ZATCA Fatoorah Phase 2 — Complete Guide for Saudi Businesses (2026)

ZATCA's Fatoorah e-invoicing system entered its second, more demanding phase in 2023 — and continues rolling out to additional taxpayer groups through 2026. Phase 2 (Integration Phase) requires businesses to connect their ERP or point-of-sale systems to ZATCA's Fatoorah platform in real-time, rather than simply generating electronic invoices internally as Phase 1 allowed. For businesses new to Phase 2, the technical requirements can seem overwhelming — but the core process is manageable with the right preparation.

Phase 1 vs Phase 2 — What Changed

Phase 1 (Generation Phase) — Mandatory from December 4, 2021 for all VAT-registered businesses: Generate all tax invoices and simplified invoices electronically, store them in XML format, and include a QR code on simplified (B2C) invoices.

Phase 2 (Integration Phase) — Rolling out in waves from January 2023: Additionally, connect your invoicing system to ZATCA's Fatoorah platform via API. For B2B tax invoices, ZATCA must cryptographically clear each invoice before it can be sent to the buyer. For B2C simplified invoices, batches must be reported to ZATCA within 24 hours.

Am I in Phase 2 Scope?

All VAT-registered businesses in Saudi Arabia will eventually be required to comply with Phase 2 — but the rollout is based on annual revenue waves. ZATCA notifies businesses at least 6 months before their integration date. If you have not been notified yet, check the ZATCA portal for your taxpayer category, as wave notifications are published there.

Businesses that were in earlier waves (above SAR 250 million turnover) were integrated in 2023. By 2026, businesses down to SAR 5 million annual revenue are being integrated. Most SMEs are now in scope or being notified.

Technical Requirements for Phase 2

• ZATCA-compliant e-invoicing solution: Your invoicing software must be certified by ZATCA as a compliant solution. Most major ERP platforms (SAP, Oracle, Microsoft Dynamics) have certified Saudi modules. For SMEs on QuickBooks, Zoho, or Odoo, certified middleware solutions bridge the gap.
• Cryptographic stamp: Each invoice must include a ZATCA-issued cryptographic stamp (CSID) — a unique digital signature that verifies the invoice's authenticity.
• UUID: Every invoice must have a unique UUID (universally unique identifier) generated at invoice creation — preventing duplicate invoice submission.
• QR Code (Phase 1 requirement maintained): All B2C simplified invoices must include a scannable QR code containing seller TRN, invoice date, total amount, and VAT amount.
• API integration: Your system must be able to communicate with ZATCA's Fatoorah API — submitting invoices for clearance (B2B) or reporting (B2C) in real time or within the required timeframe.

Common Phase 2 Implementation Mistakes

1. Waiting for the ZATCA notification deadline: Six months is tight for a full ERP integration. Businesses should begin scoping their Phase 2 readiness as soon as they are notified — or proactively before the expected wave.
2. Choosing non-certified middleware: Only ZATCA-certified solutions generate compliant cryptographic stamps. Using an uncertified solution generates invoices that ZATCA does not recognise — potentially invalidating all VAT invoices issued after your integration date.
3. Not testing B2C batch reporting: Many businesses focus on B2B clearance (which is more visible) and undertest B2C batch reporting. Batch reporting failures go unreported by ZATCA immediately but create compliance gaps that emerge in future audits.
4. Ignoring credit notes and debit notes: Phase 2 applies to all tax documents, not just invoices. Credit notes referencing Phase 2 cleared invoices must be cleared through the same API process.

Penalties for Phase 2 Non-Compliance

ZATCA penalties for Fatoorah non-compliance are substantial: fines range from SAR 5,000 to SAR 50,000 per invoice for failure to generate compliant e-invoices, plus potential suspension of business activities for persistent non-compliance. ZATCA's enforcement approach has become increasingly active — businesses notified but not integrated after their deadline can expect ZATCA field visits.