By Mohamed Abdul Baseeth, Founder — Maas Consult Middle East Co. Updated: 2026

Quick Answer Box

What is ZATCA Phase 2? ZATCA Phase 2, also called the Integration Phase, of Saudi Arabia’s e-invoicing mandate requires businesses to connect their invoicing systems directly to the Zakat, Tax and Customs Authority’s FATOORAH platform in real time. Unlike Phase 1, which simply required generating structured digital invoices, Phase 2 demands live API integration so that every invoice is either cleared or reported through ZATCA’s central system before or shortly after it is issued.

In short: your accounting or ERP system must talk to ZATCA automatically, for every invoice, every time.

Key Takeaways

• ZATCA Phase 2 is the integration phase of Saudi Arabia’s e-invoicing (FATOORAH) regulation.
• It applies in waves, based on annual revenue thresholds. As of this update, Wave 24 (above SAR 375,000) is fully enforced, and Wave 25 (above SAR 187,500, deadline 1 February 2027) is the current compliance horizon.
• Two invoice modes are required: Clearance Mode (B2B/B2G) and Reporting Mode (B2C).
• Non-compliance carries penalties from SAR 1,000 for a first offence up to SAR 50,000 for repeat violations, and ZATCA can suspend a business’s ability to issue invoices entirely.
• Businesses need a ZATCA-compliant ERP or accounting system to integrate with FATOORAH via API. ERPNext, which Maas Consult implements as an official Frappe Emerging Partner, is one such platform; Odoo, SAP Business One, and Microsoft Dynamics are others in the market, each with a different cost and complexity profile.
• Early implementation is strongly advised, waiting for your wave creates last-minute risk.

What Exactly is ZATCA, and Why Does This Matter?

If you run a business in Saudi Arabia, ZATCA is not a name you can afford to ignore.

The Zakat, Tax and Customs Authority, commonly known as ZATCA, is the Saudi government body responsible for tax collection, zakat assessment, and customs regulation across the Kingdom. It oversees VAT compliance, excise tax, and increasingly, the digitization of all commercial transactions through mandatory e-invoicing.

Saudi Arabia’s e-invoicing initiative, branded FATOORAH (فاتورة, Arabic for “invoice”), was launched as part of the Kingdom’s Vision 2030 digital transformation agenda. The goal is straightforward: eliminate paper invoices, reduce tax evasion, improve financial data transparency, and bring Saudi businesses into alignment with global digital commerce standards. Fatoorah is both the name of the regulation and the technical portal businesses connect to.

The regulation rolled out in two distinct phases, and Phase 2 is where most businesses are either currently preparing, currently integrating, or unfortunately still catching up.

ZATCA Phase 1 vs Phase 2: What Changed?

Definition Box: ZATCA Phase 1 (Generation Phase) Phase 1, effective December 4, 2021, required all VAT-registered businesses in Saudi Arabia to stop issuing manual paper invoices and begin generating electronic invoices using compliant software. Invoices had to include a QR code, specific structured data fields, and meet defined XML/PDF-A3 format requirements. Businesses were not required to connect to ZATCA’s systems in real time.

Phase 1 was essentially the discipline phase, ZATCA getting Saudi businesses to generate invoices the right way. Phase 2 takes that a major step further.

The fundamental shift is this: in Phase 1, your system generated the invoice. In Phase 2, ZATCA must approve or acknowledge it.

The Two Modes of ZATCA Phase 2: Clearance and Reporting

This is the part that confuses most business owners. Understanding the difference between these two modes is the single most important thing to grasp before planning your compliance approach.

Clearance Mode (B2B and B2G Invoices)

Definition: Clearance Mode A tax invoice (B2B or B2G) must be submitted to ZATCA’s FATOORAH platform and cleared, meaning ZATCA digitally validates and stamps it, before the invoice can legally be shared with the buyer.

How it works in practice:

1. Your ERP or accounting system generates the invoice in compliant XML format.
2. The invoice is submitted to ZATCA via API.
3. ZATCA validates the invoice data and applies a cryptographic clearance stamp.
4. The cleared invoice is returned to your system.
5. You share the cleared invoice with your B2B or government buyer.

The entire clearance cycle is designed to happen in seconds. In a well-integrated ERP setup, this is invisible to your sales team, the system handles it automatically.

Real-world scenario: A Riyadh-based IT solutions company issues an SAR 85,000 invoice to a government ministry. Before that invoice is valid, it must pass through ZATCA’s clearance process. If the system is not integrated, that invoice cannot legally be issued.

