What is ZATCA e-invoicing phase 2?

It is the integration phase of Saudi e-invoicing, applied in waves since 1 January 2023. Businesses in a notified wave must connect their invoicing solution to ZATCA's FATOORA platform, send standard tax invoices for clearance before sharing them and report simplified invoices within 24 hours.

How do I know when my business must integrate with FATOORA?

ZATCA announces each wave with its revenue threshold and reference years and notifies targeted taxpayers directly at least six months before their integration date. Check ZATCA's official announcements and your notification rather than unofficial lists.

What is the difference between clearance and reporting?

Clearance applies to standard tax invoices, mainly B2B and B2G: ZATCA validates and stamps the invoice before you share it with the buyer. Reporting applies to simplified invoices, mainly B2C: you share the invoice first and report it to ZATCA within 24 hours.

What is a CSID and how do I get one?

A cryptographic stamp identifier is the certificate that authenticates each invoicing unit to ZATCA. You generate an OTP in the FATOORA portal, enter it in your solution, pass the compliance checks with a compliance CSID and then receive a production CSID. CSIDs expire and must be renewed.

Can I cancel or edit an e-invoice after it is issued?

No. Issued e-invoices cannot be modified or deleted. To reverse or correct an invoice you issue a credit or debit note and, if needed, a new invoice. A rejected invoice is fixed and resubmitted as a new document with its own counter value and hash.

Can I integrate my existing accounting system with ZATCA instead of replacing it?

Often yes. If your system can produce the required XML, protect keys and call the FATOORA APIs, it can be extended directly or connected through middleware. The decision depends on how many systems issue invoices and whether you can maintain the integration as specifications change.

Is there a test environment for ZATCA API integration?

Yes. ZATCA's developer portal offers an integration sandbox, API documentation and an SDK for validating and signing test invoices, and there is an optional FATOORA simulation portal for end-to-end testing. Sandbox certificates cannot be used in production.

Web & Software

ZATCA E-Invoicing Phase 2: A Practical FATOORA Integration Guide

By ITCM Team · Updated October 2026

ZATCA e-invoicing phase 2, the integration phase, requires VAT-registered businesses in Saudi Arabia to connect their invoicing system to ZATCA's FATOORA platform so that B2B tax invoices are cleared before they reach the buyer and B2C simplified invoices are reported within 24 hours. ZATCA rolls the phase out in waves and notifies each targeted business at least six months before its integration date. This guide explains who is in scope, what the technical requirements actually mean, how CSID onboarding and API testing work, and how to plan the project so you go live without rejected invoices.

Key takeaways

Phase 1 (generation, since 4 December 2021) means compliant electronic invoices; phase 2 (integration, since 1 January 2023 in waves) means your system talks to FATOORA through APIs.
Standard tax invoices (mainly B2B and B2G) need clearance by ZATCA before you share them; simplified tax invoices (mainly B2C) are shared first and reported within 24 hours.
Each invoicing device or system unit (EGS unit) must be onboarded with an OTP from the FATOORA portal to obtain a cryptographic stamp identifier (CSID).
Every invoice needs a UUID, an invoice counter value and the hash of the previous invoice, forming a single tamper-evident chain per EGS unit.
Test on ZATCA's developer portal sandbox and the optional simulation portal before production; sandbox certificates cannot be used in production.
Issued invoices cannot be edited or deleted: corrections are made with credit or debit notes, and rejected documents are fixed and resubmitted as new documents.

Phase 1 vs phase 2: what changed with the integration phase

Saudi e-invoicing (FATOORA) has two phases. The generation phase took effect on 4 December 2021 and requires businesses to issue and store tax invoices, credit notes and debit notes through a compliant electronic solution, with a QR code on simplified invoices and no handwritten or manually edited invoices. A scanned or photographed paper invoice does not count as an e-invoice.

The integration phase started on 1 January 2023. It adds stricter technical requirements to the invoice itself and requires the solution to be integrated with ZATCA's systems. In practice, phase 2 turns invoicing from a local task inside your ERP or POS into a real-time exchange with a government platform, which is why it touches finance, IT, sales and operations at the same time.

