At a glance
- Authority
- Zakat, Tax and Customs Authority (ZATCA)
- Phase 1
- Generation phase, in force since 4 December 2021
- Phase 2
- Integration phase, rolled out in waves since 1 January 2023
- B2B invoices
- Cleared by ZATCA before you share them
- B2C invoices
- Stamped by you and reported within 24 hours
- Latest wave
- Wave 25: VAT revenue above SAR 187,500 in any year from 2022 to 2025. Integration date: 1 February 2027.
Phase 1 and Phase 2
Phase 1, generation, has applied to resident VAT taxpayers since 4 December 2021. Invoices must be generated and stored electronically in a compliant system.
Phase 2, integration, goes further. Your invoicing system connects to ZATCA's Fatoora platform and exchanges every invoice with it, in a set XML format and with extra fields. Phase 2 started on 1 January 2023 and reaches businesses wave by wave.
How waves work and how you learn your date
ZATCA selects each wave by VAT-subject revenue in named reference years. The threshold has fallen steadily, from SAR 3 billion in Wave 1 to SAR 187,500 in Wave 25. The direction is clear: almost every VAT-registered business will be integrated.
| Wave | Revenue threshold | Reference years | Integration timing |
|---|
| Wave 24 | Above SAR 375,000 | 2022, 2023 or 2024 | 1 April 2026 to 30 June 2026 |
| Wave 25 | Above SAR 187,500 | 2022, 2023, 2024 or 2025 | Integration date of 1 February 2027 |
ZATCA says it notifies taxpayers of their Phase 2 wave at least six months in advance, and it announces each wave's criteria publicly. Wave 25 was announced on 24 July 2026.
Do not wait for the notice. Compare your revenue for each reference year with the published threshold. If you are above it in any one of those years, you are in that wave, and six months is not long for data cleanup, testing and onboarding.
What integration means
Phase 2 treats your two invoice types differently.
Standard tax invoices (B2B): clearance
Your system sends the invoice to ZATCA before you give it to the buyer. ZATCA validates it, applies its cryptographic stamp and QR code, and returns the cleared invoice. A standard invoice is only valid once it has been cleared, so the buyer should only ever receive the cleared version.
Simplified tax invoices (B2C): reporting
Your system stamps the invoice itself, adds the QR code and gives it to the customer straight away. It then reports the invoice to ZATCA within 24 hours.
Four technical pieces sit behind every Phase 2 invoice:
- XML: invoices are generated in XML, or as PDF/A-3 with the XML embedded.
- Cryptographic stamp: a digital signature that proves which device issued the invoice and that it has not changed.
- QR code: besides the seller name, VAT number, date, total and VAT amount, it carries the invoice hash, the signature and the public key.
- Hash chain and counter: each invoice includes the hash of the previous one and a counter value that is never reused, so a missing or altered invoice breaks the chain.
Onboarding and the CSID
Every invoicing unit, such as an ERP instance, a branch system or a till, is onboarded separately and gets its own Cryptographic Stamp Identifier (CSID). A CSID is a certificate that identifies the unit to ZATCA.
- Generate an OTP
On the Fatoora portal, choose to onboard a unit and generate a one-time password. It is valid for one hour.
- Request a compliance CSID
The unit submits a certificate request with the OTP and receives a compliance CSID, used only for testing.
- Pass compliance checks
The unit sends sample documents that must pass ZATCA's compliance checks.
- Receive the production CSID
ZATCA's certificate authority issues the production CSID. From then on the unit clears and reports live invoices.
Certificates carry an expiry date. Treat them like any other critical credential, with an owner and a renewal date.
When an invoice is rejected
One error rejects the whole document. What you do next depends on the type.
- Rejected standard invoice: it is not valid. Fix the error and submit a new invoice for clearance.
- Rejected simplified invoice: the sale still stands. Correct the data and report it again, without reissuing it to the customer.
- Either way: a resubmitted document is a new document, with a new UUID, hash and counter value. Never reuse them.
Readiness checklist
- Revenue checked against your wave's threshold for every reference year
- Your invoicing system confirmed as Phase 2 compliant by its provider
- A list of every unit that issues invoices: ERP, branches, tills
- Fatoora portal access for an authorized person
- Customer master data complete for B2B buyers: VAT number, legal name, national address
- Credit and debit notes generated in the same system, linked to the original invoice
- A process that shares B2B invoices only after clearance
- Monitoring for rejected and unreported invoices, with a named owner
- Compliance testing done well before the integration date
- CSID renewal dates recorded
Common mistakes
- Sending B2B invoices before clearance. The buyer holds a document that is not yet valid.
- Reporting B2C invoices late. The 24-hour window applies to every simplified invoice, including those from a till that was offline.
- Reusing a UUID or counter after a rejection. It breaks the hash chain.
- Running parallel invoice sequences. ZATCA lists multiple sequences, changing the system date and time, and exporting the stamp's private key among prohibited functions.
- Forgetting a unit. A branch system or till that issues invoices needs its own onboarding.
- Cleaning data at the last minute. Missing buyer VAT numbers and addresses cause the bulk of early rejections.
- Assuming Phase 1 is enough. Generating invoices electronically is not integration.
How Prospera handles it
Prospera ERP is ZATCA Phase 2 compliant. Clearance and reporting run from the same records as your sales, stock and books, so a cleared invoice and your ledger always agree.
- Standard and simplified invoices, credit notes and debit notes from one system
- One customer record behind every invoice, so buyer data is right before it reaches ZATCA
- A free systems review checks your wave date and readiness against this checklist
Book a free systems review →