GCC · ZATCA (Zakat, Tax and Customs Authority)
Saudi Arabia
Updated in last 30 days·Atlas data current as of
Two-phase regime. Phase 1 (Generation, since 4 Dec 2021) mandates structured invoices with QR. Phase 2 (Integration) requires real-time clearance for B2B (standard) and 24-hour reporting for B2C (simplified) via Fatoora — rolling waves by VAT-registered turnover. Wave 25 (announced 24 Jul 2026) drops the threshold to SAR 187,500 with an integration deadline of 1 Feb 2027.
Cloudare has shipped 22 🇸🇦 Saudi Arabia integrations · talk to us →// Phased rollout
- 04 Dec 2021 · livePhase 1 — GenerationAll VAT-registered must issue structured e-invoices with QR.
- 01 Jan 2023 · livePhase 2 Wave 1Integration with Fatoora begins.VAT taxpayers > SAR 3 billion (2021)
- 31 Dec 2025 · livePhase 2 Wave 22Wave 22 integration deadline.Turnover SAR 1.0 – 1.25 m (2022/2023)
- 31 Mar 2026 · livePhase 2 Wave 23Wave 23 integration deadline.Turnover SAR 0.75 m – 1.0 m
- 30 Jun 2026 · livePhase 2 Wave 24Wave 24 integration deadline announced 7 October 2025.Turnover SAR 375k – 750k
- 01 Feb 2027 · upcomingPhase 2 Wave 25Wave 25 integration deadline. Announced 24 Jul 2026; threshold halved from Wave 24's SAR 375k. ZATCA notifies in-scope taxpayers directly.Turnover > SAR 187,500 (any of 2022-2025)
// Penalties
Penalties under VAT Implementing Regulations: SAR 5,000 to SAR 50,000 for non-compliance; failure to issue or store an e-invoice attracts fines and possible suspension.
// What you have to do
- Confirm which of your flows are in scopeB2B is mandatory, B2G is mandatory, B2C is phased.
- Emit one of UBL 2.1 KSA Profile (XML) or PDF/A-3 with embedded XMLYour ERP must produce this syntax, not a PDF or a print stream.
- Connect via Fatoora platform (mTLS REST API)This is the channel, separate from the format. Most projects underestimate it.
- Plan for the Clearance modelThe regulator validates before the invoice is legally issued, so a rejection blocks the sale. Build the rejection path first.
- Retain for 6 yearsArchive the structured original, not a rendering of it.
- Understand the exposurePenalties under VAT Implementing Regulations: SAR 5,000 to SAR 50,000 for non-compliance; failure to issue or store an e-invoice attracts fines and possible suspension.
// ERP implementation notes
SAP S/4HANA (incl. DRC) & SAP ECC
SAP DRC KSA scenario covers Phase 2: cryptographic stamp via SAP CPI keystore, XAdES-B-B signature, QR (TLV Base64) auto-generated. Activate 'SA_INVOICE'.
Microsoft Dynamics 365 (F&O + Business Central)
D365 F&O Saudi Arabia ER configuration handles UBL 2.1 KSA + XAdES; integration with Fatoora via Globalization Studio.
Oracle Fusion Cloud ERP
Oracle Cloud KSA localisation + 3rd-party (Edicom, Pagero, Comarch) for clearance.
Oracle NetSuite
Saudi Arabia E-Invoicing SuiteApp is ZATCA-certified; covers Phase 2 generation, signing and submission.
Odoo (Community + Enterprise)
l10n_sa_edi handles UBL 2.1 KSA + ZATCA Phase 2 (cryptographic stamp, QR TLV).
// Implementation playbook
Cloudare has shipped 22 Saudi Arabia integrations. We will email you the full implementation playbook for Saudi Arabia — typical project plan, ERP-by-ERP gotchas, regulator-specific edge cases, sample test data. No marketing.
// Frequently asked questions
What's the current ZATCA wave I should care about?
ZATCA Phase 2 has been rolling waves of taxpayer cohorts since 2023. As of mid-2026, the relevant target depends on your revenue threshold — ZATCA publishes the next wave's cutoff and the integration window per cohort. If your annual revenue cleared the threshold in any prior period, you're already in. The Fatoora portal lists your wave and integration deadline.
Is ZATCA Phase 2 actually clearance, or pre-clearance?
Both — depending on invoice type. Standard tax invoices (B2B) require pre-clearance: you submit, ZATCA stamps with cryptographic seal + QR, you issue. Simplified invoices (B2C) are pre-cleared offline using the device's CSID and reported within 24h. Mixing these flows is where most ERPs break.
Does our existing SAP DRC India setup help in KSA?
Not directly. SAP DRC for KSA is a separate scenario than IN_INVOICE. Localisation, cryptographic stamping, the eGov gateway endpoint, and the certificate flow are all KSA-specific. Code reuse is mostly limited to the eDocument framework scaffolding.
What's the right way to handle the cryptographic stamp from SAP / Oracle?
Two options: (1) call ZATCA's APIs from a middleware module that handles CSID provisioning, XAdES signing, and the QR generation, then post the signed XML back to the ERP for storage; (2) use SAP DRC's native KSA cryptography stack and let SAP do it. Option 2 is cleaner if you're on S/4HANA Cloud; Option 1 is the realistic path for ECC or non-SAP.
What ERPs has Cloudare implemented for ZATCA Phase 2?
Oracle Fusion, Oracle EBS, NetSuite, SAP S/4HANA, Microsoft Dynamics 365 F&O, Zoho Books, and Odoo — across mid-market and enterprise tiers. The integration pattern is consistent: ERP outputs invoice JSON/XML, middleware handles ZATCA UBL 2.1 transformation + XAdES + QR, response posts the IRN/UUID back.
What happens if my clearance API call fails?
ZATCA mandates a fallback flow. The invoice can be queued and re-submitted, but you cannot issue to the customer until clearance returns. Build for graceful retry with exponential backoff. The most common failure modes are certificate expiry, schema-validation mismatch (typically VAT-number formatting), and clock skew on the signing host.
Are there penalties beyond the obvious 'fail to file' ones?
Yes. ZATCA can suspend the ability to issue invoices, which is operationally catastrophic. Penalties also apply to invoices that pass syntactic validation but fail later business-rule checks (rare, but they exist). The published schedule starts at SAR 1,000 and scales with the number of violating invoices.
What's the archive retention requirement?
6 years from end of tax period, with the original XML preserved including XAdES signatures and QR. Storage must be readable on demand by ZATCA auditors. Most ERPs handle this via standard document archival; verify your retention policy aligns.
Can I use a non-resident ASP / EGS provider?
Yes for the EGS (issuing solution) provided it meets ZATCA's technical specifications. The accreditation is for the device/software, not the vendor's country. ZATCA publishes the list of compliant EGS units.