Saudi ZATCA Phase 2 (Fatoora) E-Invoicing Technical Guide
Complete UBL 2.1 XML Schema, CSID Onboarding, ECDSA Cryptographic Stamp, PIH Hash Chaining & Clearance/Reporting Playbook for Saudi Arabia
1. Regulatory Overview & Statutory Basis (KSA ZATCA Phase 2)
Saudi Arabia's Zakat, Tax and Customs Authority (ZATCA) rolled out Electronic Invoicing (Fatoora) in two distinct regulatory stages: Phase 1 (Generation Phase, effective 4 December 2021) prohibited handwritten invoices and mandated digital structured invoices with basic QR codes; Phase 2 (Integration Phase, rolling out in waves since 1 January 2023 based on annual taxable revenue) mandates direct real-time API integration between every taxpayer's E-Invoice Generation Solution (EGS)—such as an ERP, accounting system, or retail POS terminal—and ZATCA's central Fatoora platform.
Under Phase 2, ZATCA distinguishes between two invoice workflows: Standard Tax Invoices (B2B / B2G) and Simplified Tax Invoices (B2C retail POS receipts), along with their respective Credit and Debit Notes. Standard Tax Invoices (B2B) operate under a real-time Clearance model: the ERP generates the unsigned/signed UBL 2.1 XML payload and transmits it to ZATCA's Clearance API BEFORE issuing it to the buyer; ZATCA validates the XML, applies its cryptographic stamp and QR code, and returns the cleared invoice in sub-second latency. Only a ZATCA-cleared B2B invoice is legally valid for buyer VAT input recovery.
Simplified Tax Invoices (B2C POS) operate under a cryptographic Reporting model: the POS terminal signs the invoice locally using its onboarded Cryptographic Stamp Identifier (CSID) private key (secp256k1 ECDSA), prints the 9-tag TLV Base64 QR code immediately for the customer at checkout, and reports the XML payload to ZATCA's Reporting API within 24 hours of issuance.
Who Must Comply (Applicability & Thresholds)
- Waves 1 to 24+ (Rolling Revenue Cohorts): ZATCA notifies VAT-registered resident taxpayers at least 6 months prior to their mandatory Phase 2 integration wave cutoff, having progressed from large enterprises (>SAR 3 billion) down to mid-market and SME taxpayers (>SAR 750,000+ annual VATable revenue).
- B2B & B2G Issuers (Clearance Workflow): Wholesalers, manufacturers, B2B service providers, and contractors issuing Standard Tax Invoices to VAT-registered buyers in Saudi Arabia.
- B2C Retail, F&B & Hospitality Operators (Reporting Workflow): Supermarkets, retail chains, pharmacies, clinics, and e-commerce merchants issuing Simplified Tax Invoices at Point of Sale.
2. What Zakat, Tax and Customs Authority (ZATCA) Requires
- Onboarding every logical EGS unit (each ERP instance or store POS device group) on the Fatoora portal using a 6-digit One-Time Password (OTP) to obtain a Compliance CSID and Production CSID (X.509 certificate).
- Generation of invoices in OASIS UBL 2.1 XML format (or PDF/A-3 with the exact UBL 2.1 XML embedded as an attachment) adhering to ZATCA's KSA-specific Business Rules (`BR-KSA-*`).
- Inclusion of a 128-bit RFC 4122 Universally Unique Identifier (`UUID`), sequential Invoice Counter Value (`ICV`), and SHA-256 Previous Invoice Hash (`PIH`) chaining every invoice to its predecessor.
- Cryptographic signing of the invoice hash using the EGS unit's Elliptic Curve Digital Signature Algorithm (`ECDSA` on curve `secp256k1` with `SHA-256`).
- Real-time API Clearance prior to sharing any B2B Standard Tax Invoice, and API Reporting within 24 hours for any B2C Simplified Tax Invoice.
3. What Compliant Software Must Produce
- ZATCA Phase 2 UBL 2.1 XML and bilingual Arabic/English PDF/A-3a invoices with embedded XML.
- Automated CSR (Certificate Signing Request) generation, OTP onboarding, and Production CSID renewal inside RetailOS, DaftarAcc, and FinanceBPA.
- Tamper-proof sequential `ICV` counter and `PIH` SHA-256 hash chain per EGS unit with local offline queuing for POS terminals.
- 9-tag Tag-Length-Value (TLV) Base64 QR code containing Seller Name, 15-digit VAT TRN (`3...3`), Timestamp, Invoice Total, VAT Total, XML SHA-256 Hash, ECDSA Signature, and Public Key / Stamp.
4. Step-by-Step Onboarding & Audit Workflow
EGS Unit Inventory & CSR Generation
Define your EGS units (ERP legal entities and retail POS registers) in DaftarAcc or RetailOS and generate the `secp256k1` private key and Certificate Signing Request (CSR) with ZATCA-required Subject Alternative Name (SAN) fields.
Fatoora Portal OTP & Compliance CSID
Log into the ZATCA Fatoora portal using your 15-digit VAT Registration Number, generate a 6-digit OTP, and exchange the CSR for a Compliance CSID.
Compliance Sandbox Invoice Checks
Automatically transmit the mandatory test suite (Standard Invoice, Simplified Invoice, Standard Credit/Debit Note, Simplified Credit/Debit Note) to ZATCA's Compliance Check API.
