If you operate a restaurant, cafe, cloud kitchen, or any food service business in Saudi Arabia, ZATCA Phase 2 is not optional — and the wave system means your compliance deadline may already be approaching or overdue. The Zakat, Tax and Customs Authority (ZATCA) is actively onboarding smaller F&B operators throughout 2025 and 2026, and the penalties for non-compliance reach SAR 50,000 per violation.
What no generic ZATCA guide tells you is how Phase 2 actually works in a restaurant shift. A dine-in customer paying card, a takeaway order picked up at the counter, a delivery through Jahez, a corporate invoice for a hotel catering contract, and a voided order at table six — each of these transactions has a different compliance requirement, and your POS must handle every one of them correctly, in real time, every shift. This guide maps all of them explicitly.
We also cover the wave deadline table, the technical requirements your POS must meet, the real SAR penalty amounts that ZATCA can levy, how to choose a certified POS solution, and a side-by-side cost comparison between one-time licensing and monthly SaaS subscriptions over 36 months.
Already know you need a ZATCA-certified POS for your restaurant?
StartPOS is certified for ZATCA Phase 2 — used by restaurants, cafes, and food courts across Saudi Arabia. One-time license from SAR 7,500. Live in 24–48 hours. No monthly fees.
Explore StartPOS ZATCA Phase 2 Software →What ZATCA Phase 2 Means for Saudi Restaurants
ZATCA Phase 2 — the integration phase of Saudi Arabia's national e-invoicing mandate — requires every VAT-registered restaurant to connect its point-of-sale system directly to ZATCA's Fatoorah portal and submit each tax invoice electronically at the time of issuance. The phrase "at the time of issuance" is critical for F&B operators: it means every bill issued at a table, every printed receipt at a counter, every digital invoice sent to a delivery aggregator platform must reach ZATCA's servers before or simultaneously with the customer receiving it.
This is a step change from Phase 1, which only required restaurants to generate invoices electronically and store them. Under Phase 2, your POS must speak directly to ZATCA's API, apply a government-issued cryptographic certificate to every invoice, and maintain a verifiable chain of invoice records that cannot be altered after the fact.
Phase 1 vs Phase 2 — What Changed for F&B Operators
| Requirement | Phase 1 (from Dec 2021) | Phase 2 (your wave date) |
|---|---|---|
| Invoice format | Electronic (PDF, POS printout) | UBL 2.1 XML — structured, machine-readable |
| QR code | Required on B2C invoices | Required, now cryptographically signed |
| ZATCA submission | Not required | Real-time submission via Fatoorah API |
| Digital certificate | Not required | CCSID certificate per POS device — mandatory |
| B2B clearance | Not required | Required for standard invoices above SAR 1,000 |
| Invoice chaining | Not required | Cryptographic hash chain — invoices cannot be deleted |
| Offline mode | Paper acceptable | Must issue signed XML invoices; queue for sync |
For restaurant operators, the most disruptive change is the requirement to issue invoices that cannot be voided or altered without a formal credit note process that is also reported to ZATCA. The era of pulling a receipt off the printer and tearing it up is over.
Which Restaurants Must Comply — and By When?
ZATCA is rolling out Phase 2 in waves, starting with the largest taxpayers and progressively moving to smaller businesses. Each wave is defined by an annual revenue threshold. Once ZATCA issues a wave notification to businesses in a revenue band, those businesses have six months to achieve full Phase 2 compliance before enforcement begins.
