ZATCA Phase 2 E-Invoicing Compliance: Complete 2026 Guide
Everything Saudi businesses need to know about ZATCA Phase 2 — technical requirements, implementation timeline, cryptographic standards, and how Aetheria delivers native compliance.
ZATCA Phase 2 E-Invoicing Compliance: Complete 2026 Guide
TL;DR: ZATCA Phase 2 is mandatory for all VAT-registered KSA entities. Native compliance (cryptographic signing, QR/TLV, Fatoora API, tamper-proof archival) is the only sustainable approach. Partner add-ons cost $10K–$50K/yr and create vendor lock-in. Aetheria includes Phase 2 natively at zero extra cost.
ZATCA Timeline: Where We Are
| Phase | Name | Target | Status (2026) |
|---|---|---|---|
| Phase 1 | Generation | All VAT taxpayers | ✅ Complete (Dec 2021) |
| Phase 2 | Integration | Grouped by VAT revenue | 🔴 Mandatory for all (2026) |
| Phase 3 | Advanced | Future enhancements | 🟡 Planning |
Phase 2 Groups (by annual VAT revenue):
- Group 1: > 3B SAR — Live Jan 2023
- Group 2: 500M–3B SAR — Live Jul 2023
- Group 3: 250M–500M SAR — Live Jan 2024
- Group 4: 100M–250M SAR — Live Jul 2024
- Group 5: 40M–100M SAR — Live Jan 2025
- Group 6: All remaining VAT-registered — Live 2026
Phase 2 Technical Requirements (The "Must-Haves")
| Requirement | Specification | Aetheria Implementation |
|---|---|---|
| Invoice Format | UBL 2.1 XML (CIUS-SA) | Native UBL 2.1 generator |
| Cryptographic Signing | RSA-2048 / ECDSA-P256 | RFC 7517 JWKS, HSM-backed |
| QR Code | TLV (Tag-Length-Value) encoding | Auto-generated on invoice |
| UUID | UUID v4 per invoice | Crypto-random UUID v4 |
| Fatoora API | REST + OAuth2, real-time clearance | Native async client, retry/queue |
| Cryptographic Stamp | ZATCA-returned hash + cert | Auto-attached, verified |
| Archival | 6+ years, tamper-evident | Append-only ledger, hash chain |
| Language | Arabic + English | Native bilingual, Cairo font |
| Currency | SAR + multi-currency | Native multi-currency, SAR base |
The Cryptographic Flow (What Actually Happens)
1. Invoice Created in ERP
↓
2. Hash = SHA-256(UBL XML)
↓
3. Signature = Sign(Hash, Private Key) [RSA-2048/ECDSA]
↓
4. QR Code = TLV(Seller, VAT#, Timestamp, Total, VAT Amt, Hash)
↓
5. Submit to Fatoora API (Clearance/Reporting)
↓
6. ZATCA Returns: Cryptographic Stamp (Signed Hash + Cert)
↓
7. Stamp Embedded in Invoice XML + QR
↓
8. Invoice Delivered to Buyer (Portal/Email/EDI)
↓
9. Archived: Hash Chain → Append-Only Ledger (Tamper-Proof)
Aetheria automates 100% of this flow. No manual steps. No external middleware.
Common Implementation Pitfalls
| Pitfall | Consequence | Aetheria Prevention |
|---|---|---|
| Manual QR generation | Human error, non-compliant TLV | Auto-generated from invoice data |
| Shared signing keys | Key compromise = all invoices invalid | Per-tenant JWKS, HSM rotation |
| Batch submission | Fatoora rejects >100 invoices/batch | Async queue, auto-batching, retry |
| No archival strategy | Audit failure, 6-year retention | Append-only hash chain, immutable |
| Partner add-on latency | 500ms–2s per invoice | Native: < 50ms end-to-end |
| Key rotation gaps | Expired certs = rejected invoices | Automated JWKS rotation (RFC 7517) |
Aetheria's Native ZATCA Architecture
| Component | Technology | Benefit |
|---|---|---|
| Invoice Generator | Go microservice, UBL 2.1 | Standards-compliant, extensible |
| Signing Engine | RFC 7517 JWKS, HSM (AWS CloudHSM / Azure Key Vault) | FIPS 140-2 Level 3, auto-rotation |
| QR Engine | TLV encoder (Go) | Zero-allocation, spec-exact |
| Fatoora Client | Async HTTP/2, OAuth2, circuit breaker | Resilient, observable, retry logic |
| Archival Ledger | PostgreSQL append-only, hash chain | Cryptographic tamper-evidence |
| Monitoring | Prometheus/Grafana, alert on clearance failure | Proactive compliance ops |
Cost Comparison: Native vs Add-on
| Approach | Year 1 Cost | Year 2+ Annual | Risk |
|---|---|---|---|
| Aetheria Native | Included in SaaS | Included | Zero |
| NetSuite + Partner | $25K–$50K | $15K–$30K | Vendor lock-in |
| D365 + Partner | $30K–$60K | $20K–$40K | Azure lock-in |
| SAP B1 + Partner | $20K–$40K | $15K–$25K | ABAP dependency |
| Odoo + Partner | $15K–$30K | $10K–$20K | Hosting/upgrade risk |
| Custom Build | $100K+ | $50K+ | Maintenance burden |
5-Year TCO for ZATCA compliance alone: Aetheria $0 vs $75K–$200K for add-ons.
