ZATCA Phase 2 Wave 24: The Complete June 2026 Compliance Guide for Restaurants in Saudi Arabia

Who is affected by Wave 24

ZATCA rolls out Phase 2 integration in waves based on annual turnover. Each wave has a hard integration deadline. By Wave 24, the net captures the vast majority of operating restaurants in the Kingdom.

SAR 375,000 in annual VAT-taxable turnover translates to roughly SAR 31,250 per month — a single-location restaurant doing ~150 covers a week at SAR 200 average ticket easily crosses this threshold. Most café chains, casual-dining restaurants and cloud kitchens in major Saudi cities are in scope.

Phase 2 explained — what changed from Phase 1

Phase 1 (Generation Phase) — already in effect

From 4 December 2021, all VAT-registered businesses had to issue tax invoices electronically and include a QR code on B2C invoices. Phase 1 was about generating digital invoices in a structured format. Most restaurants completed Phase 1 by upgrading their POS software.

Phase 2 (Integration Phase) — current

Phase 2 raises the bar substantially. The four big changes:

1. Real-time integration with Fatoora. Every B2C invoice must be transmitted to ZATCA's central Fatoora platform within 24 hours of issuance. B2B invoices must be cleared by ZATCA before they are issued to the customer.
2. Cryptographic stamping. Each invoice must carry a unique cryptographic stamp from your VAT-registered ID, verified by Fatoora.
3. XML format mandatory. Invoices must be generated in UBL XML structure (XML Universal Business Language) following ZATCA's published schema.
4. QR code now contains encoded transaction data. Not just a visual element — buyers can scan the code and verify the invoice against Fatoora in real time.

Technical requirements (what your POS must do)

For a POS / cashier system to be Phase 2 compliant, it must support:

Invoice types — Standard vs Simplified

ZATCA recognises two invoice types. Restaurants generate both routinely:

Simplified tax invoice (B2C)

Used for diner-facing transactions — dine-in bills, takeaway, individual delivery orders. Must include QR code with encoded data. Reported to Fatoora within 24 hours. This is 95% of your daily volume.

Standard tax invoice (B2B)

Used when issuing an invoice to another VAT-registered business — corporate catering, supplier reimbursements, B2B partnerships. Must be cleared by Fatoora before being issued to the customer. Real-time clearance API call required.

Penalties for non-compliance

ZATCA's penalty schedule is publicly documented and enforcement has stepped up since Wave 21 took effect. The progressive structure:

Beyond fines, ZATCA can also:

• Block your VAT registration certificate, which affects your supplier relationships (suppliers can't reclaim VAT on payments to you).
• Trigger an in-person audit covering the previous 5 years of operations.
• Refer the case to Ministry of Commerce for operating-licence review in severe repeat cases.

POS vendor checklist — 12 questions to ask

If you haven't already verified your current POS supports Phase 2 Wave 24, ask your vendor these 12 questions in writing. Get answers before signing any new contract or paying any annual renewal.

1. Is your system officially listed as ZATCA Phase 2 compliant? Show me your compliance certificate.
2. Have you completed the ZATCA onboarding process (CSR + Compliance Cryptographic Stamp Identifier)?
3. Does your POS generate UBL 2.1 XML for every invoice automatically?
4. How are you handling the Fatoora real-time integration — direct API or via a third-party middleware?
5. What happens if our internet connection drops during a busy dinner service?
6. Does the QR code contain all required encoded fields (seller VAT, timestamp, total, VAT amount, hash)?
7. How do you handle ICV and PIH chaining if a restaurant operates 3 POS terminals simultaneously?
8. Can your system distinguish B2B and B2C flows based on customer VAT ID capture?
9. Does your invoice template render properly in both Arabic (RTL) and English on the same printout?
10. Where is our 6-year invoice archive stored — cloud, our server, or your data centre? Can we export it?
11. What's your standard response time if ZATCA flags an invoice as non-compliant?
12. What's included in your subscription versus charged extra (Fatoora connection fee, archive storage, support)?

Compliance timeline — what to do in your final weeks

Today (any day in June 2026)

• Check your ZATCA portal for the Wave 24 notification. If you're in scope, the clock is now.
• Verify your current POS vendor's Phase 2 compliance certificate.
• Complete the ZATCA onboarding step on your portal — generate CSR, request Compliance Cryptographic Stamp Identifier.

Week before deadline

• Run sandbox tests — issue at least 50 test invoices through your POS into ZATCA's sandbox environment.
• Verify QR code scans correctly and pulls back the right transaction data from Fatoora.
• Train your cashiers on the new flow, especially the B2B vs B2C distinction.
• Confirm offline-mode queue behaviour during a simulated internet drop.

Deadline week

• Switch from sandbox to production. Issue your first live integrated invoice.
• Monitor the first 24–48 hours for any rejection responses from Fatoora.
• Keep your old non-integrated POS on standby for fallback during the first week.

After deadline

• Monitor Fatoora portal weekly for any flagged invoices.
• Set quarterly internal compliance reviews — invoice counts, rejection rates, archive completeness.
• Stay current on ZATCA notices — they publish guidance regularly.

Multi-outlet restaurants & chains

If you operate multiple outlets, the compliance picture depends on your legal structure:

• Single VAT registration covering all branches: one ZATCA integration covers everything. Each branch needs the same compliant POS, but you only have one set of certificates and one Fatoora connection.
• Separate legal entities per outlet: each entity needs its own ZATCA integration, certificates and Fatoora connection. More expensive but cleaner for franchising.
• Mixed model (head office + franchisees): each franchisee handles their own ZATCA integration. Make sure your franchise agreement clarifies who's responsible for penalties.

Multi-outlet operators should also verify that consolidated reporting (across branches under one VAT ID) doesn't break the per-invoice cryptographic chain. Properly architected POS systems handle this automatically — but ask the question.

FAQ

Who must comply with ZATCA Wave 24?

Any business — including restaurants — with annual VAT-taxable turnover above SAR 375,000 for any year from 2022 onwards. The integration deadline is 30 June 2026.

What are the penalties for missing the deadline?

First violation: warning + SAR 1,000 fine. Repeat violations: SAR 5,000 each. Continued non-compliance triggers escalating fines up to SAR 50,000 and operating restrictions. Your VAT certificate can also be blocked.

What technical requirements does Phase 2 impose?

Real-time integration with Fatoora: UBL 2.1 XML invoice generation, cryptographic stamping, encoded QR codes, 24-hour reporting for B2C, B2B clearance before issuance, and 6-year data retention.

Do all my restaurant outlets need separate ZATCA integration?

Each tax-registered entity needs one integration. Multiple branches under the same VAT registration share one integration; separate legal entities need separate integrations.

What if my internet goes down during dinner service?

Compliant POS systems queue invoices in offline mode and submit when connection returns — but you have 24 hours for B2C reporting. Real-time B2B clearance cannot be deferred; if your internet is down, you cannot legally issue a B2B invoice during the outage.

Is Phase 2 the final phase?

ZATCA has indicated continuous integration improvements but no announced Phase 3. Future waves will continue to lower the turnover threshold — expect Wave 25 (SAR 250K) by Q3 2026 and full economy coverage by 2027.