ZATCA Phase 2 (Fatoorah): The Complete 2026 Guide for Saudi Businesses

TL;DR. ZATCA Phase 2 — branded Fatoorah — is the second generation of Saudi Arabia’s mandatory e-invoicing system. Where Phase 1 asks you to generate an electronic invoice with a TLV QR code, Phase 2 asks you to integrate your billing system with the ZATCA Fatoorah platform in real time, clear B2B invoices for clearance, report B2C invoices, and cryptographically sign every document with an ECDSA stamp. If you are a Saudi-resident business above a certain revenue threshold (see our Phase 2 waves guide), this is no longer optional.

This pillar is the index page for the Phase 2 cluster. It explains what Phase 2 is, who it applies to, and when. The four cluster pages linked at the bottom each go one level deeper: a step-by-step onboarding guide, a deep dive into the UBL 2.1 XML invoice structure, a plain-English explanation of ECDSA cryptographic stamping, and a deadlines and waves breakdown.

What changed between Phase 1 and Phase 2?

Phase 1 (live since December 2021) is fundamentally a "generate, sign, and store" model. The taxpayer generates an electronic invoice PDF, embeds a TLV Base64 QR code (tags 1 through 5), and keeps the document. ZATCA never sees the invoice in real time — it is enough that you could produce it. This is why our free Phase 1 generator works: there is no integration, no API call, and no certificate. You type, you print, you are done.

Phase 2 (Fatoorah) flips that model. Every invoice you issue must be communicated to ZATCA in real time through the Fatoorah platform. There are two integration paths: Clearance (B2B invoices — ZATCA reviews the invoice and returns a hash + counter before you can deliver it to your buyer) and Reporting (B2C invoices — you report the issued invoice to ZATCA within 24 hours). Either way, your system needs to speak HTTPS to fatoorah.zatca.gov.sa using a signed XML payload, and you need an ECDSA certificate (the CSID) loaded on the device or service that signs.

Why ZATCA introduced Phase 2

Three reasons, in plain English. First, VAT evasion. The Saudi tax base lost an estimated SAR 30+ billion annually to under-reporting before e-invoicing, per ZATCA’s published rationale. Phase 1 closed the "paper invoice" loophole. Phase 2 closes the "off-the-books invoice" loophole — every invoice ZATCA has a hash for. Second, real-time fraud detection. With clearance, ZATCA can reject a non-compliant invoice in milliseconds. Third, supply chain traceability. A buyer’s input VAT credit now depends on a clearance hash that matches a real seller invoice, which closes carousel fraud (where the same fake invoice is sold through multiple VAT-registered shells).

Who has to comply and when

The ZATCA Wave Implementation Plan rolls Phase 2 out in waves, with the relevant threshold being each taxpayer’s VAT-able revenue in the previous calendar year. As of mid-2026 the schedule looks like this (full table in our waves page):

Wave	Trigger	Deadline (typical)	Status (Aug 2026)
1	Revenue > SAR 3 billion	1 Jan 2023	Live
2–4	SAR 500M – 3B	2023–2024	Live
5–8	SAR 150M – 500M	2024–2025	Live
9–12	SAR 40M – 150M	2025–2026	Rolling
13+	All other VAT-registered	2026–2027	Upcoming

If you are reading this and you are a Saudi-resident business with revenue above SAR 40 million in either of the last two tax years, you are almost certainly already in scope. The ZATCA portal will tell you your wave directly when you log in; the table above is a generalization. If you are below SAR 40M but VAT-registered, you are still required to be Phase 1 compliant today and Phase 2 will reach you in 2026–2027.

What "Fatoorah" actually means

Fatoorah (فاتورة, literally "invoice") is the official ZATCA integration platform. Think of it as the API gateway that every compliant ERP / POS / accounting system in Saudi Arabia talks to. The taxpayer system sends a signed XML document, Fatoorah returns either a clearance hash (B2B) or a reporting receipt (B2C). The integration is REST over HTTPS, the payload is XML in UBL 2.1 format with a ZATCA-specific extension, and the signature is ECDSA over a Curve P-256 key.

