All posts

KSA ZATCA Phase 2 (Fatoorah) E-Invoicing: What Every Saudi Business Must Know

A practical guide to Saudi Arabia's ZATCA Fatoorah Phase 2 e-invoicing — timelines, technical requirements, invoice types, clearance vs. reporting, and how to avoid six-figure penalties.

Saudi Arabia's e-invoicing mandate — known as Fatoorah (فاتورة) — is one of the most technically demanding compliance requirements in the GCC. The Zakat, Tax and Customs Authority (ZATCA) has been rolling it out in waves since January 2023, and by 2026 the majority of VAT-registered businesses in the Kingdom are either live on Phase 2 or approaching their integration deadline. If you are a Saudi business still on legacy invoicing, or a regional business with a Saudi VAT registration, this guide explains what you need to do and why it matters.

Background: Two Phases, One Mandate

ZATCA launched Fatoorah in two distinct phases:

Phase 1 — Generation (4 December 2021): All VAT-registered businesses were required to generate and store e-invoices in a compliant format. Paper invoices were still permitted as a parallel output, but every invoice had to be created within a certified electronic invoicing solution. A QR code was required on B2C (simplified) invoices.

Phase 2 — Integration (from 1 January 2023): Businesses must connect their invoicing system directly to ZATCA's Fatoorah platform via API. B2B invoices must be cleared by ZATCA before they are shared with the buyer. B2C invoices must be reported to ZATCA within 24 hours of issuance. Phase 2 is being rolled out in waves based on annual taxable revenue.

The wave structure means that large taxpayers integrated first (Wave 1 covered businesses with annual revenues above SAR 3 billion from January 2023, then SAR 500 million from July 2023). By mid-2026, waves have progressed to cover a broad range of mid-market businesses. ZATCA publishes each wave's selection criteria; check your notification letter from ZATCA or the Fatoorah portal to confirm your integration deadline.

KSA VAT Rate and Context

Saudi Arabia levies VAT at 15 percent — tripled from the original 5 percent in July 2020. This is the highest VAT rate among the GCC states that have implemented VAT. Given the tax quantum per transaction, the accuracy of every invoice matters considerably more than in lower-rate jurisdictions. An incorrect invoice on a large contract can mean a material uncollected or overcollected tax liability.

The Two Invoice Types Under Fatoorah

ZATCA distinguishes between two categories of e-invoice:

Standard (Tax) Invoice — B2B

Standard invoices are used for business-to-business transactions. Under Phase 2 integration, a standard invoice must be submitted to ZATCA's Fatoorah platform for clearance before it is delivered to the buyer. The clearance process:

1. Your ERP or billing system generates the invoice in UBL 2.1 XML format.
2. The XML is cryptographically stamped with a digital signature.
3. The stamped invoice is submitted to ZATCA via the Clearance API.
4. ZATCA validates the invoice (format, TIN, VAT calculation) and returns a cleared invoice with a ZATCA digital stamp and QR code.
5. Only the cleared invoice — bearing ZATCA's stamp — may be shared with the buyer.

Clearance is typically near-real-time (seconds), but your invoicing system must be able to handle API failures gracefully and queue invoices for retry without breaking the billing workflow.

Simplified Invoice — B2C

Simplified invoices are used for transactions with final consumers. Under Phase 2, simplified invoices do not require pre-clearance — they can be issued immediately. However, they must be reported to ZATCA's Reporting API within 24 hours of issuance.

Simplified invoices still require the cryptographic stamp and QR code. The QR code encodes key invoice fields (seller name, TIN, timestamp, total amount, VAT amount) and must be scannable by ZATCA's consumer-facing verification app.

Technical Requirements in Detail

Fatoorah compliance is fundamentally a software integration challenge. The technical requirements include:

XML Format: UBL 2.1 (Universal Business Language), adapted to ZATCA's specific extension fields defined in the Fatoorah Technical Specifications. Many global ERP systems use their own proprietary invoice formats; these must be mapped and transformed before submission.

