Is There Really a ZATCA Phase 3?
Search for Saudi e-invoicing and you will find plenty of articles about "Fatoorah Phase 3": new certificate rules, seven-year archives, fines quoted to the riyal. The starting point for any finance manager should be a simple correction. ZATCA has not announced a Phase 3. The official framework has two phases: generation, and then integration, which is being rolled out in waves based on revenue.
Why does the distinction matter? Because preparing for requirements that do not exist burns budget, while the requirement that does exist, Phase 2 integration, gets less attention than it needs. Much of what gets labelled "Phase 3", such as cryptographic stamps, real-time clearance and the extended QR code, is in fact Phase 2, which has applied in waves since January 2023.
This guide sets out what actually applies in 2026 and beyond, explains the Phase 2 technical requirements in practical terms, gives a step-by-step plan for getting your ERP ready, and lists the mistakes that come up most often during integration.
The Real E-Invoicing Timeline
| Phase or wave | Date | What it requires |
|---|---|---|
| Phase 1: Generation | 4 December 2021 | Issue and store invoices and notes electronically; no handwritten or paper-only invoices |
| Phase 2: Integration | In waves from 1 January 2023 | Connect invoicing systems to Fatoora; real-time clearance of standard invoices and reporting of simplified ones |
| Wave 24 | Integration from 1 April to 30 June 2026 | Taxable turnover above SAR 375,000 in any year from 2022 to 2024 |
| Wave 25 | Compliance from 1 February 2027 | Taxable turnover above SAR 187,500 in any year from 2022 to 2025 |
With the threshold now at SAR 187,500, the same level as voluntary VAT registration, the waves are close to covering most registered businesses. ZATCA notifies taxpayers of their wave at least six months ahead by registered email and SMS, so keep the contact details on your ZATCA account up to date.
So the right question for 2026 is not "how do I prepare for Phase 3?" It is "will my system be ready for Phase 2 when my wave arrives, and if I have already integrated, is it running cleanly?"
What Phase 2 Requires Technically
Two invoice types, two paths
- Standard tax invoices for business and government customers are sent to ZATCA for real-time clearance before they are shared with the buyer. A rejected invoice is not a valid invoice; you fix the cause and resubmit.
- Simplified tax invoices for consumers are handed to the customer immediately and reported to ZATCA within 24 hours of issue.
Credit and debit notes follow the path of the invoice type they relate to. A credit note against a standard invoice is cleared; one against a simplified invoice is reported.
Format and codes
Invoices are exchanged as XML following ZATCA's implementation standard. The document type is identified by code: 388 for a tax invoice, 381 for a credit note and 383 for a debit note. Standard and simplified invoices are distinguished by the transaction subtype inside the invoice, not by the type code. This is detail for the system to handle, not the accountant.
Hash chain and invoice counter
Each invoice carries the hash of the previous invoice and a sequential counter per issuing unit. The result is a linked chain that is hard to tamper with: deleting or editing an invoice in the middle breaks it. In practice that means invoices are never edited after issue. Corrections are made with credit or debit notes.
The QR code
In Phase 1 the QR code holds five fields: seller name, VAT number, timestamp, invoice total including VAT, and VAT total. Phase 2 adds the XML hash, the cryptographic stamp and the public key. The code is mandatory on simplified invoices in both phases, optional on standard invoices in Phase 1 and mandatory on them in Phase 2.
The Onboarding Path: From EGS Unit to Production CSID
ZATCA calls every system or device that issues invoices an E-invoice Generation Solution (EGS) unit. It could be a central ERP, a POS terminal in a branch or an application on a server. Each unit goes through the same steps:
- Generate a key pair and a certificate signing request inside the unit.
- Create a one-time password in the Fatoora portal for that unit. It expires after 60 minutes.
- Receive a Compliance CSID, which is for testing only.
- Pass the compliance checks by submitting sample standard and simplified invoices, with credit and debit notes, in the simulation environment.