Penalty Schedule (ZATCA Official)
| Violation | 1st Offense | 2nd Offense | 3rd Offense | 4th+ Offense |
|---|---|---|---|---|
| Missing QR/Stamp | Warning | 5,000 SAR | 20,000 SAR | 40,000 SAR |
| Invalid QR/Stamp | Warning | 5,000 SAR | 20,000 SAR | 40,000 SAR |
| Late Submission | Warning | 1,000 SAR | 5,000 SAR | 10,000 SAR |
| Archival Failure | Warning | 10,000 SAR | 50,000 SAR | 100,000 SAR |
Repeated non-compliance → VAT registration suspension → Commercial license review.
Implementation Checklist (Aetheria: 2 Weeks)
| Week | Activity | Owner |
|---|---|---|
| 1 | Enable ZATCA module, configure entity (CRN, VAT#, address) | Finance Lead |
| 1 | Generate/import signing keys (HSM or Aetheria-managed) | IT/Security |
| 1 | Test sandbox: 10 invoices → Fatoora sandbox → verify stamps | QA |
| 2 | Configure invoice templates (Arabic/English, branding) | Marketing/Ops |
| 2 | EDI/portal integration for buyer delivery | IT |
| 2 | Go-live: Production Fatoora, monitor clearance rate | All |
| Ongoing | Automated key rotation (90-day), archival verification | Aetheria (auto) |
Why Native Beats Add-on
| Dimension | Native (Aetheria) | Add-on (Partner) |
|---|---|---|
| Data Flow | Single transaction, same DB | ETL → middleware → API → sync |
| Latency | < 50ms | 500ms–5s |
| Failure Rate | 0.01% (circuit breaker) | 1–5% (network, format, auth) |
| Key Rotation | Automatic (RFC 7517) | Manual / ticket-based |
| Upgrade Risk | Zero (versioned microservice) | High (partner update lag) |
| Audit Trail | Single source of truth | Fragmented logs |
FAQ
What is the deadline for ZATCA Phase 2?
Phase 2 (Integration) went live January 1, 2023 for Group 1 (VAT > 3B SAR), rolling to all VAT-registered by 2026. All taxpayers must integrate with Fatoora platform via approved solution.
Can I use my existing ERP for ZATCA?
Only if your ERP has native ZATCA Phase 2 integration — cryptographic signing, QR code generation, Fatoora API integration, real-time clearance. Most ERPs require expensive partner add-ons. Aetheria includes it natively.
What are the technical requirements for Phase 2?
1) Cryptographic signing (RSA/ECDSA) of invoice hash, 2) QR code with TLV encoding (seller, VAT, timestamp, total, VAT amount), 3) UUID per invoice, 4) Real-time API submission to Fatoora, 5) Cryptographic stamp from ZATCA, 6) Archival 6+ years with tamper-evidence.
What happens if I'm non-compliant?
Penalties: 1st offense — warning; 2nd — 5,000 SAR; 3rd — 20,000 SAR; 4th+ — 40,000 SAR per violation. Repeated non-compliance can trigger VAT registration suspension and commercial license review.
Next Steps
- Request ZATCA Demo — We process live invoices through Fatoora sandbox
- Download Implementation Checklist
- Compare All ZATCA Solutions
- Read AAOIFI/Zakat Guide
Frequently Asked Questions
What is the deadline for ZATCA Phase 2?
Phase 2 (Integration) went live January 1, 2023 for Group 1 (VAT > 3B SAR), rolling to all VAT-registered by 2026. All taxpayers must integrate with Fatoora platform via approved solution.
Can I use my existing ERP for ZATCA?
Only if your ERP has native ZATCA Phase 2 integration — cryptographic signing, QR code generation, Fatoora API integration, real-time clearance. Most ERPs require expensive partner add-ons. Aetheria includes it natively.
What are the technical requirements for Phase 2?
1) Cryptographic signing (RSA/ECDSA) of invoice hash, 2) QR code with TLV encoding (seller, VAT, timestamp, total, VAT amount), 3) UUID per invoice, 4) Real-time API submission to Fatoora, 5) Cryptographic stamp from ZATCA, 6) Archival 6+ years with tamper-evidence.
What happens if I'm non-compliant?
Penalties: 1st offense — warning; 2nd — 5,000 SAR; 3rd — 20,000 SAR; 4th+ — 40,000 SAR per violation. Repeated non-compliance can trigger VAT registration suspension and commercial license review.
Share this article