ZATCA E-Invoicing Phase 2 (Integration Phase): The Complete Compliance Guide
Phase 2 is where e-invoicing stops being a PDF with a QR code and becomes a real-time, API-driven integration to ZATCA. This guide breaks down every technical and operational requirement — from CSR and CSID onboarding to clearance, reporting, and Wave 25 deadlines.
The ZATCA (Zakat, Tax and Customs Authority) e-invoicing program — known as Fatoora — rolled out in two phases. Phase 1 (Generation Phase) required every VAT-registered business to stop issuing paper invoices and start generating compliant electronic invoices with a QR code. Phase 2 (Integration Phase) is far more demanding: it turns your invoicing into a live, secure, API-connected integration with ZATCA systems.
Under Phase 2 you must connect directly to ZATCA, onboard your devices cryptographically, and either clear or report every invoice in near real time. There is no manual step and no grace period for "mostly compliant". If your ERP, POS, or billing system cannot speak to ZATCA, you are simply not compliant.
This guide explains exactly what Phase 2 requires, how onboarding works, what technical fields and formats you must produce, how clearance versus reporting differ, and how to prepare for the wave deadlines — including Wave 25. It is written for finance leads, IT managers, and business owners who need a clear, practical roadmap.
Who this applies to
Clinics & Healthcare
Medical centers, dental clinics, polyclinics, labs, and pharmacies issuing insurance and patient invoices.
Restaurants & Cafés
Dine-in, takeaway, and delivery outlets with high-volume POS simplified invoices.
Car Workshops & Auto Services
Garages, spare-parts traders, and vehicle service centers issuing repair invoices.
Contracting & Construction
Progress-billing, retention, and milestone invoices for large projects.
Retail & eCommerce
Stores, marketplaces, and online shops producing simplified tax invoices per order.
Wholesale & Distribution
B2B supply chains with standard tax invoices and credit/debit notes.
Manufacturing
Factories with multi-line BOM invoices, purchase orders, and delivery notes.
Logistics & Transport
Freight, fleet, last-mile delivery, and customs clearance invoicing.
Professional Services
Legal, accounting, consulting, engineering, and audit firms billing by engagement.
Real Estate & Property
Sales, leasing, property management, and brokerage commissions.
Education & Training
Schools, universities, institutes, and training centers with tuition and fee invoices.
Travel & Hospitality
Hotels, resorts, travel agencies, and tour operators with guest folios.
Technology & SaaS
Software subscriptions, licenses, and recurring digital service invoices.
Freelancers & Sole Proprietors
Individual VAT-registered consultants and contractors issuing compliant invoices.
Government & Semi-Government
Public entities and contractors supplying government projects.
Pharmaceutical & Medical Supplies
Distribution of medicines, equipment, and consumables to facilities.
Food & Beverage Wholesale
Distributors supplying restaurants, supermarkets, and hotels.
Energy, Oil & Gas Services
Field services, equipment rental, and maintenance contracting.
What Phase 2 actually changes vs. Phase 1
Phase 1 was about generation: a compliant invoice with the mandatory Arabic/English fields and a QR code containing the seller name, VAT number, timestamp, total with VAT, and VAT amount. You generated it on your own systems and that was largely it.
Phase 2 integrates your systems with ZATCA in real time. Every standard tax invoice, simplified tax invoice, credit note, and debit note must be produced in the structured UBL 2.1 XML format, cryptographically stamped, and transmitted to ZATCA — simplified invoices must be reported within 24 hours, while standard (B2B) invoices must be cleared before they are shared with the buyer.
- Structured UBL 2.1 XML becomes the source of truth — not a PDF.
- Every invoice carries a cryptographic stamp and a UUID issued by ZATCA.
- Simplified invoices (B2C) are reported to ZATCA within 24 hours.
- Standard invoices (B2B) are cleared by ZATCA before delivery to the buyer.
- Device-level onboarding via CSR and CSID is mandatory.
- Schema, business rules, and signature validation are enforced in real time.
Phase 2 requirements checklist
Before go-live, confirm every box below. Missing any single item generally blocks onboarding or causes invoice rejection.
- A valid 15-digit VAT registration number (TRN) for every entity and branch.
- A compliant invoicing solution capable of UBL 2.1 XML and PDF/A-3 with embedded XML.
- ZATCA sandbox access for simulation and validation testing.
- CSR (Certificate Signing Request) generation with the correct ZATCA-compliant fields.
