Skip to content

Integration Phase Β· 25 waves announced

ZATCA e-invoicing Phase 2: every wave, threshold and deadline

Phase 2 (the Integration Phase) requires your invoicing system to connect to ZATCA's Fatoora platform: standard invoices are cleared in real time, simplified invoices are reported within 24 hours, and every document is signed XML. It started on 1 January 2023 with businesses above SAR 3 billion and has reached Wave 25: revenue above SAR 187,500 in 2022, 2023, 2024 or 2025, deadline 1 Feb 2027.

Last reviewed 10 September 2026 against ZATCA's wave announcements. Wave 25 was announced 24 Jul 2026.

The wave table

All 25 ZATCA Phase 2 waves

Thresholds are VAT-liable revenue in the reference years ZATCA named for each wave. Deadlines are the date by which integration with Fatoora must be complete. ZATCA notifies each wave at least six months ahead.

ZATCA e-invoicing Phase 2 integration waves with revenue thresholds and deadlines
WaveRevenue above (SAR)Reference yearsAnnouncedIntegration dateStatus
13,000,000,000202124 Jun 20221 Jan 2023Passed
2500,000,000202123 Dec 20221 Jul 2023Passed
3250,000,0002021 or 202224 Mar 20231 Oct 2023Passed
4150,000,0002021 or 202228 Apr 20231 Nov 2023Passed
5100,000,0002021 or 202226 May 20231 Dec 2023Passed
670,000,0002021 or 202216 Jun 20231 Jan 2024Passed
750,000,0002021 or 202228 Jul 20231 Feb 2024Passed
840,000,0002021 or 202218 Aug 20231 Mar 2024Passed
930,000,0002021 or 202217 Nov 20231 Jun 2024Passed
1025,000,0002022 or 202329 Mar 20241 Oct 2024Passed
1115,000,0002022 or 202326 Apr 20241 Nov 2024Passed
1210,000,0002022 or 202324 May 20241 Dec 2024Passed
137,000,0002022 or 202328 Jun 20241 Jan 2025Passed
145,000,0002022 or 202326 Jul 20241 Feb 2025Passed
154,000,0002022 or 202330 Aug 20241 Mar 2025Passed
163,000,0002022 or 202327 Sep 20241 Apr 2025Passed
172,500,0002022 or 20231 Nov 202431 Jul 2025Passed
182,000,0002022 or 202329 Nov 202431 Aug 2025Passed
191,750,0002022 or 202327 Dec 202430 Sep 2025Passed
201,500,0002022 or 202331 Jan 202531 Oct 2025Passed
211,250,0002022, 2023 or 202428 Feb 202530 Nov 2025Passed
221,000,0002022, 2023 or 202421 Mar 202531 Dec 2025Passed
23750,0002022, 2023 or 202427 Jun 202531 Mar 2026Passed
24375,0002022, 2023 or 202426 Sep 202530 Jun 2026Passed
25187,5002022, 2023, 2024 or 202524 Jul 20261 Feb 2027Upcoming

Waves 1–9

Large and mid-size businesses, SAR 30 million and above, 2023 to mid-2024.

Waves 10–22

The long tail from SAR 25 million down to SAR 1 million, monthly deadlines through 31 December 2025.

Waves 23–25

Small businesses: SAR 750,000, then the SAR 375,000 mandatory VAT threshold, then SAR 187,500 β€” the voluntary threshold β€” by 1 Feb 2027.

Dates are those published by ZATCA and consolidated by EY's tax alerts. For Waves 1–16 ZATCA set an integration start date and allowed a compliance window of roughly six months after it (Wave 1: 1 January to 30 June 2023; Wave 16: 1 April to 30 June 2025). From Wave 17 the announced date is the date by which integration must be complete, and Wave 25 is worded β€œby no later than 1 February 2027”. Where a notice named more than one reference year, the threshold applies if revenue exceeded it in any of those years. Confirm your own wave against the notification ZATCA sends you.

What Phase 2 requires

Four technical requirements behind the deadline

Phase 2 keeps every Phase 1 rule and adds the format, the cryptography and the connection.

UBL 2.1 XML for every document

Each invoice, credit note and debit note is generated as a structured XML file following ZATCA's implementation of UBL 2.1, with the mandatory fields, invoice type codes and tax categories the standard defines. A human-readable copy (print or PDF/A-3 with the XML embedded) is issued alongside it.

Cryptographic stamp, UUID, counter and hash chain

Every document carries a UUID, an invoice counter value, the hash of the previous invoice and the hash of itself, and is signed with the private key of an onboarded unit (ECDSA on the secp256k1 curve). The chain makes any gap, deletion or edit detectable.

Clearance for standard invoices

A standard (B2B/B2G) invoice is sent to the Fatoora platform in real time. ZATCA validates it, applies its own stamp and QR code and returns it as cleared. Only the cleared document may be issued to the customer.

