Saudi Arabia's e-invoicing program, known as FATOORA, is one of the most significant digital transformations in the Kingdom's business environment. Phase 1, the Generation Phase, has been in effect since December 2021 and required businesses to issue invoices electronically instead of manually. Phase 2, the Integration Phase, goes considerably further: it connects a company's invoicing systems directly with the platform of the Zakat, Tax and Customs Authority (ZATCA). Because Phase 2 is being rolled out in successive waves, readiness is no longer optional — it is a matter of timing and planning.
From Generation to Integration: What Phase 2 Actually Changes
Under Phase 1, the obligation was essentially internal: invoices had to be created through an electronic system that met the requirements, with core fields such as the VAT registration number and a QR code on simplified invoices. Phase 2 shifts the obligation outward. Invoicing systems must integrate with ZATCA's FATOORA platform through an application programming interface (API), and invoice data is exchanged with the Authority in near real time.
Two flows sit at the heart of the Integration Phase — and together they turn invoicing from a document-formatting exercise into a live data exchange with the regulator:
- Standard tax invoices — typical in business-to-business transactions — are submitted to the platform for validation before being shared with the buyer.
- Simplified tax invoices — typical in consumer sales — are issued to the customer at the point of sale and then reported to the platform within 24 hours of issuance.
Compliance Waves: Who Integrates, and When
ZATCA has deliberately avoided a single deadline for everyone. Instead, the Integration Phase is implemented in successive compliance waves, which began in January 2023 with the largest taxpayers and have progressively extended to lower annual revenue bands. Each wave is defined by VAT-taxable revenue in a reference year, and ZATCA formally notifies the businesses in each wave well before their integration deadline — typically at least six months in advance.
This wave structure has two practical implications:
- If your business has not yet been notified, the time before notification is your preparation window — not a reason to wait.
- If you have been notified, the deadline drives everything: system selection, testing, and platform onboarding all need to be scheduled backward from that date.
The Core Technical Requirements of Phase 2
The Integration Phase introduces technical requirements that go well beyond Phase 1. The most important include:
- Invoice format: invoices must be generated in XML, or as PDF/A-3 files with the XML embedded inside them.
- Cryptographic stamp: each invoice carries a cryptographic stamp generated by the invoicing solution, linking it to the registered device or system.
- Unique identifiers: every invoice includes a universally unique identifier (UUID) in addition to the sequential invoice number.
- Invoice hash: invoices are chained together through hash values, so any tampering or deletion becomes detectable.
- QR code: simplified invoices carry an enriched QR code readable by ZATCA's verification tools.
- Onboarding: each invoicing device or solution must be registered with the FATOORA platform before it can transmit invoices.
- Prohibited functions: a solution that meets the requirements must not allow uncontrolled invoice deletion, system time changes, or manipulation of the invoice sequence.
Where Companies Typically Discover Readiness Gaps
In readiness assessments, the obstacles are rarely the regulations themselves — they are usually operational, and spotting them early is what separates a controlled project from a last-minute scramble:
- Legacy or heavily customized ERP systems that cannot produce the required XML structure without additional development work.
- Poor master data quality: missing or inaccurate VAT registration numbers, buyer details, and address fields that cause invoices to be rejected at validation.
- Multiple invoicing channels — the ERP, point-of-sale (POS) systems, e-commerce platforms — each of which needs its own integration path.
- Unclear ownership: finance assumes IT is handling the project, while IT assumes the vendor is.
- Late vendor engagement, leaving too little time for testing before the wave deadline.
A Practical Readiness Roadmap
A structured approach usually covers six steps, scheduled backward from the wave deadline:
- Confirm your position: determine which wave your business falls into based on revenue, and track ZATCA notifications carefully.
- Map your invoicing landscape: list every system and channel that issues invoices, including branches and POS devices.
- Run a gap assessment: compare current invoice content and system capabilities against the Phase 2 requirements.
- Select the integration path: upgrade the existing ERP, adopt an e-invoicing solution that meets the requirements, or use a middleware layer.
- Test before the deadline: use the available simulation environments to test invoice generation, submission, and reporting end to end.
- Embed the change: train finance and sales teams, define exception-handling procedures for rejected invoices, and monitor compliance continuously after go-live.
Conclusion
Phase 2 of e-invoicing is best understood as an operational transformation with a technical core: it changes how data flows between your systems, your customers, and the regulator. Companies that treat it as a structured project — with clear ownership, an early gap assessment, and realistic testing timelines — generally find the transition manageable. It is worth remembering that formal tax advice and tax filings remain the domain of entities licensed by the competent authorities; Makeen's role is consulting and technical support for the readiness of financial systems and processes. If your business is preparing for its integration wave, the Makeen Business Solutions team would be glad to discuss how consulting support can help you approach it with clarity. This content is general educational material and does not constitute binding professional advice; for regulated matters, please consult the competent licensed entities.