The table below shows the published wave schedule from the ZATCA Fatoorah portal. Most restaurants and cafes fall into Wave 13 and beyond — the ongoing phase for smaller taxpayers that began in 2025 and continues through 2026.
| Waves | Go-Live Date | Revenue Threshold | Typical Business Profile |
|---|---|---|---|
| 1–2 | Jan–Jul 2023 | SAR 3 billion+ | Large retail chains, supermarkets, major F&B groups |
| 3–7 | Oct 2023–2024 | SAR 250 million+ | Mid-size restaurant chains, franchise operators |
| 8–12 | 2024–Feb 2025 | SAR 40 million+ | Multi-branch F&B operators, hotel restaurants |
| 13+ | 2025–2026 (ongoing) | Smaller taxpayers including most F&B SMEs | Single-branch restaurants, cafes, cloud kitchens, food trucks |
To confirm your specific wave assignment and deadline, log in to the ZATCA Fatoora portal using your Absher or Nafath credentials and check your business profile. ZATCA sends the formal wave notification by email and through the portal dashboard. Do not rely on industry estimates for your specific deadline — only the portal notification is authoritative.
Important: If you have not received a wave notification yet, you are still required to prepare. ZATCA's onboarding notifications typically give six months of lead time, but implementation, staff training, and CCSID certificate registration all take time. The businesses that scramble are the ones that wait for the notification before starting.
Technical Requirements — What Your Restaurant POS Must Do
For a complete technical breakdown of ZATCA Phase 2 requirements, see our ZATCA Phase 2 e-invoicing guide. Below are the requirements most directly relevant to restaurant and F&B POS systems.
UBL 2.1 XML for Every Transaction
Every invoice your restaurant issues — from a SAR 15 coffee to a SAR 15,000 corporate catering order — must be encoded in Universal Business Language (UBL) 2.1 XML format. Each XML invoice must include all mandatory fields:
- Seller name and VAT registration number
- Invoice UUID (unique identifier generated by your POS)
- Invoice date, time, and sequential invoice number
- Line items with description, quantity, unit price, and individual VAT amounts
- Total amount before VAT, VAT amount (15%), and total including VAT
- Invoice type code (B2C simplified or B2B standard)
- Cryptographic signature using your device's CCSID certificate
- Hash of the previous invoice (creating the anti-tampering chain)
- QR code data in Base64 TLV format
- Buyer's VAT number (B2B invoices only)
Offline Mode — Why It Matters on a Busy Friday Shift
Every restaurant operator in Saudi Arabia knows the risk: the internet drops during the Friday lunch rush, during Ramadan Iftar service when every table is full, or during a peak catering event. Under ZATCA Phase 2, internet loss does not excuse you from issuing compliant invoices — and it does not give you permission to revert to paper receipts.
Your POS must operate in certified offline mode: generating fully signed UBL 2.1 XML invoices using the CCSID certificate already stored on the device, queuing them locally with their cryptographic chain intact, and submitting them automatically to ZATCA's Fatoorah portal as soon as connectivity is restored. StartPOS implements this certified offline mode with automatic queue-and-sync — the kitchen never stops, the cashier never stops, and ZATCA receives every invoice.
B2C Simplified vs B2B Standard Invoice
Restaurants issue two fundamentally different invoice types under ZATCA Phase 2, and your POS must apply the correct type automatically based on the buyer's identity:
| Invoice Type | When Used | ZATCA Submission Mode | Buyer VAT No. Required? |
|---|---|---|---|
| B2C Simplified Tax Invoice | Individual customers — dine-in, takeaway, delivery (no VAT number provided) | Reporting mode — submit after issuance, no clearance wait | No |
| B2B Standard Tax Invoice | Corporate customers, hotel accounts, catering contracts, companies requesting VAT invoice | Clearance mode — must be cleared by ZATCA before delivery to buyer | Yes — mandatory |
The practical implication: when a corporate customer wants a VAT invoice for a catering order, your cashier must enter the buyer's VAT number into the POS before finalising the transaction. The POS then submits the invoice to ZATCA in clearance mode, waits for the clearance response (typically 1–3 seconds), and only then issues the final invoice to the customer. This cannot be skipped or bypassed.
Restaurant Invoice Workflows Under ZATCA Phase 2
This section maps the four transaction scenarios every Saudi restaurant encounters in a normal operating day to their ZATCA Phase 2 compliance requirements. No competitor guide on this topic covers this level of operational specificity — yet these workflows determine whether your restaurant is compliant or not.