Reporting for simplified invoices

A simplified (B2C) invoice is stamped by your own system, issued immediately with the nine-tag QR code, and reported to Fatoora within 24 hours. This is the model for retail, restaurants and e-commerce, and it must keep working through internet outages.

Clearance vs reporting

Which model applies to which invoice

Most businesses issue both types β€” a wholesaler with a shop counter, a contractor who also sells to walk-ins β€” so the software has to do both.

Standard tax invoice (B2B / B2G)Simplified tax invoice (B2C)
ModelClearanceReporting
When ZATCA sees itBefore issue β€” in real timeAfter issue β€” within 24 hours
Who stamps itZATCA applies its stamp and QR after validationYour onboarded unit applies its stamp and 9-tag QR
Can it be issued offline?No β€” clearance needs a live callYes β€” issue now, report when back online
Buyer detailsRequired, including buyer VAT numberNot required
Typical issuersWholesalers, contractors, service firms, suppliers to governmentShops, restaurants, pharmacies, e-commerce, clinics

Which type should you be issuing? Read standard vs simplified tax invoice.

The 9-tag QR code

Phase 2 extends the Phase 1 QR (seller name, VAT number, timestamp, total, VAT) with the XML hash, the ECDSA signature, the unit's public key and β€” on simplified invoices β€” ZATCA's signature of that key. The QR is therefore tied to one specific signed document.

The hash chain and counter

Every document stores the hash of the one before it, and its own hash is signed. Delete an invoice and the next one no longer matches; edit one and its hash changes. This is why Phase 2 systems cannot offer β€œdelete” at all β€” corrections are credit or debit notes that themselves join the chain.

Onboarding

Eight steps from your wave notice to live clearance

Steps 5 to 8 happen on the Fatoora portal and need the business owner or an authorised person β€” not only the vendor.

  1. 1

    Find your wave and your deadline

    Compare your VAT-liable revenue in the reference years against the table above. ZATCA also notifies each wave directly, at least six months before its deadline. Write the date down; everything else is scheduled backwards from it.

  2. 2

    Clean your master data

    Customer VAT numbers, structured addresses, item tax categories and unit codes become mandatory XML fields. A printed invoice tolerated a missing buyer VAT number; a Phase 2 XML fails validation on it.

  3. 3

    Choose an e-invoice generation solution (EGS)

    Your ERP, accounting software, POS or a middleware connector. It must produce the XML, sign it, talk to the Fatoora APIs and handle both clearance and reporting for the document types you issue.

  4. 4

    Test in ZATCA's sandbox and simulation environments

    The developer sandbox validates your XML and signing; the simulation portal rehearses the real onboarding flow without production consequences. Good vendors have already done this; ask to see it.

  5. 5

    Obtain a Compliance CSID

    Log in to the Fatoora portal, generate a one-time password for the unit, and give it to the software within the validity window. ZATCA returns a Compliance CSID β€” a temporary certificate for the next step.

  6. 6

    Pass the compliance checks

    The unit submits sample documents of every type it will issue β€” standard and simplified invoices, credit notes, debit notes β€” and ZATCA checks them against the specification.

  7. 7

    Obtain a Production CSID

    After the checks pass, the unit requests its Production CSID. From this point its clearance and reporting calls are real. Repeat the OTP step for every till, branch system or invoicing instance you run.

  8. 8

    Go live, monitor, renew

    Watch clearance rejections and reporting failures daily in the first weeks. CSIDs expire and must be renewed; a replaced device is re-onboarded. Keep the XML archive retrievable for the record-keeping period.

A longer, owner-focused version with the data-cleaning detail: the Phase 2 integration checklist.

Where AmalERP stands

ZATCA Phase 1 and Phase 2 compliant

AmalERP issues ZATCA-compliant bilingual invoices with the Phase 1 QR code, and integrates with the Fatoora platform for Phase 2 clearance and reporting.

Available now

  • Bilingual Arabic/English tax invoices and simplified tax invoices with your 15-digit VAT number and 15% VAT
  • ZATCA Phase 1 QR code (base64 TLV: seller name, VAT number, timestamp, total, VAT) printed on every invoice
  • Sequential, non-editable invoice numbering with a full audit trail β€” the Phase 1 control that matters most
  • Credit and debit notes that reference the original invoice instead of editing it
  • Structured customer, item and VAT data β€” the fields Phase 2 XML fails on when they are missing
  • Phase 2 Fatoora integration: UBL 2.1 XML, cryptographic stamp, hash chain, real-time clearance of standard invoices and 24-hour reporting of simplified invoices
  • Onboarding via Compliance CSID β†’ Production CSID with the OTP from your Fatoora portal

Tell us your wave

If your deadline is close we will say so honestly. If you have time, getting the books and master data right first is the work that has to happen with any vendor.

Ask on WhatsAppStart 7-day trial

FAQ

ZATCA Phase 2 questions

What is ZATCA Phase 2?

