E-Invoicing in Saudi Arabia: The Complete Phase 2 (ZATCA) Guide for 2026

Short answer: every VAT-registered business in Saudi Arabia is now — in practice — in scope for Phase 2 of e-invoicing, whatever the activity: a retail store, a salon, a laundry, a car wash, a clinic, a pharmacy, a services office, a restaurant or a café. Wave 24 covered taxpayers whose VAT-subject revenue exceeded SAR 375,000 in 2022, 2023 or 2024, with an integration deadline of 30 June 2026. ZATCA then halved the threshold for Wave 25: SAR 187,500 during 2022, 2023, 2024 or 2025, with an integration deadline of 1 February 2027.

That last number is not arbitrary: SAR 187,500 is exactly the voluntary VAT registration threshold. In other words, the net has widened to cover effectively every VAT-registered business — including the single-branch shop, the solo clinic and the coffee cart.

This guide is a complete reference: who is in scope and when, what changes technically and operationally, what differs by business type, and what to ask your POS provider before your deadline.

What is e-invoicing (Fatoora)?

E-invoicing is the system launched by the Zakat, Tax and Customs Authority (ZATCA) to move invoicing off paper and into a structured electronic format the Authority can read and validate. An invoice is not "electronic" merely because it was printed from a device or saved as a PDF or an image; it must be issued by a compliant e-invoicing solution, in a specific technical format.

The system rolled out in two phases:

• Generation Phase: started 4 December 2021 for all taxpayers at once. It requires invoices to be issued and stored electronically, with a QR code on simplified invoices.
• Integration Phase: started 1 January 2023 and applies to taxpayers in successive waves by revenue size, adding direct technical integration with the Fatoora platform.

The core difference: in Phase 1 you issue the invoice electronically and keep it. In Phase 2 your invoices become connected to the Authority — cryptographically stamped and transmitted.

Is my business in scope? The deadline table

Wave	Annual VAT-subject revenue threshold	Measurement years	Integration deadline
Wave 24	Exceeded SAR 375,000	2022, 2023 or 2024	30 June 2026
Wave 25	Exceeded SAR 187,500	2022, 2023, 2024 or 2025	1 February 2027

How to check in practice: look at your VAT returns and total the VAT-subject revenue for each of the years listed. If any single year exceeded the threshold, you are in scope. ZATCA notifies targeted taxpayers directly ahead of their wave with adequate notice — but waiting for the notice is not a plan; the notice period is measured in months, and doing this properly takes time.

An important note: the threshold is not measured by activity type, branch count or profit — only by VAT-subject revenue. A single business averaging SAR 550 a day in sales crosses the Wave 25 threshold within one year.

Phase 1 vs Phase 2: what exactly changes?

Item	Generation Phase	Integration Phase
Invoice format	Electronic, any structured format	XML (UBL 2.1), or PDF/A-3 embedding XML
Cryptographic stamp	Not required	Required — cryptographic stamp and digital signature
Invoice UUID	Not required	Required for every invoice
QR code	Required on simplified invoices	Required in a specific TLV format
Hash chain	Not required	Required — each invoice carries its predecessor's hash
Sequential counter	Not required	Required, and never reset
Connection to ZATCA	None	Direct integration with Fatoora via API
Cryptographic certificate	None	Device onboarding and a certificate (CSID)

Simplified vs standard tax invoice: which applies to you?

This is the most practical point, and the most misunderstood.

Simplified invoice (B2C): issued to an end consumer, handed over printed or electronically at the moment of sale, then reported to ZATCA within 24 hours. The cashier does not wait for approval, so peak-hour queues are unaffected. This is the dominant case in retail, restaurants, salons, laundries and any direct sale to individuals.

Standard tax invoice (B2B): when selling to a business — corporate orders, insurance claims, service contracts, subscriptions, events — it is subject to Clearance; it is transmitted to ZATCA and cleared before it is shared with the customer.

There is a real operational trap here: a POS that does not distinguish between the two will treat a corporate invoice as a simplified one, and it will be issued outside its legal path. Ask your provider directly: does the system support the clearance path for standard invoices, not just reporting?

What differs by business type?

The rules are the same for everyone, but the friction point moves from one activity to another:

Business type	What to watch for
Retail stores	Returns and exchanges happen daily; handle them with a credit note tied to the original invoice, never by deleting or editing it.
Restaurants and cafés	A high density of simplified invoices in a short window; any delay in issuance shows up immediately in the peak-hour queue.
Salons and beauty centres	A booking deposit paid up front requires an invoice when the money is received, not when the service is delivered. See appointments.
Laundries	The invoice is issued at drop-off and payment, not at pick-up days later.
Car washes and service centres	Selling a package or subscription requires an invoice at the point of sale; later redemptions do not generate a new invoice.
Clinics and pharmacies	A mix of taxable and exempt services, and insurance-company billing is a standard invoice requiring clearance.
Services firms and contractors	Most invoices go to businesses, so clearance is the default path rather than the exception.
E-commerce and delivery	Every order needs an invoice regardless of channel — website, app or WhatsApp.

The universal rule: every amount you collect from a customer must be matched by an electronic invoice issued from the system — no side paper, no transfer without an invoice.

