ZATCA E-Invoicing Phase 2: A Saudi Readiness Guide

Saudi Arabia's electronic invoicing initiative, Fatoora, connects corporate billing engines directly to the Zakat, Tax and Customs Authority (ZATCA). While Phase 1 mandated generating and storing structured electronic records from 4 December 2021, Phase 2 (Integration Phase) links taxpayer software to ZATCA via secure APIs.

A common misconception is that Saudi Arabia set a single 2026 deadline for all businesses. In reality, ZATCA enforces Phase 2 in successive waves based on turnover, providing at least six months of advance notice. Compliance requires knowing whether transactions require clearance or 24-hour reporting, how to onboard devices with Cryptographic Stamp Identifiers (CSIDs), and how to verify invoices for tax recovery.

ZATCA e-invoicing phases and integration wave mechanics

Saudi e-invoicing divides into two distinct operational phases governed by ZATCA regulations:

• Phase 1 (Generation Phase – 4 December 2021): Applied to all resident taxable persons (excluding non-residents without a Saudi permanent establishment). Taxpayers ceased issuing manual invoices, adopting software to store records and generate basic 5-tag QR codes on B2C receipts without portal integration.
• Phase 2 (Integration Phase – 1 January 2023 onwards): Mandates technical integration between taxpayer invoicing solutions (EGS) and ZATCA's Fatoora portal. Invoices must be generated in UBL 2.1 XML or PDF/A-3 formats, secured with digital stamps, cryptographic hashes, and UUIDs, and exchanged via REST APIs.

ZATCA rolls out Phase 2 in targeted waves based on annual taxable turnover, starting 1 January 2023 for businesses over SAR 3 billion and progressing to smaller tiers. By regulation, ZATCA notifies each cohort at least six months before its mandatory integration date via the portal and registered email. Never assume an arbitrary 2026 deadline; monitor your specific revenue band and official notices directly.

Hypothetical example: managing wave notification lead times

Al-Sharq Distribution Co., a Jeddah distributor with SAR 35 million turnover, receives a wave notification setting its mandatory date six months out. Although its large multinational suppliers already issue cleared e-invoices, Al-Sharq must upgrade its outbound ERP, complete compliance testing, and onboard devices before its own deadline. Waiting for an unconfirmed 2026 date risks operational disruption and penalties.

Standard invoice clearance vs simplified invoice reporting

Phase 2 separates transactions into two regulatory pathways based on the transaction type and value: Clearance for standard business billing and Reporting for simplified invoices.

Standard Tax Invoices (B2B and B2G): Mandatory for business and government sales, and B2B supplies of SAR 1,000 or more, under the Clearance model. The supplier transmits the invoice XML to Fatoora in real time. For integrated suppliers, the invoice cannot be shared with the buyer until ZATCA validates the file, applies its cryptographic stamp, embeds a clearance QR code, and returns the cleared XML.

Simplified Tax Invoices: Issued for consumer sales (B2C) and permitted for B2B transactions under SAR 1,000 under Article 53(8) of VAT regulations. Operating under the Reporting model, the EGS signs locally with its Production CSID, prints a 9-tag QR code, and issues the receipt immediately. The seller uploads the XML via API within 24 hours of invoice issuance.

Technical architecture: XML, PDF/A-3, hashes and QR codes

Under ZATCA regulations, an electronic invoice is not an image; it is structured data. The legally binding invoice is strictly the UBL 2.1 XML file. Generating an isolated PDF without embedded XML does not fulfill statutory requirements.

ZATCA permits PDF/A-3 (ISO 19005-3) to pair human-readable visual layouts with embedded, machine-readable XML. Receiving systems ingest the embedded XML directly, eliminating manual data entry.

Every Phase 2 solution must implement three cryptographic safeguards:

• Universally Unique Identifier (UUID): A 128-bit UUID (RFC 4122 v4) generated per invoice to ensure global uniqueness.
• Cryptographic Hash and Chaining: The EGS computes a SHA-256 hash of the XML payload, embedding the preceding invoice's hash in its Previous Invoice Hash (PIH) field to form an unbroken, tamper-proof sequence.
• Phase 2 9-Tag QR Code: Simplified invoices require a Base64 TLV QR code encoding: seller name, VAT number, timestamp, invoice total, VAT total, XML hash, ECDSA digital stamp, public key, and ZATCA certificate signature.

Step-by-step EGS onboarding and CSID issuance

An E-Invoice Generation Solution (EGS) unit is any ERP instance, POS terminal, or billing software producing tax invoices. Each terminal must be onboarded separately with its own cryptographic key and invoice counter.

Onboarding requires obtaining a Cryptographic Stamp Identifier (CSID)—a digital certificate issued by ZATCA's Public Key Infrastructure. Taxpayers first obtain a Compliance CSID (CCSID) for verification, followed by a permanent Production CSID (PCSID) for live operations.

