What is ZATCA e-invoicing Phase 2?

Phase 2 (the Integration phase) of Saudi Arabia's Fatoora e-invoicing programme requires VAT-registered businesses to integrate their billing systems with ZATCA, sign every invoice with a cryptographic stamp, and clear (B2B) or report (B2C) it through ZATCA APIs.

When does ZATCA Phase 2 apply to my business?

ZATCA assigns businesses to integration waves based on annual VAT-registered revenue and notifies each taxpayer at least six months before their go-live date. Check the Fatoora portal and your registered email for your wave's effective date.

What is the difference between Clearance and Reporting?

Tax invoices (B2B) follow the Clearance model — each invoice is sent to ZATCA synchronously, stamped, and only then shared with the buyer. Simplified invoices (B2C) follow the Reporting model — the invoice is issued instantly with a QR code and reported to ZATCA within 24 hours.

What technical formats are mandatory?

Invoices must be generated in UBL 2.1 XML following the ZATCA PINT-SA specification, signed with ECDSA, and accompanied by a TLV-encoded Base64 QR code. PDF/A-3 with the signed XML embedded is the recommended human-readable archival format.

Saudi compliance · Fatoora

ZATCA e-invoicing Phase 2 guide: step-by-step compliance for Saudi firms

A practical implementation checklist for finance and IT teams transitioning from Phase 1 (Generation) to Phase 2 (Integration), covering API integration, the cryptographic stamp, and the wave-by-wave readiness work the Zakat, Tax and Customs Authority expects.

What changed between Phase 1 and Phase 2

Phase 1 required Saudi VAT-registered businesses to stop issuing handwritten or PDF-only invoices and to generate structured electronic invoices instead. Phase 2 goes further: every invoice must be cryptographically signed, exchanged with ZATCA's Fatoora platform, and embedded with a verifiable QR code. B2B tax invoices follow the Clearance model and are only valid after ZATCA returns a stamped copy. B2C simplified invoices follow the Reporting model and must be transmitted within 24 hours.

Phase 2 implementation checklist

1. Confirm your integration wave

Check the official ZATCA notification email and Fatoora portal for your wave start date.
Confirm taxable turnover threshold for your wave (waves are announced by VAT-registered revenue band).
Lock an internal go-live target at least 30 days before the mandatory date to leave room for sandbox testing.

2. Prepare master data and tax setup

Verify VAT registration number, CR number, and registered Arabic + English legal name match ZATCA records exactly.
Set the seller address (street, building, district, city, postal code, additional number) on every issuing branch.
Map every product and service to a standard VAT category code (S, Z, E, O) with the correct 15% / 0% / exempt treatment.
Add buyer VAT number and address capture to your sales workflow — mandatory for B2B tax invoices.

3. Generate compliant invoice XML (UBL 2.1)

Issue tax invoices (B2B) and simplified invoices (B2C) in UBL 2.1 / PINT-SA XML.
Embed the TLV-encoded, Base64 QR code on every simplified invoice (seller name, VAT number, timestamp, total, VAT total, hash, signature, public key, signature of stamp).
Include invoice counter value (ICV) and previous invoice hash (PIH) so the chain is unbroken.
Render a human-readable PDF/A-3 with the XML embedded for archival.

4. Onboard with the Fatoora portal

Generate a CSR (Certificate Signing Request) per EGS (E-invoice Generation Solution) unit.
Request a One-Time Password (OTP) from the Fatoora portal and exchange it for a Compliance CSID.
Submit standard, simplified, credit, and debit sample invoices through the Compliance API.
Swap the Compliance CSID for a Production CSID once all sample invoices pass.

5. Wire up the production APIs

Clearance API (B2B): submit each tax invoice synchronously, receive ZATCA's cryptographic stamp, then share with the buyer.
Reporting API (B2C): report each simplified invoice within 24 hours of issuance.
Implement exponential backoff and a durable outbox so transient ZATCA outages never block sales.
Persist every ZATCA response (UUID, hash, warnings, errors) against the invoice for audit.

6. Cryptographic stamp and archival

Sign the invoice hash with the ECDSA private key tied to your Production CSID.
Store the signed XML, ZATCA-cleared XML, and PDF/A-3 for a minimum of 6 years.
Block edits on cleared invoices — corrections must be issued as credit or debit notes referencing the original UUID.
Schedule a quarterly key-rotation drill and CSID renewal reminder.

7. Operate and monitor

Dashboard cleared vs reported counts, queue depth, and last successful clearance per branch.
Alert on any clearance rejection by error code (e.g. invalid VAT, hash mismatch, expired CSID).
Reconcile daily totals from your ERP against the Fatoora portal export.
Train finance and sales staff on the difference between tax invoices, simplified invoices, and corrective notes.

API integration in plain language

ZATCA exposes three core APIs in Phase 2: Compliance (used once during onboarding to validate sample invoices and obtain a CSID), Clearance (synchronous endpoint for B2B tax invoices), and Reporting (asynchronous endpoint for B2C simplified invoices). All three accept the same UBL 2.1 XML payload, signed with the ECDSA private key derived from your CSID.

Production traffic should be queued through a durable outbox so a transient ZATCA outage never blocks point-of-sale or back-office invoicing. Persist every response — including the cleared XML, UUID, warnings, and error codes — against the originating invoice so finance, audit, and ZATCA inspectors can reconstruct any transaction.

The cryptographic stamp, explained

The cryptographic stamp is an ECDSA signature applied to a canonicalised hash of the invoice XML using the private key tied to your Production CSID. For tax invoices, the stamp is produced by ZATCA after Clearance; for simplified invoices, your EGS produces the stamp locally before reporting. Both flows require an unbroken invoice chain — each invoice carries its own counter value (ICV) and the hash of the previous invoice (PIH) so missing or out-of-order invoices can be detected immediately.

Frequently asked questions

What is ZATCA e-invoicing Phase 2?: Phase 2 (the Integration phase) of Saudi Arabia's Fatoora e-invoicing programme requires VAT-registered businesses to integrate their billing systems with ZATCA, sign every invoice with a cryptographic stamp, and clear (B2B) or report (B2C) it through ZATCA APIs.
When does ZATCA Phase 2 apply to my business?: ZATCA assigns businesses to integration waves based on annual VAT-registered revenue and notifies each taxpayer at least six months before their go-live date. Check the Fatoora portal and your registered email for your wave's effective date.
What is the difference between Clearance and Reporting?: Tax invoices (B2B) follow the Clearance model — each invoice is sent to ZATCA synchronously, stamped, and only then shared with the buyer. Simplified invoices (B2C) follow the Reporting model — the invoice is issued instantly with a QR code and reported to ZATCA within 24 hours.
What technical formats are mandatory?: Invoices must be generated in UBL 2.1 XML following the ZATCA PINT-SA specification, signed with ECDSA, and accompanied by a TLV-encoded Base64 QR code. PDF/A-3 with the signed XML embedded is the recommended human-readable archival format.

Run ZATCA Phase 2 on JMMi ERP

JMMi ERP ships ZATCA-aligned invoicing with Clearance + Reporting queues, cryptographic stamp handling, and a bilingual Arabic / English audit trail — so your team focuses on sales, not compliance plumbing.

Start a free trial