Area	Phase 1: Generation	Phase 2: Integration
Start date	4 December 2021	1 January 2023, applied in waves
Who	All resident VAT taxpayers and parties issuing invoices on their behalf	Taxpayers in each wave ZATCA announces and notifies
Format	Electronic invoice with required fields	XML (UBL 2.1 based) or PDF/A-3 with the XML embedded
Connection to ZATCA	None	APIs to FATOORA for clearance or reporting
Security	User management, no tampering, no deletion	Adds cryptographic stamp, CSID, invoice hash chain, extended QR code

Who is in scope and how waves are announced

E-invoicing applies to taxpayers registered for VAT in the Kingdom, excluding non-resident taxpayers, and also to customers or third parties that issue tax invoices on behalf of a VAT-registered supplier. If you issue VAT invoices in Saudi Arabia, assume phase 1 already applies to you and phase 2 will reach you.

ZATCA does not bring everyone into phase 2 on one date. It announces waves based on VAT-subject revenue in specified reference years and notifies each targeted taxpayer directly, at least six months before its integration date. Recent waves have lowered the threshold step by step: the 24th wave covered taxpayers with VAT-subject revenue above SAR 375,000 in 2022, 2023 or 2024, with integration by 30 June 2026, and the 25th wave, announced in July 2026, covers revenue above SAR 187,500 in any of 2022 to 2025; the dates ZATCA has published point to early 2027 (around 1 February 2027), so confirm your exact deadline in ZATCA's notification to you.

Do not rely on second-hand wave tables. Check ZATCA's official announcements and your notification, and keep in mind that once you are in a wave, your deadline applies to every VAT-registered entity and every invoicing channel you run, including branches, POS terminals, e-commerce checkouts and any system that issues credit notes.

Clearance vs reporting: B2B and B2C invoices

Phase 2 splits invoices into two flows. A standard tax invoice, used mainly for business-to-business and business-to-government sales, goes to FATOORA for clearance through the API first. ZATCA validates it, applies its stamp and returns it, and only the cleared invoice may be shared with the buyer. If clearance fails, you do not have a valid invoice to send.

A simplified tax invoice, used mainly for sales to consumers, is generated, stamped by your own solution, shared with the customer with its QR code and then reported to FATOORA within a maximum of 24 hours. Credit and debit notes follow the same flow as the invoice type they relate to. This difference matters for system design: B2B flows need FATOORA to be reachable at the moment of invoicing, while B2C flows need a reliable queue that reports everything within the deadline.

	Standard tax invoice (clearance)	Simplified tax invoice (reporting)
Typical use	B2B and B2G	B2C, retail, POS
Order of steps	Generate, send to ZATCA, receive cleared invoice, share with buyer	Generate and stamp, share with customer, report to ZATCA
Timing	Before sharing with the buyer	Within 24 hours of issuance
Who signs	ZATCA stamps the cleared invoice	Your solution applies the cryptographic stamp
Main risk	Invoice blocked if validation fails or the API is unreachable	Late or missing reports, broken hash chain

Technical requirements explained in plain terms

ZATCA's published specifications, the XML Implementation Standard, the data dictionary and the Detailed Technical Guideline, define what each invoice must contain. Your developers or vendor should work from those documents, not from summaries, because they change over time. The core building blocks are listed below.

XML format: invoices follow ZATCA's implementation of UBL 2.1, with tag order and mandatory UBL elements enforced by validation. A human-readable PDF/A-3 with the XML embedded is accepted for exchange with buyers.
UUID: a unique identifier generated by your solution and stored inside each XML document.
Invoice counter value: a sequential counter per EGS unit that users cannot reset or edit.
Previous invoice hash: each document carries the hash of the document before it, so all documents from one EGS unit form a single chain whose order cannot be changed. Only one sequence per unit is allowed.
Cryptographic stamp: an ECDSA-based digital signature using a key pair and a certificate issued through onboarding. The private key must stay protected and must never be exportable.
QR code: TLV-encoded and Base64 text. Beyond the seller name, VAT number, timestamp, total and VAT amount used in phase 1, phase 2 adds the invoice hash, the signature and the public key, plus ZATCA's signature for simplified invoices.
Internet connectivity and secure API calls to FATOORA, with logging of every request and response.

