E-Invoicing Phase 2 Saudi: Waves & Deadlines 2026

By Ishita Roy — Business Consultant, Noble Core · Updated June 2026

What e-invoicing Phase 2 Saudi actually means

Saudi Arabia’s electronic invoicing programme (known locally as Fatoora) is run by the Zakat, Tax and Customs Authority (ZATCA). It was designed in two distinct stages. Phase 1, the Generation Phase, went live for every VAT-registered business on 4 December 2021 and simply required businesses to stop issuing handwritten or free-text-editable invoices and start generating them from a compliant electronic system.

Phase 2 — the Integration Phase — is a much bigger technical step. It requires your e-invoicing solution to actually connect to ZATCA’s Fatoora Platform through an API, so invoice data flows to the Authority either in real time or shortly after issuance. Instead of a PDF you email, a Phase 2 invoice is a structured XML file, cryptographically stamped, carrying a UUID, a hash chained to the previous invoice, a QR code, and (for standard invoices) a ZATCA cryptographic stamp confirming clearance.

Unlike Phase 1, Phase 2 does not start for everyone on the same day. ZATCA rolls it out in waves, calling in groups of taxpayers based on their VAT-taxable revenue in a reference year. The authoritative, continuously updated list of waves sits on the ZATCA e-invoicing roll-out phases page, and that page is the single source of truth for which wave you belong to.

Phase 1 vs Phase 2: the practical differences

A lot of businesses assume that because they passed Phase 1 they are ready for Phase 2. In practice the two phases test completely different things. Phase 1 tested your invoice format. Phase 2 tests your invoice infrastructure.

Requirement	Phase 1 (Generation)	Phase 2 (Integration)
Start date	4 December 2021 — all VAT registrants	From 1 January 2023, by wave
Invoice format	Any electronic format (PDF, system-generated)	XML or PDF/A-3 with embedded XML
Connection to ZATCA	None required	Mandatory API integration with Fatoora
Standard (B2B/B2G) invoices	Issued directly to buyer	Cleared by ZATCA before sharing with buyer
Simplified (B2C) invoices	QR code required	Reported to ZATCA within 24 hours
Cryptographic stamp / UUID / hash	Not required	Required
Solution onboarding	Not applicable	Device onboarded via OTP on Fatoora Portal
Archiving	Electronic records kept	Electronic records kept, tamper-proof, in the Kingdom

The crucial distinction inside Phase 2 is between clearance and reporting. Standard tax invoices — those issued to another business or to a government entity — must be sent to ZATCA first. ZATCA validates them, applies its cryptographic stamp, and returns them; only then are they legally valid to give to your customer. Simplified tax invoices, the kind issued at a retail counter or restaurant till, are given to the customer immediately with a QR code and then reported to ZATCA within 24 hours.

Who needs to comply, and in which wave

Phase 2 applies to every taxpayer resident in Saudi Arabia who is registered for VAT, plus any third party issuing tax invoices on behalf of such a taxpayer (for example an outsourced billing agent). Non-resident taxpayers registered for VAT in the Kingdom are outside the scope of e-invoicing.

ZATCA groups taxpayers into waves by their VAT-taxable turnover in a specified reference year — the earliest waves used 2021 revenue, later waves shifted to 2022 and then 2023 revenue as the thresholds dropped. Each wave is announced publicly and each selected taxpayer receives a direct notification, with a minimum of six months between notification and the compliance deadline.

How the wave thresholds have moved

The pattern has been consistent: each successive wave lowers the revenue threshold, pulling smaller businesses into scope. Wave 1 covered the very largest taxpayers (revenue above SAR 3 billion), and by the later waves the threshold had fallen into the low single-digit millions of riyals. The direction of travel is clear — eventually the whole VAT-registered base will be integrated.

