ZATCA Phase 2 Compliance in 2026: What Saudi Businesses Must Do Now

If you run a business in Saudi Arabia, chances are you have already heard of ZATCA’s e‑invoicing system. The Zakat, Tax and Customs Authority (ZATCA) has been rolling out one of the most ambitious digital tax reform projects in the Middle East, and in 2026, that reform is reaching its most critical stage yet. Phase 2 of ZATCA’s e‑invoicing mandate, known as the Integration Phase, is no longer just a concern for large corporations. In 2026, even small and medium‑sized businesses (SMEs) are being brought into the system. If you have not already integrated your invoicing system with ZATCA’s Fatoora platform, the clock is ticking and the penalties for missing the deadline are very real.

MFD Services ensures that businesses of all sizes from SMEs to large enterprises navigate this transition seamlessly. By aligning invoicing workflows, integrating ZATCA‑approved solutions, and providing continuous compliance monitoring, MFD helps organizations avoid costly penalties and maintain audit‑ready operations.

What Is ZATCA E-Invoicing? 

ZATCA introduced mandatory electronic invoicing (e-invoicing) in Saudi Arabia on 4 December 2021. The goal is to modernize the country’s tax system, reduce tax evasion, improve transparency, and move toward a fully digital economy in line with Vision 2030. The e-invoicing rollout was divided into two main phases:

Phase 1: The Generation Phase (December 4, 2021). 

All VAT-registered businesses were required to stop using manual or paper invoices and switch to electronic invoicing systems that could generate, store, and manage compliant e-invoices with QR codes and all required data fields.

Phase 2: The Integration Phase (Ongoing from January 1, 2023). 

This is the bigger step. Phase 2 requires businesses to directly connect their invoicing or ERP systems to ZATCA’s central e-invoicing platform called Fatoora so that every invoice is validated or reported in real time.

Phase 2 is being rolled out gradually in numbered “waves,” with each wave targeting a specific group of businesses based on their annual taxable revenue.

What Makes Phase 2 Different from Phase 1?

Phase 1 was relatively straightforward you just needed a compliant electronic system to create and store invoices. Phase 2 goes much further. Under Phase 2, your invoicing system must be technically integrated with ZATCA’s Fatoora platform through a secure API connection. This means:

• B2B Tax Invoices must be submitted to ZATCA for real-time clearance before they are sent to the buyer. The invoice is only legally valid after ZATCA clears it.
• B2C Simplified Tax Invoices must be reported to ZATCA within 24 hours of issuance.
• All invoices must be in XML format (or PDF/A-3 with embedded XML) that meets ZATCA’s technical specifications.
• Every invoice must carry a UUID (a unique digital identification number), a cryptographic stamp (digital signature), a QR code, and a sequential invoice number.

In other words, Phase 2 transforms the way invoices are created, validated, and shared making the entire process automated, real-time, and government-monitored.

The Wave System: Where Does Your Business Stand?

ZATCA is rolling out Phase 2 in waves. Each wave is announced in advance, and businesses within that wave are given a window of time to complete their integration. Here is an overview of how the wave system has progressed:

If you are not sure which wave you fall under, check your annual taxable revenue for 2022, 2023, and 2024 and compare it to the thresholds above. ZATCA will also notify you directly when your wave applies to you.

Key Technical Requirements You Must Meet

To comply with Phase 2, your business must fulfil a set of technical and operational requirements. Here is a breakdown in plain terms:

1. A ZATCA-Compliant E-Invoicing Solution

You need to use invoicing software or an ERP system (such as SAP, Oracle, Microsoft Dynamics, or a certified local solution) that is officially approved by ZATCA for Phase 2. This software must be capable of generating XML-format invoices and connecting to the Fatoora platform via API.

2. API Integration with the Fatoora Platform

Your system must be directly connected to ZATCA’s Fatoora portal through a secure API. This is the technical “bridge” that allows your invoices to be sent to ZATCA in real time for clearance or reporting.

3. Digital Certificate (Cryptographic Stamp)

Your system must obtain a ZATCA-issued digital certificate (through a process called CSID Cryptographic Stamp Identifier). This certificate acts as your business’s official digital signature and is used to stamp every invoice, making it tamper-proof and legally authentic.

4. UUID on Every Invoice

Each invoice must carry a UUID a universally unique identifier that is automatically generated by your system. This ensures every invoice in the system is distinct and traceable.

5. QR Code on Every Invoice

Invoices must include a QR code that contains key invoice data in an encoded format. This allows buyers and ZATCA to scan and verify invoice details instantly.

6. Sequential Invoice Numbering

Your invoices must be numbered in a continuous, unbroken sequence. You cannot skip or repeat invoice numbers.

7. XML or PDF/A-3 Format

All invoices must be generated in XML format based on UBL (Universal Business Language) standards, or in PDF/A-3 format with the XML embedded within. Human-readable PDFs alone are not acceptable.

8. Real-Time Clearance (B2B) and 24-Hour Reporting (B2C)

• For B2B invoices: Submit to ZATCA, receive clearance, then send to buyer all before the transaction is finalised.
• For B2C invoices: Issue to the customer, then report to ZATCA within 24 hours.

9. Secure Data Archiving for 5 Years

All e-invoices and related credit/debit notes must be stored securely and be accessible for at least five years.

