ZATCA e-invoicing Phase 2 (Fatoorah): the complete compliance roadmap for businesses in Saudi Arabia

Overview

Saudi Arabia's e-invoicing mandate — officially called Fatoorah — was introduced by ZATCA (Zakat, Tax and Customs Authority) in two phases. Phase 1 (generation and storage) was mandatory for all VAT-registered businesses from 4 December 2021. Phase 2 (integration with ZATCA's platform) began rolling out from January 2023 in waves, and is expected to cover all VAT-registered businesses by 2026.

For Indian-owned businesses operating in Saudi Arabia — across IT, construction, retail, healthcare, and professional services — Phase 2 represents a significant technical integration requirement. Non-compliance exposes entities to ZATCA penalties, VAT return rejection, and potentially blocked commercial registration renewal.

1. Phase 1 vs Phase 2 — Key Differences

Phase 1 (from 4 December 2021 — all VAT-registered businesses):

• Generation of e-invoices and e-notes (debit/credit notes) using electronic invoicing solutions.
• Storage of invoices in a structured electronic format — paper invoices are no longer sufficient.
• No real-time ZATCA connectivity required in Phase 1 — invoices are generated and stored locally.
• Required fields: seller name, VAT number, invoice date, invoice total, VAT amount, and a QR code (TLV-encoded, for B2C invoices).

Phase 2 (from January 2023 — wave-based rollout):

• Real-time or near-real-time integration with ZATCA's Fatoorah platform via clearance or reporting APIs.
• UBL 2.1 XML invoice format — invoices must be generated in ZATCA-compliant XML schema.
• Cryptographic Stamp Identifier (CSID) — each invoice must carry a ZATCA-issued cryptographic stamp, obtained by connecting the e-invoicing solution to ZATCA's API using an onboarding certificate.
• Two invoice modes: Clearance (B2B and exports above SAR 1,000) — invoice must be cleared by ZATCA before it is issued to the buyer. Reporting (B2C and B2B below SAR 1,000) — invoice is reported to ZATCA within 24 hours (or 72 hours for simplified invoices in bulk).

2. Wave-Based Rollout — Who Is Affected and When

ZATCA selects entities for each wave based on their annual VAT-liable revenues. ZATCA notifies selected entities at least 6 months in advance of their wave go-live date. The rollout began with the largest businesses (Wave 1: entities with revenues exceeding SAR 3 billion, January 2023) and is progressively moving down the revenue scale.

Wave timeline (approximate, as ZATCA continues rollout):

• Wave 1 (Jan 2023): VAT revenues > SAR 3 billion.
• Wave 2 (Jul 2023): VAT revenues > SAR 500 million.
• Wave 3 (Oct 2023): VAT revenues > SAR 250 million.
• Waves 4–17 (2024–2026): Progressively covering all remaining VAT-registered entities down to the smallest businesses.

Most Indian-owned SMEs and mid-market businesses in Saudi Arabia (annual turnover SAR 40–200 million) were notified in Waves 8–12 (roughly 2024–2025). ZATCA sends an official notification letter, after which the entity has 6 months to achieve Phase 2 compliance.

3. Technical Requirements in Detail

UBL 2.1 XML invoice format: ZATCA mandates invoices in Universal Business Language (UBL) 2.1 format with ZATCA-specific extensions. The XML schema includes mandatory fields beyond the Phase 1 requirements: buyer VAT number (for B2B invoices), supply date, payment method, item-level tax details, and the CSID hash chain linking each invoice to the previous one.

Cryptographic Stamp Identifier (CSID): Before generating Phase 2 invoices, each e-invoicing solution must be onboarded to ZATCA's Fatoorah platform. The onboarding process involves:

• Generating a Certificate Signing Request (CSR) from the e-invoicing solution.
• Submitting the CSR to ZATCA's compliance CSID API — ZATCA returns a compliance CSID.
• Running compliance checks (ZATCA sends 6 test invoice samples across clearance and reporting modes).
• Upon passing compliance checks, receiving a Production CSID — the certificate used to cryptographically stamp live invoices.