The technical requirements in plain language

You do not need to be technical, but you do need to know what to ask about:

1. XML (UBL 2.1): the invoice is built as a structured file the Authority reads automatically — not an image or free text.
2. Cryptographic stamp and signature: a digital fingerprint proving the invoice came from a registered device and was not altered after issuance.
3. UUID: a unique identifier for every invoice, never repeated within your business.
4. QR code in TLV format: not just any barcode; a defined format carrying the seller name, VAT number, timestamp, total and VAT amount, readable by the ZATCA app for verification.
5. Hash chain (PIH) and counter: each invoice carries the hash of the one before it plus an ascending sequence number. That is what makes deleting an invoice from the middle immediately visible.
6. Device onboarding (CSID): every point of sale is registered on the Fatoora platform via an OTP and receives its own certificate. The certificate has a validity period and must be renewed.
7. No edits after issuance: an issued invoice is never edited or deleted. Corrections are made with a credit or debit note tied to the original invoice.

What actually changes at the till?

The correct answer: nothing the staff can see — if the system is well built.

In an integrated system, the cashier presses "issue invoice" exactly as before, and everything above happens in the background in a fraction of a second. Systems that treat e-invoicing as an add-on, or route you through an external middleman, show these symptoms instead:

• Seconds of delay on every invoice at peak time.
• Print failures when the connection to the middleman is slow.
• An error screen the cashier faces in front of the customer.

And the most important question — offline operation: what happens if the internet drops at peak time? In a sound system, selling continues, simplified invoices are issued and printed locally, then transmitted automatically once connectivity returns, within the legal window. At Wasla, ZATCA-compliant e-invoicing is built into the core of the POS and works exactly on that logic — no middleman and no separate subscription.

Checklist: compliance steps in order

1. Identify your wave: review your VAT-subject revenue for 2022–2025 and confirm your deadline.
2. Verify your business details: the legal name, VAT number, address and CR in the POS must match ZATCA's records exactly — a single differing character fails onboarding.
3. Confirm the solution is compliant: built into your system, ready today, not "in development" and not an external middleman with separate fees.
4. Onboard every point of sale: each till in each branch needs its own registration and certificate. Do not forget spare and mobile devices.
5. Test a real invoice: issue one and scan the QR code with the ZATCA app to verify the data.
6. Test the hard scenarios: cancellation after invoicing, partial refund, discount, advance payment, a business (standard) invoice, and an internet outage.
7. Train staff on just two cases: how to issue a standard invoice to a business customer, and how to process a refund with a credit note instead of deleting the invoice.
8. Monitor transmission status daily: your dashboard should tell you whether any invoice failed to reach ZATCA — you should not discover it months later.
9. Schedule certificate renewals: set a reminder before each device's certificate expires.

Seven common mistakes

1. A new branch with no onboarding: the branch opens and starts selling on unregistered devices, quietly accumulating unreported invoices. Review branch management at every opening.
2. Replacing a device without re-onboarding: a replacement device needs a new certificate; copying settings is not enough.
3. Editing or deleting an invoice: this breaks the hash chain and is an outright violation. Always correct with a credit or debit note.
4. A side invoice book: manual or Excel invoices for corporate customers outside the system — the most common violation and the easiest to detect. Keep all invoices in one source.
5. Ignoring failed invoices: invoices rejected by ZATCA or never transmitted sit pending with nobody watching. Make reviewing them part of the daily close, alongside sales reports.
6. Rounding VAT by hand: calculating VAT on the order total instead of precisely at line level produces halala differences that get rejected.
7. Depending on an external middleman with no fallback: if the middleman goes down, your invoicing goes down. An embedded solution removes that link entirely.

Penalties: a gradual approach is not leniency

ZATCA classifies e-invoicing violations under the VAT Law and its Implementing Regulations, and publishes a simplified guideline for classifying violations. The approach is gradual: the Authority typically starts by notifying the taxpayer and allowing a correction period, then penalties escalate with repetition and inaction, reaching up to SAR 50,000 in the violations schedule depending on the type and recurrence.

The most prominent violations: failing to issue invoices electronically, omitting the QR code from simplified invoices, failing to store invoices in the required format, deleting or editing invoices after issuance, and failing to integrate with Fatoora by the deadline.

The financial takeaway is simple: a single violation can exceed a full year's subscription to a complete POS system.

How to pick a system that closes this file for good

Put these questions to any provider, and ask for the answers in writing:

1. Is Phase 2 compliance built in, or delivered through an external middleman?
2. Is it included in the subscription, or a paid add-on? (Compare on pricing.)
3. Does it support clearance for standard invoices as well as reporting for simplified ones?
4. Does it fit my specific activity — retail, services, appointments or subscription packages?
5. What happens to invoices during an internet outage?
6. Is there a transmission status report showing pending or rejected invoices?
7. Who handles device onboarding and certificate renewal — me or you?
8. When ZATCA issues a regulatory update, does it reach me automatically at no extra cost? And is support available during my working hours?

Conclusion

Phase 2 is not a paperwork exercise; it changes how your business is connected to the tax authority: invoices that are stamped, chained, uneditable and transmitted as they happen. And with the Wave 25 threshold down to SAR 187,500, no business is small enough to stay outside the scope — and no activity is exempt by virtue of its type.

Businesses that handle this early finish it in days. Those that leave it to the final week pay for it twice: once in the rush, and once in penalties.

Wasla is a cloud POS for every activity in Saudi Arabia — retail, services, clinics, laundries, restaurants and cafés — with ZATCA-compliant e-invoicing running automatically in the background, no middleman and no extra step at the till.

Read next: How to choose the right POS and what a POS system really costs in Saudi Arabia.

This guide is for general awareness and is not tax advice. The only authoritative reference is what the Zakat, Tax and Customs Authority publishes.