CSID onboarding through the FATOORA portal

Every e-invoice generation solution unit (EGS unit), whether a POS device, an ERP instance or a server-side billing service, has to be registered before it can submit invoices. The taxpayer logs into the FATOORA portal through ZATCA's e-services, chooses to onboard a new solution unit and generates one or more one-time passwords. Each OTP is valid for one hour and is entered in the EGS unit, which generates a key pair and a certificate signing request.

With the OTP and CSR, the unit receives a compliance CSID, runs the required compliance checks by submitting sample standard and simplified documents, and only then can request its production CSID. The production CSID authenticates the unit for clearance and reporting. Certificates expire and must be renewed through the same portal, and compromised units must be revoked, so treat CSIDs as security assets with an owner, an expiry calendar and a documented renewal procedure.

Sandbox, developer portal and simulation environment

ZATCA provides a public developer portal with an integration sandbox, API documentation and an SDK that validates XML documents, generates hashes and QR codes and signs test invoices. The sandbox lets developers test onboarding, compliance, clearance and reporting calls without affecting live data. Test CSIDs from the sandbox cannot be used in production.

There is also an optional FATOORA simulation portal for end-to-end functional testing with a taxpayer's own login, which is useful for rehearsing the full onboarding and invoicing cycle before go-live. Use both: the sandbox for development and automated tests, the simulation environment for business acceptance testing with real scenarios such as returns, discounts, advance payments and multi-branch invoicing.

Your three integration options

Most businesses reach compliance in one of three ways. The right one depends on how many systems issue invoices, how customised your processes are and who will own the integration after go-live. ZATCA lists solution providers on its website, but always verify that the specific version you run supports phase 2 and your invoice types.

Option	Best for	Trade-offs
Upgrade to a phase 2 ready ERP or accounting system	Standard processes, one main system, small finance team	Fastest path, but you depend on the vendor's roadmap and may need to migrate data or retire custom features
Middleware or integration provider	Several invoicing systems (ERP, POS, e-commerce) or a legacy system you cannot change much	One compliance layer for all channels, but adds a subscription, a dependency and another point of failure
In-house or custom integration	Custom billing platforms, complex pricing, or teams with strong developers	Full control and no per-invoice fees, but you own signing, key security, chaining, monitoring and every future specification change

Integration project plan and checklist

Treat phase 2 as a finance-system project, not a plugin install. With six months of notice, aim to finish build and sandbox testing in the first three to four months so the remaining time covers simulation, staff training and a controlled cutover. Typical market durations range from a few weeks for a single certified system to several months for multi-system custom work, and they vary with scope and data quality. If you run Odoo or another ERP, our ERP services team can review readiness before you commit to a path.

Inventory every system and channel that issues invoices, credit notes or debit notes, per VAT number and branch.
Clean master data: buyer VAT numbers, commercial registration and address fields for B2B customers, item tax categories and exemption reasons.
Map each invoice scenario (standard, simplified, credit, debit, advance payment, exports, zero-rated, exempt) to the ZATCA data dictionary.
Choose the integration option and assign owners for finance, IT and the vendor.
Design the hash chain, counter and UUID handling per EGS unit, plus a retry queue and alerting for failed or late submissions.
Secure private keys and CSIDs, restrict who can access them and record expiry dates.
Test in the sandbox, then run the full cycle in the simulation portal with real scenarios.
Onboard production EGS units with OTPs, run compliance checks and obtain production CSIDs.
Train staff on corrections via credit and debit notes, rejection handling and the downtime procedure.
Go live, monitor errors and warnings daily for the first weeks and reconcile FATOORA submissions with your VAT return data.

Common errors and rejections and how to avoid them

FATOORA returns three outcomes: valid, accepted with warnings, or rejected with errors. Warnings do not block the invoice but should be fixed promptly because they often signal data problems that later become errors. The most frequent causes of rejections are predictable and mostly preventable with good data and testing.

When a document is rejected, do not edit or delete it. Fix the cause and submit a new document with its own UUID, counter value and hash; the next document must still reference the hash of the immediately preceding document, including a rejected one. If your solution goes down, ZATCA's guidelines require you to notify the authority through its channels and resume clearance or reporting as soon as the system is back.

