# ZATCA Phase Two E-Invoicing: A Complete Guide for Businesses *What changed, who has to comply now, and how to stay fully compliant* > **In short:** A complete guide to ZATCA Phase Two e-invoicing in Saudi Arabia: integration requirements, XML format, digital signature, QR code, and who must comply. - **URL:** https://www.snad.io/en/blog/fatira-iliktronia-zatca-marhala-thaniya-dalil - **Arabic original:** https://www.snad.io/blog/fatira-iliktronia-zatca-marhala-thaniya-dalil - **Category:** Guides — Tax & Zakat - **Tags:** ZATCA, e-invoicing, Zakat, Tax and Customs Authority, accounting, Value Added Tax - **Published:** 2026-05-10 - **Updated:** 2026-08-02 - **Publisher:** Snad (snad.io) E-invoicing in Saudi Arabia is no longer a PDF. Phase Two of the e-invoicing system raised the bar considerably — and non-compliance carries penalties. This guide walks through what changed, who has to comply now, and how to make sure your invoices are 100% compliant. ## The difference between Phase One and Phase Two Phase One (December 2021) required invoices to be issued electronically in a digital format — handwritten invoices were banned. A digital PDF carrying the required data fields and a QR code was enough. Phase Two (January 2023 onwards — phased) requires direct integration with the Fatoora platform. In practice that means: - Every invoice is sent to the Fatoora platform for clearance before it is handed to the customer (or shortly afterwards, depending on the invoice type) - The invoice must follow a specific XML format - A digital signature must be embedded in every invoice - An extended QR code carrying additional encoded data ## Phase Two requirements in detail Format: XML following the UBL 2.1 standard as adapted by the Zakat, Tax and Customs Authority (ZATCA). Digital signature: a digital certificate issued by ZATCA and embedded in every invoice. QR code: it carries the supplier name, the supplier's VAT registration number, the date and time, the invoice total, the tax amount, and the invoice hash. The two invoice types: - Tax invoice (B2B and B2G): submitted to ZATCA for immediate clearance before it is shared with the customer - Simplified tax receipt (B2C): reported to the platform in batches (within 24 hours at most) ## The Phase Two rollout schedule — who complies and when? ZATCA is rolling Phase Two out gradually, in waves: - Wave one (January 2023): businesses with revenue above SAR 3 billion - Later waves: phased in until every VAT-registered business is covered Even if you have not received a notification from ZATCA yet, it is worth preparing now. Many cloud accounting systems, Snad among them, are already Phase Two ready. ## E-invoicing with Snad Snad is 100% compliant with Phase Two requirements: - XML invoices issued automatically in the required format - A digital signature embedded in every invoice at the moment it is issued - An extended QR code carrying all the required data - Direct integration with the Fatoora platform for invoice clearance - No customisation and no add-on software — everything is built in ## Wave 25: who is covered and when integration starts On 24 July 2026, the Zakat, Tax and Customs Authority announced the criterion for selecting the businesses targeted in the twenty-fifth wave of the integration phase. The criterion is single and clear: your VAT-taxable revenue must have exceeded **SAR 187,500** in any of the years 2022, 2023, 2024 or 2025. One year is enough — you do not need to have exceeded the threshold in all four. | Item | Detail | |---|---| | Wave number | Twenty-fifth | | Revenue threshold | More than SAR 187,500 in VAT-taxable revenue | | Years assessed | 2022, 2023, 2024 or 2025 | | Integration deadline | 1 February 2027 at the latest | | Criterion announcement date | 24 July 2026 | The details and the preparation steps are on the [Wave 25](/zatca/wave-25) page. The figures above follow the Authority's official announcement — July 2026. ## How to confirm you are in the wave before the notice arrives The Authority notifies targeted businesses at least six months before Phase Two applies to them, per the official implementation phases page. But waiting for the notice is not a plan — the notice starts the clock, it does not buy you extra time to get ready. Checking for yourself takes minutes. Open your VAT returns for the four years and add up the taxable revenue for each year separately. If any single year exceeds SAR 187,500, you are in the wave. Three mistakes come up again and again in this check: - Counting total sales instead of VAT-taxable revenue. Exempt and out-of-scope sales do not belong in the calculation. - Adding the four years together. The threshold is measured for each year on its own. - Assuming that a drop in revenue in 2025 cancels out a year that exceeded the threshold in 2022. It does not — all four years count under the criterion. If you are pulling your return figures together by hand, the [quarterly VAT return helper](/tools/finance/vat-return-helper) shortens the aggregation step. ## The actual integration steps on the Fatoora platform Integration does not start with code. It starts with registering your invoicing device or system on the Fatoora platform and obtaining the digital signature certificate (`CSID`). The steps, per the Fatoora platform user manual published by the Authority: - Log in to the Fatoora platform and choose to onboard a new solution unit or device. - Generate a one-time password (`OTP`) from the platform for each of your invoice-generation units. - Enter the code in the generation unit **within one hour** of generating it. Once the hour lapses you have to generate a new code. - Receive the digital signature certificate and activate it on the unit. The platform lists every onboarded unit along with its status, and lets you revoke existing certificates or renew them. The practical point here: every point of sale, branch or server that issues invoices is a separate unit that needs its own certificate. Count your units before you start, not after you get stuck halfway. ## Clearance versus reporting — the difference that changes your working day This is the distinction that trips up most business owners, because it changes the daily sequence of work rather than just the file