Key Takeaway
Starting January 2026, all B2B invoices must be cleared in real‑time with ZATCA. Non‑compliance can result in penalties up to 50,000 SAR. Using Phase 2‑certified e‑invoicing software is mandatory.
What is ZATCA Phase 2 (FATOORA)?
ZATCA (Zakat, Tax and Customs Authority) has rolled out the second phase of its FATOORA electronic invoicing mandate. Unlike Phase 1 (which only required generating compliant invoices), Phase 2 requires real‑time clearance — every B2B invoice must be sent to ZATCA's portal and receive a cryptographic stamp before it can be shared with the buyer.
Who Must Comply?
All businesses with annual revenues exceeding 50 million SAR were in Wave 1. Subsequent waves now include mid‑sized companies (revenue > 25 million SAR) and will eventually cover all VAT‑registered entities by 2027. If you issue B2B invoices in Saudi Arabia, you need to prepare now.
Technical Requirements for SaaS
Your e‑invoicing solution must support:
- UBL 2.1 XML format (with Saudi‑specific extensions)
- Cryptographic stamp (CSID) generation and verification
- Real‑time API integration with ZATCA's Fatoora portal
- QR code containing invoice hash and ZATCA reference
- Tamper‑proof archiving for 6+ years
At InvoiceKSA, we verify each listed software's Phase 2 compliance by checking their official ZATCA sandbox accreditation and developer documentation.
Data Residency and PDPL
Beyond ZATCA, Saudi Arabia's Personal Data Protection Law (PDPL) requires that sensitive financial data of Saudi citizens and businesses be stored within the Kingdom. We recommend selecting vendors with data centers in Riyadh, Jeddah, or Dammam — this also reduces latency for real‑time clearance.
Checklist: How to Become Phase 2 Compliant
- Confirm your ZATCA wave and registration deadline on the official Fatoora portal.
- Select a Phase 2‑accredited e‑invoicing solution (see our recommendations below).
- Complete onboarding and obtain a Cryptographic Stamp Identifier (CSID).
- Run test invoices in the ZATCA sandbox environment.
- Switch to production mode and monitor clearance reports.
Recommended Phase 2 Compliant Software
Salla
ZATCA Phase 2 & E‑Commerce
Review →
Frequently Asked Questions
What happens if I don't comply by my wave deadline?
ZATCA may impose fines starting from 5,000 SAR up to 50,000 SAR, and repeated violations can lead to business suspension.
Can I use international invoicing software (e.g., QuickBooks, Xero)?
Only if the software has a specific ZATCA Phase 2 connector and is officially listed on ZATCA's compliant solutions page. Many global tools lack local integration.
What is a Cryptographic Stamp Identifier (CSID) and how do I get one?
A CSID is a unique cryptographic certificate issued by ZATCA that identifies your business as a compliant issuer. You obtain it by onboarding through the Fatoora portal using a compliant e‑invoicing solution. The software will generate a CSR (Certificate Signing Request) and submit it to ZATCA's API, which returns the CSID for signing invoices.
Does Phase 2 apply to B2C (business‑to‑consumer) invoices as well?
Phase 2 primarily targets B2B transactions with real‑time clearance. B2C invoices currently fall under a simplified regime (Phase 1+), but ZATCA has announced plans to extend real‑time reporting to selected B2C sectors in later waves. If you issue both B2B and B2C, ensure your solution can handle both models.
Can I still issue paper invoices alongside electronic ones?
No. Once you are enrolled in Phase 2, paper invoices are no longer considered legally valid for tax purposes. All invoices must be electronic, cleared through ZATCA, and contain the required cryptographic stamp and QR code.
How long must I archive invoices and in what format?
You must retain all electronic invoices and associated clearance responses for at least six years from the invoice date. They must be stored in the original XML format, along with the signed version, in a tamper‑proof archive that supports audit trails and easy retrieval by ZATCA.
What integration steps are required to connect my ERP to ZATCA’s API?
Typical integration involves: 1) Register your solution in the Fatoora sandbox, 2) Obtain an API key and CSID, 3) Implement endpoints for invoice reporting and clearance, 4) Handle error codes like duplicate invoices or format violations, and 5) Move to production after successful test runs. Most certified software already packages this flow, but custom ERP integrations require developer resources familiar with the ZATCA Developer Hub.
Need help picking compliant software?
Compare top ZATCA Phase 2 solutions side‑by‑side.
Compare Software →
Advertiser Disclosure: ZatcaHub is an independent comparison site. We may earn affiliate commissions when you click links or purchase software. This does not affect our editorial integrity. All trademarks are property of their respective owners.
© 2026 ZatcaHub — Built for Saudi B2B e-invoicing decisions. Privacy · Terms · Disclosure · sitemap