Clearance API workflow (B2B invoices > SAR 1,000):

• Generate UBL XML invoice and sign with Production CSID.
• Submit to ZATCA clearance API (POST /invoices/clearance/single).
• ZATCA validates and returns: cleared invoice XML with ZATCA's cryptographic stamp embedded.
• Issue the ZATCA-cleared invoice to the buyer — the buyer's ERP can verify the invoice is ZATCA-cleared.

Reporting API workflow (B2C and simplified invoices):

• Generate UBL XML invoice (simplified format for B2C) and sign with Production CSID.
• Issue the invoice immediately to the customer (no pre-clearance required).
• Submit the invoice to ZATCA reporting API within 24 hours (or batch of simplified invoices within 72 hours).

4. ERP Integration — SAP, Oracle, and Microsoft Dynamics

Most Indian-owned businesses in Saudi Arabia run SAP ECC/S4HANA, Oracle Fusion/EBS, or Microsoft Dynamics. ZATCA Phase 2 requires the ERP to generate UBL 2.1 XML, call the ZATCA clearance/reporting API, and embed the ZATCA-returned stamp in the invoice PDF sent to customers.

SAP: SAP released its ZATCA e-invoicing add-on (SAP Localization Hub, e-Document Cockpit) as part of SAP standard. Indian IT teams deploying SAP for Saudi clients must configure the SAP ZATCA connector with the Production CSID credentials, and ensure the UBL mapping from SD/FI billing documents is complete.

Oracle: Oracle provides its ZATCA e-invoicing solution through Oracle E-Business Suite (EBS) and Fusion Cloud Financial. India-based Oracle implementation partners commonly handle ZATCA Phase 2 for Indian clients in Saudi Arabia — but remote API access from India to ZATCA's Saudi-hosted platform requires VPN or direct internet egress from Saudi Arabia (ZATCA API access from offshore IPs may be blocked).

Microsoft Dynamics 365: Microsoft released ZATCA e-invoicing for Dynamics 365 Finance and Supply Chain Management. Third-party ISVs also provide ZATCA connectors for Dynamics BC/NAV deployments.

5. Common Errors and ZATCA Penalties

Common Phase 2 integration errors:

• Certificate mismatch: Using the compliance CSID (test environment) in production — invoices are rejected by ZATCA's clearance API.
• XML schema validation failure: Missing mandatory fields (buyer VAT number for B2B, supply date) or incorrect namespace declarations in UBL 2.1.
• QR code encoding error: Phase 2 B2C simplified invoices use TLV-encoded QR codes with 8 mandatory fields — incorrect encoding causes ZATCA rejection.
• Certificate renewal failure: Production CSIDs expire and must be renewed. Failure to renew results in all new invoices being generated without a valid CSID — constituting non-compliance.
• API latency and timeout handling: The clearance API can have response delays — e-invoicing solutions must handle timeout retries correctly without generating duplicate invoice UUIDs.

ZATCA penalties for e-invoicing non-compliance:

• Failure to comply with e-invoicing obligations: warning for first offence, fine not less than SAR 1,000 and not more than SAR 50,000 for subsequent offences.
• Issuing invoices not in compliance with Phase 2 requirements after ZATCA notification: treated as a VAT violation — VAT and penalties on incorrectly issued invoices.
• Commercial registration renewal blocks: MOC has indicated that Phase 2 compliance may be a condition for CR renewal in future waves.

6. Action Checklist for Indian-Owned Businesses

• Monitor ZATCA notifications — check if your entity has received a Phase 2 wave notification letter (available on ZATCA's Fatoorah portal).
• Assess your e-invoicing solution — confirm it supports UBL 2.1 XML generation, CSID signing, and direct ZATCA clearance/reporting API connectivity.
• Complete ZATCA onboarding in the simulation environment before your wave go-live — ZATCA provides a sandbox (simulation) environment for testing.
• Configure your ERP (SAP/Oracle/Dynamics) with Production CSID credentials and test end-to-end invoice clearance in UAT.
• Train your finance team on the new invoice issuance workflow — Phase 2 invoices cannot be issued to buyers until ZATCA clearance is received (for B2B).
• Set up certificate renewal monitoring — Production CSIDs must be renewed before expiry to avoid compliance gaps.
• Review ZATCA penalty exposure for any past non-compliance — ZATCA's voluntary disclosure programme may be available.