ZATCA E-Invoicing Phase Two Requirements: Complete Guide

How does an invoice issued by a supplier reach the Zakat, Tax and Customs Authority (ZATCA) and get approved instantly before being sent to the customer, without any manual intervention? The answer lies in ZATCA E-Invoicing Phase 2 of the electronic invoicing system, known as the linkage and integration phase.

This highlights the importance of electronic invoicing in this second phase in Saudi Arabia, as it is no longer just a technological option but has become a fundamental pillar of the Kingdom's business operations.

After the first phase of the electronic invoicing system successfully established the initial rules for issuing and storing invoices electronically, ZATCA E-Invoicing Phase 2 presented businesses with more advanced requirements related to linking their invoicing systems with the "Fatora" platform of the Zakat, Tax and Customs Authority, and exchanging invoice data electronically according to specific regulations and standards.

We will answer these questions in detail, providing up-to-date information from official sources and ZATCA guidelines on the organization and management of electronic invoicing implementation.

What is the ZATCA E-Invoicing Phase 2 in KSA?

ZATCA E-Invoicing Phase 2 is officially called the "Integration Phase," the second step in the e-invoicing project launched by the Zakat, Tax and Customs Authority (ZATCA). Its implementation began gradually on January 1, 2023, based on the size of each establishment's VAT-liable revenue.

ZATCA E-Invoicing Phase 2 of e-invoicing goes far beyond the first phase, known as the "Issuance and Storage Phase." While the first phase required establishments to issue and store invoices electronically through approved service providers, ZATCA E-Invoicing Phase 2 has more stringent requirements. It requires establishments to link their accounting or point-of-sale systems directly to ZATCA's "Fatora" platform to send invoices electronically in real time or within a specified timeframe.

The core idea of ZATCA E-Invoicing Phase 2 is to transform the invoice workflow from a mere document that the supplier delivers to the customer into structured data in an approved markup language that carries a unique identifier (UUID) and a cryptographic seal, all to ensure that invoices are not tampered with after they are issued and to be able to verify and approve them.

Which companies are targeted by the second phase of the e-invoice?

The Zakat, Tax and Customs Authority does not base its selection of companies for the second phase of e-invoicing on business activity or sector. Instead, the main criterion for determining which establishments qualify for this phase is their revenue size. In other words, any business, whether it's a large commercial company, a small restaurant, or a professional services office, becomes obligated to comply with the second-phase e-invoicing requirements as soon as its revenue exceeds the threshold announced by the Authority.

Currently, the second phase of the electronic invoicing system is mandatory for companies with revenues exceeding SAR 187,500, with a deadline of February 2027 for this category to fully connect to and implement the Fatora platform. The Zakat, Tax and Customs Authority has gradually reduced this threshold since the phase was first introduced, when it applied only to companies with revenues above SAR 3 billion. The Authority continues to lower the threshold in successive waves, steadily broadening the scope of establishments required to join the second phase of e-invoicing.

Recommended for you: Commercial Registration (CR) in Saudi Arabia: A Comprehensive Guide

What are ZATCA Phase 2 Requirements?

Many business owners assume that Phase Two of e-invoicing is just about "improving the look" of the invoice the customer sees. In reality, it's a full verification system integrated with the Fatora platform run by ZATCA, and this verification comes with mandatory conditions and accounting/technical requirements for the invoice itself. Here are the key requirements:

1- Mandatory XML format, not just PDF

Establishments subject to Phase Two e-invoicing must generate all their invoices in XML format compliant with the UBL 2.1 standard, or as PDF/A-3 with an embedded XML file. Note that invoices created manually, through word processors, as scanned images, or as plain PDF files are not accepted at all under Phase Two requirements.

2- Including a Universally Unique Identifier (UUID) for each invoice

Every invoice must carry a globally unique identifier that distinguishes it from any other invoice issued by the same establishment or by any other establishment, preventing duplication or manipulation of numbering.

3- Cryptographic stamp and hash chaining

Every invoice must carry a cryptographic stamp that ensures data integrity and prevents alteration after issuance, along with a hash value linked to the preceding invoice, forming a connected "Hash Chain." This chain allows ZATCA's systems to detect any attempt to delete an invoice or tamper with its data and treat it as a violation of the requirements.

