This guide covers who Phase 2 applies to, what is required, the onboarding steps on the Fatoora portal, and the mistakes businesses make most often.
What Phase 2 is and who it covers
| Phase | Name | Start | What it requires |
|---|---|---|---|
| 1 | Generation | 4 December 2021 | Issue and store invoices electronically from a compliant system |
| 2 | Integration | 1 January 2023 (Wave 1) | Connect to Fatoora; invoices are cleared or reported |
Waves and targeting
Phase 2 is not switched on for everyone at once. ZATCA selects businesses in waves, based on their VAT-subject revenue in one or more reference years. Wave 1 covered businesses above SAR 3 billion, and the threshold has come down wave by wave. In its September 2025 announcement, ZATCA set Wave 24 for businesses whose VAT-subject revenue exceeded SAR 375,000 in 2022, 2023 or 2024, to integrate no later than 30 June 2026. That deadline has passed: if your business was in that wave and is not integrated yet, contact ZATCA and move to an integrated solution without delay. In July 2026 ZATCA then announced Wave 25, for businesses whose VAT-subject revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025, to integrate no later than 1 February 2027. Check your wave and deadline on ZATCA's site.
The one rule that stays constant: ZATCA notifies each targeted business directly at least six months before its integration date.
Phase 2 requirements
1. XML in the UBL 2.1-based standard
Every invoice, credit note and debit note is generated as an XML file following ZATCA's implementation standard (based on UBL 2.1). You can still print it or send a PDF, but the electronic file is the legal record.
2. Cryptographic stamp and CSID
Each invoicing solution (or each invoice-generating unit) obtains a Cryptographic Stamp Identifier (CSID) from ZATCA. It is used to stamp simplified invoices and to access the clearance and reporting services.
3. QR code
Invoices carry a QR code. In Phase 2 it holds extra fields such as the invoice hash and signature, alongside the seller's name, VAT number, timestamp, total and VAT.
4. Chaining — no edits
Each invoice has a counter and the hash of the previous invoice, forming a tamper-evident chain. Invoices are never deleted or edited after issue; corrections go through credit or debit notes.
Clearance vs reporting
| Standard tax invoice | Simplified tax invoice | |
|---|---|---|
| Typical buyer | Business or government (B2B/B2G) | Consumer not registered for VAT (B2C) |
| Mechanism | Clearance | Reporting |
| Timing | Before it is shared with the buyer | Within 24 hours of issue |
| Who stamps it | ZATCA, after validation | Your solution, with its CSID |
| Valid from | ZATCA's clearance | Issue (then reported) |
With clearance, your system sends the invoice to Fatoora, ZATCA validates it and returns it stamped, and only then does it go to the buyer. With reporting, your system stamps the simplified invoice, hands it to the customer immediately and sends it to ZATCA within 24 hours. For the detail on the two invoice types, read tax invoice vs simplified tax invoice.
Steps
- Confirm your wave. Check ZATCA's notice or the Fatoora portal for your integration deadline.
- Use a Phase 2-compliant solution. It must generate the XML, stamp invoices and connect to Fatoora for clearance and reporting.
- Complete your company data. Legal name as on the VAT certificate, VAT number, and the full national address (building number, street, district, city, postal code, additional number).
- Complete your business customers' data. Name, address and VAT number, or another identifier such as the commercial registration if they are not VAT-registered.
- Log in to the Fatoora portal with your ZATCA e-services account and generate a one-time password (OTP).
- Enter the OTP in your solution while it is valid. The solution creates its certificate request and receives a compliance CSID.
- Pass the compliance checks. The solution submits test documents of each type you will issue (standard, simplified, notes); the production CSID is not issued until they pass.
- Receive the production CSID and start live invoicing.
- Monitor statuses daily. Fix rejected or pending invoices with a credit note and a new invoice, and never leave a simplified invoice unreported for more than 24 hours.
What changes day to day after integration
- Selling to a business: you wait for clearance before sending or printing the invoice for the customer — normally automatic in your system.
- Selling to consumers: the customer gets the invoice at once, and the system reports it in the background.
- Fixing an error: instead of editing, you issue a credit or debit note that references the original invoice, then a correct invoice if needed.
- New device or system: each invoice-generating unit needs its own certificate, so it needs a fresh OTP from the Fatoora portal.
- Monitoring: you now have a status for every invoice (cleared, reported, rejected) to review regularly.
Common mistakes
- Sending a standard invoice before clearance. An uncleared tax invoice is not valid.
- Incomplete addresses. The national address is a required field; a missing building number or postal code can lead to rejection or a warning.
- Simplified invoices to VAT-registered businesses. If the buyer needs the invoice to deduct input VAT, issue a full tax invoice.
- Deleting or manually voiding invoices. Correct only through credit or debit notes.
- Wrong tax mapping. Zero-rated or exempt lines need the right reason on the invoice; see how to calculate 15% VAT in Saudi Arabia.
- Leaving onboarding to the last week. Compliance checks and data clean-up take time.
Summary
Phase 2 turns the invoice into a document ZATCA sees: standard tax invoices are cleared before they reach the buyer, simplified invoices are reported within 24 hours, all as XML with a cryptographic stamp and a QR code. Confirm your wave, clean up your company and customer data, then onboard on the Fatoora portal with an OTP and pass the compliance checks well before your deadline. To see where invoices are issued in Ehsebly, visit the Sales app.