- Receive a Production CSID tied to that unit and use it for live invoices.
A point that catches multi-branch businesses: branches of one legal entity invoice under a single VAT number even if each has its own commercial registration, but each EGS unit needs its own CSID, and counters and hash chains run separately per unit. Five POS terminals and a central ERP means six units to manage.
Getting Your ERP Ready: A Six-Step Plan
1. Inventory every invoice source
List every place an invoice or note is produced: the accounting system, POS terminals, the sales reps' app, and the service invoices that someone still types in Excel. Anything missing from the list becomes a compliance gap. As a working rule, fewer issuing sources make compliance easier.
2. Clean the master data
A standard invoice carries the buyer's name, address and VAT number. If customer records are incomplete or VAT numbers are wrong, invoices will be rejected or go out with bad data. Check:
- VAT numbers for business customers (15 digits).
- Full national addresses.
- The VAT treatment of every item and service: 15%, zero-rated or exempt.
- Arabic names and descriptions, since an invoice that is not in Arabic is not sufficient on its own.
3. Fix the correction workflow
Decide who issues credit and debit notes, with what authority and when. Teams used to "editing the invoice" in an old system need to drop that habit before go-live.
4. Test in simulation with your own scenarios
One successful test invoice proves very little. Test what actually happens in your business: mixed-rate invoices, invoice-level discounts, partial credit notes, foreign-currency invoices with VAT shown in riyals, and advance payments.
5. Plan for downtime
What happens when the connection to the platform drops? A standard invoice is not complete until cleared; a simplified invoice can be issued and reported within 24 hours. The system needs to hold pending invoices, resubmit them and show the team a clear list.
6. Monitor after go-live
For the first few weeks, review rejected invoices and warnings every day. Most rejection reasons repeat, and fixing the source in master data once makes them stop.
Scenarios Your System Must Handle
Small sales to businesses
A simplified invoice may be used for a business-to-business supply of SAR 1,000 or less, and it does not need buyer details. A buyer who wants to deduct input VAT, though, will usually ask for a standard invoice in their name with their VAT number. Your POS needs a way to switch a sale to a standard invoice on request and capture the buyer's tax details.
Advance payments
VAT becomes due on the earliest of supply, issue of the tax invoice, or receipt of payment, to the extent of the payment. An advance received before delivery is taxed on receipt, and the tax invoice must be issued within 15 days after the end of the month of receipt. When the final invoice is raised, the system must deduct the advance and its VAT so tax is not counted twice. This scenario deserves careful testing in simulation.
Government contracts
Since 1 November 2021, VAT on government contracts is due on the earlier of the payment order or receipt of payment. Businesses that work for government entities need invoices linked to the approved progress claim and the payment order date, not just the date the work was done.
Mixed VAT treatment
One invoice can combine 15% items and zero-rated items. VAT must show per line, and the total must equal the sum of the lines after rounding. A mismatch between line-level and total-level rounding is a common reason for rejection.
Who Does What in an Integration Project
| Role | Responsibility |
|---|---|
| Finance manager | Approves VAT treatment and the credit note policy; tracks readiness against the wave date |
| Accountant or tax lead | Cleans customer and item data; reviews rejected invoices daily |
| IT or the system provider | Registers EGS units, manages CSIDs, connects to simulation and production |
| Branch and POS managers | Keep terminals online so simplified invoices are reported on time |
| Sales team | Collects VAT numbers and national addresses from new customers before the first invoice |
Projects left to IT alone tend to stall, because most rejection causes are accounting or data problems, not code.