5- QR Code

E-invoices must include a QR code containing at least nine data fields, including the cryptographic stamp, so that the customer or ZATCA's platform systems can verify the invoice's validity simply by scanning the code.

6- Electronic signature

Invoicing solutions (whether an ERP system, accounting software, or point-of-sale system) must be directly integrated with the "Fatora" platform and obtain an onboarding certificate (OTP, followed by CSID/PCSID), which is used to sign invoices before they're sent to ZATCA electronically.

7- Clearance and reporting models

Standard tax invoices, whether between businesses and government entities in Saudi Arabia (B2B) or between businesses (B2G), are subject to the "Clearance" model, under which the invoice is sent to the Authority for approval and verification before it's shared with the customer. This differs from simplified invoices issued from a business to a consumer, which are subject to the "Reporting" model, shared with the customer immediately, then reported to the Authority within 24 hours of issuance.

Read Also: Tax in Saudi Arabia: Types, Rates & How to Calculate

8- Including all mandatory additional fields

Phase Two adds fields to the invoice that weren't required in Phase One, including:

• The invoice's unique identifier
• A precise timestamp
• Seller and buyer identifiers
• The additional number in the Saudi National Address
• Additional details for export invoices or tax-exempt cases.

9- No modification or deletion after issuance

No invoice may be modified or deleted after issuance. Any required correction must go through an electronic credit or debit note linked to the original invoice, using the same cryptographic stamping mechanism.

Implementation stages of the ZATCA E-Invoicing Phase 2

Phase Two of e-invoicing wasn't rolled out to all establishments in Saudi Arabia at once. Instead, the Authority chose a deliberate, gradual approach, dividing establishments into successive "waves" (groups) based on revenue size to ease operational pressure on the market and give each category enough time to prepare.

Below is a workflow outlining how Phase Two e-invoicing is rolled out gradually:

• The Authority issues an official decision specifying the revenue threshold for the new wave and publishes it in the Official Gazette.
• The Authority notifies each establishment in that wave, either through its account on the Fatora portal or its registered email address, at least six months before the integration deadline.
• The establishment reviews its current accounting or point-of-sale system to determine whether it complies with the XML and cryptographic stamp requirements and whether it needs to upgrade its system or replace it with a ZATCA-approved solution.
• The technical solution provider connects the system to the Fatora platform's Sandbox environment to confirm that the invoices issued successfully pass verification and clearance processes.
• The establishment obtains an activation code (OTP) from the Fatora portal, then extracts the onboarding certificate (CSID), which it later uses to sign actual invoices.
• Once the establishment passes the tests, it activates the integration and begins sending real invoices to the Fatora platform under the Clearance or Reporting model, depending on the invoice type.
• After completing integration with Phase Two, the establishment remains responsible for tracking any technical updates issued by ZATCA to ensure the integration continues running smoothly, and for promptly addressing any technical issues by reporting them to the Authority.

What are the key differences between ZATCA Phase 1 and Phase 2?

The main difference is that Phase One only required issuing and storing the invoice electronically within the establishment's own system, with no direct communication with the Authority at the time of issuance. Phase Two, on the other hand, requires live, direct integration between the establishment's system and the Fatora platform, so that the Authority verifies every invoice either before it reaches the customer or within 24 hours of issuance. You could sum up the core difference between the two phases this way: Phase One is "internal documentation," while Phase Two is “instant external verification.”

We had a client who was approaching his Phase Two integration deadline based on his revenue size. Yet, he believed "e-invoicing was already up and running" since he'd been issuing PDF invoices with a QR code and storing them electronically for years, as Phase One required. He assumed integrating with Phase Two would only need a "simple update" to his accounting software.

But once he actually started preparing after receiving the Authority's notification, he discovered that his current system didn't generate XML at all, had no mechanism for creating a UUID or a cryptographic stamp, and that he needed to connect directly to the Fatora platform and obtain digital certificates, and that his current software provider wasn't approved for any of these requirements.

Several other clients recommended Daftra accounting software to him, since it's a fully integrated solution approved and listed among ZATCA's e-invoicing service providers for both phases. He subscribed to the system and now benefits from the full range of smart, automated solutions Daftra Cloud provides, ensuring compliance with all of the Authority's requirements and protecting him from violations or penalties.

