ZATCA Phase 2:
what we're finding eighteen months in.

Phase 2 e-invoicing is mandatory across most Saudi mid-market businesses now. ZATCA has rolled through more than twenty waves of taxpayer onboarding since the integration phase began. For most clients we work with, the integration is "live" - which is not the same as compliant. Eighteen months in, we are still finding the same six gaps when we run an integration audit.

What follows is the diagnostic our partners take to every Phase 2 health check. None of these gaps are exotic. All of them surface during ZATCA review, and all of them compound silently in the months between the gap appearing and the review finding it. If your finance director cannot answer each of these questions in the affirmative, the integration is at risk.

Why integration audits matter now

When Phase 2 first went live, ZATCA's review posture was supportive. Errors were flagged, guidance was provided, time was given to remediate. That posture has shifted. Reviews are now structured, technical, and quantitative. Findings are documented. Penalties for systematic non-compliance now apply across the period of non-compliance, not just from the date of the finding. For mid-market firms with multi-branch operations and high transaction volumes, the cumulative exposure can be material.

The integration is also rarely the last word. Phase 2 reads off the operational systems behind it - point-of-sale, hospital information systems, ERP modules, online ordering platforms, delivery aggregator integrations. When those systems update, the integration changes too. Without ongoing assurance, gaps that did not exist at go-live appear over time.

The six gaps we keep finding

1. Credit notes that don't link to the original invoice

Phase 2 requires credit notes and debit notes to reference the original cleared invoice via UUID. The integration sometimes sends the credit note correctly but without the link, or with the link populated incorrectly. ZATCA accepts the credit note but flags the broken reference downstream. The pattern is most common where the credit note was issued through a different module than the original invoice - for example, an invoice issued through the POS but credited through accounts receivable. The fix is integration-level, not operational, and requires ERP-side configuration changes that the operator's IT partner often did not implement at go-live.

2. Multi-branch reconciliation that doesn't tie to the consolidated VAT return

Each branch's POS submits its own clearance events to ZATCA. The consolidated VAT return is filed at entity level. The two should reconcile to the rial. They often do not, because branch-level events include cancellations, voids, and re-issues that the consolidated return treats differently. The variance compounds month over month. By the time the year-end audit picks it up, the reconciling differences span twelve VAT periods and require partner-level work to unwind.

3. Refunds and partial returns that span VAT periods

A customer pays in March, returns the goods in April. The original invoice cleared in the March period. The credit note clears in the April period. The VAT treatment depends on contract terms, return policy, and the timing of the refund. We see operators applying the same treatment across all return scenarios when the underlying tax position requires nuance. The exposure here is small per transaction and large in aggregate.

4. Prepaid scenarios where VAT timing is misaligned

Hotel deposits, restaurant prepaid bookings, gift cards, training-centre upfront fees, education tuition - all involve cash collected before the service is delivered. Phase 2 sends a clearance event when the invoice is issued. The VAT treatment depends on whether the invoice represents the taxable supply or just a deposit receipt. The integration rarely distinguishes. The pattern is most damaging in hospitality, where the same operator will have all four prepaid scenarios across different revenue lines and the integration treats them identically.

5. B2C edge cases above the simplified-invoice threshold

Simplified tax invoices apply for B2C transactions below SAR 1,000. Above that threshold, full tax invoice requirements apply - including buyer details. We routinely find operators issuing simplified invoices for high-value B2C sales because the POS configuration treats all consumer sales the same way. The volume is low; the per-transaction cost of a finding is high.

6. Self-billing and reverse charge handled by exception

Self-billed invoices for services received from non-resident suppliers, reverse-charge VAT on imported services - these flows are handled in accounts payable, often manually, often outside the Phase 2 integration entirely. The clearance events that should have been generated weren't. The flow looks correct from a VAT-return perspective but fails the technical Phase 2 audit. This is the gap that most often surfaces during diligence on a strategic transaction, where the integration audit goes deeper than ZATCA's routine review.

What good integration looks like

A clean Phase 2 integration has five markers. We check them in this order on every health check.

• End-to-end UUID traceability. Every cleared invoice can be traced from origination through cancellation, credit note, or debit note via consistent UUID linkage. The audit trail is reconstructable.
• Branch-to-entity reconciliation discipline. Branch-level clearance events tie to the consolidated VAT return monthly with documented variance analysis. Reconciliation is not a year-end exercise.
• VAT period treatment that matches the contract. Refunds, returns, and prepaid scenarios are mapped against the underlying contract terms with consistent VAT treatment across the operating estate.
• B2C threshold enforcement at point of sale. The POS distinguishes simplified-invoice from full-invoice scenarios at transaction time, not at month-end during reconciliation.
• Self-billing and reverse charge integrated, not parallel. Every Phase 2-relevant flow runs through the same integration with the same audit posture, including AP-originated and import-originated transactions.

The diagnostic we run

On a Phase 2 health check engagement, we run a structured five-day diagnostic across three workstreams - sample-based transaction testing, configuration review, and reconciliation analysis. Sample-based testing covers each of the six gaps above using a stratified sample of 60 transactions across normal and edge-case patterns. Configuration review covers the integration mapping, the data routing, and the exception-handling pathways. Reconciliation analysis covers three months of VAT returns against branch-level clearance event data with full variance documentation.

The output is a one-page partner summary with the headline finding and a short remediation backlog. The full diagnostic report sits underneath. The partner walks the finance director and operator through the headline issues in a one-hour session. If the gaps are fixable in-line, we run the remediation. If they require system-level change, we scope that as a separate engagement and coordinate with the IT partner.

If you are running Phase 2 in production and have not commissioned an integration audit since go-live, that is the engagement to run before year-end. A senior partner will respond within one working day with a short read of where you are and where we'd start.