- CSID (Cryptographic Stamp Identifier) obtained through the Compliance and Production APIs.
- OTP from the Fatoora portal for production CSID issuance.
- QR code in TLV Base64 format on every invoice.
- Hash chaining: each invoice links to the previous invoice hash (PIH).
- French/Arabic bilingual field support where required.
- A secure key store (HSM or equivalent) for private keys and certificates.
Onboarding: CSR, CSID and the compliance API
Onboarding is the most misunderstood part of Phase 2. Each invoicing device or EGS (E-invoicing Generation Solution) must be registered individually with ZATCA.
You generate a CSR containing your VAT number, organization identifier, invoice type, environment, and device identifiers. You then exchange it with ZATCA through the Compliance API using the OTP from the Fatoora portal. ZATCA returns a Compliance CSID — a certificate that lets you test in the sandbox or simulation environment.
Once your invoices pass compliance checks, you request a Production CSID. That certificate is what signs live invoices. Rotate and protect it carefully; a leaked private key invalidates the integrity of everything you issued.
- CSR fields: common name, serial number, organization identifier, organizational unit, invoice type, environment, location, industry.
- Use the Compliance API to obtain the Compliance CSID for testing.
- Run compliance checks across all invoice types before requesting production access.
- Store keys in a secure element, HSM, or encrypted store — never in plain text.
- Track per-device CSIDs, especially across multiple branches or POS terminals.
Invoice formats and mandatory fields
ZATCA requires structured UBL 2.1 XML. The human-readable invoice is a PDF/A-3 file with the XML embedded as an attachment, so the document and the machine-readable data always travel together.
Businesses must populate a strict set of fields for both standard and simplified invoices. Missing or malformed fields are the number one cause of rejections.
- Invoice type code (standard, simplified, credit note, debit note) and transaction type.
- Issue date and time in the correct format and timezone.
- Seller and buyer legal names, VAT numbers, and full addresses (including street, building number, district, city, postal code, country).
- Line items: description, quantity, unit price, discounts, VAT rate, and VAT amount.
- Tax totals broken down by category (S, Z, E, O) for standard-rate, zero-rated, exempt, and out-of-scope.
- Monetary totals, payable amount, and currency (SAR or converted).
- QR code (TLV, Base64) with seller name, VAT number, timestamp, invoice total, and VAT total.
- UUID, invoice counter value (ICV), previous invoice hash (PIH), and cryptographic stamp.
Clearance vs. reporting: how the two flows differ
Standard tax invoices follow the Clearance flow. You build the XML, stamp it, and send it to ZATCA. ZATCA validates and clears it, returning the cleared invoice with a QR code. Only then may you share it with the buyer. If ZATCA rejects it, you must fix and resubmit before delivery.
Simplified tax invoices follow the Reporting flow. Because B2C transactions happen at speed, you issue the invoice to the customer immediately with your QR code, then report it to ZATCA within 24 hours. ZATCA may accept, warn, or reject; rejections must be corrected and re-reported.
- Clearance: real-time validation before delivery (B2B / standard invoices).
- Reporting: post-issue validation within 24 hours (B2C / simplified invoices).
- Both flows use signed XML and return ZATCA validation results.
- Warnings allow progression but should be fixed to avoid future rejection.
- Rejected invoices must never be delivered to the buyer.
Wave 25 and how the integration deadlines work
ZATCA rolls Phase 2 out in waves based on annual VAT-taxable revenue. Each wave gives a target group a fixed go-live date. Wave 25 extends Phase 2 to another tranche of businesses, and being named in a wave means the integration deadline is now firm.
The practical rule: the moment your revenue puts you in a wave, budget for onboarding, testing, and training — often 6 to 12 weeks of real work. Late integration after a wave deadline triggers penalties.
- Waves are based on annual revenue thresholds; later waves cover smaller businesses.
- Wave 25 brings a new tranche — usually clinics, restaurants, workshops, and SMEs — into scope.
- Integration typically needs 6–12 weeks including sandbox testing and go-live.
- After the wave deadline, non-compliance fines apply immediately.
Common Phase 2 integration mistakes
Most Phase 2 failures are not exotic bugs — they are predictable integration problems that appear when a project is rushed. Avoiding them saves weeks of rework.
- Treating the PDF as the invoice and forgetting to generate UBL 2.1 XML.
