ZATCA Phase 2 Explained: Scope, Thresholds, Waves, Penalties, Timeline (2026)

ZATCA Phase 2 — the Integration Phase of Saudi Arabia's Fatoorah e-invoicing programme — requires every VAT-registered business in KSA to integrate its e-invoicing system with ZATCA's central platform. B2B Standard Tax Invoices are cleared in real time; B2C Simplified Tax Invoices are reported within 24 hours. Rollout is wave-based: Wave 1 began 1 January 2023 for taxpayers with VATable revenue ≥ SAR 3 bn; subsequent waves have stepped down the threshold through 2026.

Macro context — where Phase 2 fits

Phase 2 puts Saudi Arabia in the CTC clearance camp alongside Italy (SdI), Türkiye (e-Fatura), India (IRP), and most LATAM regimes.

Phase 2 puts Saudi Arabia in the CTC clearance camp alongside Italy (SdI), Türkiye (e-Fatura), India (IRP), and most LATAM regimes. ZATCA chose UBL 2.1 over its own schema — a deliberate alignment with European invoicing standards that makes ZATCA-cleared invoices structurally closer to Peppol BIS than to neighbouring Gulf systems. The mandate page /e-invoicing/zatca-phase-2 implements those primitives in product; this article is the rule-set behind it.

What Phase 2 requires

What artefacts must each invoice carry?

A UBL 2. 1 XML payload with the ZATCA KSA extensions and the correct ProfileID (standard:1.

• A UBL 2.1 XML payload with the ZATCA KSA extensions and the correct ProfileID (standard:1.0 or reporting:1.0).
• An XAdES B-B signature applied after canonicalisation, signed with the Production CSID.
• An invoice hash chained to the previous invoice's hash (PIH).
• A sequential, gap-free Invoice Counter Value (ICV) per Solution Unit.
• A Base64-encoded TLV QR with nine tags in Phase 2 (the original five plus the cryptographic stamp tags).
• A PDF/A-3 rendering with the XML embedded.

How is the invoice transmitted to ZATCA?

Standard Tax Invoices (B2B) use the Clearance API: invoice in, cleared invoice out, only then delivered to the buyer. Simplified Tax Invoices (B2C) use the Reporting API: invoice delivered to buyer immediately and submitted to ZATCA within 24 hours.

Standard Tax Invoices (B2B) use the Clearance API: invoice in, cleared invoice out, only then delivered to the buyer. Simplified Tax Invoices (B2C) use the Reporting API: invoice delivered to buyer immediately and submitted to ZATCA within 24 hours.

Wave schedule and revenue thresholds

ZATCA does not switch every taxpayer on simultaneously. Each wave names taxpayers above a VATable-revenue threshold for the prior calendar year, with at least six months of integration notice.

ZATCA does not switch every taxpayer on simultaneously. Each wave names taxpayers above a VATable-revenue threshold for the prior calendar year, with at least six months of integration notice. The published waves so far:

Each wave is published as a news item on the ZATCA site — for example, the Wave 21 criteria notice. Always confirm your wave on Fatoora; the published threshold is the trigger but ZATCA notifies named taxpayers individually.

Who is in scope, and who is excluded

In scope: all resident VAT-registered persons in KSA, plus any party issuing tax invoices on their behalf.

In scope: all resident VAT-registered persons in KSA, plus any party issuing tax invoices on their behalf. Out of scope: non-resident sellers without a Saudi VAT registration; B2C cash sales below the simplified-invoice threshold remain in the Simplified Tax Invoice (reporting) flow rather than the Standard (clearance) flow.

What changed from Phase 1 (Generation)

Phase 1 demanded a structured, tamper-resistant, sequentially-numbered invoice with a TLV QR on B2C documents.

Phase 1 demanded a structured, tamper-resistant, sequentially-numbered invoice with a TLV QR on B2C documents. Phase 2 keeps all of that and adds: cryptographic signing with a state-issued certificate (CSID), a hash chain across invoices, real-time clearance for B2B, 24-hour reporting for B2C, and cryptographic-stamp QR tags. The full delta is in ZATCA Phase 1 vs Phase 2.

Penalty schedule

The penalty matrix issued under the e-invoicing regulation is escalating (warning on first breach, fine on second, then doubling on repeat).

The penalty matrix issued under the e-invoicing regulation is escalating (warning on first breach, fine on second, then doubling on repeat). Key bands:

• Failure to issue or store an e-invoice: warning, then up to SAR 50,000.
• Deletion or alteration of an issued invoice: up to SAR 50,000.
• Missing required QR field on a Simplified Tax Invoice: warning to SAR 5,000.
• Failure to notify ZATCA of malfunction of the EGS: warning to SAR 10,000.
• Late clearance (B2B) or late reporting (B2C, >24 h): per-invoice fine, capped per period.

Compliance checklist

Compliance checklist includes: ☐ Confirmed wave assignment on Fatoora. ☐ Production CSID issued per Solution Unit.

• ☐ Confirmed wave assignment on Fatoora.
• ☐ Production CSID issued per Solution Unit.
• ☐ Clearance flow blocks B2B delivery until cleared response received.
• ☐ Reporting flow submits B2C within the 24-hour window.
• ☐ Six-year archive of XML + QR + PDF/A-3 + cleared response.
• ☐ Penalty monitoring dashboard for late reports / failed clearances.

Key takeaways

Key takeaways includes: Phase 2 is real-time clearance for B2B, 24-hour reporting for B2C, on a UBL 2. 1 KSA profile.

• Phase 2 is real-time clearance for B2B, 24-hour reporting for B2C, on a UBL 2.1 KSA profile.
• Rollout is wave-based; thresholds have stepped down from SAR 3 bn (Wave 1) to under SAR 3 m (current waves).
• Phase 1 controls are preconditions, not substitutes — Phase 2 adds cryptography and transport.
• Penalties escalate on repeat; the most common breach in practice is missing or malformed QR on Simplified Tax Invoices.

Authority sources

• ZATCA — Roll-out phases
• ZATCA — What is e-invoicing?
• ZATCA — Detailed Guidelines for E-Invoicing v2 (PDF)
• ZATCA — E-Invoice specifications
• ZATCA — Wave 21 criteria announcement
• ZATCA — E-invoicing (Fatoorah) FAQ (PDF)

Ready to implement?

Follow the onboarding playbook in How to comply with ZATCA Phase 2, debug rejections with ZATCA Phase 2 common errors, and see the product implementation at Invoicemonk — ZATCA Phase 2.

Follow the onboarding playbook in How to comply with ZATCA Phase 2, debug rejections with ZATCA Phase 2 common errors, and see the product implementation at Invoicemonk — ZATCA Phase 2.