ZATCA e-invoicing Phase 2 on Salesforce: what Saudi companies need in place

On 24 July 2026, ZATCA announced the 25th wave of Phase 2 e-invoicing. It covers taxpayers whose VAT-subject revenue passed SAR 187,500 in any year from 2022 to 2025, and they must be integrated with ZATCA’s Fatoora platform by 1 February 2027. SAR 187,500 is the voluntary VAT registration threshold, measured on taxable supplies or expenses, so Wave 25 reaches very small businesses. A business that registered voluntarily and whose revenue stayed at or below SAR 187,500 in every year from 2022 to 2025 is not in any wave yet. The largest companies have been integrated since 2023.

Most of the Saudi companies we work with run sales on Salesforce, and many of them are now asking the same question: does Salesforce have to talk to ZATCA, and if so, how? This guide answers that from ZATCA’s own regulations, guidelines and technical standards, and from Salesforce’s documentation. It is written for CFOs, tax managers and Salesforce architects.

What Phase 2 asks of the system that issues the invoice

Phase 1, the generation phase, started on 4 December 2021. Invoices had to be electronic and generated by a compliant solution, and simplified invoices had to carry a QR code. Phase 2, the integration phase, started on 1 January 2023 and is rolled out in waves. ZATCA notifies each wave at least six months before its integration date. Phase 2 adds these requirements, set out in ZATCA’s E-Invoicing Detailed Guideline and the technical standards behind it:

ZATCA also lists functions that a compliant solution must not have. The list includes anonymous access, default passwords, altering or deleting an issued invoice or its logs, resetting the invoice counter, more than one invoice sequence per unit, changing the time, and exporting stamping keys. Editing records, deleting them and admin access to change them are normal in a CRM, so each one has to be switched off for invoices.

The waves so far

ZATCA selects each wave by VAT-subject revenue in the listed reference years. The windows below are as published by ZATCA and summarized by EY. For Waves 1 to 16 ZATCA’s notices give the start of each window, and from Wave 17 they give the “no later than” date.

Wave 25 is the first to count 2025 revenue, according to EY and Grant Thornton. As of 4 November 2026 we have seen no announcement of a 26th wave. ZATCA says it will contact each Wave 25 taxpayer directly, so check the email and mobile number registered on your ZATCA account.

Which system should issue the invoice?

In the Salesforce estates we see in Saudi Arabia, invoices are issued in one of three ways.

Pattern A is the most common, and ERP vendors offer Phase 2 support or partner connectors. Microsoft documents a Saudi Arabian ZATCA submission feature in Dynamics 365 electronic invoicing, and Odoo documents clearance and reporting in its Saudi localization. If finance already runs on one of these, keep the invoice there. Salesforce’s job is then to give the ERP correct buyer data and show the result to the people who talk to customers.

Pattern B makes sense when the commercial logic lives in Salesforce, such as subscriptions, usage, milestones or service contracts, and moving it to the ERP would mean rebuilding it. The rest of this guide spends most of its time on pattern B, because that is where Salesforce teams carry the compliance risk.

We advise against pattern C for almost everyone. It is possible, but you would be maintaining an e-invoice generation solution, with its certificate lifecycle, key custody and rule updates, inside a CRM. ZATCA changed its SDK rules at least four times in 2025, and every change would land on your release calendar.

What Salesforce gives you, and what it does not

Revenue Cloud billing generates invoices in scheduled batches, on demand or through an ingestion API. It supports posted and voided invoices and sequence policies for invoice numbering, and the Generate Invoice Documents action produces PDF invoices from a template. Salesforce’s own e-invoicing page describes invoice generation tied to quote and order, with tax calculated per line, and names no country mandate.

What we could not find in Salesforce’s documentation is ZATCA itself: no UBL 2.1 XML in ZATCA’s format, no PDF/A-3 output with embedded XML, no CSID onboarding, no clearance or reporting calls. We also found no AppExchange listing that names ZATCA or Fatoora. That may change, so search AppExchange yourself before you decide, but plan on the ZATCA part coming from middleware or a Phase 2 provider.

ZATCA publishes a Solution Providers Directory that marks providers as Phase 1 or Phase 2 qualified. ZATCA describes it as a guiding list that is not binding and not an approval of any solution, so treat it as a starting point for due diligence. The real test is the compliance check that every generation unit has to pass before it receives a production certificate.

