Electronic Invoicing in Saudi Arabia: ZATCA Phase 2 Compliance Guide

Phase 1 was about generating e-invoices. Phase 2 is about connecting them in real time to ZATCA's systems. If your business is VAT-registered in Saudi Arabia and you have not integrated with the Fatoora platform, your compliance clock is running — and it may already be expired.

Here is what Phase 2 actually requires, when your deadline is, and how Wateer's digital receipt infrastructure is built to handle it.

Phase 1 vs. Phase 2 — What Changed

ZATCA rolled out electronic invoicing in two phases.

**Phase 1 — Generation Phase** (live since December 4, 2021): Every VAT-registered business in the Kingdom must generate, store, and issue e-invoices in a structured electronic format. Paper invoices with handwritten entries no longer comply. Phase 1 was the floor — every business had to get off paper.

**Phase 2 — Integration Phase** (rolling out in waves since January 2023): Businesses must integrate their billing systems directly with ZATCA's Fatoora platform via API. Every invoice is reported to ZATCA in near-real time before it reaches the customer. Phase 1 created digital invoices. Phase 2 puts them on ZATCA's ledger.

The shift matters because Phase 2 is not just a format upgrade. It is a live connection between your point of sale and a government tax authority. Any invoice generated without a valid UUID, a cryptographic stamp, and a confirmed API handshake is technically non-compliant.

Deadline Timeline: When Is Your Wave?

ZATCA is phasing in compliance by taxpayer revenue size. Larger businesses integrated first. Smaller businesses are being added in successive waves.

| Wave | Annual Revenue Threshold | Integration Deadline |

|------|--------------------------|---------------------|

| 1 | Above SAR 3 billion | January 1, 2023 |

| 2 | Above SAR 500 million | July 1, 2023 |

| 3 | Above SAR 250 million | October 1, 2023 |

| 4 | Above SAR 150 million | November 1, 2023 |

| 5 | Above SAR 100 million | December 1, 2023 |

| 6 | Above SAR 70 million | January 1, 2024 |

| 7–onward | Smaller taxpayers | Announced per wave by ZATCA |

If you are in Wave 7 or beyond, ZATCA will notify you directly with a 6-month preparation window before your integration deadline. The notification comes via official communication to your registered contact. If you have not received it yet, it does not mean your deadline has not been set — verify your registered details at [zatca.gov.sa](https://zatca.gov.sa).

What Phase 2 Technically Requires

This is where most businesses get stuck. Phase 2 is not just an invoice format — it is a set of technical specifications your billing system must meet before you can generate a compliant invoice.

**UUID (Universally Unique Identifier):** Every invoice must carry a UUID generated by your system. This is a 128-bit identifier that makes each invoice globally unique and traceable. If your POS or billing software does not generate UUIDs, it cannot produce a Phase 2-compliant invoice.

**Cryptographic Stamp:** Each invoice must be cryptographically signed using a certificate issued by ZATCA's Certificate Authority. The stamp validates that the invoice was generated by your system and has not been altered. ZATCA verifies this stamp when you report the invoice.

**QR Code:** The stamped invoice must include a machine-readable QR code that encodes the seller's name, VAT registration number, invoice timestamp, total amount, and VAT amount. Customers and auditors can scan it to verify authenticity.

**UBL 2.1 XML Format:** Invoices must be structured in Universal Business Language 2.1 XML — a standardized machine-readable format. This is what Fatoora's API accepts. Your system must output invoices in this format before reporting.

**Fatoora API Integration:** For standard tax invoices (B2B), your system must submit the invoice to Fatoora for clearance before issuing it to the buyer. For simplified invoices (B2C — including most retail receipts), reporting is near-real-time but can happen within 24 hours.

Penalties for Non-Compliance

ZATCA's E-Invoicing Regulations set out penalties for businesses that do not meet their Phase 2 obligations.

Failure to comply with e-invoicing requirements carries administrative fines of up to **SAR 50,000**. ZATCA has the authority to audit billing systems, review integration logs, and issue enforcement notices. For deliberate forgery or manipulation of e-invoice data, criminal liability applies separately.

Beyond the financial penalty, there is an operational risk: invoices that have not cleared Fatoora cannot be used as valid VAT documentation. If a B2B customer cannot reclaim input VAT because your invoice failed clearance, that is a commercial relationship problem — not just a compliance one.

How Wateer Is Already Phase 2 Compliant

Most businesses face Phase 2 compliance as a project: assess current billing infrastructure, identify gaps, rebuild or replace, integrate, test. It takes months and typically requires a technical implementation partner.

Wateer customers do not run that project.

Wateer's digital receipt infrastructure is built on the same technical requirements ZATCA mandates. Every receipt issued through Wateer carries a UUID, is timestamped and cryptographically signed, and is structured in a format compatible with ZATCA's reporting requirements. The QR code on every Wateer receipt is ZATCA-compliant by default — not retrofitted after the fact.

When ZATCA's B2C simplified invoice reporting requirements reach your wave, Wateer handles the Fatoora API reporting automatically. You do not rebuild your POS. You do not hire an implementation firm. The integration is already there.

One integration. PDPL compliance and ZATCA Phase 2 compliance, both handled. That is the architecture Wateer was built on.

---

#