ZATCA Phase 2 (e-Invoicing Integration) in Saudi Arabia: A Practical Guide for SMBs

Saudi Arabia's e-invoicing program, run by ZATCA (the Zakat, Tax and Customs Authority), rolled out in two phases. Phase 1, the "Generation" phase, has been mandatory for all VAT-registered businesses since 4 December 2021: it required you to stop issuing handwritten or simple PDF invoices and instead generate invoices through a compliant electronic system that produces a structured invoice and a QR code for simplified (B2C) invoices.

Phase 2 — the "Integration" phase — began rolling out in waves from 1 January 2023. It goes much further than Phase 1. Instead of just generating an electronic invoice inside your own system, your system must now connect to ZATCA's FATOORA platform through an API and exchange data with the authority in near-real time.

The practical difference comes down to two flows: - Standard (B2B / tax) invoices follow a "Clearance" model: the invoice is sent to ZATCA, cryptographically validated and stamped, and only then is it considered legally valid to share with your customer. - Simplified (B2C) invoices follow a "Reporting" model: they are generated and shared with the customer immediately, then reported to ZATCA within 24 hours.

In short, Phase 1 was about how you create invoices; Phase 2 is about connecting your system to the government so invoices are cleared or reported automatically. Saudi VAT remains 15%, and that rate must be calculated and shown correctly on every compliant invoice.

Phase 2 has specific technical requirements that a generic invoicing tool will not satisfy on its own. Your e-invoicing solution must be able to: - Produce invoices as UBL 2.1 XML — the structured, machine-readable format ZATCA mandates (a standard PDF is not enough on its own). - Generate a QR code on every invoice, encoding the seller details, VAT number, timestamp, total with VAT, and the VAT amount. - Apply a cryptographic stamp using a digital certificate (CSID) issued through the FATOORA platform, so each invoice is tamper-evident and verifiably linked to your business. - Maintain a sequential, unbroken chain of invoices using a counter and a hash of the previous invoice, so gaps or deletions are detectable. - Integrate with ZATCA's APIs to clear standard invoices and report simplified invoices. - Store invoices securely and keep them available for the legally required retention period.

These controls are why Phase 2 is often the point where businesses move from spreadsheets or basic accounting apps to a properly integrated ERP. The cryptographic stamping, hashing chain, and API onboarding are not features you can bolt on by hand — they have to be built into the system that issues your invoices.

ZATCA is not switching on Phase 2 for everyone at the same time. Instead it is enforcing it in "waves," grouping taxpayers and giving each group a compliance window. Eligibility for each wave has been based on the business's annual taxable revenue, starting with the largest taxpayers and moving down to smaller ones over time.

ZATCA notifies each in-scope business directly, typically several months before its enforcement date, so you should receive an official notification rather than having to guess. What this means in practice: - If you have already been notified, your integration deadline is a hard date — plan your project backwards from it. - If you have not yet been notified, you are very likely to be in a future wave, so it is worth preparing early rather than scrambling later.

Because the specific revenue threshold and dates for each wave change as the rollout progresses, you should confirm your own status and deadline against ZATCA's official communications and your direct notification. The current wave threshold and your assigned enforcement date are: based on your annual revenue and stated in ZATCA's official notification to you. METCH can help you confirm exactly which wave you fall into and when you must be live.

Odoo is an open-source ERP that is priced per user plus per app, with modules for accounting, sales, inventory, HR, POS, manufacturing, CRM and more. For Saudi businesses, the relevant point is that Odoo's accounting and invoicing modules can be configured to meet ZATCA's e-invoicing requirements, so your sales, inventory and accounting all feed a single compliant invoice flow instead of being stitched together from separate tools.

With a correctly implemented Odoo setup for Phase 2 you can: - Generate invoices in the required UBL 2.1 XML structure with the mandated fields. - Produce the compliant QR code on simplified invoices automatically. - Apply the cryptographic stamp and maintain the sequential hash chain. - Connect to ZATCA's FATOORA platform to clear standard invoices and report simplified invoices. - Keep one source of truth for VAT (15%), customer data, and reporting.

The value of doing this inside an ERP is that compliance stops being a separate chore. The same invoice that satisfies ZATCA also updates your books, your inventory, and your customer records. As a certified Odoo partner in Saudi Arabia, METCH configures, tests, and onboards your Odoo system with ZATCA so the integration is verified end to end before your enforcement date — not improvised afterwards.

Use this checklist to gauge how ready you are for Phase 2: - Confirm you are VAT-registered and already meeting Phase 1 (generating electronic invoices with QR codes for B2C). - Find out your wave and enforcement date from ZATCA's notification to your business. - Choose an e-invoicing solution that supports UBL 2.1 XML, QR codes, cryptographic stamping, the hash chain, and FATOORA API integration. - Obtain your cryptographic certificate (CSID) by onboarding your device/solution with the FATOORA platform. - Map your invoice types: which are standard (B2B, clearance) and which are simplified (B2C, reporting). - Run end-to-end tests against ZATCA's sandbox before going live, covering both clearance and reporting flows. - Validate VAT (15%) calculations, Arabic and English fields, and that totals match across the QR code and the XML. - Confirm secure storage and retention of issued invoices. - Go live on or before your enforcement date, then monitor for rejected or failed submissions.

Missing the enforcement date or submitting non-compliant invoices can expose your business to penalties, so treat the date as a project deadline. If you would like a partner to handle the technical onboarding and testing, METCH delivers ZATCA-ready Odoo implementations for Saudi SMBs.