ZATCA Phase 2 E-Invoicing 2026: KSA VAT Compliance Guide

Your client's ERP is generating tax invoices. ZATCA's portal is rejecting them. The VAT return is due in four days. If that scenario already feels familiar, you are not alone — and it is about to get worse before it gets better. ZATCA's Phase 2 (Integration Phase) rollout has been progressing in waves since January 2023, and by mid-2026 virtually every VAT-registered taxpayer above the applicable turnover threshold will be operating under real-time clearance obligations. The compliance gap between "we have e-invoicing software" and "we are genuinely Phase 2 compliant" is wider than most finance teams realise.

What Phase 2 Actually Requires (Beyond the Basics)

Phase 1 (Generation Phase) was straightforward: produce a structured XML invoice, embed a QR code, archive it. Phase 2 raises the bar substantially. Under ZATCA's E-Invoicing Implementing Regulation (Articles 53–57 as published on zatca.gov.sa), taxpayers must:

1. Integrate their billing/ERP solution with ZATCA's Fatoorah platform via API.
2. Obtain clearance for standard tax invoices (B2B) before delivery to the buyer — the invoice is only legally valid once ZATCA stamps it with a Cryptographic Stamp and returns a cleared copy.
3. Report simplified invoices (B2C) within 24 hours of issuance, not in real-time, but the reporting window is strictly enforced.
4. Maintain a tamper-evident audit log — every invoice, debit note, and credit note must carry a UUID, a sequential hash chain (invoice counter + previous invoice hash), and a digital certificate issued by ZATCA's Certificate Authority.

The practical consequence for your workflow: a B2B invoice that has not been cleared is not a valid VAT document. Your client cannot claim input VAT on it, and you cannot include it in Box 1 of the VAT return until clearance is confirmed. This is not a technicality — ZATCA auditors are cross-referencing buyer-side input VAT claims against seller-side clearance records.

Phase 2 Onboarding Waves: Where Does Your Client Stand?

ZATCA rolled out Phase 2 in waves based on annual revenue thresholds. The wave schedule (as published on the official portal) is summarised below:

Wave	Annual Revenue Threshold	Compliance Deadline
1	＞ SAR 3 billion	1 January 2023 (1 Jumada II 1444H)
2	＞ SAR 500 million	1 July 2023 (12 Dhul Hijjah 1444H)
3	＞ SAR 250 million	1 October 2023
4	＞ SAR 150 million	1 November 2023
5	＞ SAR 100 million	1 December 2023
6	＞ SAR 70 million	1 January 2024
7	＞ SAR 50 million	1 February 2024
Subsequent waves	Lower thresholds	Continuing through 2025–2026

If your client falls into the mid-market segment (SAR 5 million–50 million in revenue), their integration deadline is likely within the 2025–2026 window. Confirm the exact wave notification ZATCA sends by registered letter and check the portal — do not rely on informal advice.

The Six Most Common Phase 2 Validation Errors — and How to Fix Them

This is the section most published guides skip. When ZATCA's Fatoorah API rejects an invoice, it returns an error code. Here are the six rejections that appear most frequently in practice, and the corrective action for each:

1. UBL Schema Violation (Error Code: BR-KSA-01 series) The invoice XML does not conform to the KSA UBL 2.1 standard. Root cause is almost always a custom ERP field mapping that drops a mandatory element — commonly cbc:InvoiceTypeCode or the KSAExtension block. Fix: run the invoice through ZATCA's SDK validator locally before submission. The SDK is downloadable from the official developer portal at zatca.gov.sa.

2. Cryptographic Stamp Mismatch (Error Code: BR-KSA-26) The invoice hash does not match the prior invoice in the chain, or the digital certificate has expired. This breaks the sequential hash chain required under Article 54 of the Implementing Regulation. Fix: re-sequence the invoice counter, re-generate the hash from the last successfully cleared invoice, and renew the CSID (Cryptographic Stamp Identifier) if the certificate validity window has lapsed.

3. Seller TIN / VAT Registration Number Not Matching ZATCA Records The cac:TaxRegistrationNumber in the XML differs from the registered number on file — often because a client has recently amended their VAT registration or trades under a branch code. Fix: verify the exact VAT number format with ZATCA's VAT registration portal before building the certificate.

4. Supply Date Outside Permitted Reporting Window For simplified invoices, the 24-hour reporting window is hard-enforced. Submitting a batch of B2C invoices 36 hours after issuance will trigger rejection. Fix: implement a real-time queue in your ERP integration layer, not a nightly batch job.

5. Incorrect Invoice Type Code for Credit Notes Credit notes referencing a cleared B2B invoice must carry type code 381 and include the original invoice UUID in cac:BillingReference. Omitting the UUID causes rejection even when the credit note is otherwise correctly formatted.

