What Phase 2 Adds — The Operational Shift
Phase 2 (Integration Phase) adds mandatory real-time connectivity between your invoicing system and ZATCA’s FATOORA platform. For Tax Invoices (B2B), clearance by ZATCA is a legal prerequisite before the invoice can be shared with the buyer. For Simplified Tax Invoices (B2C), reporting to FATOORA must occur within 24 hours of generation. Phase 1 asked: does your system generate a valid invoice? Phase 2 asks: does your system connect to ours, in real time, for every transaction?
| Requirement | Phase 1 | Phase 2 |
|---|---|---|
| Invoice format | Any electronic format | XML (UBL 2.1) or PDF/A-3 with embedded XML |
| Cryptographic stamp | Not required | Applied by your EGS using ZATCA-issued CSID |
| UUID per invoice | Not required | Mandatory |
| Previous Invoice Hash | Not required | Mandatory — links each invoice to the prior in sequence |
| QR code fields | 4 fields (simplified only) | 9 fields TLV base64 (both invoice types) |
| FATOORA API connection | Not required | Mandatory |
| Tax Invoice clearance | Not required | Must occur before sharing with buyer |
| Simplified Invoice reporting | Not required | Within 24 hours of generation |
| EGS device registration (CSID) | Not required | Mandatory — one per EGS unit |
The Wave System — How Your Notification Works
ZATCA rolls out Phase 2 in waves, with each wave targeting taxpayers in a specific revenue band determined by their highest VAT-taxable annual revenue in any designated reference year. Waves have expanded from SAR 3 billion at launch (Wave 1, January 2023) to SAR 375,000 at Wave 24 (deadline June 2026). ZATCA is required to notify businesses at least six months before their integration deadline.
The wave criteria are public. You do not need to wait for a personal notification to know whether you are in scope. If your revenue exceeds SAR 375,000 in any of 2022, 2023, or 2024, Wave 24 applies at minimum. The clock runs from the published deadline — not from the date you receive a notification.
Your wave is based on your highest revenue in any of the applicable reference years — not your most recent year. A business with SAR 2 million revenue in 2022 but only SAR 800,000 in 2024 is still captured by the 2022 figure. Always check across the full reference period before concluding which wave applies.
Onboarding Your System to FATOORA
Before a single Phase 2 invoice can be cleared or reported, your EGS must be registered with FATOORA and issued a Cryptographic Stamp Identifier (CSID). The process requires accessing the FATOORA portal with ERAD credentials, generating an OTP for each EGS unit, entering the OTP into the EGS, receiving the CSID, accepting ZATCA’s subscriber agreement, and testing in ZATCA’s sandbox before going live.
A business with 20 POS terminals needs 20 CSIDs. A central billing server plus a separate POS system needs 2. Onboarding one unit and applying its CSID to multiple systems is a compliance failure. Invoices stamped by an incorrectly associated unit are invalid. Map your EGS units before starting onboarding and confirm the count with your IT team.
Clearance for Tax Invoices — Step by Step
Your EGS generates the invoice in XML, applies your cryptographic stamp, assigns a UUID, embeds the Previous Invoice Hash, and transmits to FATOORA via API. FATOORA validates the XML schema, field completeness, VAT mathematical accuracy, stamp validity, and referential integrity. If everything passes, FATOORA applies its own stamp and returns the cleared XML. You then share the cleared document — as XML or PDF/A-3 with embedded XML — with the buyer.
| FATOORA Response | Meaning | Action Required |
|---|---|---|
| Accepted | Invoice fully cleared — ZATCA stamp applied | Share cleared invoice with buyer |
| Accepted with Warnings | Cleared but minor issues noted | Share invoice; investigate warning for future invoices |
| Rejected | Mandatory field errors, schema failures, VAT miscalculations | Do NOT modify original. Generate new invoice with new UUID. Use rejected invoice hash as PIH in new invoice. |
| No connectivity | FATOORA unreachable | Retry every 5 min; after ~5 min share uncleared invoice temporarily; retry every 15 min until cleared |
Reporting for Simplified Tax Invoices
Your EGS generates the invoice, applies your cryptographic stamp, and you share it with the customer immediately — before any interaction with FATOORA. All Simplified Tax Invoices must then be transmitted to FATOORA within 24 hours of generation. The window is measured from the timestamp on each individual invoice and does not reset at midnight, extend over Eid, or pause for connectivity issues.
An invoice generated at 11:45pm must be reported by 11:45pm the following day. Your reporting system must run continuously and handle retry logic automatically — not depend on staff manually submitting batches. For high-volume B2C businesses, automated batch reporting running throughout the day is the only sustainable approach.
Common Phase 2 Implementation Mistakes
- Treating Phase 2 as an IT project only. Both IT and finance must be engaged. The invoice type classification, VAT field mapping, and rejection handling all have tax consequences that IT teams cannot assess alone, and compliance failures that finance teams cannot detect without access to FATOORA data.
- Not testing in the ZATCA sandbox before go-live. ZATCA provides a full sandbox environment and SDK. Skipping this guarantees configuration errors on live transactions. Discover them in sandbox, not in production.
- Missing the OTP window during onboarding. The OTP generated in the FATOORA portal has a short validity window. If it expires before entry into the EGS, the entire onboarding restarts. Have your IT team ready at the moment the OTP is generated.
- Underestimating Phase 2 field requirements. Buyer address fields — street, building number, city — are mandatory on Tax Invoices. Many businesses have never collected or stored this data. Identifying the gap six weeks before go-live is a very different problem from six months out.
- No retry logic for clearance failures. FATOORA returns rejections, warnings, and connectivity failures. Your system must handle each programmatically — logging rejections, queuing retries, and alerting the finance team. Silent failure is non-compliance accumulating with every transaction.
Frequently Asked Questions
- Phase 2 is a real-time infrastructure obligation. Your invoicing system must be connected to FATOORA via API, with live clearance for Tax Invoices and 24-hour automated reporting for Simplified Tax Invoices.
- Six months’ notice from ZATCA is the minimum. ERP configuration, vendor engagement, data gap remediation, sandbox testing, and CSID onboarding all take time. Treat the notification as the start of an urgent project, not confirmation of an eventual one.
- Each EGS unit needs its own CSID. Map your units before starting onboarding. A CSID applied to the wrong unit or shared across multiple units invalidates every invoice those units produce.
- Clearance is a prerequisite for Tax Invoices — not a background process. A Tax Invoice shared before FATOORA has cleared it is legally invalid for VAT purposes.
- The 24-hour reporting window for Simplified Tax Invoices does not pause for outages, weekends, or public holidays. Automated, fault-tolerant reporting with retry logic is the only way to reliably meet this obligation at meaningful transaction volumes.
Also in this series
This article reflects ZATCA’s E-Invoicing Regulation (December 2020) and the Controls, Requirements, Technical Specifications and Procedural Rules Resolution (May 2023). It is for informational purposes only and does not constitute legal or tax advice. Confirm the current position at zatca.gov.sa or with a qualified Saudi tax advisor. dariba.co is an independent platform with no consulting relationships.