Understanding ZATCA Phase 2: What Businesses Must Know

Introduction to ZATCA and Phase 2 Regulations

The Zakat, Tax, and Customs Authority (ZATCA) in Saudi Arabia has introduced an electronic invoicing (e-invoicing) mandate to streamline tax compliance, curb tax evasion, and facilitate digital transformation in business transactions. The initiative is divided into two phases:

• Phase 1 (Generation Phase): Implemented on December 4, 2021, Phase 1 required businesses to issue and store e-invoices using a structured format (XML or PDF/A-3 with embedded XML). However, there was no direct integration with ZATCA’s platform at this stage.
• Phase 2 (Integration Phase): This phase requires businesses to integrate their e-invoicing systems with ZATCA’s central platform, the Fatoora system. It mandates real-time invoice validation and transmission, ensuring compliance with digital taxation policies.

The introduction of Phase 2 marks a major step towards full automation of tax reporting and verification, enhancing transparency and efficiency in Saudi Arabia’s financial ecosystem.

Key Deadlines and Compliance Requirements

ZATCA has implemented a phased rollout for Phase 2, targeting businesses based on their revenue size. The deadlines are as follows:

• Wave 1: Businesses with annual revenue exceeding SAR 3 billion must comply by January 1, 2023.
• Wave 2: Businesses with annual revenue exceeding SAR 500 million must comply by July 1, 2023.
• Wave 3 and Beyond: Further phases will gradually include businesses with lower annual revenues until full adoption is achieved.

To ensure compliance, businesses must adhere to the following requirements:

• Use a compliant e-invoicing system: The system must be approved and certified by ZATCA.
• Generate invoices in the required format: Only XML or PDF/A-3 formats with embedded XML are allowed.
• Include mandatory security features: These include a universally unique identifier (UUID), cryptographic stamp, and QR code.
• Enable real-time invoice reporting: Businesses must transmit invoices to ZATCA for validation before sharing them with customers.
• Maintain digital storage of invoices: Compliance requires secure and retrievable storage of e-invoices for auditing purposes.

Differences Between Phase 1 and Phase 2

Who Must Comply?

The ZATCA e-invoicing mandate applies to all businesses that are registered for Value-Added Tax (VAT) in Saudi Arabia. This includes:

• Businesses with taxable revenue: Companies conducting transactions subject to VAT must comply with Phase 2 regulations.
• Suppliers of taxable goods and services: Vendors issuing invoices for goods and services within the Kingdom.
• Cross-border businesses: Companies engaging in exports or cross-border transactions must ensure that their invoicing systems comply with ZATCA’s integration requirements.
• Third-party solution providers: Businesses using third-party invoicing software must ensure that their providers are ZATCA-certified and compliant.

Technical Requirements for Businesses

To meet the compliance requirements of Phase 2, businesses must implement the following technical measures:

1. E-Invoicing Solution Certification: Ensure the invoicing system is registered and certified by ZATCA.
2. Secure Invoice Generation: Use structured formats (XML or PDF/A-3 with embedded XML) that meet Saudi tax regulations.
3. Mandatory Invoice Elements:
   • Universally Unique Identifier (UUID)
   • Cryptographic stamp for security
   • QR code for instant verification
   • VAT number of the supplier and buyer
   • Invoice reference number
4. Integration with ZATCA’s Fatoora Portal: Implement an API-based integration to enable real-time invoice transmission.
5. Data Security & Digital Storage: Store invoices securely and in compliance with ZATCA’s digital record-keeping policies.
6. Audit & Monitoring Capability: Ensure the system allows retrieval and tracking of invoices for regulatory audits.

How to Prepare for Compliance

Businesses must take proactive steps to meet ZATCA’s compliance requirements and avoid penalties. The following steps will help in preparation:

1. Assess Current Invoicing Systems: Conduct a gap analysis to determine whether existing invoicing software meets ZATCA’s Phase 2 technical requirements.
2. Upgrade or Integrate Systems: If the current system is non-compliant, upgrade to a ZATCA-approved e-invoicing solution or integrate an API to connect with the Fatoora platform.
3. Ensure Data Security Measures: Implement encryption, digital signatures, and secure storage to meet regulatory standards.
4. Train Employees: Educate accounting, finance, and IT teams on compliance requirements, security protocols, and invoice validation processes.
5. Conduct Pilot Testing: Before the compliance deadline, run tests to ensure seamless integration, invoice generation, and real-time reporting to ZATCA.
6. Monitor & Maintain Compliance: Regularly update systems, conduct audits, and stay informed about any regulatory changes from ZATCA.

Conclusion

ZATCA Phase 2 represents a major step forward in Saudi Arabia’s digital transformation and tax compliance efforts. Businesses must act quickly to upgrade their systems, integrate with the Fatoora platform, and train their teams to ensure smooth compliance. By adopting a proactive approach, companies can not only meet regulatory requirements but also enhance operational efficiency, reduce manual tax filing errors, and avoid penalties. Investing in a robust e-invoicing system now will ensure long-term compliance and business sustainability in the evolving digital taxation landscape.