Reporting Mode (B2C Invoices)

Definition: Reporting Mode Simplified tax invoices (B2C) are generated and issued to the end customer first, then reported to ZATCA’s FATOORAH platform within 24 hours of issuance.

How it works in practice:

1. The system generates a simplified invoice for a retail or consumer transaction.
2. The invoice is issued immediately to the customer.
3. Within 24 hours, the invoice data is submitted to ZATCA in batch or real-time via API.
4. ZATCA acknowledges receipt.

Real-world scenario: A retail store in Riyadh sells SAR 350 of goods to a walk-in customer. The POS system generates the simplified invoice instantly. In the background, that invoice, along with all others from that day, gets reported to ZATCA by end of business.

Which Businesses Does ZATCA Phase 2 Apply To?

ZATCA rolls Phase 2 out in waves, targeting businesses based on annual revenue. If a business is VAT-registered and its taxable revenue exceeded a wave’s threshold in the relevant reference years, it is in that wave with a fixed compliance deadline.

Wave rollout, current status:

Wave 25, announced 24 July 2026, is the lowest threshold ZATCA has set so far, roughly matching Saudi Arabia’s own voluntary VAT registration threshold, which pulls in most of the remaining VAT-registered business population, including many small trading, retail and services firms for the first time. It is not a complete guarantee that no wave will ever follow it; ZATCA’s own roll-out page leaves room for further waves.

Important: even if a specific wave has not been announced for a business yet, it has been legally required to be Phase 1 compliant since December 2021. Given the pace of ZATCA’s rollout, and how far the threshold has already dropped, SMEs should not assume they are exempt.

ZATCA typically announces each wave around six months before its deadline and notifies targeted taxpayers directly. Check the official ZATCA portal at zatca.gov.sa for the latest wave announcements and to confirm your own status rather than assuming based on a general threshold alone.

What Are the ZATCA Phase 2 Technical Requirements?

This section is for business owners, CFOs, and IT teams who need to understand what “integration” actually means technically. For the full technical walkthrough, see our dedicated ERPNext ZATCA integration guide.

1. Invoice Format Requirements

All invoices must be generated in:

• XML format conforming to the UBL 2.1 (Universal Business Language) standard.
• PDF/A-3 format embedding the XML (for human-readable versions).
• Compliance with ZATCA’s technical specifications document (available on zatca.gov.sa).

2. Required Invoice Fields

Every compliant Phase 2 invoice must include: seller’s VAT registration number, buyer’s VAT registration number (for B2B), invoice UUID, invoice sequential number, issue date and time, invoice type code, line-level item description/quantity/unit price, VAT amount and rate, total amounts, cryptographic stamp, QR code, and the previous invoice hash for audit chain integrity.

3. Cryptographic Stamp Requirements

Each invoice must carry a ZATCA-issued cryptographic stamp, a digital signature generated using a certificate ZATCA issues during onboarding, proving the invoice has not been tampered with. The ERP system needs to store the certificate securely, apply the stamp automatically during generation, and maintain the invoice counter and hash chain.

4. FATOORAH API Integration

Systems communicate with FATOORAH via a Clearance API (B2B/B2G), a Reporting API (B2C), and an Onboarding API (initial device registration and certificate issuance). These use standard HTTPS calls with JSON payloads. Most modern ERP systems, including ERPNext, either natively support this or have certified integration modules available.

5. CSID and PCSID Onboarding

Before any invoice can be submitted, the system must complete technical onboarding: generate a CSR, submit it to ZATCA, receive a CCSID for compliance testing, complete that testing, receive a PCSID (the production certificate), then go live. This typically takes 5 to 15 business days when done correctly, longer if technical issues surface during testing.

Step-by-Step ZATCA Phase 2 Implementation Guide

Based on implementations our team at Maas Consult has completed for Saudi businesses across multiple sectors, here is a realistic step-by-step approach:

Step 1: Assess your current invoicing setup. Is the current system Phase 1 compliant? What ERP or accounting software is in use? Is the vendor ZATCA-certified? Daily invoice volume, and the B2B/B2C split, both affect scope.

Step 2: Select a ZATCA-compliant solution. If already on ERPNext, verify the ZATCA Phase 2 module is installed and configured. If on unsupported or legacy software, this is the point to migrate. Evaluate vendors on ZATCA certification status, API integration maturity, local support, and cost, see our ERPNext modules guide for what a Saudi deployment typically needs.

Step 3: Complete ZATCA technical onboarding. Generate a CSR, submit and obtain a CCSID, complete compliance testing, resolve any rejection errors, obtain the production PCSID.

