The short answer: ZATCA Phase 2 (the Integration Phase) connects your invoicing system to ZATCA's Fatoora platform. Standard tax invoices (B2B) must be cleared by Fatoora before they reach the buyer; simplified tax invoices (B2C) are stamped by your own system and reported within 24 hours. Every invoice is an XML document based on UBL 2.1 carrying a UUID, a hash of the previous invoice, a cryptographic stamp and a QR code. ZATCA brings taxpayers in by waves: Wave 25 covers VAT-taxable revenue above SAR 187,500 and must be integrated by 1 February 2027. Most systems can be integrated in 4–8 weeks; the cleanest architecture triggers clearance or reporting automatically when a sale is posted, so finance never uploads an invoice by hand.
Phase 2 has been rolling out in waves since 1 January 2023. Before you choose how to integrate, it pays to understand exactly what the Fatoora platform checks — and which parts of your current invoicing process will have to change.
What is ZATCA Phase 2?
ZATCA Phase 2, also called the Integration Phase, requires businesses to connect their e-invoicing solution directly to ZATCA's Fatoora platform through APIs. Phase 1 (the Generation Phase, enforced from 4 December 2021) only required invoices to be generated and stored electronically by a compliant solution. Phase 2 adds a prescribed XML format, additional invoice fields and live integration with ZATCA, according to ZATCA's roll-out phases page.
A scanned or photographed paper invoice never counts as an e-invoice, in either phase — the invoice has to be generated in a structured electronic format from the start.
Who must integrate, and when
ZATCA selects taxpayers for Phase 2 in waves based on VAT-taxable revenue, and commits to notifying each wave at least six months before its integration date. The latest announcement, published on 24 July 2026, sets the criteria for Wave 25: taxpayers whose revenue subject to VAT exceeded SAR 187,500 in 2022, 2023, 2024 or 2025 must integrate with Fatoora no later than 1 February 2027.
Two practical consequences:
- Check all four years, not just the last one. A single year above the threshold is enough to bring you into scope.
- Watch your notification channel. ZATCA notifies targeted taxpayers directly; treat that notice as the start of a six-month project clock, not a reminder.
Key requirements
Technical requirements
- XML based on UBL 2.1: ZATCA's XML Implementation Standard builds on UBL 2.1 and EN 16931; invoices are generated as XML, or as PDF/A-3 with the XML embedded, but only the XML is submitted to Fatoora
- UUID: every invoice and note carries a unique identifier generated by your solution
- Invoice counter and previous invoice hash: each document references the hash of the one before it, forming a tamper-evident chain
- Cryptographic stamp: applied by ZATCA at clearance for B2B, and by your own solution (using its CSID) for B2C
- QR code: mandatory on simplified invoices; in Phase 2 it encodes nine fields in base64 TLV format, including the invoice hash and the stamp's signature
- API integration: a compliant solution connects to ZATCA's published clearance and reporting APIs
Business requirements
- Clearance before sharing: B2B invoices, and their credit and debit notes, are only legally valid once Fatoora has cleared them
- Reporting within 24 hours: B2C invoices go to the customer immediately and are reported to Fatoora within 24 hours
- Arabic is mandatory: the human-readable invoice must be in Arabic; English or any other language may be added alongside
- VAT accuracy: the standard rate has been 15% since 1 July 2020, per Deloitte's summary of the increase; zero-rated and exempt lines need the right tax category codes
- Tamper resistance: users must not be able to delete or edit issued invoices, reset the counter or change the system date
The format, field and security rules above are summarised from ZATCA's Detailed Guidelines for E-Invoicing and its Detailed Technical Guideline.
Clearance vs reporting
Phase 2 runs two different flows, and treating them as one is a common source of integration bugs:
| Clearance (B2B) | Reporting (B2C) | |
|---|---|---|
| Applies to | Standard tax invoices and their credit/debit notes | Simplified tax invoices and their notes |
| Who stamps the invoice | ZATCA, during clearance | Your e-invoicing solution, using its CSID |
| When Fatoora sees it | Before the buyer receives it | Within 24 hours of issue |
| What the buyer receives | The cleared XML, or PDF/A-3 with the XML embedded | A printed or electronic invoice with a QR code, immediately |
| If validation fails | The invoice is not valid; fix it and submit a new one | Fix the error and report the corrected invoice |
A rejected document still counts in the chain: ZATCA's technical guideline says every resubmission needs its own new UUID, hash and invoice counter value, and a counter value is never reused. A single validation error rejects the whole document, while a warning lets it through — but ZATCA notes that repeated warnings can be investigated.
Onboarding: from OTP to production CSID
Before your system can clear or report anything, each unit that stamps or submits invoices (for example an ERP server, a smart POS device, or a sales journal with its own invoice sequence) must be onboarded with ZATCA:
- 1.Generate an OTP on the Fatoora portal with your ERAD credentials. OTPs are valid for one hour, and up to 100 can be generated in one request for bulk onboarding.