Five design rules for a Salesforce invoice flow

1. Lock the invoice once it goes to ZATCA

Salesforce lets users delete invoices to correct billing errors and void posted ones, and its help pages describe both. ZATCA prohibits altering or deleting an issued e-invoice, and corrections must be made with a credit or debit note that references the original. Deleting or amending invoices after issue carries fines of SAR 10,000 to 50,000. So once an invoice is sent for clearance or reporting, the record has to be locked. That means a before-delete trigger and validation rules that block changes once the ZATCA status is set, delete permission removed from custom profiles and permission sets, and a credit note process in place of voiding. Test this with an administrator account, because administrators are usually the ones who “fix” invoices.

2. Do not send a B2B invoice before it is cleared

Standard invoices must be cleared before the buyer receives them, and the cleared invoice carries ZATCA’s stamp and QR code. Many Salesforce orgs email the invoice PDF the moment it is posted. That automation has to wait for cleared status and send the cleared document. If clearance fails, the invoice should go to a finance queue, and nothing should reach the customer.

3. Get buyer data right where it is entered

Clearance rejects invoices with bad buyer data, and most of that data is typed into Salesforce by sales teams. For standard invoices you need the buyer’s name and address, plus the buyer’s VAT number if it is registered, or another identifier, such as the commercial registration number, if it is not. ZATCA’s {ext(S[“sec”], “standards”)} define a VAT number as 15 digits that begin and end with 3. Providers report that Saudi addresses are validated against the National Address format, with a 4-digit building number and a 5-digit postal code, and that item names must include an Arabic name. Put these checks on the Account and Product records, where a salesperson can fix them in a minute, so they do not surface at month end as rejected invoices.

4. Map each generation unit to one invoice sequence

A unit must not produce more than one invoice sequence, and its counter can never be reset. If several Salesforce billing processes, legal entities or branches issue invoices, decide which unit each one maps to, and make sure Salesforce numbering and the unit’s counter cannot drift apart. For a VAT group, each member is onboarded under the group’s VAT number with the member’s 10-digit TIN, as a separate unit with its own certificate. When a company joins a VAT group, its own VAT registration is suspended and its existing certificates are revoked, so tell IT before the legal team changes the group.

5. Write the ZATCA result back to Salesforce

Add fields for the ZATCA status (cleared, reported, rejected, warning), the UUID, the cleared document, and the error message. Show them on the invoice, the order and the account. When a customer calls about an invoice, the person who answers should not have to ask finance whether it was cleared.

The integration, step by step

A common pattern, described in a Salesforce community guide to e-invoicing with Revenue Cloud, is event-driven:

1. A flow or trigger fires when an invoice is posted, and Salesforce publishes a platform event.
2. Middleware, often MuleSoft, reads the invoice, its lines and the buyer through the API.
3. The e-invoicing layer builds the UBL XML with the next counter value and the previous invoice hash, calculates the invoice hash, and signs it.
4. It calls ZATCA’s clearance API for standard invoices or the reporting API for simplified ones.
5. The result, the cleared XML and any PDF/A-3 copy go to the archive, and status and references are written back to Salesforce.

Two details cause most production problems. The first is connectivity. ZATCA requires the solution to keep generating and archiving offline, queue documents, and submit them once the connection returns. A queued standard invoice still cannot go to the buyer until it is cleared. Your taxpayer team also has to notify ZATCA of any incident that stops integration, and again when it is fixed.

The second is ordering. Each unit must assign the counter and previous invoice hash one invoice at a time, so a middleware design that processes invoices in parallel needs one queue per unit. A rejected invoice stays in the chain, and its corrected version is a new document with a new UUID and counter value.

Onboarding: getting the certificates

Each e-invoice generation unit is onboarded through the Fatoora portal, as set out in ZATCA’s Detailed Technical Guideline:

1. A taxpayer user logs in to Fatoora and generates one-time passwords. Each is valid for one hour, and up to 100 can be requested at a time.
2. The unit creates a certificate signing request with its details, including the VAT number, branch or VAT group member, location and invoice types, and submits it with the OTP. ZATCA’s platform returns a compliance certificate.
3. The unit passes compliance checks by submitting sample documents. For standard invoicing that means a tax invoice, a debit note and a credit note, and for simplified invoicing the simplified equivalents. A unit that issues both sends all six.
4. ZATCA issues the production certificate. It is valid for up to five years and can be renewed before it expires.

