ZATCA Phase 2 integration guide for KSA businesses | BSE

What ZATCA Phase 2 actually is

Saudi Arabia's Zakat, Tax and Customs Authority (ZATCA) introduced e-invoicing in two phases:

Phase 1 (Generation) — launched December 2021. Required businesses to issue VAT invoices electronically in a structured XML format, but invoices did not need to be cleared with ZATCA before delivery to the buyer.
Phase 2 (Integration) — rolled out in waves since January 2023. Requires real-time integration with ZATCA's Fatoora platform: every invoice is signed, sent to ZATCA, and either cleared (B2B) or reported (B2C) before it has legal force.

Phase 2 is what most KSA businesses now need to focus on.

Who is required to integrate

Integration applies to every business that's VAT-registered in KSA. The rollout has been waved by revenue size:

Wave 1 (January 2023) — businesses with VAT-eligible revenue above SAR 3 billion
Wave 2 (July 2023) — SAR 500 million and above
Waves 3 to 11 (late 2023 through 2025) — progressively smaller revenue thresholds
Wave 12 and beyond (2026 and after) — SMBs with smaller revenues

If you are VAT-registered in KSA and have not received your integration notice yet, expect one within the next twelve months. The waves don't stop until everyone is covered.

The two transaction modes — clearance vs reporting

ZATCA Phase 2 distinguishes two modes:

Clearance (B2B). Every invoice you issue to another VAT-registered business must be sent to ZATCA before it is delivered to the buyer. ZATCA validates and stamps it, and only then can the buyer receive the legally valid invoice.

Reporting (B2C). Simplified tax invoices for retail and consumer sales can be issued on the spot. Within 24 hours, you must report them to ZATCA.

The same business can have both transaction types depending on what they sell — a retailer with a B2B wholesale arm, for example, deals with both.

What integration actually looks like

A compliant ZATCA Phase 2 setup needs:

An APIC certificate (Application Programming Interface Compliance) for your business — and often a separate one per branch
Structured XML invoices matching the ZATCA technical specification (TLV-encoded fields)
A cryptographic stamp applied to every invoice using the certificate
QR codes generated for each invoice (a Phase 1 carry-over, still required)
Real-time integration with the Fatoora platform — your ERP submits, ZATCA responds

The technical work is in steps 2 through 5. Step 1 is paperwork with ZATCA.

Three integration paths

Path A — Native ERP integration. Your ERP already integrates with Fatoora. You configure your APIC certificate, branch settings, and the invoice format mapping. Fastest path if you are choosing or replacing your ERP this year. SafeERP supports this directly.

Path B — Middleware layer. Your existing ERP does not speak ZATCA. A middleware layer pulls invoices from your system, signs them, submits to Fatoora, and writes the clearance result back. Best fit when you cannot replace your current ERP yet.

Path C — Standalone invoicing tool. You use a separate ZATCA-compliant invoicing tool alongside your accounting software. Workable for very low volume; introduces manual reconciliation work that grows with volume.

Common rollout mistakes

Five mistakes we see KSA businesses make in their first Phase 2 setup:

Ordering the APIC certificate late. Issuance can take days. Order it the moment your wave date is confirmed.
Underestimating multi-branch complexity. Each branch may need its own certificate and its own configuration.
Skipping the first close in test mode. Phase 2 close-of-period reconciliation surfaces edge cases you won't see in day-to-day issuance.
Treating B2B and B2C as the same workflow. Clearance and reporting follow different paths; mixing them up causes failed submissions and missed deadlines.
No paper-rollback procedure. If Fatoora has a brief outage, your team needs a written process — not improvisation.

Where BSE fits in

BSE handles ZATCA Phase 2 integrations both for KSA-based clients and for Egyptian companies expanding into Saudi Arabia. For a single-entity, single-branch business, we deliver a working Path A or Path B setup in 5 to 10 business days after the APIC certificate is in hand. Multi-entity GCC groups take longer because each entity needs its own certificate, its own configuration, and its own close-of-period rehearsal.

If you are approaching your ZATCA wave date or already past it, BSE can scope your integration in a 30-minute call. The conversation is free.

Frequently asked questions

What is the difference between ZATCA Phase 1 and Phase 2?

Phase 1 (Generation) required structured electronic invoices but did not involve real-time clearance with ZATCA. Phase 2 (Integration) requires every invoice to be signed, submitted to ZATCA, and either cleared (B2B) or reported (B2C) before it is legally valid. Phase 2 is what is currently rolling out across all KSA VAT-registered businesses by revenue waves.

When does my business have to integrate with ZATCA?

ZATCA notifies you about your wave at least six months in advance. Waves have been rolling out by revenue size since January 2023. If you are VAT-registered in KSA and have not received a notice yet, expect one within the next twelve months — the rollout extends until every VAT-registered business is covered.

What is an APIC certificate and why do I need one?

An APIC (Application Programming Interface Compliance) certificate is the cryptographic key your ERP uses to sign invoices before submitting them to ZATCA. Without it, the Fatoora platform will not accept your submissions. Each entity — and sometimes each branch — needs its own certificate. Order it as soon as your wave date is confirmed.

Can I use my existing accounting software with ZATCA Phase 2?

Maybe. Some packages now have native Fatoora integration; others do not. The cheapest check is to ask your software vendor directly. If the answer is no, you can either move to a system that supports it (like SafeERP) or add a middleware layer that connects your existing software to ZATCA. BSE delivers both paths.

How long does ZATCA integration usually take?

For a single-entity, single-branch business, BSE typically delivers a working integration in 5 to 10 business days after the APIC certificate is in hand. Multi-entity GCC groups take longer because each entity needs its own certificate, configuration, and close-of-period rehearsal.

What if I miss the ZATCA integration deadline?

Penalties for non-compliance include suspended VAT credits, daily fines, and in extreme cases business license complications. Voluntary catch-up before a ZATCA audit is materially cheaper than discovery. If you are past your wave date and have not integrated, the priority is to register the gap with ZATCA and start the technical work in parallel.