Common Rejections and How to Fix Them
| Problem | Usual cause | Fix |
|---|---|---|
| Standard invoice rejected | Wrong VAT number or incomplete buyer address | Clean customer records and make the fields mandatory at creation |
| VAT total mismatch | Line rounding differs from total rounding | Use one rounding rule across the system |
| Broken hash chain | An invoice cancelled or deleted after issue | Block deletion and use credit notes |
| Simplified invoices not reported | A POS terminal stayed offline | Alert on pending invoices well before 24 hours |
| CSID fails in a new branch | Another unit's certificate reused | Onboard each new unit with its own CSID |
Hypothetical Example: A Food Distributor With Three Branches
A food distributor in the Eastern Province with annual sales of SAR 9 million runs a central accounting system for standard invoices to restaurants and grocers, three POS terminals in its showrooms for simplified invoices, and a reps' app that prints invoices in the field.
During preparation the team found three problems. About 40% of customer records had no VAT number or an incomplete address. The reps' app could not integrate. And the accountant was used to editing issued invoices when a quantity turned out to be wrong.
They fixed it in three moves: a three-week customer data drive, with credit sales paused for anyone who did not update their details; moving rep invoicing into the central system, so the rep creates the sales order and the invoice is issued centrally; and a written rule banning invoice edits in favour of credit notes approved by the finance manager. The number of issuing units fell from seven to four, each with its own CSID.
Upgrade the Current System or Move to a New One?
| Option | When it fits | Risk |
|---|---|---|
| Upgrade through your current vendor | The vendor officially supports integration and the rest of the system works well | You depend on the vendor's schedule |
| Add a separate integration middleware | The system cannot integrate and you do not want to replace it yet | An extra layer that needs ongoing reconciliation |
| Move to an integrated ERP | Invoicing, stock and accounting are separate and already causing errors | A bigger project that needs planning and data migration |
If integration is the only problem, an upgrade or middleware is enough. If the team re-keys invoices into accounting, or stock does not match sales, the wave deadline is a chance to fix the larger problem. Either way, start at least three months ahead; data clean-up usually takes longer than the technical connection.
After Go-Live: E-Invoicing as Part of Accounting
When every invoice comes from the accounting system and standard invoices are cleared in real time, your sales ledger matches what ZATCA holds. That simplifies the VAT return, filed monthly if taxable turnover exceeds SAR 40 million a year and quarterly otherwise, by the last day of the following month. A simple monthly check helps: invoices and notes issued per unit, against those cleared or reported, with a list of anything pending or rejected.
Retention rules still apply: tax records are generally kept for at least six years, longer for certain capital assets and real estate. And your customers can only deduct input VAT with a valid tax invoice, so the quality of your invoice affects them too.
Tranquil generates ZATCA-compliant invoices for Phase 1 and Phase 2, with real-time integration, automatic validation and deadline alerts, as part of its accounting and finance module. For the wider picture of e-invoicing inside an ERP, read our e-invoicing and ERP guide and the Saudi e-invoicing resource page. We also cover the knock-on effects on the rest of the finance function in ERP accounting automation. If you want a readiness review before your wave date, contact the Tranquil team.
Frequently Asked Questions
Has ZATCA announced a Phase 3 for e-invoicing?
No. There are two phases: generation since December 2021 and integration in waves since January 2023. Claims about a "Phase 3" with specific requirements and fines are not based on an official announcement, so check any new requirement on ZATCA's own site.
How do I find out when my business must integrate?
ZATCA notifies targeted taxpayers at least six months ahead by registered email and SMS. Waves are based on taxable turnover above a threshold in specified years, such as SAR 187,500 for Wave 25.
Do I need a certificate for every branch?
You need a CSID for every EGS unit, meaning every system or device that issues invoices, not every commercial registration. Branches of one legal entity share the same VAT number.
What if I find an error in an invoice after issuing it?
Do not edit or delete it. Issue a credit or debit note linked to it. The note follows the same path as the original invoice and keeps the hash chain intact.
Do I have to onboard a new POS terminal?
Yes. Each new device or system that issues invoices is a separate EGS unit with its own onboarding, CSID, counter and hash chain. Add this step to your branch-opening checklist.
Is a compliant system enough to be compliant?
It is necessary but not sufficient. Compliance also depends on correct customer data and VAT treatment, a proper correction workflow, and daily follow-up of rejected invoices.