Electronic Invoicing in Saudi Arabia: A Practical Guide to ZATCA Phase 2 Compliance

Phase 1 was about generating e-invoices. Phase 2 is about connecting them to ZATCA's systems in real time. If your business is VAT-registered in Saudi Arabia and you have not integrated with the Fatoora platform, your compliance clock is running, and it may already have run out.

Here is what Phase 2 actually requires, how to identify your deadline, and how Wateer's digital receipt infrastructure is built to handle it.

Phase 1 and Phase 2: What Changed

ZATCA rolled out electronic invoicing in two stages.

Phase 1, the generation phase (live since December 4, 2021): every VAT-registered business in the Kingdom must generate, store, and issue e-invoices in a structured electronic format. Paper invoices with handwritten entries no longer comply. Phase 1 set the floor. Every business had to get off paper.

Phase 2, the integration phase (rolling out in waves since January 2023): businesses must connect their billing systems directly to ZATCA's Fatoora platform through an API. Invoices are reported to ZATCA in near real time before they reach the customer. Phase 1 created digital invoices. Phase 2 puts them on ZATCA's ledger.

The distinction matters, because Phase 2 is not a format upgrade. It is a live connection between your point of sale and a government tax authority. Any invoice generated without a valid UUID, a cryptographic stamp, and a confirmed API handshake is technically non-compliant.

Deadlines: Finding Your Wave

ZATCA is phasing in compliance according to taxpayer revenue. Larger businesses integrated first, with smaller ones added in successive waves.

• Wave 1: annual revenue above SAR 3 billion, integration deadline January 1, 2023

• Wave 2: above SAR 500 million, July 1, 2023

• Wave 3: above SAR 250 million, October 1, 2023

• Wave 4: above SAR 150 million, November 1, 2023

• Wave 5: above SAR 100 million, December 1, 2023

• Wave 6: above SAR 70 million, January 1, 2024

• Wave 7 onward: smaller taxpayers, announced per wave by ZATCA

If you fall into Wave 7 or later, ZATCA will notify you directly and give you a six-month preparation window before your integration deadline. The notice arrives through official communication to your registered contact details. If it has not reached you yet, that does not mean your deadline has not been set. Verify your registered details at zatca.gov.sa.

What Phase 2 Requires Technically

This is where most businesses stall. Phase 2 is a set of technical specifications your billing system must meet before it can produce a compliant invoice.

UUID (universally unique identifier): every invoice must carry a UUID generated by your system. This 128-bit identifier makes each invoice globally unique and traceable. If your point-of-sale or billing software cannot generate UUIDs, it cannot produce a Phase 2-compliant invoice.

Cryptographic stamp: each invoice must be cryptographically signed using a certificate issued by ZATCA's Certificate Authority. The stamp confirms that the invoice came from your system and has not been altered. ZATCA verifies it when the invoice is reported.

QR code: the stamped invoice must carry a machine-readable QR code encoding the seller's name, VAT registration number, invoice timestamp, total amount, and VAT amount. Customers and auditors can scan it to confirm authenticity.

UBL 2.1 XML format: invoices must be structured in Universal Business Language 2.1 XML, a standardized machine-readable format. This is what the Fatoora API accepts, so your system must output invoices in this format before reporting them.

Fatoora API integration: for standard tax invoices (B2B), your system must submit the invoice to Fatoora for clearance before issuing it to the buyer. For simplified invoices (B2C, which covers most retail receipts), reporting is near real time but may occur within 24 hours.

Penalties for Non-Compliance

ZATCA's E-Invoicing Regulations set out penalties for businesses that fail to meet their Phase 2 obligations.

Failure to comply with e-invoicing requirements carries administrative fines of up to SAR 50,000. ZATCA has the authority to audit billing systems, review integration logs, and issue enforcement notices. Deliberate forgery or manipulation of e-invoice data carries criminal liability separately.

There is an operational risk alongside the financial one. Invoices that have not cleared Fatoora cannot serve as valid VAT documentation. If a B2B customer cannot reclaim input VAT because your invoice failed clearance, that becomes a commercial relationship problem, not only a compliance issue.

How Wateer Is Already Phase 2 Compliant

For most businesses, Phase 2 becomes a project: assess the current billing infrastructure, identify gaps, rebuild or replace, integrate, test. It takes months and usually calls for a technical implementation partner.

Wateer customers skip that project.

Wateer's digital receipt infrastructure is built on the same technical requirements ZATCA mandates. Every receipt issued through Wateer carries a UUID, is timestamped and cryptographically signed, and is structured in a format compatible with ZATCA's reporting requirements. The QR code on every Wateer receipt supports validation by default, not retrofitted afterwards.

When ZATCA's B2C simplified invoice reporting requirements reach your wave, Wateer handles the Fatoora API reporting automatically. No rebuilding your point of sale. No hiring an implementation firm. The integration is already in place.

One integration, covering both PDPL compliance and ZATCA Phase 2 compliance. That is the architecture Wateer was built on.

Sources & References

• ZATCA — Phase 2 E-Invoicing (Integration Phase) Official Technical Specifications & Portal
• ZATCA — Official Integration Wave Criteria & Mandate Timelines