Wave group	Indicative revenue threshold (reference year)	Typical go-live window
Wave 1	Above SAR 3 billion (2021)	From 1 January 2023
Waves 2–5	SAR 150 million – SAR 3 billion (2021/2022)	Through 2023
Waves 6–12	SAR 10 million – SAR 150 million (2021/2022)	2024
Waves 13–20	SAR 2 million – SAR 10 million (2022/2023)	2024–2025
Waves 21 onward	Below SAR 2 million (2022/2023 onward)	2025–2026

These bands are indicative groupings to help you locate yourself; the exact threshold, reference year and deadline for every individual wave are published on ZATCA’s roll-out phases page. Confirm current figures on the official portal before you plan a budget or a project timeline.

How to check whether you are in a wave

1. Open zatca.gov.sa → E-Invoicing → Introduction → Roll-out phases and read the wave table from the bottom up — the newest waves are the ones most likely to include you.
2. Pull your VAT returns for the reference year named in the wave criteria and total the taxable supplies. Use the figure as declared, not your management accounts.
3. Check the email address and mobile number registered against your VAT profile in the ZATCA portal. Wave notifications go there, and a stale contact record is the single most common reason a business misses its notice.
4. Log in to the ZATCA e-services portal and look at your taxpayer dashboard notifications inbox for any e-invoicing letter.
5. If you are still unsure, contact ZATCA through the 19993 unified number or the live-chat channel on the portal and ask for your wave status in writing.

Step-by-step: getting Phase 2 ready

The work splits into a software track and an administrative track. Run them in parallel — the software track is usually the long pole.

1. Select or upgrade a compliant e-invoicing solution

Your billing system must be able to generate XML in ZATCA’s required schema, produce a UUID and a previous-invoice hash, generate the TLV-encoded QR code, hold a cryptographic stamp identity, and call the Fatoora APIs. Most established ERP and POS vendors in the Kingdom now ship a certified Phase 2 module; smaller businesses often adopt a lightweight ZATCA-compliant cloud invoicing tool instead. Check that the vendor lists the Kingdom-specific compliance features explicitly, not just “e-invoicing”.

2. Register on the Fatoora Portal

Access the Fatoora Platform through your ZATCA taxpayer login. Inside, you will find the onboarding area where you generate the OTP codes used to pair each invoicing device or system instance with ZATCA.

3. Onboard each device with an OTP

1. In the Fatoora Portal, choose Onboard New Solution Unit/Device.
2. Enter the number of OTP codes you need — one per till, branch server or system instance.
3. Click Generate OTP. Each code is short-lived, so have your technical team ready before you generate.
4. Enter the OTP into your e-invoicing solution’s ZATCA onboarding screen.
5. The solution generates a Certificate Signing Request; ZATCA returns a Compliance Cryptographic Stamp Identifier (CCSID).
6. The solution runs compliance checks by submitting sample standard and simplified invoices, credit notes and debit notes.
7. On passing, ZATCA issues the Production Cryptographic Stamp Identifier (PCSID). The device is now live.

4. Run the compliance and integration sandbox

ZATCA provides a developer portal and sandbox environment so your team can test API calls, schema validation and error codes without touching production data. Do not skip this — most go-live failures are schema or field-mapping problems that the sandbox would have caught weeks earlier.

5. Clean your master data

Phase 2 validation is strict. Buyer VAT numbers, commercial register numbers, national addresses, item descriptions and unit codes all get checked. A customer record with a missing building number or a 14-digit VAT number typed as 13 digits will bounce an invoice at clearance.

6. Go live and monitor rejections

For the first fortnight after go-live, assign someone to watch the clearance and reporting responses daily. Rejected standard invoices are not valid tax invoices, which means your customer cannot recover input VAT and your own reporting will not tie out.

Documents, IDs and data you need on hand

• VAT registration certificate and 15-digit VAT identification number.
• Commercial Register (CR) number issued through the Ministry of Commerce. Note that under the new Commercial Register Law effective 3 April 2026, the Kingdom moved to a unified national CR whose identifier starts with “7” and which carries no expiry date — an annual confirmation replaces renewal, with a five-year grace period for transition, and English trade names are now permitted.
• National Address details for the head office and each branch — building number, street, district, city, postal code and additional number. Invoices are validated against national address formatting.
• Authorised signatory credentials for the ZATCA portal (usually the taxpayer’s registered user with a National ID or Iqama linked through Absher).
• Other tax identifiers where you hold them — group VAT number, customs importer number, or the “Other seller ID” fields ZATCA accepts.
• Technical assets: server or cloud environment, outbound HTTPS access to ZATCA endpoints, and secure storage for the cryptographic stamp certificates.
• For foreign-owned entities, the MISA investment licence number is worth keeping to hand, because it is frequently requested alongside the CR when updating registration data.

