Saudi Arabia's e-invoicing mandate — run by the Zakat, Tax and Customs Authority (ZATCA) under the Fatoora program — is now one of the most important compliance deadlines for any business operating in the Kingdom. If your software cannot issue a compliant electronic invoice and, when required, integrate directly with ZATCA's platform, you face rejected invoices, blocked VAT deductions, and potential penalties. This guide explains what Fatoora requires in 2026, who must comply and by when, and how to choose accounting software that meets the standard.
This page is built from ZATCA's official guidance and reputable tax advisories (see Sources). Always confirm your specific obligation through ZATCA's own notification and published material before you act.
What is ZATCA e-invoicing (Fatoora)?
E-invoicing (Fatoora) is the requirement to generate, store, and exchange invoices in a structured electronic format instead of paper or simple PDFs. ZATCA introduced it in two phases:
- Phase 1 — the Generation Phase — enforceable from 4 December 2021 for all resident taxpayers. Businesses must issue and store tax invoices electronically using a compliant solution, and B2C (simplified) invoices must carry a QR code.
- Phase 2 — the Integration Phase — rolled out in waves by annual revenue. This phase adds technical and security requirements and, critically, requires your e-invoicing solution to integrate directly with ZATCA's Fatoora platform.
The distinction matters: Phase 1 is about how the invoice is created; Phase 2 is about connecting your system to the government so invoices are cleared or reported in near real time.
Who must comply in 2026 — Wave 23 and Wave 24
ZATCA brings businesses into Phase 2 in waves, defined by VAT-subject revenue in 2022, 2023, or 2024. The authority notifies each targeted taxpayer at least six months before their go-live window. Two waves dominate 2026:
| Wave | Revenue threshold (2022–2024) | Integration deadline |
|---|---|---|
| Wave 23 | Over SAR 750,000 | By 31 March 2026 |
| Wave 24 | Over SAR 375,000 | By 30 June 2026 |
Wave 24 is significant: by lowering the threshold to SAR 375,000, ZATCA pulls thousands of small and medium businesses into mandatory Phase 2 for the first time. If your VAT-subject revenue crossed SAR 375,000 in any of 2022, 2023, or 2024 and you have not yet integrated, 2026 is your year — confirm your wave in your ZATCA portal notification.
ZATCA has also extended its "Cancellation of Fines and Exemption of Penalties" initiative to 30 June 2026, giving businesses a grace window to correct past errors. Treat that as breathing room to get compliant, not a reason to delay.
Phase 2 technical requirements you must support
To pass Phase 2, your invoices and your software must meet ZATCA's technical standard. The essentials:
- Structured format — invoices in XML (or PDF/A-3 with embedded XML for the human-readable version).
- Unique identifier (UUID) — every invoice carries a Universally Unique Identifier.
- Cryptographic stamp — invoices are cryptographically stamped so they cannot be altered after issue.
- Hash and previous-invoice hash — chaining invoices to detect tampering.
- QR code — generated to ZATCA's specification; mandatory on B2C (simplified) invoices for instant validation.
- Invoice classification — your system must distinguish B2B, B2C, and B2G transactions, which carry slightly different fields and flows.
- Clearance vs reporting — standard (B2B) invoices are cleared with ZATCA in real time before they are shared with the buyer; simplified (B2C) invoices are reported to ZATCA within 24 hours.
Once an invoice is generated, a Phase-2 solution submits it to the Fatoora portal, where ZATCA validates it, applies a digital signature/time-stamp, and returns it. That round-trip is the heart of Phase 2 — and it is exactly why your choice of software matters.
How to choose a ZATCA-compliant accounting tool
Not every accounting package can do Phase 2. When you shortlist, verify each of these against the vendor's official documentation and ZATCA's published list of compliant solutions:
- Phase 2 integration — does it connect to the Fatoora platform via ZATCA's API, handle clearance/reporting, and manage the cryptographic stamp and CSID onboarding for you?
- Correct invoice fields and formats — XML / PDF/A-3, UUID, hash, and a ZATCA-spec QR code on B2C invoices.
- Arabic and bilingual invoices — Arabic is required; bilingual Arabic/English is a plus for exporters.
- VAT handling — 15% VAT, tax invoices vs simplified invoices, credit/debit notes.
- Audit-ready retention — secure, tamper-evident storage of cleared invoices.
- Local support — a vendor that tracks ZATCA wave changes and updates the integration for you.
Among the tools we cover, Daftra is built for the Saudi/MENA market and positions itself around ZATCA e-invoice and QR-invoice support, which makes it a natural shortlist candidate for KSA SMEs. Global cloud tools such as Zoho Books also offer Saudi e-invoicing localization. Whichever you pick, confirm current ZATCA certification on the vendor's site and ZATCA's list before you commit — compliance status can change between waves.
For a broader shortlist with pricing and buyer-fit notes, start from our best accounting software hub and compare the options that explicitly advertise Phase 2 integration.
A practical compliance checklist
Use this sequence to get from "notified" to "integrated":
- Confirm your wave and deadline in the ZATCA portal — do not rely on rumor; ZATCA notifies you directly.
- Audit your current invoicing — can your present system issue Phase 1 invoices with a QR code today? If not, fix Phase 1 first.
- Select a Phase 2 solution using the criteria above, and confirm it appears as compliant.
- Onboard with ZATCA — generate the cryptographic stamp identifier (CSID) and complete the integration/compliance checks in the sandbox.
- Test end to end — issue B2B (clearance) and B2C (reporting) invoices and confirm successful round-trips before go-live.
- Train your team on the new flow, invoice types, and what to do if clearance fails.
- Go live before your deadline — leave margin for last-minute fixes.
