZATCA validates and clears it, returns a clearance token, and only then can the cleared invoice be delivered to the buying institution.

The hospital or clinic cannot legally claim input VAT on an invoice that has not been cleared by ZATCA. If your pharmacy delivers medications to a hospital with an uncleared invoice, the hospital's finance department will return it — and the relationship damage is real. Pharmacy software must apply clearance mode automatically when a buyer's VAT number is entered into the transaction, without requiring the dispensing pharmacist to make a compliance judgement call at the counter.

Dispensing Errors and Credit Notes

A pharmacist who dispenses the wrong medication, the wrong quantity, or an expired batch must issue a credit note. Under ZATCA Phase 2, that credit note is not a simple internal adjustment — it is itself a ZATCA submission. The credit note must reference the original invoice's UUID, carry the same CCSID digital signature, and be submitted to ZATCA in the same mode (reporting for B2C retail, clearance for B2B hospital supply) as the original invoice it corrects. Pharmacies that have not thought through their returns workflow will discover the gap quickly once they go live.

VAT Rates in a Pharmacy Invoice — What Gets What

The table below maps every major product category a Saudi pharmacy typically carries to its correct ZATCA VAT rate. The VAT treatment follows the Saudi VAT Law, the GCC Unified VAT Agreement, and ZATCA's published healthcare and food exemption guidance.

Important: The ministerial exemption list for medical devices is not static. It is updated by the Saudi Ministry of Health and the General Authority for Zakat and Tax. Pharmacy operators should review the current list on the ZATCA Fatoora portal when onboarding new SKUs, rather than relying on a classification made at initial setup.

ZATCA Wave 24 and the Pharmacy Sector

ZATCA's phase-in approach divides Saudi businesses into waves by annual revenue. The progression moves from the largest taxpayers — large pharmaceutical distributors and hospital supply chains — down to independent retail pharmacies and smaller community dispensaries.

Wave 24 — covering VAT-registered businesses with annual revenue above SAR 500,000 — brings the vast majority of independent and small-chain pharmacies in Saudi Arabia into mandatory ZATCA Phase 2 compliance. An owner-operated pharmacy in Riyadh or Jeddah with SAR 600,000 in annual revenue is in scope from June 2026. The six-month notification window before enforcement means the preparation window has either already opened or is imminent for most independent operators.

For pharmacies below the SAR 500,000 threshold who are not yet in Wave 24, this is not a reason to defer preparation. ZATCA has publicly stated its intention to bring all VAT-registered businesses into Phase 2 compliance by end of 2026. The onboarding process — product catalogue VAT classification, SFDA code mapping, CCSID device registration — takes time that should not be left until the final notification.

The insurance billing consequence of non-compliance is immediate. Insurance companies — Tawuniya, Bupa Arabia, Medgulf, and others — have updated their pharmacy billing acceptance policies to require ZATCA-cleared invoices. A non-compliant pharmacy that submits paper or non-cleared invoices to insurance companies for reimbursement will face payment refusal regardless of whether ZATCA enforcement has formally begun. For a pharmacy where insurance billing represents 30–60% of revenue, this is not a compliance abstraction — it is a cash flow crisis.

5 Specific ZATCA Compliance Scenarios for Saudi Pharmacies

The scenarios below represent the most common compliance situations that pharmacy operators encounter in practice. Each one has a specific ZATCA requirement that differs from the generic retail case.

Scenario 1: Mixed Basket — Prescription and OTC in One Transaction

A customer brings a prescription for amoxicillin and also picks up a bottle of paracetamol and a vitamin C supplement from the shelf. Total purchase: three items, two VAT rates.

The ZATCA-compliant invoice for this transaction must include three line items, each with its own tax category code: amoxicillin coded as zero-rated (Z, 0% VAT), paracetamol coded as standard-rated (S, 15% VAT), and vitamin C coded as standard-rated (S, 15% VAT). The invoice totals must separately itemise the zero-rated subtotal, the standard-rated subtotal, and the VAT amount on the standard-rated goods only. The QR code embedded in the B2C simplified invoice encodes these split totals.

A POS system that cannot handle multi-rate line items on a single invoice cannot produce a compliant pharmacy invoice. This is the most common gap in generic retail POS systems that are not pharmacy-configured.

Scenario 2: Credit Note for a Returned Medication

A patient returns a sealed, unexpired pack of medication — perhaps the prescription changed, or the wrong strength was dispensed. The pharmacist accepts the return and issues a refund.

Under ZATCA Phase 2, the pharmacist cannot simply reverse the transaction in the POS and delete the original invoice. The original invoice is permanently recorded in ZATCA's Fatoorah system with a cryptographic chain. The correct process is: the POS generates a credit note referencing the original invoice's UUID, applies the CCSID digital signature to the credit note, and submits it to ZATCA in reporting mode (for a B2C retail return). ZATCA records both the original invoice and the credit note — the net position in ZATCA's ledger reflects the actual transaction, and the pharmacy's invoice chain remains intact.