Step 4: Configure invoice templates and workflows. Set up required fields, the invoice counter and hash chain, the clearance workflow for B2B, and the reporting workflow for B2C.

Step 5: Staff training. Finance needs to understand cleared invoices and how to handle rejections; sales needs to understand that B2B invoices require clearance before sharing with customers; IT needs to monitor API health, manage certificate renewals, and escalate errors.

Step 6: Go-live and monitor. Move to production, watch the first week of transactions closely, have a process for handling rejected invoices, and set a reminder for certificate renewal before the PCSID expires.

ZATCA Phase 2 Penalties: What Non-Compliance Actually Costs

Many business owners underestimate the severity of ZATCA’s penalty framework. This is a genuine risk, not a formality.

ZATCA has historically paired new waves with a “warning first” grace period for first-time violations, but coverage and dates for that initiative change with each announcement, so don’t assume an earlier wave’s grace period still applies to yours. Enforcement is active for businesses already past their deadline.

There’s also a less-discussed risk: reputational and commercial risk. B2B buyers in Saudi Arabia increasingly request ZATCA-cleared invoices as part of their own internal compliance processes. A business that cannot produce a cleared invoice may lose work to competitors who can.

Expert Insight: What We See Going Wrong

From Mohamed Abdul Baseeth, Founder, Maas Consult Middle East Co.:

“After supporting more than 800 businesses through ZATCA compliance, the biggest mistake I see is businesses treating this as an IT project rather than a business process project. The technical integration is achievable, most modern ERP systems can handle it. The failures happen when a business hasn’t mapped its invoice workflows properly before integration, has legacy data problems, or hasn’t trained its finance team to understand what a rejected invoice means and what to do about it.

The second mistake is choosing a solution based on price alone. A cheap ERP module that isn’t regularly updated for ZATCA specification changes creates compliance risk six months down the line. Choose a solution with an active development team that monitors ZATCA’s technical bulletins.”

ZATCA regularly updates its technical specifications, most recently with Wave 25. Integration is not a one-time project; the solution needs to evolve with the regulation.

ZATCA Phase 2 and ERP Systems: The Landscape

If you’re evaluating ERP systems or wondering whether your current one is Phase 2 capable, here’s an honest overview of the landscape, and a note on where Maas Consult actually fits into it.

ERPNext and ZATCA Phase 2

ERPNext, the open-source ERP platform, supports ZATCA Phase 2 integration through dedicated modules. Its flexibility and open-source architecture make it well-suited for ZATCA compliance customization, invoice generation, XML formatting, cryptographic stamping, and API calls to FATOORAH can all be implemented natively. Maas Consult implements ERPNext for Saudi businesses as an official Frappe Emerging Partner, with full ZATCA Phase 2 integration as a core part of the deployment. For SMEs especially, ERPNext offers a cost-effective path to compliance without SAP-level licensing costs, real, current figures are in our ERP cost guide for Saudi Arabia.

Odoo and ZATCA Phase 2

Odoo supports ZATCA Phase 2 through its Saudi Arabia localization module. Its modular architecture means ZATCA compliance sits inside the same platform used for accounting, inventory, sales, and HR. The official localization is developed by Odoo S.A. and partner-maintained, with updates as ZATCA specifications evolve. Odoo is not a platform Maas Consult implements; it’s included here as part of a fair picture of the market, not a recommendation either way.

SAP and ZATCA Phase 2

SAP Business One and SAP S/4HANA have ZATCA-certified localization for Saudi Arabia, typically suited to mid-sized and larger enterprises given the licensing cost structure.

Microsoft Dynamics and ZATCA Phase 2

Microsoft Dynamics 365 Finance also has Saudi Arabia e-invoicing localization. As with SAP, implementation complexity and cost tend to favor larger organizations.

What If Your Current Software Is Not ZATCA-Compliant?

More common than you’d expect. Many Saudi SMEs still run basic accounting software, Excel-based invoicing, or regional systems never updated for Phase 2. Options are: upgrade to a compliant version if your vendor offers one (cheapest, if available), replace the system entirely, or use a ZATCA-certified middleware layer between the existing system and FATOORAH (higher ongoing cost, less short-term disruption).

Industry-Specific ZATCA Phase 2 Considerations

Retail and F&B. High B2C volumes make reporting mode the primary concern. The POS system needs to be integrated, or a certified POS-to-FATOORAH connector is required.

Contracting and Construction. High-value B2B invoices make clearance mode the primary concern. Project-based, staged invoicing (advance, progress, final) adds complexity, each invoice must be individually cleared.