Dine-In Orders
The dine-in customer paying by cash, mada card, or credit card is the most common F&B transaction in Saudi Arabia. Under ZATCA Phase 2, the workflow at the point of payment is:
- Cashier finalises the order on the POS and selects payment method.
- POS generates a UBL 2.1 XML invoice with invoice type B2C simplified.
- POS applies the CCSID digital signature and computes the QR code data.
- POS submits the invoice to ZATCA's Fatoorah API in reporting mode.
- POS prints the receipt (and/or sends via WhatsApp) including the compliant QR code.
- ZATCA logs the invoice; the customer's receipt is now a legally valid ZATCA Phase 2 tax invoice.
The critical point for restaurant operators: steps 3 through 5 happen simultaneously within your POS — the customer does not wait. ZATCA reporting mode does not require you to hold the receipt until ZATCA responds. The signed invoice is issued, the submission is made, and the customer receives their receipt in one fluid action.
If the customer asks for the receipt via WhatsApp — a common expectation in Saudi Arabia — StartPOS sends the PDF invoice with the embedded QR code directly to the customer's WhatsApp number, bilingual in Arabic and English.
Takeaway and Delivery Orders (Including the Delivery Aggregator Gap)
Takeaway orders follow the same B2C simplified invoice workflow as dine-in. The compliance gap that catches many Saudi restaurant operators is the delivery aggregator question.
If your restaurant accepts orders through Jahez, HungerStation, Noon Food, Careem Food, or any other delivery platform, you may assume the aggregator handles the invoicing. This is incorrect, and it is one of the most common ZATCA compliance mistakes in the Saudi F&B sector.
The delivery aggregator is a sales channel and a payment intermediary — it is not the seller for ZATCA purposes. The legal seller is your restaurant, and the ZATCA-responsible party for every aggregator order is always the restaurant. Your POS must generate a compliant ZATCA Phase 2 invoice for every order that arrives through a delivery platform, with your VAT number as the seller, at the time the order is fulfilled. You may include the aggregator's order reference number in the invoice notes field for your own reconciliation, but the invoice is yours.
Practically, this means your POS must be integrated with your aggregator order management flow — either through direct integration or by ensuring staff log every aggregator order into the POS before fulfilling it. Aggregator orders that leave the kitchen without a corresponding ZATCA invoice are a compliance violation, not the aggregator's problem.
Corporate Catering and B2B Invoices
Corporate catering — office lunches, hotel F&B accounts, event catering, school meal contracts — typically involves larger invoice values and a business buyer who needs a VAT invoice for their own input tax credit claims. These invoices follow the B2B standard invoice workflow, and the difference from the B2C flow is material:
- Cashier or account manager enters the buyer's VAT registration number into the POS.
- POS generates a UBL 2.1 XML invoice with invoice type B2B standard.
- POS applies the CCSID digital signature.
- POS submits the invoice to ZATCA's Fatoorah API in clearance mode.
- ZATCA's API clears the invoice and returns a clearance token (typically within 1–3 seconds).
- POS embeds the clearance token in the final invoice XML.
- POS issues the cleared invoice to the buyer (print, email, or WhatsApp).
The buyer cannot legally claim input VAT on an invoice that has not been cleared by ZATCA. If your restaurant issues an unclearanced invoice to a corporate customer — even if it looks correct — that customer's VAT claim may be rejected, damaging the business relationship. StartPOS handles the entire clearance handshake automatically; the cashier enters the VAT number and the system does the rest.
For catering contracts above SAR 1,000, clearance is not optional regardless of whether the buyer requests it.
Voided Transactions and Credit Notes
In any busy restaurant shift, orders get voided — a customer changes their mind, a wrong item is keyed in, a delivery order is cancelled. Under ZATCA Phase 2, you cannot simply delete an invoice from your POS. The anti-tampering chain means every issued invoice is permanently recorded.
The correct process for a voided or corrected transaction is:
- The original invoice remains in the system — it cannot be deleted.
- Your POS generates a credit note (ZATCA invoice type: debit/credit note) referencing the original invoice's UUID.