For a prescription return, the credit note must carry the same SFDA code and the same zero-rated tax category as the original dispensing invoice. A credit note that applies the wrong VAT rate to a returned prescription drug is itself a non-compliant submission.

Scenario 3: Pharmacy Billing a Hospital for Bulk Drug Supply

A community pharmacy or specialist dispensary supplies a clinic or hospital with a bulk order of medications. The invoice value is SAR 8,500 — well above the SAR 1,000 B2B clearance threshold.

This is a B2B standard tax invoice requiring clearance before the hospital can take delivery. The workflow: the pharmacy's POS generates the UBL 2.1 XML invoice with the hospital's VAT registration number as the buyer, submits it to ZATCA's Fatoorah API in clearance mode, receives the clearance token (typically within 1–3 seconds on a stable connection), embeds the clearance token in the final invoice XML, and only then delivers the cleared invoice to the hospital purchasing department along with the goods. The hospital cannot claim input VAT on an invoice that lacks the ZATCA clearance stamp. Pharmacies that attempt to issue paper delivery notes and send invoices separately are generating compliance violations on every such supply.

Scenario 4: Insurance-Covered Prescription

A patient presents a prescription under their employer's insurance scheme. The pharmacy dispenses the medication and bills the insurance company directly for all or part of the cost. The patient may pay a small co-payment.

The insurance payer — whether Tawuniya, Bupa, or a self-insured corporate employer — is a VAT-registered entity. The pharmacy's ZATCA invoice for the insurance portion of the billing must be a B2B standard invoice, with the insurance company's VAT registration number as the buyer, submitted in clearance mode. The patient's co-payment portion, if collected separately, is a B2C transaction covered by a simplified invoice. A pharmacy billing model that issues a single mixed invoice — covering both the insurance portion and the co-payment — must structure the ZATCA XML correctly to reflect the actual payer split. Pharmacy software that lacks insurance billing logic will produce non-compliant submissions for this very common transaction type.

Scenario 5: Pharmacy Group with Three Branches

A pharmacy operator runs three branches across the city — main branch in the city centre, a residential branch, and a mall kiosk. Each branch has its own dispensing counter and POS terminal. The VAT registration is centralised under the group's single VAT number.

Under ZATCA Phase 2, each physical dispensing location requires its own CCSID device. The three branches cannot share a single certificate — each terminal must be individually registered with ZATCA and issued its own cryptographic credential. The invoices from each terminal carry that terminal's unique CCSID signature, making the location of each invoice issuance verifiable in ZATCA's system.

Centralised management of three separate CCSID registrations, with monitoring of each terminal's invoice chain and certificate renewal cycles, is the multi-branch pharmacy compliance overhead that a pharmacy-aware POS system must handle from a single dashboard — rather than requiring the pharmacy owner to separately log into ZATCA's developer portal for each device.

How StartPOS Handles Pharmacy ZATCA Compliance

StartPOS is Gulf Union Ozone's ZATCA Phase 2 certified point-of-sale system, deployed across retail and healthcare businesses in Saudi Arabia with a 0% invoice rejection rate on all live Phase 2 deployments. For pharmacies, StartPOS includes dedicated pharmacy compliance features that address every scenario described above.

Product-Level VAT Rate Configuration

Every SKU in the StartPOS product master carries its own VAT tax category — zero-rated (prescription), standard-rated (OTC), or exempt — configured at setup and enforced automatically at the point of sale. A mixed-basket transaction with prescription and OTC items produces a single ZATCA-compliant invoice with correctly coded line items at both rates, without any intervention from the pharmacist or cashier at the counter.

SFDA Code Field in Product Master

StartPOS includes a dedicated SFDA code field in the product master record. At setup, each SFDA-registered drug SKU is linked to its official product code. At the point of dispensing, the SFDA code is automatically populated in the corresponding ZATCA invoice line item, producing fully compliant XML for traceable pharmaceutical products without any manual data entry during the transaction.

Automatic B2B Clearance for Hospital Supply Invoices

When a buyer's VAT registration number is entered into a StartPOS transaction, the system automatically applies B2B clearance mode: submitting the invoice to ZATCA's Fatoorah API, waiting for the clearance token, embedding the token in the final invoice XML, and generating the cleared invoice for delivery. The pharmacist or accounts team does not need to make a compliance decision — the system applies the correct mode based on the presence of a buyer VAT number. For supply invoices above SAR 1,000, clearance is enforced and cannot be bypassed.

Multi-Terminal CCSID Management from One Dashboard

For pharmacy groups with multiple branches or dispensing terminals, Gulf Union Ozone manages the CCSID certificate registration for every device centrally. The pharmacy owner does not interact with ZATCA's developer portal for initial registration, certificate renewal, or device decommissioning. The StartPOS dashboard gives a single view of all active CCSID devices, their certificate expiry dates, and their invoice submission status — so the group owner can see compliance status across all branches without logging into each terminal separately.

