What are the fines for ZATCA non-compliance?

ZATCA fines range from SAR 5,000 to SAR 50,000 per violation. QR code violations alone can cost up to SAR 10,000 per invoice. The fines exemption period also ends June 30, 2026.

What are the 4 pillars of ZATCA Phase 2 compliance?

The four technical pillars are: (1) UBL 2.1 XML invoices, (2) XAdES digital signatures using ECDSA secp256k1 with SHA-256, (3) Hash chain across all invoices, (4) TLV-encoded QR codes with 9 mandatory tags in Base64.

ZATCA POS — Wave 24 Compliant E-Invoicing Software

The 4 Pillars of ZATCA Phase 2 Compliance

Every ZATCA-compliant POS must produce invoices that pass these four technical checks. Saheeh handles all of them automatically.

UBL 2.1 XML

Every invoice is generated as a Universal Business Language XML document, the international standard required by ZATCA.

application/xml

XAdES Digital Signatures

Every invoice is signed cryptographically using ECDSA secp256k1 with SHA-256, providing legal proof of origin.

secp256k1 · SHA-256

Hash Chain

Each invoice's hash includes the previous invoice's hash — making it tamper-evident and impossible to alter retroactively.

SHA-256 chain

TLV QR Codes

Every receipt prints a Tag-Length-Value encoded QR code with 9 mandatory tags including signature, in Base64 format.

TLV · Base64

Source: ZATCA E-Invoicing Roll-out Phases · Wave 24 Announcement

What Non-Compliance Actually Costs

ZATCA fines are per-violation. One non-compliant POS can rack up tens of thousands of riyals in fines within weeks.

SAR 5,000

Minimum violation fine

For minor issues like missing invoice fields or formatting errors.

SAR 10,000

QR code violation

Per invoice. Missing or invalid TLV QR codes alone can trigger this fine.

SAR 50,000

Maximum per violation

For repeat or severe violations — including non-integration with Fatoora portal.

Source: EY Tax Alert — Wave 24 · Fines exemption also ends June 30, 2026.

The 5-Step Path to ZATCA Compliance

Becoming Wave 24 compliant doesn't take weeks. With Saheeh, most restaurants are live within 24 hours.

Register with ZATCA Fatoora

Log into fatoora.zatca.gov.sa with your Tax Identification Number (TIN). This takes 10 minutes.
Choose a Compliant POS (like Saheeh)

Your POS must produce UBL 2.1 XML, XAdES signatures, TLV QR codes, and maintain hash chains. Saheeh meets all four pillars from day one — no add-ons, no extras.
Obtain Your CSID

The POS generates a Certificate Signing Request (CSR) and submits it to ZATCA. You receive back a Cryptographic Stamp Identifier (CSID). Saheeh automates this entirely — you just confirm.
Pass the 6 Sandbox Test Scenarios

ZATCA requires you to successfully clear 6 invoice types in their sandbox: standard invoice, simplified invoice, debit note, credit note, etc. Saheeh runs these automatically against your data.
Go Live with Production CSID

Once sandbox tests pass, ZATCA issues a production CSID. From this moment, every invoice you generate is Wave 24 compliant. Done.

Non-Compliant vs. Saheeh Compliant

The practical difference between a "ZATCA-ready" claim and actual Phase 2 implementation.

Old POS / "Phase 1 Only"

Prints receipts, doesn't generate XML
No digital signatures
No hash chain — invoices can be silently altered
QR code is plain text, not TLV-encoded
No CSID — can't connect to Fatoora portal
Risk: SAR 5,000–50,000 fines per violation
Risk: Business operations suspended by ZATCA

Saheeh POS · ZATCA Phase 2

Every invoice is UBL 2.1 XML
XAdES signatures (ECDSA secp256k1, SHA-256)
Cryptographic hash chain — tamper-evident
TLV QR codes with all 9 mandatory tags
CSID onboarding automated in 10 minutes
Direct Fatoora portal integration
Sandbox tests run on your real data

ZATCA POS — FAQ

Common questions about ZATCA Phase 2, Wave 24, and what compliance actually requires.

What is ZATCA Wave 24?

Wave 24 is the final integration wave of ZATCA Phase 2 e-invoicing. It applies to all Saudi VAT-registered businesses with annual revenue of SAR 375,000 or more. The deadline to integrate is June 30, 2026. After that date, fines apply and the amnesty period for past violations ends.

What are the fines for not complying with ZATCA Phase 2?

Fines range from SAR 5,000 to SAR 50,000 per violation. QR code violations alone can cost SAR 10,000 per invoice. Repeat violations stack — a single non-compliant restaurant can accumulate SAR 100,000+ in fines within weeks. The fines exemption period also ends June 30, 2026, meaning past unreported violations become enforceable.

What are the four pillars of ZATCA Phase 2 compliance?

(1) UBL 2.1 XML invoices — every invoice in this universal business language format. (2) XAdES digital signatures — ECDSA on the secp256k1 curve with SHA-256 hashing. (3) Hash chain — each invoice's hash includes the previous one, making tampering visible. (4) TLV QR codes — Tag-Length-Value encoded with 9 mandatory tags including the signature, output in Base64.

How do I get a ZATCA CSID?

CSID stands for Cryptographic Stamp Identifier. It's how ZATCA identifies your specific business in every signed invoice. To get one: your POS generates a Certificate Signing Request (CSR), submits it to ZATCA's Fatoora portal, and receives a signed CSID in return. With Saheeh, this onboarding is automated — typically completes in 10 minutes.

Does my POS need to be on the ZATCA "approved" list?

No. ZATCA doesn't approve POS systems before use — restaurants register their own EGS (E-invoice Generation Solution) on Fatoora. However, ZATCA publishes a voluntary Solution Providers Directory — inclusion is optional but is a strong trust signal.

Can I just patch my existing POS to be compliant?

Technically possible but practically risky. Most older POS systems were not built around cryptographic signing and hash chaining, so retrofitting often produces fragile compliance that fails at peak load. A purpose-built ZATCA Phase 2 POS like Saheeh handles the requirements natively without patching.

What happens if my internet goes down — can I still issue invoices?

Yes. ZATCA allows offline invoice generation for simplified (B2C) invoices, which can be reported to Fatoora within 24 hours of being issued. Saheeh handles this automatically — invoices are signed and chained locally, queued, and pushed to ZATCA the moment connectivity returns.

ZATCA Compliant POS Built for Wave 24