Costs and timelines: what to budget

ZATCA does not charge a fee to onboard onto the Fatoora Platform — registration, OTP generation and cryptographic stamp issuance are free. Your costs are software, integration effort and internal time. The figures below are indicative market ranges to help you scope a budget; actual quotes vary widely by transaction volume and ERP complexity.

Item	Indicative cost (SAR)	Indicative timeline
ZATCA Fatoora onboarding / OTP / stamp issuance	Free	Same day per device
Cloud e-invoicing tool (small business, single branch)	2,000 – 8,000 per year	1–2 weeks to configure
Mid-market ERP e-invoicing module	15,000 – 60,000 one-off	4–8 weeks
Large ERP / multi-entity integration project	80,000 – 400,000+	3–6 months
Sandbox testing and compliance certification support	5,000 – 25,000	2–4 weeks
Master-data cleansing (customers, items, addresses)	Internal effort	2–6 weeks
Ongoing managed compliance / monitoring	1,500 – 6,000 per month	Continuous
Noble Core company formation package (new entities)	From 36,999	Varies by activity

All software figures are indicative and set by private vendors, not by government. Government-side there is nothing to pay for e-invoicing itself; confirm current figures on the official portal for any statutory charge. For context on adjacent government costs when you are also setting up an entity: MISA licence issue and renewal fees are suspended in 2026 (previously SAR 12,000 initial and SAR 62,000 renewal), a Commercial Register costs roughly SAR 1,200–2,000, and Chamber of Commerce membership runs about SAR 2,000–3,000 per year.

How Phase 2 connects to your wider Saudi compliance stack

E-invoicing does not sit in isolation. The data you push to ZATCA has to reconcile with what you file elsewhere, and several government platforms feed the same master record.

• ZATCA — VAT returns at 15%, withholding tax, zakat and customs all draw on the same taxpayer profile that carries your e-invoicing configuration.
• Ministry of Commerce — your CR data, trade name and activities flow into invoice header validation. Update the CR first, then your invoicing master data.
• Saudi Business Center (business.sa) — the unified window for licences and registrations that most new entities pass through.
• MISA — foreign investors hold an investment licence here, typically issued in around 3 to 10 business days, with 100% foreign ownership permitted in most activities.
• MHRSD, Qiwa and GOSI — payroll and social insurance. GOSI contributions total roughly 21.5% for a Saudi employee across employer and employee shares, and payroll cost feeds the same financial records your invoices roll into.
• Balady (balady.gov.sa) — municipal licences for physical premises, which matter because each branch may need its own onboarded invoicing device.
• Monsha’at (monshaat.gov.sa) — the SME authority, a useful source of support programmes for smaller businesses upgrading systems.
• Etimad (etimad.sa) — if you supply government entities, your invoices are standard tax invoices and must be cleared by ZATCA before submission.

If you are still forming the entity that will issue these invoices, get the structure right first. Our guide to company formation in Saudi Arabia walks through entity types, capital and registration order, and foreign investors should read the detail on the MISA investment licence before committing to an activity code — because the activity you pick determines your invoicing profile, your VAT treatment and, in some cases, whether special invoicing rules apply.

Field-by-field: what a compliant Phase 2 invoice carries

Understanding the required fields helps you brief your vendor accurately and spot gaps in your own data. A standard tax invoice under Phase 2 must include, at minimum:

• Seller name, address and 15-digit VAT number.
• Buyer name, address and VAT number (mandatory for standard invoices where the buyer is VAT-registered).
• Invoice issue date and, where different, the supply date.
• Sequential invoice number plus a system-generated UUID.
• Previous invoice hash, chaining each invoice to the one before it so tampering is detectable.
• Line-level description, quantity, unit price, discount, VAT rate and VAT amount.
• Total excluding VAT, total VAT, and total including VAT — in Saudi riyals.
• QR code encoding seller name, VAT number, timestamp, invoice total, VAT total, and for Phase 2 the stamp and public key data.
• Cryptographic stamp applied by ZATCA on clearance for standard invoices, or by the solution for simplified invoices.
• Reason codes where a zero-rated or exempt treatment is applied.

