Saudi Arabia ZATCA Phase 2: ERP Integration & Compliance Guide

Back to all articles

Most ZATCA Phase 2 guides explain what the law requires. This one is for the people who have to make it work: the IT team wiring an ERP to the Fatoora platform and the finance team who will live with the results. It covers the onboarding steps, the cryptography, the integration options, testing and the failure points that cause most rejections.

What Phase 2 actually asks of your ERP

Phase 1 (Generation) only required an electronic invoice with the right fields. Phase 2 (Integration) turns your ERP or POS into a connected E-Invoice Generation Solution (EGS). ZATCA's Detailed Guidelines for E-Invoicing (Version 2, May 2023) set out what that means in practice:

• Invoices and their credit and debit notes are generated as XML, or as PDF/A-3 with the XML embedded.
• The XML follows the Electronic Invoice XML Implementation Standard (dated 19 May 2023), which is built on UBL 2.1 and the EN 16931 semantic model, with KSA rules on top.
• Each EGS unit is onboarded to the Fatoora platform and holds its own Cryptographic Stamp Identifier (CSID).
• The solution must be tamper resistant: no invoice counter reset, no system date changes, no deletion or editing of stored XML, and no export of the private stamping key.

ZATCA treats B2B and B2C documents differently:

Both flows go to Fatoora as XML only, never as PDF/A-3. If your ERP issues both invoice types, you are building two integration paths, not one.

The wave schedule: where things stand in November 2026

Phase 2 has been enforced since 1 January 2023 in waves of taxpayers, selected by VAT-taxable revenue. ZATCA notifies each targeted taxpayer at least six months before its integration date. These are the most recent waves:

Wave 25 was announced on 24 July 2026 and is the only announced wave with a deadline still ahead. At SAR 187,500 it reaches deep into the small business segment, where many companies run entry-level accounting software or a POS that has never talked to an API. If you are in Wave 25 and have not started, three months is a realistic but tight window for a native or middleware integration.

Until your wave starts, Phase 1 rules still apply. ZATCA allows voluntary early adoption of Phase 2.

The technical building blocks your IT team must get right

The E-invoicing Detailed Technical Guidelines and the Security Features Implementation Standards (19 May 2023) define the parts every integration needs.

1. CSR and the two CSIDs

Onboarding starts on the Fatoora portal, where an authorised user generates a one-time password (OTP) for each EGS unit. Each OTP is valid for one hour, and up to 100 can be requested at once. The ERP then generates a key pair, builds a Certificate Signing Request (CSR) with the mandatory fields and receives a Compliance CSID. The unit then submits test documents (an invoice, debit note and credit note for each invoice type it will issue). When these pass, ZATCA issues the Production CSID, which is what authenticates live clearance and reporting calls.

2. Cryptographic stamp

The stamp is an enveloped XAdES signature using ECDSA with SHA-256. The private key must be generated inside the solution and must not be viewable or exportable. CSIDs expire, the Fatoora portal sends renewal reminders, and they can be revoked if a device is lost, sold, compromised or majorly upgraded.

3. Invoice hash and hash chaining

Each document carries the hash of the previous document (field KSA-13). The XML Implementation Standard describes the method: remove the UBL extensions, QR and signature blocks, canonicalise with C14N11, hash with SHA-256 and Base64 encode. For the very first invoice, the previous hash is the Base64 encoded SHA-256 of the character "0". Each EGS unit keeps one single chain.

4. Invoice counter value (ICV)

Every document carries a counter (KSA-16) that contains only digits, increments for every invoice and note, and can never be reset. A counter value is never reused, even for a rejected document.

5. QR code

The QR code is Base64 encoded TLV, up to 700 characters, with nine tags, from seller name and VAT totals to the XML hash, ECDSA signature and public key. For standard invoices, ZATCA returns the QR string at clearance and your ERP only has to render it.

Three integration approaches compared

The right choice depends on your ERP, your volumes and how much of the cryptography you want to own.

ZATCA publishes a Solution Providers Directory listing providers qualified for Phase 1 and Phase 2. It is an indicative list, not an approval or certification, and ZATCA states that a taxpayer meeting the requirements is compliant even if its provider is not listed. Treat it as a starting point for due diligence, not a guarantee.

For platform-specific detail, see our guides to Zoho Books and ZATCA, Odoo accounting for ZATCA and Dynamics 365 in Saudi Arabia.

Testing: sandbox, simulation, then production

ZATCA gives you three environments. Use all of them in order.

1. Developer Portal tools. The Compliance and Enablement Toolbox (SDK) validates XML and QR codes offline or from the command line. A web-based validator and the Integration Sandbox let developers simulate onboarding and submit test invoices using the published API (Swagger) files.
2. Fatoora simulation portal. Reached from the Fatoora portal, it is an independent environment for end-to-end functional testing with its own onboarding, OTPs and API endpoints. Devices onboarded here are not onboarded in production.
3. Fatoora production. Accessed with your ZATCA (ERAD) taxpayer credentials. Onboard each live EGS unit only when simulation tests pass.

Build a test pack from real data covering every document type you issue: credit notes against several invoices, advance payment adjustments, zero-rated and exempt lines. The guidelines list over 100 possible warning and error combinations.