ZATCA runs a developer portal with an SDK for validating documents, a simulation environment for testing, and production. Test the whole Salesforce flow in simulation, including credit notes, rejected invoices and an outage, before you onboard production units. In some products, Odoo for example, a journal switched to production mode cannot be switched back to simulation.

Rule changes to track

ZATCA’s core documents, the XML standard and data dictionary, are still the versions of 19 May 2023. The detail changes through the SDK and announcements on ZATCA’s Fatoora developer community, which in 2025 included a date format breaking change, changes to duplicate checking with new response codes, and the retirement of an old API gateway. With SDK 3.4.3, ZATCA staff described new flags for continuous supplies and for supplies to government, with a contract reference required for the latter, taking effect once updated standards are published. And the Guideline for Tax Invoicing and Records reached version 3 in May 2026.

If an outside provider runs your e-invoicing layer, these changes are mostly theirs to absorb. Ask how quickly they shipped the 2025 changes, and get the answer in the contract.

Penalties

The penalty schedule ZATCA announced in 2021, as summarized by Deloitte and Grant Thornton, is the most recent published schedule we found.

ZATCA’s fines cancellation initiative covered e-invoicing violations until 30 June 2026. It has since been extended to 31 December 2026, but the extension lists late registration, payment, filing and return correction fines and no longer names e-invoicing violations, so do not assume e-invoicing fines are waived.

Does Salesforce need to be hosted in Saudi Arabia for this?

Phase 2 does not say where your CRM is hosted. It governs the e-invoicing solution, the archive and your ability to give ZATCA records on request. Data residency is still a fair question for other reasons, such as the PDPL or a sector regulator, so here is where things stand.

In February 2025, Salesforce announced a $500 million investment in Saudi Arabia, including plans to bring Hyperforce to the Kingdom in partnership with AWS. In November 2025 it launched Salesforce Saudi Arabia as a local entity. AWS says its first Saudi region is on track to launch in December 2026. As of 4 November 2026 we have not seen a Saudi Hyperforce region announced as live. In the meantime, keep the legal archive of your e-invoices, the XML, the cleared documents and the logs, in the system that issues them, and decide where that system is hosted with your tax and legal advisers.

A 90-day plan for Wave 25, or for a late fix

1. Weeks 1 to 2. Confirm your wave and deadline. Map every place an invoice, credit note or debit note is created today, in Salesforce, the ERP and anything else, and decide which system issues each one.
2. Weeks 2 to 4. Choose the e-invoicing layer, ERP localization or Phase 2 provider. Check references, how they handled the 2025 SDK changes, and who holds the stamping keys.
3. Weeks 3 to 6. Fix buyer data in Salesforce: VAT numbers, National Address fields, Arabic legal names, and Arabic product names.
4. Weeks 4 to 8. Build the flow: invoice locking, credit notes in place of voids, events, middleware, status write-back, and delayed sending of B2B invoices.
5. Weeks 8 to 10. Test in ZATCA’s simulation environment, including rejections, outages and credit notes against cleared invoices.
6. Weeks 10 to 12. Onboard production units, run the first invoices with finance watching, and agree who checks the rejection queue every day.

Companies in earlier waves that integrated in a hurry can use the same list as an audit. The two things we find most often are invoices that can still be edited after clearance, and B2B invoices emailed from Salesforce before ZATCA has cleared them.

Our view

ZATCA Phase 2 is a finance obligation that lands in your CRM, because most of the data on an invoice is created in Salesforce before finance sees it. The real choice is which system holds the certificate, and how much rule-checking happens early, when a salesperson can still fix a VAT number.

For most of our clients the answer is to let the ERP or a Phase 2 provider issue the invoice, keep Salesforce as the source of clean customer and order data, and show ZATCA status where customer-facing teams can see it. If you bill from Salesforce, as many subscription and manufacturing businesses do with Revenue Cloud, build the five design rules in before the first invoice goes to ZATCA.