Credit notes and debit notes carry the same discipline plus a mandatory reference to the original invoice and a reason for issuance. Many wave-1 and wave-2 businesses discovered late that their systems could produce compliant invoices but not compliant credit notes.

What happens after go-live: ongoing obligations

Passing onboarding is the start, not the finish. From your wave’s compliance date onward you carry continuing duties:

• Report simplified invoices within 24 hours of issuance. Batch reporting is allowed but the clock still runs from issuance.
• Clear every standard invoice before sharing it with the buyer. If the API is unavailable, follow ZATCA’s documented downtime handling rather than reverting to manual invoices.
• Renew cryptographic stamp certificates before expiry. Diarise the renewal date — an expired PCSID stops invoicing entirely.
• Re-onboard devices when you change ERP, migrate servers, or open a new branch.
• Retain records in electronic, tamper-resistant form, hosted in the Kingdom, for the statutory retention period.
• Reconcile monthly — the total of cleared and reported invoices should agree with your VAT return output tax before you file.

ZATCA has consistently taken a supportive, education-first stance during roll-out, publishing detailed guides, running awareness workshops and offering direct technical support to taxpayers preparing for their wave. Taxpayers who engage early generally find the process straightforward.

Common mistakes to avoid

• Assuming Phase 1 compliance is enough. A PDF generator with a QR code will fail every Phase 2 validation. The API integration is a separate build.
• Waiting for the notification letter. Six months sounds generous until a mid-market ERP project eats four of them. Estimate your wave from the published thresholds and start early.
• Letting portal contact details go stale. If the registered email or mobile belongs to a departed employee, you will not see the wave notice.
• Generating OTPs before the technical team is ready. The codes are short-lived; generate them on the call, not the week before.
• Onboarding one device for a multi-branch business. Each solution unit or till needs its own onboarded identity.
• Ignoring credit and debit notes. They are in scope, they need original-invoice references, and they are the most common gap found in testing.
• Dirty customer master data. Wrong VAT number length, missing building number or missing district will reject invoices at clearance.
• Treating a B2G invoice as simplified. Sales to government entities are standard invoices and require clearance before submission through Etimad.
• Forgetting certificate expiry. An expired production stamp halts invoicing on a working day with no warning if nobody diarised it.
• Skipping the sandbox. Testing in production means your first schema error is a real customer’s real invoice.
• Storing archives outside the Kingdom. Electronic records must be retained in Saudi Arabia in a tamper-resistant form.
• No reconciliation routine. If cleared invoice totals never get compared to the VAT return, discrepancies surface only at audit.

A realistic 90-day readiness plan

1. Days 1–10: Confirm your wave and deadline against ZATCA’s roll-out phases page. Verify portal contact details. Appoint an internal owner.
2. Days 11–25: Assess your current invoicing system. Ask your vendor in writing whether the version you run supports Phase 2 clearance and reporting, and what the upgrade costs.
3. Days 26–45: Select and contract the solution. Begin master-data cleansing in parallel — customer VAT numbers, national addresses, item codes and unit codes.
4. Days 46–65: Build and test in the ZATCA sandbox. Cover standard invoices, simplified invoices, credit notes, debit notes, discounts, zero-rated lines and exempt lines.
5. Days 66–80: Onboard production devices via the Fatoora Portal. Pass compliance checks and obtain the production stamp for each unit.
6. Days 81–90: Train counter and finance staff, run a parallel week, then cut over. Monitor rejections daily for the first two weeks.