- Incorrect or missing QR TLV encoding — decoders must be able to read all five tags.
- Broken hash chaining (wrong PIH) so ZATCA rejects the sequence.
- One CSID used across multiple devices or branches.
- No retry/queue logic, so a network blip loses an invoice.
- Timezone or date-format errors on issue date and time.
- Storing private keys insecurely or committing them to source control.
- Skipping sandbox testing and discovering rules violations in production.
How to implement Phase 2 without disrupting operations
The safest approach is to add an e-invoicing integration layer rather than rebuild your core system. The layer ingests invoices from your existing ERP, POS, or billing app, generates compliant UBL 2.1 XML, signs it, transmits it to ZATCA, and stores both the response and the archived PDF/A-3.
This keeps your day-to-day operations untouched while satisfying every ZATCA requirement. It also makes wave compliance a matter of configuration, not a multi-quarter reimplementation.
- Keep your existing ERP/POS; wrap it with a ZATCA integration layer.
- Centralize signing and key management in a secure service.
- Add an outbound queue with retries for clearance and reporting.
- Archive XML, PDF/A-3, QR codes, and ZATCA responses for audit.
- Monitor validation warnings and rejection rates with alerting.
- Plan for key rotation, certificate renewal, and wave expansions.
Frequently asked questions
What is ZATCA Phase 2?+
ZATCA Phase 2, also called the Integration Phase, is the second stage of Saudi Arabia e-invoicing. It requires VAT-registered businesses to integrate directly with ZATCA systems, generate structured UBL 2.1 XML invoices, apply a cryptographic stamp, and either clear (standard/B2B) or report (simplified/B2C) every invoice in near real time.
Who must comply with ZATCA Phase 2?+
All VAT-registered businesses in Saudi Arabia that fall within an announced wave are required to comply. Waves are determined by annual VAT-taxable revenue, with later waves covering smaller businesses. Once you are named in a wave, compliance is mandatory from the stated go-live date.
What is the difference between Phase 1 and Phase 2?+
Phase 1 (Generation) required compliant electronic invoices with a QR code but did not require connection to ZATCA. Phase 2 (Integration) requires real-time or near real-time API integration with ZATCA, cryptographic onboarding (CSR/CSID), UBL 2.1 XML, hash chaining, and clearance or reporting of every invoice.
What is a CSID and why do I need one?+
A CSID (Cryptographic Stamp Identifier) is a certificate issued by ZATCA that allows a device or E-invoicing Generation Solution to sign invoices. You first obtain a Compliance CSID for testing, then a Production CSID for live invoices. Each device must be onboarded individually.
What is the difference between clearance and reporting?+
Clearance applies to standard (B2B) tax invoices: ZATCA validates and clears the invoice before it is shared with the buyer. Reporting applies to simplified (B2C) invoices: you issue the invoice to the customer immediately and report it to ZATCA within 24 hours.
What formats must invoices be in for Phase 2?+
Invoices must be produced as structured UBL 2.1 XML and delivered as a human-readable PDF/A-3 file with the XML embedded as an attachment, so the printed and machine-readable versions always match.
What is the QR code requirement in Phase 2?+
Every invoice must carry a QR code encoded in TLV (Tag-Length-Value), Base64 encoded, containing the seller name, VAT registration number, invoice timestamp, invoice total with VAT, and VAT total. In Phase 2 the QR also relates to ZATCA-side data returned during clearance.
How does hash chaining work?+
Each invoice includes a Previous Invoice Hash (PIH) referencing the hash of the previous invoice, plus an Invoice Counter Value (ICV). This creates a tamper-evident chain that ZATCA validates; a broken chain causes rejections.
How long does ZATCA Phase 2 integration take?+
Most businesses need 6 to 12 weeks, including CSR/CSID onboarding, sandbox testing across all invoice types, integration into the existing ERP or POS, and go-live. Starting early in the wave window avoids last-minute penalties.
Do I need to replace my ERP to become Phase 2 compliant?+
No. You can keep your existing ERP, POS, or billing system and add an e-invoicing integration layer that generates UBL 2.1 XML, applies the cryptographic stamp, transmits to ZATCA, and archives the results. This is usually faster and less disruptive than a full rebuild.
Topics covered
Related reading
Need help building this?
CODEXTERS designs and builds software across ERP and ERPNext, ZATCA e-invoicing compliance, AI and data platforms, SaaS products, and startup MVPs — for companies of every size.