ZATCA Phase 2 compliance — explained.
Every Saudi restaurant with VAT-taxable turnover above SAR 375K is in scope by 30 June 2026. This is the complete, vendor-neutral reference: the waves, the deadlines, the technical requirements, the penalties, and a 12-point POS checklist. Save it. Share it with your finance team.
Phase 1 vs Phase 2 — the difference.
Most Saudi restaurants completed Phase 1 in late 2021. Phase 2 is a much bigger lift — it's where the real compliance work happens.
Generate digital invoices
In effect since 4 December 2021. Required electronic generation of tax invoices with a QR code on B2C transactions. Most restaurants completed this by upgrading their POS software.
- Digital invoice format mandatory
- Basic QR code on receipts
- Stored locally on POS
- No real-time integration
Real-time Fatoora integration
Rolling out in waves since Jan 2023. Requires direct integration with ZATCA's Fatoora platform — XML invoices, cryptographic stamps, real-time clearance for B2B, 24-hour reporting for B2C.
- UBL 2.1 XML invoice generation
- Cryptographic stamp per invoice
- QR code with encoded data
- Real-time Fatoora API integration
What your POS must do.
If your POS vendor can't tick all 10 of these, you're not compliant — and you're heading for a fine.
UBL 2.1 XML generation
Every invoice in ZATCA's structured XML schema.
Cryptographic stamping
CSR-issued certificate stamping every invoice.
Real-time Fatoora API
B2B clearance + B2C 24-hr reporting via Fatoora endpoint.
Encoded QR code
VAT ID + timestamp + total + tax + hash, all in QR.
ICV + PIH chaining
Sequential invoice counter + previous-invoice-hash chain.
Bilingual invoices
Arabic + English on every receipt.
Offline-mode handling
Queue and submit within 24 hours when net returns.
6-year retention
Both XML and PDF, searchable archive.
Credit + debit notes
Reference original invoice ICV, clearance flow.
B2B VAT ID capture
Customer VAT ID detection for B2B clearance flow.
Penalty schedule (ZATCA published).
| Violation | First instance | Repeat instance |
|---|---|---|
| Failure to integrate by deadline | Warning + SAR 1,000 | SAR 5,000 each |
| Issuing non-compliant invoice | SAR 1,000 per invoice | SAR 5,000 per invoice |
| Failure to report within 24 hrs | SAR 1,000 | SAR 5,000 |
| B2B invoice without clearance | SAR 5,000 | SAR 10,000 |
| Tampering with cryptographic stamp | SAR 50,000 + criminal referral | Operating licence review |
| Failure to retain invoices 6 yrs | SAR 5,000 | SAR 10,000 |
ZATCA can also block your VAT certificate, trigger a 5-year audit, or refer cases to the Ministry of Commerce.
Read the full guides.
Wave 24: Complete June 2026 Guide
The full compliance checklist, technical requirements and POS vendor questions. 13-minute read.
Best POS in Saudi Arabia 2026
Top 5 systems compared — Online eMenu, Foodics, Marn, Lightspeed, Toast. ZATCA-readiness scored.
دليل أفضل نظام POS للخليج 2026
Complete Arabic guide for GCC restaurants — full ZATCA Phase 2 coverage in Arabic.
Online eMenu for Saudi Arabia
ZATCA Phase 2 compliant POS — Arabic-native, Mada + STC Pay + Apple Pay, from SAR 184/month.
Foodics alternative — full side-by-side
Compare ZATCA support, pricing, hardware flexibility and Arabic-language features.
Talk to a ZATCA expert
30-minute free WhatsApp call. We'll audit your current setup and tell you exactly what's missing.
ZATCA questions Saudi restaurants ask first.
What is ZATCA Phase 2? +
ZATCA Phase 2 is the Integration Phase of Saudi Arabia's e-invoicing mandate. It requires real-time integration with the Fatoora platform: UBL 2.1 XML invoice generation, cryptographic stamping, encoded QR codes, B2B clearance before issuance, and B2C reporting within 24 hours.
Which wave applies to my restaurant? +
Waves are determined by annual VAT-taxable turnover in any year from 2022. Wave 24 (deadline 30 June 2026) captures all businesses with SAR 375K+ turnover. Most operating restaurants in Saudi cities fall into Wave 23 (SAR 750K+, already live) or Wave 24. Check your ZATCA taxpayer portal for the wave notification.
What are the penalties for non-compliance? +
First violation: SAR 1,000 fine + warning. Repeat: SAR 5,000 each. Issuing B2B invoice without clearance: SAR 5,000-10,000. ZATCA can also block VAT registration certificates and trigger audits covering 5 prior years. See the Wave 24 guide for full details.
How do I know if my POS is ZATCA Phase 2 compliant? +
Ask for the ZATCA compliance certificate. The POS must support UBL 2.1 XML, cryptographic stamping, real-time Fatoora API, encoded QR codes with all required fields, ICV/PIH chaining, bilingual Arabic+English invoices, and 6-year retention. Online eMenu is compliant out of the box.
Does it matter if my restaurant has only one outlet? +
Yes. ZATCA waves are based on annual turnover, not outlet count. A single high-volume restaurant doing SAR 500K/year is just as in-scope as a multi-outlet chain. Wave thresholds keep dropping — by 2027 essentially every operating restaurant will be in scope.
How long does ZATCA Phase 2 setup take? +
With a pre-compliant POS like Online eMenu: 48 hours including ZATCA onboarding, CSR generation, certificate signing, and sandbox testing. Without — typically 2-4 weeks of integration work plus testing.
Can I get an extension on my wave deadline? +
No. ZATCA does not grant extensions on wave integration deadlines. Once your wave is announced, the date is firm. Missing it triggers the penalty schedule above and a higher-priority audit flag on your account.
Online eMenu — ZATCA Phase 2 ready out of the box.
UBL 2.1 XML · Cryptographic stamping · Fatoora API · Bilingual invoices · 6-year archive · Live in 48 hours.