How Noble Core helps

Noble Core Ventures supports businesses in the Kingdom across the full compliance chain — from incorporation through to steady-state tax filing. On e-invoicing specifically, we help you confirm your wave and deadline against ZATCA’s published criteria, assess whether your current billing system can be upgraded or should be replaced, brief and manage the vendor, clean the master data that causes most clearance rejections, and shepherd device onboarding on the Fatoora Portal through to production stamp issuance.

Because e-invoicing sits on top of your VAT registration, our ZATCA and VAT compliance service handles the registration, filing and reconciliation side alongside the technical roll-out, so your cleared invoices and your filed returns agree. For companies still being formed, we sequence the work correctly — MISA licence, Commercial Register under the new unified framework, Chamber membership, national address, VAT registration, then e-invoicing onboarding — so nothing has to be redone.

Foreign investors setting up now have a genuine advantage: with MISA licence fees suspended in 2026, 100% foreign ownership available in most activities, and the modernised Commercial Register removing renewal cycles, entering the Saudi market has become notably more streamlined as the Kingdom continues to modernise its business environment under Vision 2030. Building compliant e-invoicing in from day one is far cheaper than retrofitting it after your wave notice arrives.

Frequently Asked Questions

What is e-invoicing phase 2 in Saudi Arabia?

E-invoicing phase 2 Saudi is ZATCA’s Integration Phase, live from 1 January 2023 and rolled out in waves by revenue. It requires your billing system to connect to the Fatoora Platform via API, issue XML or PDF/A-3 invoices with a UUID, hash and QR code, clear standard invoices with ZATCA, and report simplified invoices within 24 hours.

How do I know which ZATCA e-invoicing wave I am in?

Check the roll-out phases page on zatca.gov.sa, which lists every wave with its revenue threshold and reference year. Compare that threshold against your declared VAT-taxable supplies for the stated year. ZATCA also notifies each selected taxpayer directly at least six months before the deadline, so keep your registered email and mobile current in the portal.

What is the difference between clearance and reporting under phase 2?

Clearance applies to standard tax invoices issued to businesses or government entities: you send the invoice to ZATCA first, it validates and cryptographically stamps it, and only then is it valid to share with the buyer. Reporting applies to simplified B2C invoices, which you give the customer immediately and transmit to ZATCA within 24 hours of issuance.

How much does e-invoicing phase 2 compliance cost in Saudi Arabia?

ZATCA charges nothing for Fatoora onboarding, OTP generation or cryptographic stamps. Your cost is software and integration: indicatively SAR 2,000-8,000 per year for a small cloud tool, SAR 15,000-60,000 for a mid-market ERP module, and SAR 80,000-400,000+ for large multi-entity projects. These are private vendor prices and vary widely.

How do I onboard a device on the ZATCA Fatoora Portal?

Log in to the Fatoora Platform, choose Onboard New Solution Unit or Device, enter how many OTP codes you need, and click Generate OTP. Enter each short-lived code into your e-invoicing solution. It creates a certificate signing request, receives a compliance stamp identifier, passes ZATCA sample-invoice checks, then obtains the production cryptographic stamp.

What fields must a phase 2 e-invoice contain?

A compliant standard invoice needs seller and buyer names, addresses and 15-digit VAT numbers, issue and supply dates, a sequential number plus UUID, the previous invoice hash, line-level quantity, price, VAT rate and amount, totals in Saudi riyals at 15% VAT, a TLV QR code, and the ZATCA cryptographic stamp applied at clearance.

Does e-invoicing phase 2 apply to small businesses in Saudi Arabia?

Yes, progressively. Each successive wave lowers the revenue threshold, moving from above SAR 3 billion in wave 1 down into the low single-digit millions of riyals in later waves, so smaller VAT-registered resident taxpayers are steadily brought into scope. Non-resident taxpayers registered for VAT in the Kingdom remain outside e-invoicing requirements.

How long does it take to get ready for e-invoicing phase 2?

Plan around 90 days for a typical mid-market business: roughly two weeks confirming your wave and assessing the system, four weeks selecting the solution and cleaning master data, three weeks sandbox testing all invoice and credit-note scenarios, two weeks production onboarding, then training and cutover with daily rejection monitoring afterwards.