Professional Services. Consulting, legal, accounting, and advisory firms primarily issue B2B invoices under clearance mode. Volume is typically lower but invoice values higher, so errors are more commercially sensitive.

Manufacturing and Distribution. Handling both B2B and B2C channels means both modes apply, and credit notes, debit notes, and supply chain transactions all need proper integration, not just standard invoices.

Healthcare and Pharmaceuticals. ZATCA compliance intersects with Ministry of Health regulations for certain providers, implementations need to account for both frameworks at once.

Common ZATCA Phase 2 Implementation Mistakes

1. Starting too late. A proper implementation realistically takes 4 to 12 weeks depending on complexity. Waiting until 2 to 3 weeks before a wave deadline means going live under pressure.
2. Relying on a non-certified ERP module. Not every “integration” sold in the market has actually been tested and certified by ZATCA. Verify against ZATCA’s published list of compliant solutions.
3. Ignoring credit notes and debit notes. These have their own ZATCA requirements and must also be cleared or reported, a commonly missed detail.
4. Poor certificate management. A PCSID certificate has an expiry date. Without proactive renewal, the live integration breaks silently.
5. Not testing with realistic data. Rushing through compliance testing with simplified sample data often means real-world edge cases only surface after go-live.
6. Treating it as a one-time project. ZATCA updates its technical specifications regularly. An integration compliant in 2023 may need updating for Wave 25’s requirements in 2026.

ZATCA Phase 2 Compliance Checklist

Legal and Registration

• Business is VAT-registered with ZATCA
• Wave number and compliance deadline confirmed, not assumed
• Commercial registration number is current

Technical Infrastructure

• ERP or accounting software is ZATCA Phase 2 certified
• Invoice generation produces UBL 2.1 compliant XML
• System supports PDF/A-3 format with embedded XML
• Cryptographic stamp is implemented
• Invoice counter and hash chain are configured correctly

ZATCA Onboarding

• CSR generated and submitted
• CCSID received and compliance testing completed
• Testing passed with zero critical errors
• PCSID received for production use
• Certificate validity date tracked with a renewal reminder

Workflow Configuration

• B2B invoices follow the clearance workflow
• B2C invoices follow the reporting workflow (within 24 hours)
• Credit notes and debit notes configured for compliance
• Rejection handling process is defined and tested

Training and Monitoring

• Finance team trained on cleared vs uncleared invoices
• Sales team understands the clearance process for B2B
• IT team knows how to monitor API health and handle errors
• ZATCA portal access is set up for manual monitoring

How Much Does ZATCA Phase 2 Implementation Cost?

The honest answer: it depends on what you’re starting from, and the cost of non-compliance is higher than the cost of getting it right. What actually drives the number is invoice volume, how many branches or entities are involved, how far your current system sits from ZATCA’s requirements, and how much historical data needs migrating if you’re moving off a legacy system entirely.

Rather than publish a generic price table here that goes stale the moment a vendor changes their pricing, we keep real, sourced, current numbers in one place: our ERP cost guide for Saudi Arabia breaks down actual, cited pricing for ERPNext, TallyPrime, Zoho Books, Odoo, SAP Business One, and Daftra, including what’s publicly priced and what genuinely requires a quote.

ROI considerations beyond compliance: businesses that implement a full ERP alongside ZATCA integration typically see reduced invoice processing time, fewer VAT reconciliation errors, faster accounts receivable (cleared invoices are dispute-resistant), and better financial visibility. In our experience, businesses moving off paper or basic accounting software for ZATCA compliance often find the broader efficiency gains pay back the implementation cost within the first year, though this varies by business.

Illustrative Case Study: Small Professional Services Firm, Riyadh

A management consultancy in Riyadh with 12 employees and approximately SAR 4 million in annual B2B revenue was approaching its ZATCA Phase 2 wave deadline, running invoices on basic accounting software with no Phase 2 capability and no vendor roadmap to add it.

Challenge: replace the invoicing system, achieve compliance, and maintain business continuity, within 8 weeks.

Solution: Maas Consult deployed ERPNext with full ZATCA Phase 2 integration: Saudi Arabia localization, ZATCA onboarding and PCSID issuance, clearance workflow configuration for all B2B invoices, migration of customer master data and open invoices, and two finance team training sessions.

Result: live and compliant 6 weeks after project start. The first production invoice cleared successfully through ZATCA on day one of go-live. The firm also gained real-time financial dashboards and automated VAT reporting as additional benefits of the ERP deployment.

