Saudi Arabia · ZATCA FATOORA

Saudi Arabia ZATCA Phase 2 E-Invoicing Integration

Connect your existing ERP, accounting or POS system to ZATCA's FATOORA platform. We build the UBL 2.1 XML generation, cryptographic stamping, QR codes, CSID onboarding and clearance and reporting API integration, around the software you already run.

Talk to an Engineer Free readiness check WhatsApp an engineer

Who must comply with ZATCA Phase 2?

E-invoicing in Saudi Arabia applies to VAT-registered persons resident in the Kingdom, and to third parties issuing tax invoices on their behalf. It was introduced in two phases:

Phase 1 (Generation): invoices must be generated and stored electronically by a compliant solution. This applies to all in-scope taxpayers.
Phase 2 (Integration): e-invoicing solutions must integrate with ZATCA's FATOORA platform. ZATCA brings taxpayers in through waves based on revenue, notifying each group ahead of its integration date.

Phase 2 covers both standard tax invoices (mainly B2B and B2G) and simplified tax invoices (mainly B2C), plus their credit and debit notes. If you have received a wave notification or expect one, your integration needs to be built, onboarded and tested before the date ZATCA gives you.

How do ZATCA clearance and reporting work?

ZATCA Phase 2 clearance and reporting flow with Co-Mate's e-invoicing solution layer

Saudi Arabia uses a centralised clearance and reporting model. Your e-invoicing solution talks directly to ZATCA's APIs.

Clearance (standard tax invoices): your solution generates and signs the XML, sends it to the Clearance API, and receives the cleared invoice with ZATCA's stamp. Only then is it shared with the buyer.
Reporting (simplified tax invoices): your solution signs the invoice, prints the QR code, gives it to the customer, and reports it through the Reporting API within 24 hours.

Before going live, each solution unit is onboarded: it obtains a compliance CSID, passes compliance checks with sample documents, then receives a production CSID.

Definition: Clearance model: Invoices are validated and stamped by the tax authority before they are legally issued to the buyer. ZATCA applies this to standard tax invoices.

Definition: CSID: Cryptographic Stamp Identifier: the certificate ZATCA issues to an e-invoice generation solution unit to sign invoices and authenticate API calls.

What are the ZATCA Phase 2 technical requirements?

UBL 2.1 XML following ZATCA's data dictionary, XML implementation standard and business rules.
Cryptographic stamp: an XAdES-style digital signature over the invoice using the key behind your CSID.
Invoice hash and chaining: each invoice includes the hash of the previous invoice (PIH), an invoice counter value (ICV) and a UUID.
QR code: TLV-encoded, Base64, containing seller, VAT, totals, hash, signature and public key data. Mandatory on simplified invoices and included on standard invoices.
Invoice types: standard and simplified tax invoices, credit notes and debit notes, with transaction flags such as third-party, nominal, export or summary where they apply.
Security: private keys stored securely, tamper-resistant counters, and no ability to edit or delete issued invoices.
Archiving of the XML and ZATCA responses for the statutory retention period.

How does Co-Mate integrate your ERP with ZATCA FATOORA?

We add a ZATCA-compliant e-invoicing layer next to your ERP. Users keep their normal billing screens.

Capture: pick up each posted invoice or note from your ERP or POS in real time.
Generate: build the UBL 2.1 XML, calculate the hash, apply PIH and ICV sequencing per EGS unit.
Sign and QR: apply the cryptographic stamp and generate the QR code.
Clear or report: call the Clearance API for standard invoices; report simplified invoices within the 24-hour window, with queues and retries.
Return: store the cleared XML, ZATCA status, warnings and QR back on the ERP document, and print bilingual PDFs.
Operate: dashboards for pending, cleared, reported and rejected documents; CSID renewal reminders.

For businesses with both UAE and Saudi entities, the same connector also feeds a PINT AE module for your UAE ASP.

Which ERPs and billing systems do we support for Saudi Arabia?

SAP Business One
Microsoft Dynamics 365
Oracle NetSuite
Odoo
ERPNext
Zoho Books
Tally
QuickBooks
Xero
Sage
Custom PHP / .NET / Java
POS systems

Don't see yours? If it stores invoices in a database or exposes an API, export or webhook, we can connect it. See all ERP e-invoicing integrations.

Implementation steps

A predictable path from first call to live, monitored e-invoicing.