- The credit note is submitted to ZATCA via the Fatoorah API in the same mode as the original (reporting for B2C, clearance for B2B).
- The net effect of the original invoice and the credit note is zero — but both records exist in ZATCA's system.
Partial credits (e.g., removing one item from a multi-item order) follow the same process. StartPOS generates credit notes automatically from the void/refund workflow — the cashier initiates the void and the system handles the ZATCA submission without any additional steps.
"We were worried about the Friday rush — we do 300 covers in three hours and the internet here is not always reliable. The StartPOS offline mode meant we never had to stop issuing receipts. Everything synced to ZATCA automatically when the connection came back. We went live in one day."
— Cafe owner, Jeddah (multi-branch, Wave 13)ZATCA Phase 2 Penalties Restaurants Must Know
ZATCA's enforcement authority for e-invoicing violations is established in the E-Invoicing Regulations published under the VAT Law. The penalty schedule below reflects ZATCA's published fine structure for Phase 2 non-compliance. Unlike warnings that characterised the early Phase 1 period, Phase 2 enforcement includes financial penalties from the first violation.
| Violation | Penalty |
|---|---|
| Failure to generate a compliant invoice (e.g., paper receipt, non-certified POS) | SAR 1,000 (first offence) → SAR 5,000 → SAR 10,000 (repeated within 12 months) |
| Non-compliance with real-time reporting (failure to submit invoices to Fatoorah API) | SAR 5,000–50,000 per violation |
| Failure to include a compliant QR code on a B2C simplified invoice | Up to SAR 10,000 per invoice |
| Full integration non-compliance (operating without ZATCA Phase 2 integration after wave deadline) | Up to SAR 50,000 |
Penalties are assessed per violation, not per audit period. A restaurant that operates non-compliant for a month — issuing hundreds of non-compliant invoices — is exposed to penalties on each individual invoice, not just a single fine. The SAR 10,000 per-invoice ceiling on QR code violations means that a high-volume cafe could face hundreds of thousands of SAR in potential penalties from a single audit cycle.
Penalties are published in ZATCA's E-Invoicing Regulations. For the current version, refer to zatca.gov.sa.
How to Avoid ZATCA Audit Triggers in Restaurant Operations
ZATCA's audit systems compare declared revenue with submitted invoice totals in real time. The patterns most likely to trigger an audit or investigation for restaurant operators are:
- Revenue gaps: Total VAT returns reporting revenue significantly higher than submitted invoice values — suggesting invoices are being issued outside the ZATCA system.
- Sequential gaps: Missing invoice numbers in the chain — indicating voided invoices handled incorrectly rather than through credit notes.
- Submission delays: Large batches of invoices submitted hours after their stated issuance time — suggesting offline queuing is being abused rather than genuinely triggered by connectivity issues.
- Aggregator revenue not invoiced: Aggregator settlement amounts visible in bank statements that have no corresponding ZATCA invoices.
How to Choose a ZATCA Phase 2 POS for Your Saudi Restaurant
Not all POS systems that claim ZATCA compliance are actually certified. ZATCA publishes an approved solutions directory — only systems that have passed ZATCA's technical certification can legally issue Phase 2 invoices. Before signing any contract with a POS provider, verify their certification status on the ZATCA portal.
ZATCA Certification Checklist for Restaurant POS
- ZATCA Phase 2 certification confirmed — both Phase 1 and Phase 2, both B2B and B2C
- UBL 2.1 XML invoice generation with all mandatory fields
- CCSID certificate registration handled by the provider — no developer portal access required
- Clearance mode support for B2B invoices above SAR 1,000
- Reporting mode for B2C simplified invoices
- Certified offline mode with automatic queue-and-sync on reconnection
- Credit note / debit note issuance for voids and returns
- WhatsApp invoice delivery (customer expectation in Saudi Arabia)
- Arabic and English bilingual invoice output
- Multi-branch support with per-device CCSID certificates
- Restaurant-specific features: table management, kitchen display, delivery aggregator workflow
- Saudi support team available in Arabic during business hours
One-Time License vs Monthly Subscription — True Cost Over 36 Months
The Saudi restaurant POS market is dominated by subscription-based products — primarily Foodics, which charges monthly per-branch fees that accumulate significantly over a multi-year operating period. See how StartPOS compares to Foodics on pricing and ZATCA compliance.