This example is representative of similar implementations. Timelines and outcomes vary by business complexity.

Frequently Asked Questions

What is ZATCA Phase 2 in simple terms? The second stage of Saudi Arabia’s e-invoicing law (FATOORAH). It requires businesses to connect their invoicing software directly to ZATCA’s system so invoices are automatically verified by the tax authority in real time, think of it as ZATCA being a silent co-signer on every invoice a business issues.

What does “Fatoorah” actually mean? Fatoorah (فاتورة) is simply the Arabic word for “invoice.” It’s the brand name ZATCA gave the entire e-invoicing programme, and also the name of the technical platform businesses connect to for clearance and reporting.

When is the ZATCA Phase 2 deadline? There is no single deadline, Phase 2 rolls out in waves based on annual revenue. The largest businesses (SAR 3 billion+) complied from January 2023. As of this update, Wave 24 (above SAR 375,000) is fully enforced, and Wave 25 (above SAR 187,500) runs through 1 February 2027. Check zatca.gov.sa to confirm a specific wave.

What is the difference between clearance mode and reporting mode? Clearance applies to B2B and B2G invoices, ZATCA must approve the invoice before it reaches the customer. Reporting applies to B2C invoices, the customer gets the invoice immediately, and it’s reported to ZATCA within 24 hours.

Which businesses are required to comply with ZATCA Phase 2? All VAT-registered businesses in Saudi Arabia. The only variable is when, determined by annual revenue wave. Higher-revenue businesses integrated first; lower-revenue SMEs follow in later waves.

What happens if a business misses its ZATCA Phase 2 deadline? Penalties from SAR 1,000 up to SAR 50,000 depending on the violation and whether it’s a repeat offence. More immediately, non-compliant businesses may be unable to issue legally valid B2B invoices, affecting their ability to collect payment from corporate clients. ZATCA typically issues warning notices before maximum penalties, but enforcement is active.

Can a business handle ZATCA Phase 2 without an ERP? Technically possible but impractical at meaningful volume. Some businesses use ZATCA-certified standalone invoicing software instead of a full ERP, but for businesses with real invoice volumes, an ERP with built-in ZATCA integration is significantly more efficient and less error-prone.

Is ERPNext compliant with ZATCA Phase 2? Yes, through its Saudi Arabia localization. The capability exists in the platform, but correct implementation and configuration by a qualified implementer is what makes it functional and legally compliant, not the software alone.

How long does ZATCA Phase 2 implementation take? For a straightforward SME implementation, 4 to 8 weeks from project start to go-live is typical. Larger or more complex businesses may need 3 to 6 months. ZATCA’s own onboarding and testing process alone can take 2 to 3 weeks.

What is a PCSID? Production Cryptographic Solution Identifier, the digital certificate ZATCA issues that authorizes production API integration. No live invoices can be submitted without a valid PCSID, and it must be renewed proactively before it expires.

Does ZATCA Phase 2 apply to credit notes and debit notes? Yes. They must be cleared or reported through FATOORAH the same as standard invoices, a commonly missed detail during implementation.

Can a foreign company operating in Saudi Arabia be subject to ZATCA Phase 2? If VAT-registered in Saudi Arabia, for example through a branch office or permanent establishment, yes, the same requirements apply as for Saudi-registered businesses.

Conclusion

ZATCA Phase 2 is not going away, and the compliance wave is heading toward every VAT-registered business in Saudi Arabia regardless of size. The businesses that navigate it most smoothly treat it as a business improvement opportunity, not just a regulatory checkbox. The mandate forces a proper, integrated invoicing system into place; once it’s there, the downstream benefits, faster invoicing, cleaner VAT reconciliation, better cash flow visibility, dispute-resistant cleared invoices, are real.

If you’re unsure where your business stands, the practical first step is a straightforward assessment: where you are today, what wave applies, and what implementation actually looks like for your specific situation. For the practical, deadline-driven side of this, including a live countdown to the Wave 25 deadline and a free audit offer, see our ZATCA e-invoicing compliance page.

Work With Maas Consult on ZATCA Phase 2

Maas Consult Middle East Co. has supported over 800 businesses in achieving ZATCA e-invoicing compliance across Saudi Arabia, and implements ERPNext with full Phase 2 integration as a core part of every deployment, as an official Frappe Emerging Partner.

Request a ZATCA Phase 2 compliance assessment →

This article is provided for informational purposes. Regulations may be updated, always verify current requirements at zatca.gov.sa or consult a qualified compliance specialist.