1. 1Generate OTP on FatooraAccess the Fatoora portal (fatoora.zatca.gov.sa) using registered credentials and generate an onboarding One-Time Password (OTP).
2. 2Generate keypair and CSR locallyThe EGS creates an ECDSA secp256k1 keypair and Certificate Signing Request (CSR) encoding VAT number, legal name, and serial number.
3. 3Request Compliance CSID via APISubmit the CSR and OTP to ZATCA's API to receive a temporary Compliance CSID (CCSID) for testing.
4. 4Complete compliance checksSubmit sample standard invoices, simplified invoices, and notes through ZATCA's compliance API to verify validation checks.
5. 5Obtain Production CSID (PCSID)Call the Production CSID endpoint upon passing tests to obtain the active Production CSID for live operations.
6. 6Enable sync monitoring and queuesEnable retry queues and error monitoring to ensure simplified invoices report within 24 hours of issuance.

For organizations using legacy billing software, custom API connectors streamline this transition. Explore our accounting software solutions to evaluate middleware suitable for your enterprise architecture.

Branch data, National Address, and VAT field requirements

Master data defects represent the leading cause of API invoice rejections. ZATCA's validation engine programmatically matches submitted XML fields against government registries across four core data clusters:

• Saudi National Address Standard: Addresses must include building number (4 digits), street, district, city, postal code (5 digits), and additional 4-digit number.
• Tax Identification Numbers (TRN): The seller's 15-digit VAT number is mandatory. Standard B2B invoices also require the buyer's VAT number or national identifier (CRN or 700-number).
• Tax Categorization: Line items must specify unit prices, quantities, and official tax codes: Standard ('S'), Zero-Rated ('Z'), Exempt ('E'), or Out-of-Scope ('O'), with required exemption reason codes.
• Currency Conversions: Foreign-currency invoices must state the exchange rate and express all tax totals and VAT amounts in Saudi Riyals (SAR).

Outbound cross-border transactions also intersect with other tax rules. When paying foreign vendors for technical services or software licenses, businesses must verify their Saudi withholding tax obligations under KSA corporate tax regulations.

Prohibited software functions and failure handling procedures

To prevent tax fraud and unrecorded sales, ZATCA regulations explicitly outlaw several software capabilities. Deploying solutions with prohibited functions exposes businesses to severe statutory fines:

• Anonymous Access: Generic logins and factory default passwords are prohibited; systems must enforce authenticated user sessions.
• Invoice Alteration: Software must never permit editing, modifying, or deleting issued or cleared e-invoices.
• Log Tampering: System audit trails tracking logins, invoice generation, and API calls must be immutable.
• Clock Changes: Mechanisms allowing manual alterations to system dates, timestamps, or clocks are banned.
• Counter Resets: Invoicing units must maintain a single sequential counter; resetting counters or splitting sequences is forbidden.
• Exporting Private Keys: Cryptographic keys must reside in secure keystores or HSMs and cannot be exportable in plain text.

Adjusting issued invoices: electronic credit and debit notes

Because issued invoices cannot be modified or deleted, all adjustments—such as goods returns, volume rebates, or price corrections—must be processed via an Electronic Credit Note or Debit Note. The note must reference the original Invoice Reference Number (IRN), maintain sequential hashing, and undergo Clearance (for B2B) or 24-hour Reporting (for simplified invoices).

Contingency procedures during system and network outages

ZATCA sets specific procedural rules for technical disruptions, emphasizing that reporting deadlines run from the moment of invoice issuance:

• Simplified Invoices Offline: POS units issue simplified invoices locally with 9-tag QR codes, queuing XML files for reporting within 24 hours of issuance. If disruptions exceed 24 hours, submit a technical failure notice via ZATCA's portal and report immediately upon reconnection.
• B2B Clearance Outages: If clearance servers are unreachable, systems retry regularly while logging transmission errors. Suppliers must preserve transaction records and re-submit for clearance immediately once services resume to protect buyer deduction rights.
• Hardware Breakdown: In device failures, notify ZATCA immediately via the portal, document sales under authority contingency rules, and re-generate electronic records once equipment is repaired.

Practical readiness checklist and ERP transition roadmap

Achieving Phase 2 compliance requires disciplined execution across finance, IT, and operations. If your business has received a wave notice—or is planning ahead—follow this transition roadmap:

1. Classify Streams: Separate B2B/B2G clearance workflows from simplified reporting, and verify buyer and supplier invoice eligibility against Saudi VAT registration thresholds.
2. Scrub Master Data: Cleanse customer files to ensure complete National Address components, 15-digit VAT numbers, and corporate registration identifiers.
3. Assess Software: Confirm whether your billing engine supports UBL 2.1 XML, SHA-256 chaining, and REST APIs natively, or source integration middleware.
4. Execute Compliance Tests: Request Compliance CSIDs and validate standard invoices, simplified invoices, credit notes, and error handling with ZATCA's API.
5. Deploy Production CSIDs: Cut over to live issuance, activate daily reconciliation against ZATCA acceptance responses, and train staff on credit note rules.

As digital reporting expands across the GCC—exemplified by the UAE e-invoicing rollout—automated tax operations are essential for compliance. HOF Partners' invoice processing team supports businesses with data validation, API exception monitoring, and daily transaction reconciliation, ensuring dependable compliance with ZATCA regulations.