ZATCA Phase 2: what KSA distributors need to know

What changed in Phase 2

Saudi Arabia's Zakat, Tax and Customs Authority (ZATCA) introduced e-invoicing in two phases:

Phase 1 (Generation) — December 2021. Required businesses to generate electronic invoices in a structured format. Most distributors complied by switching their POS or accounting system to one that outputs structured XML or PDF/A-3.

Phase 2 (Integration) — Rolling out by waves through 2024-2026 based on annual revenue. This is the bigger lift. Every invoice must be:

1. Generated as a UBL 2.1 XML
2. Signed with a ZATCA-issued cryptographic certificate
3. Submitted to ZATCA's Fatoora platform in real-time (for B2B) or near-real-time (for B2C)
4. Cleared (B2B) or reported (B2C) before being delivered to the customer

This is no longer a "save as PDF" approach. Your software must integrate with ZATCA's API, manage certificates, sign payloads, and handle clearance responses.

Who needs to comply when

ZATCA assigned waves based on prior-year revenue:

• Wave 1: revenue > SAR 3 billion (January 2023)
• Wave 2: > SAR 500M (July 2023)
• Wave 3: > SAR 250M (October 2023)
• Subsequent waves continue down through smaller businesses

If you haven't received a notification yet, you will. Plan for it now. The technical integration is not trivial.

What can go wrong

We have helped distributors through Phase 2 integration. The common failure modes:

1. Certificate management. ZATCA issues two types of certificates: compliance (testing) and production. They expire and need renewal. Forgetting to renew means your invoices stop clearing, which means your customers don't get them, which means you can't bill.

2. XML schema mismatches. ZATCA's UBL 2.1 profile has specific rules. A B2B credit note has different mandatory fields than a B2C invoice. Get one wrong, ZATCA rejects, your customer is waiting, your finance team is panicking.

3. Real-time API failures. When ZATCA's clearance endpoint is slow (it happens), your invoices queue up. If your software doesn't handle the queue properly, you either block sales or lose track of unsubmitted invoices.

4. Reconciliation between your system and ZATCA's records. ZATCA can audit your declared invoices against what they cleared. Mismatches trigger penalties. Many distributors don't have a reliable reconciliation report.

How to prepare

If you are a KSA distributor not yet on Phase 2:

1. Identify your wave. Check your prior-year revenue. Contact ZATCA directly or your tax advisor if uncertain.
2. Pick software that handles certificates for you. Not every "ZATCA-ready" system actually manages certificate lifecycle. Ask vendors specifically.
3. Test in the compliance environment first. ZATCA provides a sandbox. Run a full month of invoices through it before going to production.
4. Build the reconciliation report. You need a daily report comparing: invoices issued in your system vs. invoices cleared by ZATCA vs. invoices delivered to customers. Mismatches need investigation within 24 hours.
5. Train your finance team. The error messages from ZATCA can be cryptic. Your team needs to read XML responses and understand what went wrong.

How DistroOps handles ZATCA Phase 2

We integrated with ZATCA's Fatoora platform at the platform level so individual tenants don't have to. When a KSA-based tenant issues an invoice:

1. We generate UBL 2.1 XML automatically
2. We sign with the tenant's certificate (managed and renewed for them)
3. We submit to ZATCA in real-time (B2B) or batch (B2C)
4. We handle clearance responses, including retries on transient errors
5. We give finance a daily reconciliation report

If you are evaluating software for KSA distribution, this is one of those things that looks like a checkbox feature but is genuinely complex. Get a demo. Ask hard questions about edge cases. Ask to see the reconciliation report.

What about Phase 3?

ZATCA hasn't officially announced Phase 3 yet, but the direction is clear: more granular reporting, more category-specific rules, more real-time submission requirements. Building on a foundation that already handles real-time API integration sets you up for whatever comes next.