Penalties for non-compliance with Phase 2

The Zakat, Tax and Customs Authority applies a progressive penalty system that typically doesn't start with a direct fine. Instead, it follows a "warning first" approach when a violation is discovered for the first time, giving the establishment a correction period of 30 to 60 days, depending on the type of violation (except for obstructing the work of the Authority's inspectors, which gets only 10 days). The goal behind this penalty mechanism is to achieve compliance, not simply to collect fines.

Below is a breakdown of violation types and their corresponding penalties:

Common ZATCA Phase 2 Mistakes and How to Avoid

What ZATCA Phase 2 Reveals About Your Business Operations

Phase Two of e-invoicing exposes just how organized an establishment's internal operations really are, in the following ways:

1- Inconsistent or incomplete customer data

Many establishments discover, once they start issuing invoices, that their customer records contain spelling errors, outdated tax numbers, or duplicate entries in different formats, all of which disrupt the clearance process with the Authority and delay invoice issuance.

2- Inconsistent systems across multiple branches

The integration process requires standardizing systems across multiple branches. As a result, establishments running more than one branch or point of sale often find that each branch operates under different settings, revealing operational gaps that weren't visible before integration.

3- The invoice issuance and calculation process

In manual or semi-manual systems, the final invoice value, tax, and deductions are often calculated outside the system (for example, in separate Excel files) and then entered manually into the final invoice. Phase Two exposes this, since it requires these calculations to be part of the system's logic, trackable and automatically auditable.

How Daftra helps you issue e-invoicing compliant with Phase 2

Daftra e-invoice software in KSA offers integrated solutions that help Saudi establishments comply with Phase Two e-invoicing requirements without needing an in-house specialized technical team. These solutions include:

• Daftra automatically generates invoices in the approved XML format (UBL 2.1), including all mandatory fields the UUID, the cryptographic stamp, and the full QR code with no manual intervention.
• Direct integration between Daftra and ZATCA's Fatora platform, covering both the Clearance model (for standard B2B invoices) and the Reporting model (for simplified B2C invoices), while handling the extraction of the digital certificates needed for electronic signing.
• The system supports unifying the invoicing process across all points of sale from a single place, ensuring data consistency and compliance throughout the establishment with no operational gaps.
• Daftra helps organize customer records and tax numbers in a standardized way, reducing incomplete-data errors that could disrupt the clearance process with the Authority.
• The system lets you issue credit and debit correction notes linked to the original invoices, fully compliant with the cryptographic hash chain mechanism, without deleting or modifying the original invoice.
• It retains invoice records for as long as the Authority requires, making internal and external audits easier.
• It keeps up with ZATCA technical updates and applies them automatically, so the business owner doesn't have to track them personally.

FAQs

What is the ZATCA Phase 2 integration in Saudi Arabia?

It's the process of connecting an establishment's accounting system or point-of-sale system directly to the "fatora" platform run by ZATCA, so that it can issue invoices meeting these core requirements:

• In a structured XML format
• Carrying a UUID
• Including a cryptographic stamp
• Capable of being verified or reported to the Authority electronically (either before delivery to the customer for standard invoices, or within 24 hours for simplified invoices)

Who is exempted from e-invoicing?

Generally, establishments not registered for VAT are exempt, as are transactions that aren't subject to tax in the first place, along with certain special cases the Authority defines, such as certain transactions involving non-resident suppliers.

Who is mandatory to issue an e-invoice?

Every person or establishment registered for VAT in Saudi Arabia must issue e-invoices since Phase One took effect on December 4, 2021, regardless of business size. Compliance with Phase Two's specific requirements (integration and connection with the fatora platform), however, kicks in gradually depending on which wave the establishment falls into, based on its taxable revenue.

What if I don't generate an e-invoice?

This counts as a violation, with a fine starting at SAR 5,000 and potentially escalating up to SAR 50,000 depending on the severity and recurrence of the violation within twelve months. In cases specifically involving failure to complete Phase Two integration, the fine can reach similar or higher amounts, especially with repeated violations.

Which e-invoicing software is the best?

There's no single "best" software that suits every establishment across the board, but the best choice for your business is an integrated system like Daftra, which combines:

• Full technical approval from ZATCA for Phase Two requirements (XML, cryptographic stamp, direct integration)
• Support for your business size (a single branch or multiple branches)
• Ease of daily use for your accounting team
• Staying current with any future changes the Authority issues

Read Also: Best E-invoicing Software in Saudi Arabia