Cryptographic Stamp: Each invoice must be digitally signed using a certificate issued by ZATCA's Certificate Authority. The signing process links invoices in a chain via a cryptographic hash of the previous invoice — an anti-tampering mechanism that makes it impossible to modify or delete historical invoices without detection.

UUID: Every invoice requires a universally unique identifier generated at creation time.

QR Code: Generated from the invoice data using a ZATCA-specified encoding. Required on all invoice types.

Invoice Counter: A monotonically increasing counter per device or billing unit. ZATCA uses this to detect gaps in the invoice sequence, which could indicate suppressed sales.

Onboarding: Before your system can submit invoices, it must go through a ZATCA onboarding process: obtain a Compliance CSID (Cryptographic Stamp Identifier) from the Compliance API, pass the compliance checks, then upgrade to a Production CSID.

Penalties for Non-Compliance

ZATCA's penalty framework for e-invoicing violations is substantial:

• Failure to issue an e-invoice: SAR 10,000 for a first offence, escalating for repeat violations.
• Failure to submit for clearance/reporting: Equivalent to the tax amount, up to 200 percent in cases of deliberate evasion.
• Tampering with invoice data: Criminal liability; ZATCA may suspend the business's VAT registration.
• Missing integration deadline: ZATCA has issued grace periods for some waves, but businesses that miss their notified deadline without an approved extension face formal enforcement.

Reputational risk adds to the financial exposure: buyers will increasingly refuse to accept invoices that do not carry a ZATCA clearance stamp, because they cannot claim input VAT on them.

What Businesses Need to Prepare

Integrating with Fatoorah requires effort across three areas:

1. ERP / billing system readiness. Your invoicing system must generate UBL 2.1 XML, handle signing certificates, call the ZATCA APIs, and store the cleared/reported response. If your current system cannot do this natively, you need either a certified solution or a middleware adapter. ZATCA maintains a list of certified e-invoicing solutions on the Fatoorah portal.

2. Certificate management. ZATCA certificates expire and must be renewed. Your system must handle renewal without any invoicing downtime. Failure to renew the production certificate means invoices cannot be cleared — which means billing stops.

3. Disaster recovery. If your ERP goes offline, you need a fallback process for capturing invoices and submitting them within the allowed window once the system recovers. For standard invoices, the buyer cannot receive the invoice until it is cleared — so an API outage directly delays billing.

Planning Your Integration Timeline

If your wave notification is imminent or overdue, a realistic integration timeline looks like this:

• Weeks 1–2: Gap analysis of current invoicing system against ZATCA technical specifications.
• Weeks 3–6: XML mapping, API integration development, and testing in ZATCA's sandbox environment (Fatoorah portal provides a dedicated sandbox).
• Weeks 7–8: Compliance testing via the Compliance API to obtain your CSID.
• Week 9: Production onboarding and parallel-run testing.
• Week 10: Go-live on Phase 2.

Two months is achievable for businesses using a modern cloud ERP with native ZATCA support. Custom-built or legacy systems may take longer.

Key Takeaways

• Phase 2 integration is mandatory for VAT-registered businesses in KSA; your wave deadline is in your ZATCA notification.
• B2B standard invoices require pre-clearance; B2C simplified invoices require reporting within 24 hours.
• The technical stack requires UBL 2.1 XML, cryptographic signing, ZATCA certificates, and real-time API connectivity.
• Penalties range from SAR 10,000 per invoice violation to criminal liability for tampering.
• Choose a billing or ERP system with native Fatoorah integration, not a bolt-on adapter that requires manual steps.

---

Fatoorah compliance is ultimately about data integrity at the point of invoice creation. Axion ERP's finance module generates ZATCA-compliant UBL 2.1 invoices, manages clearance and reporting automatically, and handles certificate renewal — so your billing team works normally while compliance happens in the background.