6. VAT Amount Rounding Discrepancy ZATCA's validator applies strict SAR rounding to two decimal places at the line level and recalculates the invoice total independently. If your ERP rounds at the header level, you will get a 1-halala discrepancy that triggers rejection. Fix: enforce line-level rounding in your ERP's tax calculation engine.

Mapping Phase 2 Clearance Data to Your VAT Return

Here is where the audit trail becomes operationally critical. Your VAT return (Form VAT-01) requires you to report:

• Box 1A: Standard-rated supplies — must equal the sum of cleared B2B invoices plus reported B2C invoices for the period.
• Box 7: Input VAT — each purchase invoice you include must have a corresponding ZATCA clearance UUID from your supplier. If the supplier has not cleared the invoice, your input VAT claim is at risk under a ZATCA audit.

Practically, this means your month-end close procedure should now include a clearance reconciliation step: export all outbound cleared invoice UUIDs from Fatoorah, reconcile against your AR sub-ledger, and flag any invoices issued but not yet cleared. On the purchase side, request the cleared XML (with ZATCA stamp) from key suppliers — not just the PDF. A PDF without the cryptographic stamp is not audit-proof under Phase 2 rules.

For clients using a Mu'tamad-certified ERP (the list of certified solutions is maintained at zatca.gov.sa), the clearance API response is typically stored automatically. For clients on non-certified or legacy systems, this reconciliation must be manual until the system is upgraded.

Building Your Phase 2 Compliance Checklist

Before you sign off on any client's Phase 2 readiness, walk through each of these:

• CSID (digital certificate) obtained from ZATCA CA and loaded into the ERP integration layer
• Invoice XML validated against KSA UBL 2.1 schema using ZATCA SDK
• Sequential hash chain initialised from a successfully cleared seed invoice
• B2B clearance API call confirmed end-to-end in UAT environment
• B2C 24-hour reporting queue implemented (not nightly batch)
• Credit note 381 type code and BillingReference UUID mapping verified
• Line-level VAT rounding enforced in ERP tax engine
• Supplier cleared-XML collection process in place for input VAT audit trail
• VAT return reconciliation procedure updated to include clearance UUID matching
• Staff trained on rejection code interpretation and resubmission workflow

If any box is unchecked, that is an open compliance exposure. ZATCA penalties under Article 41 of the VAT Law include fines starting at SAR 1,000 per violation for procedural non-compliance, scaling to 50% of the evaded tax for substantive errors. Non-issuance of a compliant tax invoice carries a fine of SAR 1,000 per invoice — which accumulates rapidly in high-volume businesses.

What ZATCA Auditors Are Actually Looking For in 2026

Based on the audit focus areas outlined in ZATCA's published compliance guidelines, examiners in 2026 are prioritising:

• Hash chain integrity: Can you demonstrate an unbroken sequential chain from your first Phase 2 invoice to the current period? Gaps in the counter sequence trigger immediate scrutiny.
• Buyer/seller UUID cross-matching: ZATCA holds both sides of every B2B transaction. If your client's input VAT claims reference UUIDs that do not appear in the seller's clearance records, expect a query.
• Credit note traceability: Every credit note must trace back to a cleared original. Auditors will pull the BillingReference and verify the original clearance timestamp.
• Archiving compliance: Under Article 66 of the VAT Implementing Regulation, cleared invoices must be retained for a minimum of six years. The archived file must be the cleared XML (with ZATCA cryptographic stamp), not merely the printed PDF.

If you want to benchmark your current knowledge of these requirements against exam-standard questions, the SuperAccountant quiz covers ZATCA Phase 2 scenarios drawn from real compliance situations.

Practical Integration Advice for Mid-Market Clients

For clients in the SAR 5 million–50 million band who are still integrating:

• Do not wait for a Mu'tamad ERP upgrade if it is 12+ months away. ZATCA permits a middleware/connector approach where a third-party integration layer handles the API calls and certificate management, while your existing ERP generates the UBL XML. Several Saudi-market middleware providers are certified independently.
• Test with ZATCA's Fatoorah sandbox before going live. The sandbox environment at zatca.gov.sa replicates production validation rules and is the only reliable way to catch schema and hash errors before they affect real invoices.
• Establish a rejection SLA internally: a rejected invoice must be corrected and resubmitted within the same business day to avoid supply chain disruption. Assign ownership now — do not discover the gap during a peak invoicing period.

The accountant's role here has expanded beyond VAT return preparation. You are now, effectively, the first line of audit defence for your client's entire invoicing infrastructure. That is a significant responsibility — and an opportunity to add genuine value beyond compliance box-ticking.

---

Sharpen your edge with SuperAccountant's next live cohort — small batches, real client workpapers, taught by partners. Details and seats at https://app.superaccountant.in/en/cohort.