Frequently asked questions

What is ZATCA Wave 25?

Wave 25 is the 25th wave of Phase 2 integration. It covers taxpayers whose VAT-subject revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025, and they must integrate with the Fatoora platform no later than 1 February 2027. ZATCA announced it on 24 July 2026.

Does Salesforce support ZATCA e-invoicing out of the box?

Salesforce Revenue Cloud billing generates invoices, credit memos and PDF documents, but we found no native support for ZATCA’s XML format, certificate onboarding, or clearance and reporting. Most companies use their ERP or a Phase 2 e-invoicing provider for the ZATCA part, connected to Salesforce through middleware.

What is the difference between clearance and reporting?

Clearance applies to standard tax invoices (B2B). ZATCA must validate and stamp the invoice before it is shared with the buyer. Reporting applies to simplified tax invoices (B2C). Your solution stamps the invoice and reports it to ZATCA within 24 hours.

Can we delete or edit an invoice in Salesforce after it is sent to ZATCA?

No. ZATCA prohibits altering or deleting an issued e-invoice. Corrections are made with a credit or debit note that references the original invoice. Lock the invoice record in Salesforce once it is submitted.

What is a CSID?

A cryptographic stamp identifier, the certificate each e-invoice generation unit uses to sign invoices. A unit first receives a compliance CSID, passes compliance checks, then receives a production CSID valid for up to five years.

Do ZATCA e-invoices have to be in Arabic?

Yes. Invoices must be in Arabic. Other languages may appear alongside, and the Arabic text prevails.

Is Salesforce Hyperforce available in Saudi Arabia?

Salesforce announced plans in February 2025 to bring Hyperforce to Saudi Arabia with AWS. AWS says its first Saudi region is on track to launch in December 2026. As of 4 November 2026 we had not seen a Saudi Hyperforce region announced as live.

Sources

• ZATCA: E-Invoicing Regulation (4 December 2020)
• ZATCA: E-Invoicing Implementation Resolution (consolidated, 19 May 2023)
• ZATCA: E-Invoicing Detailed Guideline, version 2 (May 2023)
• ZATCA: E-Invoicing Detailed Technical Guideline, version 2
• ZATCA: Electronic Invoice XML Implementation Standard v1.2
• ZATCA: Electronic Invoice Security Features Implementation Standards v1.2
• ZATCA: E-Invoice specifications
• ZATCA: Guideline for Tax Invoicing and Records under VAT Provisions, version 3 (May 2026)
• ZATCA: Wave 25 of the integration phase (24 July 2026)
• EY: Saudi Arabia announces 25th wave of Phase 2 e-invoicing integration (10 August 2026)
• Grant Thornton: ZATCA announces wave 25 of e-invoicing
• ZATCA: Wave 24 of the integration phase (26 September 2025)
• EY: Saudi Arabia announces 23rd wave of Phase 2 e-invoicing integration (7 July 2025)
• ClearTax: VAT registration thresholds in Saudi Arabia
• Deloitte: ZATCA announces violations and penalties for e-invoicing (November 2021)
• Grant Thornton: e-invoicing penalty alert (November 2021)
• ZATCA: Fines cancellation and penalty exemption extended to 30 June 2026
• ZATCA: Fines cancellation and penalty exemption extended to 31 December 2026
• ZATCA: Solution Providers Directory
• ZATCA Fatoora Developer Community: announcements
• ZATCA Fatoora Developer Community: e-invoicing API endpoints
• ZATCA Fatoora Developer Community: SDK 3.4.3 queries
• ClearTax: ZATCA SDK updates
• GOBL: Saudi Arabia ZATCA addon (address validation rules)
• Salesforce Help: Invoice generation in Agentforce Revenue Management
• Salesforce Developers: Generate Invoice Documents action
• Salesforce: E-invoicing with Revenue Cloud
• UnofficialSF: E-invoicing with Revenue Cloud (October 2025)
• Microsoft Learn: Get started with electronic invoicing for Saudi Arabia
• Odoo documentation: Saudi Arabia fiscal localization
• Salesforce: $500 million investment in Saudi Arabia (10 February 2025)
• Salesforce: Salesforce Saudi Arabia launches (18 November 2025)
• Amazon: AWS cloud region in Saudi Arabia (31 August 2026)