ZATCA Phase 2 e-invoicing is no longer something Saudi businesses can plan for later — it’s already here. With Wave 24, the threshold dropped to businesses with annual VAT-able turnover above SAR 375,000, whose deadline to integrate with ZATCA’s Fatoora platform was 30 June 2026. That threshold is low enough to capture virtually every restaurant, café and retailer in the Kingdom. If your point-of-sale system still isn’t connected, you’re now exposed to penalties. Here’s exactly what’s required, what it means for restaurants and drive-thrus, and how to get compliant.
What Is ZATCA Phase 2 E-Invoicing?
Saudi Arabia’s Zakat, Tax and Customs Authority (ZATCA) rolled out e-invoicing — known as Fatoora — in two phases:
- Phase 1 — “Generation” (live since December 2021): businesses had to stop issuing handwritten or simple PDF invoices and start generating structured electronic invoices, including a QR code on simplified (B2C) invoices.
- Phase 2 — “Integration” (rolling out in waves since January 2023): your POS, ERP or billing software must now connect directly to ZATCA’s Fatoora platform via API and transmit invoices for validation.
Phase 2 is the demanding one. It’s not just about how an invoice looks — it’s about your system talking to ZATCA in real time.
Who Has to Comply — and When
ZATCA notifies businesses in waves, working down from the largest taxpayers to the smallest. The two most recent waves matter most for small and mid-sized businesses:
| Wave | Applies to (annual VAT-able turnover) | Integration deadline |
|---|---|---|
| Wave 23 | Above SAR 750,000 | 31 March 2026 |
| Wave 24 | Above SAR 375,000 | 30 June 2026 |
ZATCA continues to announce further waves reaching progressively smaller businesses, so even if you haven’t been notified yet, it’s a matter of when — not if. Always confirm your own wave and deadline directly with ZATCA or your tax advisor, since notifications are issued per taxpayer.
What Phase 2 Technically Requires
A compliant Phase 2 e-invoice isn’t a PDF. Every invoice your system produces must include:
- A UUID — a unique identifier for each individual invoice
- A cryptographic stamp applied using a CSID (Cryptographic Stamp Identifier)
- A digital signature using an X.509 certificate issued during ZATCA onboarding
- A TLV-encoded QR code carrying ZATCA’s mandatory tags
- A SHA-256 hash chain that cryptographically links each invoice to the previous one
On top of that, the two invoice types are handled differently:
- Standard invoices (B2B) must be sent to ZATCA in real time and returned with a “Cleared” status before you can legally share them with the buyer.
- Simplified invoices (B2C) — your everyday customer receipts — are given to the customer immediately, but must be reported to ZATCA within 24 hours.
What This Means for Restaurants and Drive-Thrus
This is where it gets practical. Almost every transaction in a restaurant — counter, dine-in, delivery and drive-thru — is a simplified B2C invoice. That means:
- Every single receipt must carry a compliant, ZATCA-readable QR code.
- Every one of those transactions must be reported to ZATCA within 24 hours.
- Your POS can’t be a standalone cash register anymore — it has to be an integrated, ZATCA-onboarded system.
High-volume operations feel this hardest. A busy drive-thru can push hundreds of transactions through a single lane in a day, so the integration has to be reliable and fast — an outage or a failed batch isn’t just an IT problem, it’s a compliance problem. If your drive-thru ordering flows into your POS, that whole chain needs to be solid.
Penalties for Non-Compliance
ZATCA applies a progressive penalty system rather than an immediate maximum fine — and importantly, the first time a violation is found you generally receive a written warning and three months to correct it. After that, fines escalate within a rolling 12-month window:
- Missing QR code on a simplified invoice: warning → SAR 1,000 → SAR 5,000 → SAR 10,000 → up to SAR 40,000 for repeat violations
- Failure to issue or retain e-invoices: fines starting around SAR 5,000
- Deleting or amending an e-invoice after issuance: fines starting around SAR 10,000
- Failure to integrate with Fatoora / submit data in the required format: penalties that can reach SAR 50,000
If a violation isn’t repeated within 12 months of the original notice, the cycle resets and a future occurrence is treated as a first violation again. The takeaway: ZATCA gives you a chance to fix things — but ignoring it gets expensive quickly.
How to Get Compliant: A Practical Checklist
- Confirm your wave. Check your annual VAT-able turnover against the thresholds and look for your ZATCA notification.
- Audit your current POS/ERP. Ask your vendor directly: is it Phase 2 ready, with API integration to Fatoora?
- Complete ZATCA onboarding. Register your solution and obtain your CSID / cryptographic stamp certificate.
- Test in ZATCA’s sandbox before going live, so you catch formatting or signature errors early.
- Go live and verify — scan real receipts and confirm B2C invoices are reporting within 24 hours.
- Train your team and retain records in the required electronic format.
Your POS Doesn’t Work Alone
Compliance is the trigger, but it’s also a good moment to look at the whole front-of-house stack. Your POS connects to your kitchen display, your drive-thru timer, your digital menu boards and your drive-thru audio system. If ordering, payment and reporting don’t talk to each other cleanly, you get slower lanes, more errors — and now, compliance risk on top.
At TheNextGen Technologies, we supply, install and integrate restaurant ERP and POS solutions, drive-thru systems, digital menu boards and queue management across Saudi Arabia and Pakistan. We’ll help you make sure your ordering and point-of-sale stack works cleanly alongside your ZATCA-compliant invoicing setup — so the front of house keeps moving while the back office stays compliant.
Also operating in Pakistan? See our companion guide to FBR digital invoicing.
Frequently Asked Questions
What is ZATCA Phase 2 e-invoicing?
It’s the “Integration” phase of Saudi Arabia’s Fatoora e-invoicing programme, requiring businesses to connect their POS, ERP or billing software directly to ZATCA’s platform so invoices are validated and reported electronically.
Who needs to comply with ZATCA Phase 2?
Compliance is rolled out in waves by turnover. Wave 23 covered businesses above SAR 750,000 (deadline 31 March 2026) and Wave 24 covered those above SAR 375,000 (deadline 30 June 2026), with further waves reaching smaller businesses. Confirm your specific wave with ZATCA.
What is the penalty for not complying with ZATCA e-invoicing?
Penalties are progressive — typically a written warning first with three months to correct, then fines escalating from SAR 1,000 up to SAR 40,000 for repeat violations, and up to around SAR 50,000 for failing to integrate or submit data in the required format.
Does my restaurant’s drive-thru POS need ZATCA integration?
Yes. Drive-thru sales are simplified (B2C) invoices, so each receipt needs a compliant QR code and must be reported to ZATCA within 24 hours — which requires an integrated, ZATCA-onboarded POS system.
The Bottom Line
ZATCA Phase 2 e-invoicing has moved from “large enterprise problem” to “everyone’s problem” — and at the SAR 375,000 threshold, that includes nearly every restaurant and retailer in Saudi Arabia. The businesses that handle it well treat it as more than a tax box to tick: they use it as a reason to modernise the whole ordering-to-payment chain. Talk to TheNextGen Technologies about getting your POS, ERP and drive-thru systems working together — and ready for whatever ZATCA rolls out next.
This article is general information, not tax or legal advice. Confirm your specific obligations and deadlines with ZATCA or a qualified tax advisor.