The table below shows the true total cost of a one-time license model versus a typical monthly SaaS subscription for a single-branch restaurant over 36 months:
| Cost Component | StartPOS One-Time License | Typical Monthly SaaS POS |
|---|---|---|
| Initial / licence fee | SAR 7,500 (one-time) | SAR 0 setup |
| Monthly fee × 36 months | SAR 0 | SAR 500–900/month = SAR 18,000–32,400 |
| Annual hosting / maintenance | SAR 1,200/year = SAR 3,600 over 36 months | Included in monthly fee |
| Total over 36 months | SAR 11,100 | SAR 18,000–32,400 |
| Saving vs. mid-range SaaS | SAR 10,000–21,000 over three years | |
For a restaurant owner managing thin margins, the three-year saving of SAR 10,000–21,000 is not incidental — it is material. StartPOS's one-time license model means your ZATCA compliance cost is predictable and capped from day one.
StartPOS ZATCA Phase 2 for Saudi Restaurants
StartPOS is Gulf Union Ozone's ZATCA Phase 2 certified point-of-sale system, purpose-built for Saudi Arabia's restaurant, cafe, retail, and food service sectors. It has been deployed in restaurants across Riyadh, Jeddah, Dammam, and throughout the Kingdom, with a 0% invoice rejection rate on all live Phase 2 deployments.
StartPOS handles the complete ZATCA Phase 2 compliance stack for restaurants: UBL 2.1 XML generation, CCSID certificate registration and renewal, real-time Fatoorah API submission, certified offline mode, Arabic/English bilingual invoices, and WhatsApp delivery to customers. Your team does not interact with ZATCA's developer portal at any stage — Gulf Union Ozone manages the technical onboarding entirely.
Restaurant-specific features include: table and section management, kitchen display system integration, delivery aggregator order logging, split-bill support, and multi-branch centralised reporting.
| Plan | One-Time License | Annual Hosting | Best For |
|---|---|---|---|
| Starter | SAR 7,500 | SAR 1,200/year | Single-branch restaurant or cafe |
| Advanced | SAR 10,500 | SAR 1,800/year | Multi-branch with purchase orders and inventory |
| AI Pro | SAR 15,000 | SAR 2,400/year | AI analytics, voice queries, and advanced reporting |
All plans include ZATCA Phase 2 certification, CCSID onboarding, bilingual invoicing, WhatsApp delivery, and Saudi Arabia-based Arabic support. No monthly fees. 15-day free trial, no credit card required. VAT No. 311592828300003 · CR 4030570569.
Start your free 15-day trial — no card required
Try StartPOS in your restaurant for 15 days. Our team will handle your ZATCA Phase 2 onboarding, issue your CCSID certificate, and go live on the Fatoorah portal within 24–48 hours. WhatsApp us to get started.
Start Free Trial via WhatsApp →Frequently Asked Questions
Does ZATCA Phase 2 apply to all restaurants in Saudi Arabia?
Yes, ZATCA Phase 2 applies to every VAT-registered restaurant, cafe, cloud kitchen, and food service business in Saudi Arabia once their wave notification has been issued. Restaurants with annual revenues below the VAT registration threshold of SAR 375,000 are exempt, but any business that is already VAT-registered must comply. ZATCA has been progressively onboarding smaller F&B operators since 2025, and most restaurants operating a single branch or small chain will have received their wave notification by end of 2026. To confirm your specific deadline, log in to the ZATCA Fatoora portal using your Absher or Nafath credentials.
What type of invoice does my POS need to generate for a dine-in customer paying cash or card?