Insurance Billing VAT Split

StartPOS supports split-payer invoicing for insurance-covered prescriptions: the insurance portion generates a B2B clearance invoice to the insurer's VAT number, and the patient co-payment generates a B2C simplified invoice, both from a single dispensing transaction. The pharmacist enters the insurance split at the point of dispensing, and StartPOS handles the dual ZATCA submissions — one in clearance mode, one in reporting mode — automatically.

Credit Note ZATCA Submission

The StartPOS returns and refund workflow generates a ZATCA-compliant credit note automatically. The pharmacist initiates the return through the standard refund screen; StartPOS generates the credit note XML referencing the original invoice UUID, applies the CCSID signature, and submits it to ZATCA without any additional steps. The credit note carries the correct tax category codes matching the original dispensing invoice — zero-rated for prescription returns, standard-rated for OTC returns.

Quick-Start: Going ZATCA-Live for Your Pharmacy in 48 Hours

The following is Gulf Union Ozone's standard pharmacy ZATCA Phase 2 onboarding sequence. Most independent and small-chain pharmacies complete this process in 24 to 48 hours from the point of initial engagement.

1. Sign up for a 15-day free trial. WhatsApp our team at +966 50 197 1075 with your VAT registration number and number of dispensing terminals. No credit card is required for the trial period.
2. Gulf Union Ozone registers your CCSID device(s). Our team submits the CCSID certificate signing requests to ZATCA's Fatoorah portal on your behalf — one for each physical dispensing terminal. You do not need access to the ZATCA developer portal. Certificate issuance typically completes within a few hours during business days.
3. Product catalogue setup: prescription (0%) vs OTC (15%) tax codes assigned. Our onboarding team works with you to classify every product category in your catalogue — assigning zero-rated codes to prescription medicines and medical devices, standard-rated codes to OTC products, cosmetics, and accessories. For large product catalogues, we accept CSV imports from your existing POS or pharmacy management system.
4. SFDA codes linked to drug SKUs. For SFDA-registered pharmaceutical products, we map the SFDA code to each corresponding SKU in the StartPOS product master. This step ensures every dispensed prescription item carries the correct SFDA identifier in the ZATCA invoice XML automatically.
5. First live invoice: zero-rejected, ZATCA-cleared. Once CCSID certificates are issued and the product catalogue is configured, we run a compliance test against ZATCA's sandbox environment and then go live on the Fatoorah production portal. Your first real customer invoice is issued, signed, and submitted to ZATCA — correctly coded by product, correctly routed (B2C reporting or B2B clearance), and zero-rejected.

For pharmacies with multiple branches, the process runs in parallel across all terminals — the 48-hour window covers the full group deployment, not just a single device. See the ZATCA Phase 2 software overview for full technical specifications and the best ZATCA Phase 2 software comparison for how StartPOS compares to other certified solutions.

StartPOS Pricing for Pharmacies

All plans include ZATCA Phase 2 certification, CCSID onboarding for all terminals, SFDA code support, prescription (0%) and OTC (15%) tax code configuration, bilingual Arabic/English invoicing, and Saudi Arabia-based Arabic support. No monthly fees after the first year's hosting. 15-day free trial, no credit card required. VAT No. 311592828300003 · CR 4030570569.

Frequently Asked Questions

Final Word: Pharmacy ZATCA Compliance Is Sector-Specific — Treat It That Way

ZATCA Phase 2 compliance for Saudi pharmacies is not the same as ZATCA compliance for a general retail business. The combination of zero-rated prescription medicines, standard-rated OTC products, SFDA drug coding requirements, B2B hospital supply clearance, insurance billing VAT splits, and multi-terminal CCSID management creates a compliance requirement that generic POS systems — even ZATCA-certified generic systems — may not handle correctly out of the box.

The pharmacies most at risk are those using retail POS systems that apply a flat 15% VAT to all products (producing non-compliant invoices for every prescription dispensed), those issuing paper delivery notes to hospital clients without ZATCA clearance (creating receivables that hospitals will not pay), and those with multiple branches assuming one CCSID certificate covers all terminals.

The Wave 24 deadline and the insurance industry's own compliance requirements make delay costly in two directions — direct ZATCA penalties and refused insurance reimbursements. Pharmacies that go live early with a correctly configured, pharmacy-aware ZATCA system eliminate both risks and spend zero operating hours managing compliance exceptions.

StartPOS gives your pharmacy ZATCA Phase 2 certification, product-level VAT code configuration, SFDA code support, hospital B2B clearance, and multi-branch CCSID management from a single platform. Gulf Union Ozone handles the full onboarding in 24–48 hours. WhatsApp us at +966 50 197 1075 to start your 15-day free trial, or read the ZATCA Phase 2 e-invoicing explained guide for the full technical background. Operators across Riyadh and Jeddah are already live — yours can be next.