Common pitfalls to avoid
- Treating Phase 1 compliance as enough. A QR code on a PDF is not Phase 2; integration is the new bar.
- Assuming any "e-invoice" feature is ZATCA-ready. Many tools generate PDFs but cannot clear/report with Fatoora. Verify integration specifically.
- Waiting for enforcement. With six-month notice and fixed wave deadlines, late starts mean rushed, error-prone go-lives.
- Ignoring the grace period's end. The penalty-waiver initiative runs only to 30 June 2026.
Bottom line
ZATCA e-invoicing is no longer a "large enterprise" problem. With Wave 24 lowering the threshold to SAR 375,000, most VAT-registered SMEs in Saudi Arabia are now in scope, with a 30 June 2026 integration deadline. The safest path is to choose accounting software that already handles Phase 2 integration end to end, confirm its ZATCA compliance, and test well before your wave's deadline. Begin your shortlist on our accounting software hub, and prioritize tools that explicitly support Fatoora Phase 2.
Pricing, plan, and compliance-status claims change frequently. Confirm current details on ZATCA's official site and the vendor's pricing/compliance pages before purchase.
Clearance vs reporting: B2B, B2C, and B2G explained
Phase 2 does not treat every invoice the same way, and understanding the split prevents most compliance surprises:
- Standard tax invoices (B2B and B2G) go through clearance. Your system sends the invoice to ZATCA before you share it with the buyer; ZATCA validates it, applies its cryptographic stamp, and returns a cleared version. Only the cleared invoice is legally valid to send. This is real-time, so your integration and internet connectivity must be reliable.
- Simplified tax invoices (B2C) go through reporting. You issue the invoice to the consumer immediately (with the QR code), then your system reports it to ZATCA within 24 hours. The customer does not wait for clearance, but your system must still transmit the record.
Getting the classification right in your software matters: a B2B sale wrongly issued as a simplified invoice (or vice versa) can create compliance gaps. A good Phase 2 solution detects the invoice type from the customer/VAT details and routes it through the correct flow automatically.
Phase 2 onboarding: the technical steps in detail
Integration is more than flipping a switch. The typical onboarding sequence is:
- Generate a CSID (Cryptographic Stamp Identifier). Your solution requests a compliance CSID from ZATCA using a one-time password from your Fatoora portal. This identity is what cryptographically stamps your invoices.
- Pass compliance checks in the sandbox. ZATCA requires your solution to submit sample standard and simplified invoices (plus credit/debit notes) and pass validation before it issues a production CSID.
- Obtain the production CSID and go live. Once compliance is confirmed, you receive the production credentials and begin clearing/reporting real invoices.
- Monitor and renew. Certificates and credentials have lifecycles; a good vendor manages renewal so your clearance never silently breaks.
If your accounting tool handles steps 1–4 for you behind a simple setup wizard, onboarding is a matter of days. If it does not, you may need a middleware provider — a real cost to weigh when choosing software.
Common reasons ZATCA rejects an e-invoice
When clearance fails, it is almost always one of a small set of issues. Knowing them helps you choose software that prevents them:
- Missing or malformed required fields — VAT numbers, buyer details on B2B invoices, or line-item tax breakdowns that don't match ZATCA's schema.
- Incorrect format — the XML doesn't validate against ZATCA's specification, or the PDF/A-3 lacks the embedded XML.
- QR code errors — the QR isn't generated to ZATCA's TLV specification, or is absent on a simplified invoice.
- Hash/stamp problems — a broken invoice chain (wrong previous-invoice hash) or an invalid cryptographic stamp.
- Wrong invoice type — a standard invoice sent through the reporting flow, or a simplified one sent for clearance.
The practical takeaway: these are exactly the things a properly certified Phase 2 solution handles automatically. If you are evaluating tools, ask the vendor how each of these is prevented, not just whether the tool "supports e-invoicing."
What happens if you miss your wave deadline
Each wave has a hard go-live date communicated by ZATCA with at least six months' notice. Continuing to issue non-integrated invoices after your deadline is non-compliance and exposes you to penalties. The mitigating factor for 2026 is ZATCA's "Cancellation of Fines and Exemption of Penalties" initiative, extended to 30 June 2026, which gives a window to correct historical errors. But that initiative is not a reason to delay integration — it is a grace period to fix the past while you get compliant. The safe approach is to treat your wave deadline as fixed, start onboarding well before it, and keep the penalty-waiver window as a backstop rather than a plan.
In-house vs outsourced compliance: which path fits you
A final strategic choice underlies the software decision: do you want compliance built into your accounting tool, or handled by a separate e-invoicing middleware connected to your existing system?
- Built-in (recommended for most SMEs): an accounting platform that is itself ZATCA-certified handles generation, clearance/reporting, the cryptographic stamp, and the QR code in one place. This is the simplest, lowest-maintenance path and is why most small and mid-sized Saudi businesses choose a compliant all-in-one tool.
- Middleware/integration layer: larger organizations with an existing ERP (SAP, Oracle, Microsoft Dynamics) that they will not replace often connect a certified e-invoicing service to that ERP. This preserves the core system but adds an integration to build, test, and maintain.
For a typical SME, the built-in route wins on cost and simplicity; for an enterprise with an entrenched ERP, the middleware route protects that investment. Either way, the compliance outcome is the same — what differs is who owns the integration and its upkeep. Decide this early, because it determines whether your "accounting software choice" is really an accounting choice or an integration-architecture choice.
Sources
- ZATCA — E-Invoicing roll-out phases and wave criteria (zatca.gov.sa).
- EY — Saudi Arabia Phase 2 e-invoicing integration wave tax alerts.
- Wafeq — ZATCA e-invoicing fundamentals and wave guidance.