A dine-in customer paying cash or card — with no VAT number provided — receives a B2C simplified tax invoice. Under ZATCA Phase 2, this invoice must be generated in UBL 2.1 XML format, digitally signed with your device's CCSID certificate, include a compliant QR code, and submitted to ZATCA's Fatoorah portal in reporting mode. The invoice can be delivered to the customer (as a printed receipt or WhatsApp message) without waiting for ZATCA clearance, but it must be reported to ZATCA within the session. A compliant ZATCA POS handles all of this automatically at the moment of payment — no additional steps from the cashier are needed.
Who is responsible for ZATCA compliance on a Jahez or HungerStation delivery order?
The restaurant is always the ZATCA-responsible party, even when the order arrives through Jahez, HungerStation, Noon Food, Careem Food, or any other delivery aggregator. The aggregator is a sales channel and a payment intermediary — it is not the invoicing entity. Your POS must generate a compliant ZATCA Phase 2 invoice for every aggregator order, just as it does for walk-in customers. The invoice should reference the aggregator order reference in the notes field for reconciliation purposes, but the seller VAT number on the invoice is always yours. Aggregator orders that leave the kitchen without a corresponding ZATCA invoice are a compliance violation and the legal responsibility lies with your restaurant, not the aggregator.
What happens if my internet goes down during a busy shift — Friday lunch or Ramadan Iftar?
ZATCA allows a defined offline mode for intermittent connectivity loss. Your POS must continue generating compliant UBL 2.1 XML invoices with digital signatures during the outage — invoices cannot be skipped or replaced with paper receipts. The offline invoices are queued locally and submitted to ZATCA's Fatoorah portal in batch when connectivity is restored. The QR code and digital signature are applied at the device level using the CCSID certificate already stored on the device, so invoices remain cryptographically valid without an active internet connection. StartPOS includes certified offline mode with automatic queue-and-sync — your kitchen and cashier never stop, and ZATCA receives every invoice once the connection is restored.
How long does ZATCA Phase 2 onboarding take for a restaurant?
With StartPOS, the complete ZATCA Phase 2 onboarding process — including CCSID certificate registration, compliance testing against ZATCA's sandbox, production go-live on the Fatoorah portal, and staff training — takes 24 to 48 hours from the time we receive your VAT registration details. For restaurants with multiple branches, each branch POS device requires its own CCSID certificate, but the process is parallelised and typically completed within the same window. You do not need to interact with ZATCA's developer portal at any stage. Gulf Union Ozone's Saudi-based team handles the technical onboarding entirely in Arabic and English.
Can I keep my existing POS system or do I need to replace it for ZATCA Phase 2?
It depends on whether your existing POS has received ZATCA Phase 2 certification. Only POS systems that have passed ZATCA's technical certification and are listed on ZATCA's approved solution directory can legally issue Phase 2 invoices. If your current system is not certified, you must replace or supplement it with a certified solution before your wave deadline. Attempting to issue Phase 2 invoices using non-certified software — even if the invoices appear visually correct — is a violation that attracts penalties of up to SAR 50,000. Check your current provider's certification status on the ZATCA Fatoora portal before assuming compliance.
Final Word: Compliance Is Not Optional — But It Does Not Have to Be Complicated
ZATCA Phase 2 compliance for Saudi restaurants comes down to one operational requirement: every transaction that leaves your kitchen must have a corresponding ZATCA-compliant invoice. Dine-in, takeaway, aggregator delivery, corporate catering, and void — all of them. The wave system means most F&B SMEs are now in scope or will be within months.
The restaurant operators who are most exposed are those who assume their aggregator handles their invoicing, those who revert to paper during internet outages, and those who are using POS software that is not ZATCA-certified. The businesses that go live early, with a certified system, are the ones that never have to think about it again.
StartPOS gives you ZATCA Phase 2 certification from day one, handles your onboarding in 24–48 hours, and costs you a predictable one-time license fee rather than an open-ended monthly subscription. WhatsApp us at +966 50 197 1075 to start your 15-day free trial, or explore ZATCA Phase 2 software for Saudi businesses to learn more.