Phase 2, the Integration Phase, is the second stage of Saudi Arabia's e-invoicing mandate. It requires the invoicing system of each taxpayer to integrate with ZATCA's Fatoora platform: invoices are produced as signed UBL 2.1 XML documents with a UUID, counter and hash chain; standard (B2B) invoices are cleared by ZATCA in real time before they are issued, and simplified (B2C) invoices are reported within 24 hours. It began on 1 January 2023 and is applied in waves by VAT-liable revenue.

How do I know which ZATCA wave I am in?

Compare your VAT-liable revenue in the reference years against the threshold for each wave in the table on this page. ZATCA also notifies businesses in each wave directly, at least six months ahead of the deadline. As of 10 September 2026, every business with revenue above SAR 375,000 in 2022, 2023 or 2024 should already be integrated (Wave 24, 30 June 2026), and businesses above SAR 187,500 in any year from 2022 to 2025 are in Wave 25 with a deadline of 1 February 2027.

What is the latest ZATCA Phase 2 wave?

Wave 25, announced on 24 Jul 2026: VAT-liable revenue above SAR 187,500 in 2022, 2023, 2024 or 2025, integration deadline 1 Feb 2027. It is the first wave below the SAR 375,000 mandatory VAT registration threshold, which means voluntarily registered small businesses are now in scope.

What happens if my wave deadline has passed and I am not integrated?

Failure to integrate is a listed violation. ZATCA's approach is warning-first: a first violation normally draws a warning, and repeated violations within twelve months are fined on an escalating schedule up to SAR 50,000. Integrate as soon as possible and keep a dated record of the steps you have taken; that is a far better position than waiting for a notice.

What is the difference between clearance and reporting?

Clearance is real-time approval before issue and applies to standard tax invoices: ZATCA validates, stamps and returns the invoice, and only the cleared version may be given to the customer. Reporting is after-the-fact notification and applies to simplified tax invoices: your system stamps and issues the invoice immediately and reports it to ZATCA within 24 hours.

What is a CSID and why are there two?

A Cryptographic Stamp Identifier is the certificate ZATCA issues to an invoicing unit so it can sign invoices. The Compliance CSID is temporary and is used only to pass ZATCA's compliance checks with sample documents. The Production CSID is issued afterwards and is used for real clearance and reporting. Both are obtained with a one-time password generated in the Fatoora portal by the taxpayer.

Do I need to onboard every device?

Yes. Onboarding is per e-invoice generation solution unit. A trading company with one ERP instance onboards one unit; a retailer with five tills onboards five. Each unit holds its own CSID, keeps its own invoice counter and hash chain, and must be renewed and, if replaced, re-onboarded.

What format must a Phase 2 e-invoice be in?

XML following ZATCA's UBL 2.1 implementation standard, or a PDF/A-3 file with that XML embedded. The XML carries the mandatory fields, the invoice type code (distinguishing standard from simplified, and invoices from notes), the UUID, the counter, the previous-invoice hash, the digital signature and, for simplified invoices, the QR code data.

What is in the Phase 2 QR code?

Nine TLV tags: the five Phase 1 tags (seller name, VAT number, timestamp, total with VAT, VAT total) plus the invoice XML hash, the ECDSA signature, the unit's ECDSA public key and, on simplified invoices, ZATCA's signature of that public key. Our free decoder shows every tag from a scanned QR.

Can my POS keep selling if the internet goes down?

Yes β€” the reporting model was designed for it. Simplified invoices are stamped locally and issued immediately, then reported once connectivity returns, within 24 hours of issue. Standard invoices are different: they need clearance before issue, so a B2B invoice cannot be finalised offline.

Does Phase 2 replace Phase 1?

No. Everything Phase 1 requires β€” electronic generation, mandatory fields, Arabic, no editing or deleting, electronic storage β€” continues to apply. Phase 2 adds the XML format, the cryptographic controls and the live connection to Fatoora.

Does AmalERP support ZATCA Phase 2?

Yes. AmalERP issues bilingual Arabic/English tax and simplified invoices with the Phase 1 QR code, and integrates with ZATCA's Fatoora platform for Phase 2 β€” standard invoices are cleared in real time and simplified invoices are reported within 24 hours, from a unit onboarded with a Production CSID. We are not listed in ZATCA's solution-provider directory and do not call ourselves 'ZATCA-approved', because ZATCA says listing is not an approval; what matters is your onboarding, which we walk you through.

This page is general information, not tax advice. Wave thresholds, reference years and deadlines are taken from ZATCA's published announcements; confirm your own wave against the notification you receive and the current list on zatca.gov.sa. Last reviewed 10 September 2026.

Get the groundwork done before your wave

7-day free trial, no credit card required. ZATCA plans from SAR 599/year.

No credit card required Β· 200+ businesses across the Gulf and beyond.