Missing or malformed buyer VAT number or address on standard invoices.
Calculation and rounding mismatches between line totals, VAT and invoice totals.
Wrong XML tag order, missing mandatory UBL elements or schema (XSD) errors.
Broken hash chain after a restore, a second invoice sequence or parallel processes writing to one EGS unit.
QR code built incorrectly, such as text instead of binary TLV values or Arabic text not encoded as UTF-8.
Wrong or expired CSID, or a sandbox certificate used in production.
Server clock drift: changing the solution's date and time is a prohibited function.

Data retention, security and penalties

Invoices must be stored and kept available for audit under the VAT Law, its Implementing Regulation and the e-invoicing rules; ZATCA allows storage on premises in the Kingdom or in the cloud, subject to those laws. Keep the XML, the cleared or reported version, ZATCA's responses and the audit logs, and make sure backups preserve the hash chain. Solutions must log user activity, prevent anonymous access and default passwords, and never allow invoices or logs to be modified.

Non-compliance can lead to warnings and financial penalties under ZATCA's violations rules, which have been revised over time. Check the current schedule on ZATCA's website rather than relying on older figures, and remember that the operational risk of blocked B2B invoices usually hurts sooner than any fine.

How ITCM helps with FATOORA integration

ITCM builds and integrates finance systems remotely, in English and Arabic. For phase 2 we can assess which of your systems issue invoices, clean the data that causes rejections, and build or extend the integration layer, from XML generation, signing and hash chaining to clearance and reporting queues, monitoring and CSID renewal procedures. See our custom finance software service, or read the custom accounting software development guide if you are weighing a wider rebuild.

Every service starts from $100, bigger builds are quoted per project and delivered in stages, and the price is agreed first with no advance payment: you pay after reviewing the work. ITCM is not a ZATCA-certified provider; we work to ZATCA's published specifications and validate every build against its own SDK and sandbox before go-live. You can book a free initial consultation to discuss your wave and systems.

Frequently asked questions

What is ZATCA e-invoicing phase 2?: It is the integration phase of Saudi e-invoicing, applied in waves since 1 January 2023. Businesses in a notified wave must connect their invoicing solution to ZATCA's FATOORA platform, send standard tax invoices for clearance before sharing them and report simplified invoices within 24 hours.
How do I know when my business must integrate with FATOORA?: ZATCA announces each wave with its revenue threshold and reference years and notifies targeted taxpayers directly at least six months before their integration date. Check ZATCA's official announcements and your notification rather than unofficial lists.
What is the difference between clearance and reporting?: Clearance applies to standard tax invoices, mainly B2B and B2G: ZATCA validates and stamps the invoice before you share it with the buyer. Reporting applies to simplified invoices, mainly B2C: you share the invoice first and report it to ZATCA within 24 hours.
What is a CSID and how do I get one?: A cryptographic stamp identifier is the certificate that authenticates each invoicing unit to ZATCA. You generate an OTP in the FATOORA portal, enter it in your solution, pass the compliance checks with a compliance CSID and then receive a production CSID. CSIDs expire and must be renewed.
Can I cancel or edit an e-invoice after it is issued?: No. Issued e-invoices cannot be modified or deleted. To reverse or correct an invoice you issue a credit or debit note and, if needed, a new invoice. A rejected invoice is fixed and resubmitted as a new document with its own counter value and hash.
Can I integrate my existing accounting system with ZATCA instead of replacing it?: Often yes. If your system can produce the required XML, protect keys and call the FATOORA APIs, it can be extended directly or connected through middleware. The decision depends on how many systems issue invoices and whether you can maintain the integration as specifications change.
Is there a test environment for ZATCA API integration?: Yes. ZATCA's developer portal offers an integration sandbox, API documentation and an SDK for validating and signing test invoices, and there is an optional FATOORA simulation portal for end-to-end testing. Sandbox certificates cannot be used in production.

Want this handled for you?

We deliver all of this remotely — get a quote or start with a free audit.

Get a Quote Free Audit

← All articles