Production CSID Issuance & Hash Chain Initialization
Exchange the validated Compliance CSID for a Production CSID (`PCSID`) and initialize the EGS unit's genesis Previous Invoice Hash (`PIH` = Base64 SHA-256 of `'0'`).
Live B2B Clearance & B2C 24-Hour Reporting
Activate live API Clearance for B2B invoices and background batch/real-time Reporting for B2C POS receipts, monitoring ZATCA `PASS`, `WARNING`, and `ERROR` responses.
5. Required Data Fields & Integration Specifications
| Record / Data Field | Required Format / Standard | Validation & Audit Rule |
|---|---|---|
| UUID & Invoice Counter Value (ICV) | UUID v4 (cbc:UUID) + Monotonic Integer (cac:AdditionalDocumentReference/ICV) | Uniquely identifies every invoice and enforces strict sequential ordering per EGS unit. |
| Previous Invoice Hash (PIH) | Base64-encoded SHA-256 digest of preceding XML invoice | Creates a blockchain-style tamper-evident chain across all invoices issued by an EGS unit. |
| Seller & Buyer 15-Digit KSA VAT Number | 15 digits starting with '3' and ending with '3' (BT-31 / BT-48) | Mandatory alongside National Address (Building No, Street, District, City, 5-digit Postal Code) on B2B invoices. |
| TLV Base64 QR Code (Tags 1–9) | Tag-Length-Value binary array encoded in Base64 (< 700 chars) | Tags 1–5 (Seller, VAT No, Timestamp, Total, VAT) + Tags 6–9 (XML Hash, ECDSA Sig, Public Key, ZATCA Stamp). |
| Credit / Debit Note Billing Reference | Original Invoice Number + Reason for Issuance (KSA-10) | Cleared e-invoices can never be edited or deleted; adjustments must reference the original invoice. |
6. Statutory Deadlines & Cycles
- B2B Standard Tax Invoices (Real-Time Clearance): Must be transmitted to and cleared by ZATCA's Clearance API immediately upon generation—before delivery to the customer.
- B2C Simplified Tax Invoices (24-Hour Reporting): Must be cryptographically signed at checkout and reported to ZATCA's Reporting API within 24 hours of issuance.
- Wave Integration Notice Period: Taxpayers receive a minimum 6-month formal onboarding window from ZATCA's wave announcement date to complete Phase 2 integration.
7. Non-Compliance Penalties & Sanctions
- Issuing Non-Compliant Invoices (SAR 5,000 to SAR 50,000): Progressive fines starting from warning/SAR 5,000 up to SAR 50,000 per violation for issuing invoices without Phase 2 clearance/reporting.
- Deleting or Modifying Cleared E-Invoices (SAR 10,000 to SAR 50,000): Altering an issued invoice rather than issuing a linked Credit/Debit Note (`BR-KSA-56`) carries heavy statutory penalties.
- Denial of Buyer Input VAT Deduction: Corporate buyers in Saudi Arabia cannot claim 15% input VAT credit on a B2B invoice that lacks a valid ZATCA Phase 2 clearance stamp and UUID.
8. Common Gateway / Audit Rejection Reasons & Fixes
Root Cause: Line item VAT or document total rounding differing by SAR 0.01 from ZATCA's EN 16931 / KSA mathematical specification (`round(Net * 0.15, 2)`).
Automated Fix: DaftarAcc and RetailOS implement ZATCA's exact line-level and document-level decimal rounding formulas tested against the official ZATCA Java/CLI SDK.
Root Cause: Submitting a Standard Tax Invoice for clearance where the buyer's 4-digit Building Number, 5-digit Postal Code, District, or City is missing.
Automated Fix: Enforce mandatory Saudi National Address validation on all B2B customer master records prior to sales order confirmation.
Root Cause: Multiple POS registers sharing a single EGS sequence counter without serialized hash locking.
Automated Fix: Onboard each physical or logical POS terminal as its own dedicated EGS unit with an independent local `ICV` and `PIH` chain.
Root Cause: Issuing a zero-rated export (`Z`) or VAT-exempt (`E`) invoice line without populating the exact ZATCA `VATEX-SA-*` statutory code and Arabic/English text.
Automated Fix: Select from pre-mapped `VATEX-SA-*` tax codes in DaftarAcc and RetailOS.
9. How RetailOS & DaftarAcc Automates KSA ZATCA Phase 2 Compliance
RetailOS, DaftarAcc, and FinanceBPA include a native ZATCA Phase 2 (Fatoora) engine supporting CSR generation, OTP onboarding, UBL 2.1 XML signing, and PDF/A-3 embedding.
Validates all invoices locally against ZATCA's EN 16931 and `BR-KSA-*` business rules before API transmission to eliminate rejection loops.
Supports offline-first B2C POS cryptographic signing and 9-tag QR printing in RetailOS with automatic background reporting within the 24-hour statutory window.
Frequently Asked Questions
Everything you need to know about implementation, compliance, and features.
Phase 1 (effective December 2021) required digital structured invoices and a basic 5-tag QR code on B2C receipts without connecting to ZATCA. Phase 2 (the Integration Phase) requires direct API integration with ZATCA's Fatoora portal, UBL 2.1 XML formatting, UUIDs, SHA-256 Previous Invoice Hash (PIH) chaining, ECDSA cryptographic stamps, real-time B2B Clearance, and 24-hour B2C Reporting.