ZATCA FATOORA Phase 2 e-invoicing for Zoho Books, Saudi Arabia 2026 Guide

Back to all articles

Saudi Arabia's ZATCA FATOORA Phase 2 mandate is now law for every VAT registered Saudi business. If your invoicing isn't generating XML, signing with a CSID and reporting to ZATCA in real time, you are non compliant. This walkthrough shows exactly how Shyphan wires Zoho Books to FATOORA Phase 2, from CSID issuance to TLV QR codes, B2B clearance and B2C reporting.

What is ZATCA FATOORA Phase 2?

ZATCA, the Zakat, Tax and Customs Authority of Saudi Arabia, runs e-invoicing in two phases.

• Phase 1, Generation (December 2021). All VAT registered businesses had to stop using handwritten or unstructured PDF invoices. Invoices became XML or PDF/A-3 with TLV QR codes for Simplified tax invoices.
• Phase 2, Integration (January 2023 onwards, rolled out in waves). Invoices must be transmitted in real time to ZATCA's FATOORA platform using API. Standard tax invoices (B2B) need clearance from FATOORA before they can be issued. Simplified tax invoices (B2C) must be reported within 24 hours. Every invoice carries a cryptographic stamp from a ZATCA issued CSID (Cryptographic Stamp Identifier).

Non compliance is treated by ZATCA the same as VAT evasion. Fines start at SAR 1,000 and scale up. For Saudi finance teams, getting FATOORA Phase 2 right is not optional.

FATOORA Phase 2, the technical pieces Zoho Books has to handle

1. Onboarding to FATOORA. Log in to fatoora.zatca.gov.sa with your VAT credentials and generate a One Time Password (OTP) to activate your taxpayer profile.
2. Compliance CSID. Generate a CSR (Certificate Signing Request) inside Zoho Books and submit it to FATOORA. ZATCA returns a Compliance CSID that lets you test invoice signing.
3. Compliance check. Submit three test invoices (Standard, Simplified, Credit Note) through the Compliance Check API. ZATCA validates the XML schema, the TLV QR code and the cryptographic stamp.
4. Production CSID. Once compliance passes, submit a fresh CSR for Production. ZATCA returns the Production CSID. Zoho Books uses this for live invoices going forward.
5. Clearance and Reporting APIs. Standard tax invoices (B2B) hit the Clearance API and wait for ZATCA's signed response before they can be sent to the buyer. Simplified tax invoices (B2C) hit the Reporting API and just need acknowledgement within 24 hours.

How Shyphan wires Zoho Books to FATOORA Phase 2

Every Zoho Books rollout we ship in Saudi Arabia follows this sequence.

1. Pre-flight (week 1). Verify VAT registration is active on ZATCA. Confirm Commercial Registration (CR) and seller details. Set up FATOORA portal account.
2. Zoho Books base config (week 1 to 2). Chart of accounts in SAR, 15% VAT enabled, zero rated and exempt tax codes, Reverse Charge Mechanism (RCM) for imports, bilingual Arabic and English invoice template with Hijri and Gregorian dates.
3. CSR + Compliance CSID (week 2). Generate CSR inside Zoho Books with the seller's TIN, CR, address and email. Submit OTP to FATOORA. Receive Compliance CSID.
4. Compliance Check sandbox (week 2 to 3). Push test invoices through ZATCA's sandbox. Validate XML, TLV QR, hash and cryptographic stamp. Fix any schema mismatches.
5. Production CSID (week 3). Generate fresh CSR for production. Receive Production CSID. Switch Zoho Books to live mode.
6. Live invoice flow (week 4). First batch of real customer invoices flow through. Standard tax invoices route through the Clearance API. Simplified tax invoices route through the Reporting API. Both archived for 6 years per ZATCA retention.
7. 30 day hyper care. Monitor every invoice's clearance status in Zoho Books. Alert on any rejected invoices. Fix and resubmit.

What goes inside the FATOORA XML invoice

ZATCA's XML schema follows the UBL 2.1 standard with Saudi extensions. Every Zoho Books FATOORA invoice carries:

• Seller details. Name (Arabic and English), VAT registration number, CR number, address.
• Buyer details. Name, VAT registration number (for Standard invoices), address.
• Invoice metadata. Invoice number, issue date, issue time, invoice type code (388 for Standard, 380 for Simplified, 381 for Credit Note, 383 for Debit Note).
• Line items. Description (Arabic primary), quantity, unit price, tax category, tax rate.
• Tax totals. Line totals, VAT amount per rate, grand total in SAR.
• TLV QR code. Tag Length Value encoded QR with seller name, VAT number, invoice timestamp, invoice total, VAT total, hash and signature. For Simplified invoices this is on the printed receipt; for Standard invoices it's embedded in the XML.
• Cryptographic stamp. XAdES-BES signature using the Production CSID.
• Previous invoice hash. Forms an unbreakable chain. ZATCA validates that no invoice has been deleted from the sequence.

Common FATOORA Phase 2 mistakes Shyphan fixes for Saudi clients

• VAT number mismatch between Zoho Books and ZATCA. The seller TIN inside Zoho must match ZATCA's records exactly. One trailing space breaks the signature.
• Arabic field encoding. Some Zoho installations default to UTF-8 BOM, which ZATCA rejects. We strip the BOM at the connector layer.
• Wrong invoice type code. Many SMEs default everything to 388 (Standard). Restaurants, retail and cash POS must use 380 (Simplified). Refunds must use 381 (Credit Note).
• Missing previous invoice hash. The chain must start from the first invoice of the year. Migrations from QuickBooks or Tally often break this. We rebuild the hash chain during migration.
• Clock skew. ZATCA rejects invoices with a timestamp more than 5 minutes off UTC. Zoho Books inherits the server clock, so we ensure NTP sync.
• Self-billing scenarios. Buyers acting as sellers (common for Aramco vendors) need a separate Buyer's CSID. Easy to miss until you go live.

FATOORA Phase 2 pricing, what Shyphan charges for the Zoho Books setup

SAR pricing for a fixed quote ZATCA Phase 2 setup inside Zoho Books.

• Standalone Zoho Books + FATOORA Phase 2 setup for an existing Zoho Books tenant: SAR 14,000 to 25,000.
• Zoho Books from scratch + FATOORA Phase 2 (chart of accounts, opening balances, VAT setup, bilingual invoice, CSID issuance, sandbox to production): SAR 22,000 to 45,000.
• FATOORA Phase 2 + migration from QuickBooks, Tally or Sage: SAR 35,000 to 70,000.
• Enterprise FATOORA + multi entity consolidation with Zoho Books Premium and Zoho Analytics: SAR 70,000 to 150,000.

Every quote is fixed and SOW backed. 30 days of post go live hyper care included.