1
Wave & scope check
Confirm your Phase 2 wave notification, the VAT-registered entities in scope and which invoice types you issue (standard, simplified or both).
2
UBL 2.1 gap analysis
Map ERP data to ZATCA UBL 2.1 fields: seller and buyer IDs, addresses, VAT categories, exemption reason codes, invoice type codes and references.
3
EGS & signing build
Build XML generation, invoice hashing and chaining (PIH, ICV, UUID), XAdES signing, QR generation and the clearance and reporting API calls.
4
Onboarding & compliance checks
Generate CSRs, onboard each EGS unit with an OTP from the FATOORA portal, obtain compliance CSIDs and pass the required compliance invoice checks.
5
Production go-live
Obtain production CSIDs, switch on clearance and reporting, and run hypercare through the first billing cycles with an engineer on call.
6
Monitor & renew
Track cleared, reported and rejected invoices, handle warnings, renew CSIDs before expiry and apply ZATCA specification updates.

Common Saudi Arabia e-invoicing challenges and how we handle them

Challenge	Why it matters	How we handle it
Invoice hash chaining	Each invoice must carry the previous invoice hash (PIH) and a counter (ICV). Gaps or parallel generation break the chain.	A per-EGS sequencing service with locking, so concurrent users and branches never corrupt the chain.
Many POS terminals or branches	Each EGS unit needs its own onboarding and CSID.	Scripted onboarding, certificate inventory and expiry alerts across all units.
Clearance latency or downtime	Standard invoices cannot be shared until cleared.	Queues, timeouts, retries and clear user feedback so billing teams know what is pending.
Buyer data gaps	Standard invoices need buyer VAT numbers, addresses and identifiers.	Validation at invoice creation and master-data clean-up before go-live.
Credit and debit notes	Notes must reference the original invoice and give a reason.	Mapping rules and ERP fields for billing references and reasons, tested in compliance checks.
Arabic data requirements	Some fields and invoice presentation need Arabic text.	Arabic seller and item data captured in the ERP or connector, plus bilingual PDF layouts.

Saudi Arabia e-invoicing FAQ

What is ZATCA Phase 2?

ZATCA Phase 2, the Integration Phase, requires VAT-registered businesses in Saudi Arabia to connect their e-invoicing solutions to ZATCA's FATOORA platform. Standard tax invoices must be cleared by ZATCA before sharing, and simplified tax invoices must be reported to ZATCA within 24 hours.

Do I need to replace my ERP for ZATCA Phase 2?

No, not usually. Your ERP can keep creating invoices while a compliant e-invoicing solution layer generates the UBL 2.1 XML, signs it, creates the QR code and calls ZATCA's APIs. Co-Mate builds that layer around SAP Business One, Dynamics, Odoo, Zoho, Tally and custom systems.

What is the difference between clearance and reporting?

Clearance applies to standard tax invoices (mainly B2B and B2G): the invoice is sent to ZATCA, validated and stamped before it is shared with the buyer. Reporting applies to simplified tax invoices (mainly B2C): the invoice is issued to the customer first and reported to ZATCA within 24 hours.

What is a CSID?

A Cryptographic Stamp Identifier (CSID) is the certificate ZATCA issues to each e-invoice generation solution (EGS) unit. A compliance CSID is used for onboarding checks; a production CSID is used to sign live invoices and authenticate API calls.

When does my business need to comply with Phase 2?

ZATCA rolls out Phase 2 in waves based on taxpayer revenue and notifies selected taxpayers in advance of their integration date. Check your notification and the ZATCA e-invoicing page for the current waves.

What does the QR code on a Saudi e-invoice contain?

The QR code is TLV-encoded and Base64-represented. In Phase 2 it includes the seller name, VAT number, timestamp, invoice total, VAT total, the invoice hash, the digital signature and public key, and for simplified invoices ZATCA's cryptographic stamp signature.

What happens if ZATCA rejects an invoice during clearance?

A rejected standard invoice is not valid and must not be shared with the buyer. Our connector records the error codes against the invoice, alerts your team, and supports correction and resubmission as a new invoice according to ZATCA rules.

Do I need a separate CSID for each branch or POS terminal?

Each EGS unit that generates invoices needs its own onboarding and CSID. Businesses with many POS terminals or branches need an onboarding plan, and we automate it where possible.

Can one solution handle both UAE and Saudi e-invoicing?

Yes, with the right design. We use one canonical invoice layer from your ERP, then a ZATCA module (UBL 2.1, signing, clearance and reporting) and a UAE module (PINT AE via your ASP). See our UAE e-invoicing page.

Official sources

Last reviewed: 19 October 2026

E-invoicing rules, timelines and technical specifications change often. This page summarises the official guidance as we understood it on the review date. Always confirm obligations and dates with the tax authority or your tax adviser before acting. Co-Mate provides integration engineering, not tax or legal advice.