- 2.Send a certificate signing request (CSR) from the unit, together with the OTP, to receive a Compliance CSID.
- 3.Pass the compliance checks: submit sample standard and simplified invoices and notes, which Fatoora validates.
- 4.Receive the Production CSID, which the unit then uses for live submissions. ZATCA says a CSID is issued once at onboarding and stays valid for multiple years; renewal follows the same OTP flow.
ZATCA's developer portal also provides an offline SDK for validating XML and an integration sandbox for testing API calls before you touch production.
Anti-tampering and the invoice hash chain
Custom and legacy systems usually need the most work here. ZATCA's guidelines require the solution to prevent counter resets, date changes, and the deletion or editing of issued invoices; to restrict functions to logged-in users with the right role; and to protect the private key behind the CSID from export. Corrections happen through credit or debit notes, never by editing the original. If your current system lets an administrator void an invoice and reuse its number, plan to change that workflow — not just the output format.
When a failure stops you from issuing e-invoices, ZATCA expects you to notify it through its failure-notification service and to clear or report every invoice from the downtime in compliant XML once the system is back.
ERP integration options
Odoo ERP
Odoo's standard Saudi localisation includes the Saudi Arabia - E-invoicing module (l10n_sa_edi) for Phase 2 API integration and a simplified-invoice module for Odoo Point of Sale, per Odoo's documentation. Mantiqi delivers ZATCA Phase 2 for Odoo ERP: onboarding each sales journal, mapping tax categories, handling rejections, and extending the flow where your invoicing is customised. It supports both B2B clearance and B2C reporting.
Microsoft Dynamics 365
Dynamics 365 Finance handles Phase 2 through Microsoft's Electronic Invoicing service, using ZATCA submission and compliance-check features that clear tax invoices and report simplified ones, as described in Microsoft's setup guide. For Dynamics 365 users, we configure those features, manage the Compliance and Production CSIDs, and build custom extensions where your posting logic falls outside the standard formats. Pairs cleanly with AI-powered CRM deployments so the quote-to-cash flow lands a cleared invoice from the moment the deal closes.
Custom systems
For businesses with proprietary invoicing systems, we build standalone ZATCA middleware that sits between your system and the Fatoora platform — generating the XML, keeping the hash chain and counter, stamping B2C invoices, and queuing reports — without modifying your core application. This is the right path for retail / e-commerce, construction, and logistics where the invoicing engine is buried inside a vertical-specific ERP. For online stores, our ZATCA e-commerce integration guide covers checkout-specific patterns.
Industry-specific notes
ZATCA applies to every sector but the integration pattern varies:
- Banking & fintech: wire Phase 2 clearance into the payment-success webhook so every chargeable event generates a cleared invoice automatically.
- Retail & e-commerce: both B2B clearance (wholesale, marketplace) and B2C reporting (consumer checkout) flow through the same platform; the QR code lands on the receipt the customer sees, and the 24-hour reporting queue must survive outages.
- Construction & real estate: progress billing, change orders, and subcontractor invoicing each generate Phase 2 invoices — penalty exposure scales with invoice volume, so the integration belongs at the ERP layer, not as a manual upload.
Implementation timeline
A typical ZATCA Phase 2 implementation takes 4–8 weeks depending on your existing system complexity:
- 1.Week 1–2: Assessment, gap analysis against the XML standard, and Fatoora portal access
- 2.Week 3–4: Development of integration components, hash chain and tax-code mapping
- 3.Week 5–6: SDK validation, sandbox testing and compliance checks
- 4.Week 7–8: Production CSID, go-live and monitoring of the first submissions
Penalties for non-compliance
ZATCA's current guideline on e-invoicing violations (2nd edition, May 2024, in Arabic) starts every e-invoicing violation with an alert, and fines apply when it is repeated. Not issuing e-invoices, or deleting or amending them after issue, then costs SAR 5,000 rising to SAR 40,000; failing to integrate by your wave's deadline costs SAR 10,000 rising to SAR 50,000, imposed every 30 days; after the alert, a missing QR code is fined from SAR 1,000. This replaced the scale ZATCA announced in November 2021, which fined some first offences directly. Fines escalate with repetition, so a recurring integration bug is also a recurring compliance risk. Our ZATCA e-invoicing statistics page lists the full scale with its sources.
How Mantiqi can help
Mantiqi's team has developed ZATCA-compliant e-invoicing integrations for Saudi businesses. Our ZATCA e-invoicing service covers the full implementation — from Fatoora onboarding to production deployment and ongoing support — and pairs with our accounting and bookkeeping team when your VAT mapping needs a clean-up first. Reach out via the contact page for a free ZATCA compliance assessment.