Common failure points and how to handle them

Build your error handling around the Fatoora API responses described in the Detailed Guidelines:

Other common issues:

• Broken hash chains after a rejection. A rejected document stays in the chain. The corrected version is a new document with a new ICV and UUID, and its previous hash points to the last document generated, not the original.
• Treating a rejected invoice as cancellable. Invoices cannot be cancelled. A simplified invoice returned as NOT_REPORTED is invalid and is reversed with a credit note, then reissued.
• Counter gaps when one billing engine also produces out-of-scope documents.
• Credit notes without the original invoice reference, which breaches Article 54 of the VAT Implementing Regulations.
• Weak master data: missing buyer VAT numbers, addresses without the required parts, wrong exemption reason codes.
• Expired CSIDs because nobody owns the renewal reminders.
• Offline sites. Reporting must happen within 24 hours. If connectivity fails for longer, ZATCA expects you to notify it through the dedicated form and again on recovery.

A step-by-step integration plan

1. Confirm your wave and date from your ZATCA notification and check your revenue against the thresholds above.
2. Inventory every invoicing source: ERP, POS terminals, e-commerce, billing portals and any custom system. Each one that issues invoices is an EGS unit.
3. Map document types to clearance or reporting, and list the special cases you issue.
4. Choose the approach (native, middleware or provider) per source.
5. Clean master data: customer VAT numbers, national addresses, item tax categories, exemption codes and Arabic names.
6. Build or configure XML generation, signing, hashing, counters, QR rendering and the PDF/A-3 output.
7. Validate with the SDK and web validator, then run end-to-end tests in the Fatoora simulation portal.
8. Train finance users on rejections, warnings, credit notes and the 24 hour reporting window.
9. Onboard production units with OTPs from the Fatoora portal and run a controlled first day.
10. Monitor warnings, failed submissions and CSID expiry dates weekly after go-live.

For a broader, less technical walkthrough, read our ZATCA Phase 2 implementation guide.

Go-live checklist for IT and finance

• Every EGS unit is onboarded in production with a valid Production CSID, and renewal dates are tracked.
• Private keys are generated in the solution and cannot be exported.
• Counter reset, date changes and XML deletion are blocked for all users.
• Standard invoices are not released to buyers until ZATCA returns the cleared XML.
• Simplified invoices are queued and reported within 24 hours, with alerts for anything pending.
• Rejections create a new document with a new ICV, and the hash chain is verified after each test.
• The human-readable invoice is in Arabic (other languages may be added) and shows the QR code.
• Invoices are archived in XML, named by VAT number, timestamp and invoice reference number.
• A named owner handles 202 warnings, ZATCA notifications and CSID renewals.

Penalties and getting help

When ZATCA announced e-invoicing violations and fines in November 2021, it stated that failing to issue e-invoices starts at a fine of SAR 5,000 and deleting or amending invoices after issue starts at SAR 10,000. Omitting the QR code on simplified invoices, omitting the buyer's VAT number on tax invoices and failing to notify ZATCA of a malfunction start with a warning, with fines rising by violation type and repetition. ZATCA's VAT penalties page lists a maximum fine of SAR 50,000 for violating other VAT provisions, and a repeated violation within three years may be doubled.

Shyphan is a Zoho Premium Partner and the first AI Enabled Zoho Partner in the Middle East and Africa, with an office in Riyadh and 500+ projects delivered. Our team handles Phase 2 integration for ZATCA-compliant ERP software, from master data clean-up to simulation testing and production onboarding. Explore our Phase 2 e-invoicing services in Saudi Arabia or our ZATCA e-invoicing software options.

Sources

• ZATCA Phase 2 implementation guide
• ZATCA Fatoora Phase 2 with Zoho
• Zoho Books for ZATCA in Saudi Arabia
• Odoo accounting and ZATCA compliance
• Phase 2 e-invoicing services in Saudi Arabia
• ZATCA-compliant ERP software
• ZATCA e-invoicing software
• Dynamics 365 partner in Saudi Arabia

Frequently Asked Questions

What is the difference between a Compliance CSID and a Production CSID?

The Compliance CSID is issued after your EGS unit submits a CSR and is used only to pass ZATCA's compliance checks. Once the test documents pass, ZATCA issues a Production CSID, which authenticates live clearance and reporting calls.

Can we use the same ERP we used for Phase 1?

Yes. ZATCA's guidelines allow a Phase 1 solution to be used for Phase 2 once it is updated to meet the Phase 2 requirements, including XML generation, stamping and Fatoora integration.

Do simplified B2C invoices need ZATCA approval before we give them to customers?

No. Simplified invoices are stamped by your own solution, given to the customer immediately and reported to Fatoora within 24 hours of issue.

What happens if a standard invoice is rejected by ZATCA?

You fix the errors and submit it as a new document with its own invoice counter value and hash. The rejected document's hash and counter stay in the chain and are not reused.

Does our solution provider have to be on ZATCA's list?

No. ZATCA's Solution Providers Directory is indicative and is not an approval. ZATCA considers a taxpayer compliant if the requirements are met, even if the provider is not listed.

Who is in Wave 25 and what is the deadline?

Taxpayers whose VAT-taxable revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025. ZATCA will notify them to integrate with Fatoora by no later than 1 February 2027.

Is there a test environment before going live?

Yes. ZATCA's Developer Portal offers an SDK, a web validator and an Integration Sandbox, and the Fatoora simulation portal provides an independent end-to-end test environment.

Related reading

• Shyphan featured in Zoho Partner Times, Q3 2026
• Shyphan recognised as a Q3 2026 Top Zoho Partner in MEA
• How Shyphan became a Zoho Premium Partner in 8 months
• AI agent development
• AI development company in the UAE
• Zoho Premium Partner in the UAE
• Zoho Premium Partner in Saudi Arabia
• AI chatbot development cost in 2026
• 10 Zoho CRM implementation mistakes to avoid