The four pieces every Phase 2 solution needs

1. CSR + CSID certificate. You generate a Certificate Signing Request on your side, upload it to the Fatoorah portal, and ZATCA returns a CSID. This is the ECDSA keypair that signs every invoice. The full onboarding flow is in this guide.
2. UBL 2.1 XML generator. Your ERP / POS / generator tool must produce XML that matches the ZATCA schema. The schema breakdown is here.
3. ECDSA signer + hash chain. Each invoice includes a SHA-256 hash of the previous invoice in your series plus an ECDSA signature of the new invoice XML. The cryptography is explained here.
4. Counter (UUID/PIH). ZATCA expects a monotonically increasing counter (or UUID) per invoice, stored on your side, that ZATCA validates on every call. Miss a number, the next call fails. Don’t skip the counter.

What Phase 2 actually changes for a typical SME

Concretely: you replace the PDF-plus-QR workflow with an API call. Every time a sale happens, your cashier system or ERP must (1) generate the XML invoice, (2) sign it with the CSID, (3) POST it to Fatoorah, (4) capture the clearance hash (B2B) or reporting receipt (B2C), and (5) include that hash on the printed PDF the buyer walks away with. Total added latency per invoice: 200–800 ms in practice. You still produce a PDF for the customer — that part of Phase 1 doesn’t go away — but the PDF is now a render of an XML document that ZATCA has already seen, not the source of truth.

Cost and vendor landscape (2026)

You have three options. (1) Off-the-shelf SaaS from a ZATCA-accredited solution provider: SAR 100–500 / month for a small business, plus a setup fee of SAR 2,000–10,000. (2) Build it yourself using open-source ERP (Odoo, ERPNext) with a ZATCA Phase 2 module — you own the integration but spend 40–80 hours of dev time. (3) Pay your bank or POS provider to bundle it (most Saudi banks now offer this free if you process payments through them). The Phase 2 cost line item is real but small relative to the VAT you’re already paying.

What "Phase 1 compliant" still buys you in a Phase 2 world

Phase 1 is not obsolete. You still need the TLV QR code on customer-facing PDFs. You still need a 5-year retention policy. You still need bilingual invoices. And for businesses below the Phase 2 wave threshold (sub-SAR 40M), Phase 1 alone is sufficient for compliance. That is why our free ZATCA generator remains useful: it is the right tool for the largest remaining set of Saudi businesses, and a good fallback when a Phase 2 solution is unavailable.

How to read the rest of this cluster

Four cluster pages follow. They are intentionally short and focused so you can hand one to a developer, an accountant, or a manager without them having to read the whole thing:

• Fatoorah Onboarding (step-by-step) — for the person doing the actual integration. CSID generation, sandbox testing, go-live checklist.
• UBL 2.1 XML Structure — for the developer writing the integration. Field-by-field, with examples.
• ECDSA Cryptographic Stamping — for the security-conscious. How the signature actually works, hash chaining, and what to audit in a vendor’s solution.
• Integration Waves & Deadlines — for the CFO or owner. When you must comply, what it costs, who is exempt.

Frequently asked questions

Is Phase 1 still required if I am in a Phase 2 wave?
Yes. Phase 2 is additive, not replacement. You still produce the TLV QR, still store invoices for 5 years, still include both Arabic and English on the PDF. Phase 2 adds the API call to Fatoorah on top.

Can I use the free Phase 1 generator if I am in a Phase 2 wave?
For internal documentation and printing, yes. For invoices you issue to customers or report to ZATCA, no — those need a real Phase 2 integration. A common pattern is: Phase 2 system of record, free PDF generator for backfilling or printing.

What if I miss my wave deadline?
ZATCA fines for non-compliance start at SAR 5,000 and scale to SAR 50,000+ per violation. A 6-month grace period is typical for the first missed wave, but you should not count on it. File the integration plan in the Fatoorah portal as soon as your wave is announced.

Can a non-Saudi business integrate?
Yes, if it is VAT-registered in Saudi Arabia. The CSID is issued to the VAT number, not to a Saudi national ID.

Where can I read ZATCA’s official spec?
On the ZATCA E-Invoicing portal. The full technical spec is a 200+ page PDF that is updated roughly quarterly. Expect version drift — pin your spec version in code.