format. | Aspect | Tax invoice (B2B / B2G) | Simplified tax receipt (B2C) | |---|---|---| | Process | Clearance | Reporting | | Timing | Before it is handed to the customer | Within 24 hours of issuance | | Format | XML via an API | XML via an API | | What the platform does | Adds a cryptographic stamp and a QR code to the XML file once validation passes | Returns the validation result | | Effect of a rejection | The invoice is not cleared and is not handed over | The reason for the rejection must be resolved | The direct operational impact: at the point of sale the customer waits for nothing, because reporting happens within 24 hours. In business-to-business sales, by contrast, the invoice cannot be handed over until it has been cleared. That is exactly why your [point of sale system](/pos) and your [accounting](/accounting) system need to handle both cases automatically, with no staff intervention. The details follow the detailed e-invoicing guideline published by the Authority. ## Penalties for non-compliance — the officially published figures Breaches of the e-invoicing regulation are subject to the penalties and fines set out in the VAT Law. The figures published on the Authority's official penalties and fines page: | Violation | Fine | |---|---| | Failure to register for VAT | SAR 10,000 | | Issuing a tax invoice by a party not authorised to issue one | Up to SAR 100,000 | | Failure to keep invoices and tax records | Up to SAR 50,000 | | Breaching any other provision of the Law or the Regulations | Up to SAR 50,000 | | Failure to file the return on time | 5% to 25% of the value of the tax | | Late payment of the tax | 5% of the unpaid tax for each month or part of a month | The same page states that if the violation is repeated within three years of the date of the final decision on it, the fine may be doubled. The figures above follow the penalties and fines page on the Authority's website — accessed August 2026. ## A practical readiness plan before 1 February 2027 The window between now and 1 February 2027 is enough — if you start now. Most delays happen when a flaw in the master data surfaces a few weeks before the deadline. - Check the VAT number, the legal name and the national address in your system. Any mismatch with the Authority's records will stop clearance. - Count your invoice-generation units: every register, every branch, every system. Each unit needs a certificate. - Review your item data, prices and tax rates. An invoice that gets rejected is usually rejected over a missing field, not over the integration itself. - Run a full cycle in the sandbox environment: a tax invoice, a simplified receipt, a credit note and a debit note. - Train whoever issues invoices to read a rejection message and act on it. This is the single most useful skill your team will need after go-live. - Have a plan for outages: what happens if the platform cannot be reached during a working day? Know how your system handles the queue and the retries. Businesses that integrate two months ahead of the deadline walk into 1 February 2027 without a pause. Those that leave it to the last week discover their data problems at the worst possible moment. ## Frequently asked questions ### Is my business covered by Wave 25 of e-invoicing? Yes, if your VAT-taxable revenue exceeded SAR 187,500 in any of the years 2022, 2023, 2024 or 2025. Exceeding the threshold in a single year is enough to bring you into the wave; you do not need to have exceeded it in all four years. The criterion follows the Zakat, Tax and Customs Authority announcement issued on 24 July 2026. ### What is the deadline for Wave 25 systems to integrate with the Fatoora platform? 1 February 2027 at the latest. The Zakat, Tax and Customs Authority announced that it will notify all businesses targeted in the twenty-fifth wave to integrate their e-invoicing solutions with the Fatoora platform by that date at the latest. ### What should I do if I have not received a notification from the Zakat, Tax and Customs Authority? Do not wait. The Authority notifies targeted businesses at least six months before implementation, per the official implementation phases page, but the notice starts the clock and does not buy you extra time. Review your own taxable revenue for 2022 through 2025, and if any year exceeded SAR 187,500, start preparing immediately. ### What is the difference between clearing a tax invoice and reporting a simplified receipt? A tax invoice (B2B and B2G) is sent to the Fatoora platform for clearance before it is handed to the customer, and the platform adds a cryptographic stamp and a QR code to it once validation passes. A simplified tax receipt (B2C) is reported in XML within 24 hours of issuance, so the customer waits for nothing at the point of sale. ### How do I get the digital signature certificate for an invoicing device? Through the Fatoora platform: log in, choose to onboard a new solution unit or device, generate a one-time password, then enter it in the generation unit within one hour of generating it. You then receive the digital signature certificate and activate it on the unit. Every point of sale, branch or server that issues invoices needs its own unit and its own certificate. ### What is the penalty for failing to comply with the e-invoicing requirements? Breaches of the e-invoicing regulation are subject to the penalties and fines set out in the VAT Law. Among the figures published on the official penalties and fines page: SAR 10,000 for failure to register for VAT, up to SAR 100,000 for issuing a tax invoice by a party not authorised to issue one, and up to SAR 50,000 for failure to keep invoices and tax records. If the violation is repeated within three years of the final decision, the fine may be doubled. --- ## About the publisher **Snad (سند)** — a private Saudi software company based in Riyadh, founded 2025. Legal form: Sole proprietorship. Commercial registration: 7038154642 VAT number: 310959226500003 Only official domain: snad.io > Snad is a private commercial business-management platform. It is not a > government body, not a bank, and not a government services portal, and it > is not affiliated with any government entity. Any site or app with a > similar name is unrelated to Snad.