Step-by-Step: How to Get Compliant

If your business is approaching its Phase 2 deadline, here is a simple action plan:

Step 1 – Confirm Your Wave and Deadline: 

Check your annual taxable revenue for 2022, 2023, and 2024. Compare it to the wave thresholds and identify your deadline. Watch for official ZATCA notifications sent to your registered contact details.

Step 2 – Assess Your Current System: 

Evaluate whether your existing accounting or ERP system supports Phase 2. Can it generate XML invoices? Does it support API connectivity? If not, you will need to upgrade or switch to a compliant solution.

Step 3 – Choose a ZATCA-Approved Solution: 

Select a software provider that is certified by ZATCA for Phase 2 compliance. Many vendors in Saudi Arabia offer ready-to-use solutions that handle integration, certificate management, and real-time submission automatically.

Step 4 – Obtain Your Digital Certificate: 

Work with your software provider to obtain your CSID (Cryptographic Stamp Identifier) from ZATCA. This is your business’s official digital identity for the e-invoicing system.

Step 5 – Test in the ZATCA Sandbox Environment: 

Before going live, test your system in ZATCA’s sandbox (testing) environment. This allows you to simulate invoice submission and identify any issues without affecting real transactions.

Step 6 – Go Live: 

Once testing is complete and your system is working correctly, activate the live integration. From this point, all invoices will flow through the Fatoora platform automatically.

Step 7 – Train Your Team 

Make sure your finance and IT teams understand the new process, know how to handle errors or rejections, and are aware of their responsibilities under the new system.

Step 8 – Monitor and Maintain Compliance 

Compliance does not end at integration. Regularly review your invoicing processes, keep your digital certificate updated, and stay alert to future ZATCA announcements about new requirements or updated waves.

Penalties for Non-Compliance

ZATCA takes non-compliance very seriously. If your business fails to meet Phase 2 requirements by your wave deadline, you could face the following penalties:

• SAR 5,000 to SAR 50,000 in fines for failure to comply with real-time invoice reporting requirements.
• Up to SAR 10,000 per invoice for failing to generate a compliant QR code.
• Temporary suspension of VAT registration for repeat violations.
• Additional fines for delayed or incorrect integration with the Fatoora platform.

These are not minor administrative penalties; they can seriously affect your business’s finances and reputation.

Important: ZATCA’s Penalty Waiver Initiative

There is a silver lining for businesses that have fallen behind. ZATCA has extended its “Initiative to Cancel Fines and Exempt Taxpayers from Penalties” until June 30, 2026. This initiative gives businesses a final opportunity to correct past errors and complete their integration without facing financial penalties for historical non-compliance.

Who Exactly Needs to Comply?

Phase 2 applies to all VAT-registered resident taxpayers in Saudi Arabia, excluding non-resident taxpayers. This includes:

• Large corporations and enterprises
• Small and medium-sized businesses (SMEs)
• Sole proprietors registered for VAT
• Any business issuing tax invoices on behalf of a VAT-registered supplier

The key factor is your annual taxable revenue and the wave you have been assigned to. Even if you are a small business, if your revenue exceeds the threshold for your wave, you must comply.

Common Mistakes to Avoid

Many businesses make avoidable errors during their Phase 2 transition. Here are the most common pitfalls:

Waiting too long to start. Integration is not a one-day job. Getting a ZATCA-approved system in place, obtaining a digital certificate, testing, and training your team takes time. Start at least 2–3 months before your deadline.

Assuming your current software is already compliant. Many older accounting systems are not Phase 2-ready. Always verify with your software provider whether your system is certified for ZATCA Phase 2 integration.

Ignoring ZATCA notifications. ZATCA sends official notifications to businesses about their wave deadlines. Make sure your registered contact details with ZATCA are up to date so you do not miss these alerts.

Skipping the sandbox testing phase. Going live without testing is risky. Use ZATCA’s sandbox environment to catch and fix problems before they affect real invoices.

Not training staff. Phase 2 changes how invoices are created and managed. Your team needs to understand the new workflow, or you risk errors, rejections, and compliance failures.

How Phase 2 Fits into Saudi Arabia’s Bigger Vision

ZATCA’s e-invoicing initiative is not just about collecting taxes more efficiently. It is a cornerstone of Saudi Arabia’s Vision 2030 digital transformation strategy.

By building a fully connected, real-time tax reporting system, Saudi Arabia is:

• Reducing tax evasion through automated transaction monitoring.
• Streamlining VAT filing: ZATCA is moving toward pre-filled VAT returns based on e-invoice data, which will significantly reduce the compliance burden on businesses.
• Creating a transparent, trustworthy business environment that attracts foreign investment.
• Aligning with global best practices in digital taxation, putting Saudi Arabia among the world’s most advanced tax systems.

For businesses, early adoption of Phase 2 compliance is not just about avoiding fines; it is about positioning yourself for a future where digital financial management is the norm.

Final Thoughts:

ZATCA Phase 2 compliance in 2026 is not optional, and it is not something you can fix overnight. With Wave 23 already in its final weeks (deadline: March 31, 2026) and Wave 24 approaching fast (deadline: June 30, 2026), the time for action is right now.

MFD Services stands as your compliance partner, guiding SMEs and large enterprises alike through seamless integration, penalty avoidance, and audit‑ready operations. By leveraging ZATCA‑approved solutions and continuous monitoring, MFD ensures that your invoicing system is not just compliant but future‑proof.

Delaying action risks financial penalties and reputational damage, while proactive alignment with MFD guarantees peace of mind and uninterrupted business continuity.

Note: The above-mentioned services are provided via network firms if not provided directly.