Vikas SarojThe Zakat, Tax and Customs Authority's (ZATCA) e-invoicing mandate is the most consequential compliance change for Saudi businesses in a decade. If your annual revenue crosses SAR 3 million, you're either already integrated with FATOORA Phase 2 or on the rollout roadmap.
This guide explains what Phase 2 actually requires, the technical integration steps, and how Zoho Books (and other ZATCA-approved tools) can get you compliant without building anything from scratch.
Phase 1 vs Phase 2: What Changed?
Phase 1 ("Generation") - effective December 2021 - required Saudi businesses to issue tax invoices electronically in a structured format with QR codes embedded.
Phase 2 ("Integration") - rolled out in waves since January 2023 - connects your invoicing system directly to ZATCA's FATOORA platform. Every invoice is either cleared in real-time (B2B standard invoices) or reported within 24 hours (B2C simplified invoices).
The 5-Step FATOORA Phase 2 Integration Checklist
| Step | Action | Outcome |
|---|---|---|
| 1 | Register on ZATCA's portal | Obtain your CSID (Cryptographic Stamp Identifier) |
| 2 | Configure invoicing system | Generate XML in UBL 2.1 + ZATCA's XSD schema |
| 3 | Implement digital signing | ECDSA P-256 keys with XAdES signatures |
| 4 | Embed compliant QR codes | Seller, VAT, timestamp, total, VAT amount, prev-invoice hash |
| 5 | Wire the live API | B2B clearance + B2C reporting |
Who is Required to Comply?
ZATCA has rolled out Phase 2 in waves based on annual revenue:
| Wave | Effective Date | Revenue Threshold |
|---|---|---|
| Wave 1 | Jan 2023 | SAR 3 billion+ |
| Wave 2 | Jul 2023 | SAR 500M - 3B |
| Wave 3 | Oct 2023 | SAR 250M - 500M |
| Wave 4 | Nov 2023 | SAR 150M - 250M |
| Wave 5+ | 2024 onwards | All VAT-registered businesses |
Eventually, every VAT-registered business in Saudi Arabia must be Phase 2 compliant.
How Zoho Books Handles Phase 2 Compliance
Zoho Books has been ZATCA-certified for both Phase 1 and Phase 2. Once configured, every Saudi-issued invoice is:
- Automatically signed with your ECDSA key
- Embedded with a compliant QR code
- Submitted to ZATCA's FATOORA endpoint (cleared or reported per type)
- Stored with full audit trail and hash chain integrity
No middleware, no manual reconciliation, no custom code.
Common Pitfalls and How to Avoid Them
Customer Master Data Quality
The #1 reason clearance requests fail. If a B2B customer's VAT registration number is missing, malformed, or doesn't match ZATCA's records, the invoice is rejected. Run a complete data-cleanup before integration day.
Pre-Phase-2 Invoice Reconciliation
You can't retroactively clear historical invoices, but ZATCA does want continuity. Make sure your hash chain starts cleanly from your first Phase 2 invoice.
Backup Strategy for Outages
If ZATCA's API is down, you can still issue invoices - they auto-queue and submit when the API recovers. Make sure your team knows this and doesn't panic.
Penalty Risks for Non-Compliance
ZATCA penalties for non-compliance include:
- SAR 5,000-50,000 for failing to issue compliant invoices
- SAR 10,000-50,000 for failing to report or clear invoices
- Repeated violations can trigger business license review
Frequently Asked Questions
Is Zoho Books ZATCA Phase 2 approved?
Yes. Zoho Books is on ZATCA's list of approved e-invoicing solutions for both Phase 1 (Generation) and Phase 2 (Integration).
Do I need separate software for ZATCA compliance?
No. If you use Zoho Books, SAP Business One, Oracle NetSuite (with KSA localization), or another ZATCA-approved solution, compliance is built in.
How long does ZATCA integration take?
With Zoho Books and a competent partner, 2-3 weeks for SMB. Larger enterprises with custom workflows: 4-8 weeks.
Need help getting compliant? Talk to Raqmiat about Zoho Books - we've integrated 150+ Saudi businesses with FATOORA.
