ZATCA Phase 2 e-Invoicing: What Every Saudi Business Needs to Know

What ZATCA Phase 2 requires

ZATCA Phase 2 — the Clearance and Reporting phase of Saudi Arabia's e-invoicing mandate — requires that all tax invoices issued by VAT-registered businesses be submitted to the Fatoorah portal (ZATCA's e-invoicing gateway) in real time or near-real time, in the ZATCA-compliant XML format (UBL 2.1), digitally signed with a ZATCA-issued certificate.

Phase 2 has two modes: Clearance (for B2B standard tax invoices above SAR 1,000) and Reporting (for simplified tax invoices — B2C). Clearance means the invoice must be submitted to Fatoorah and cleared before it can be shared with the customer. Reporting means the invoice is submitted to Fatoorah within 24 hours of issuance.

Businesses were onboarded in waves based on annual turnover. All VAT-registered Saudi businesses are now covered under the mandate regardless of turnover threshold.

The Fatoorah integration architecture

The Fatoorah portal is ZATCA's API gateway for e-invoice submission. Integration requires: a ZATCA-compliant cryptographic stamp (CSID), a production certificate issued by ZATCA after onboarding, and the ability to generate invoices in the required XML format (electronic invoice XML with a QR code, digital signature, and hash chain).

The integration flow for a standard B2B invoice: the business system generates the invoice XML → signs it with the CSID → submits to the Fatoorah clearance API → receives a clearance response (approved or rejected with error codes) → embeds the ZATCA QR code in the final invoice → delivers to the customer.

Rejected invoices must be corrected and resubmitted. ZATCA maintains the complete invoice chain; any tampering with a cleared invoice is detected against the hash.

The ERP system must maintain its own invoice hash chain to match ZATCA's records.

What your ERP system needs to support

To be ZATCA Phase 2 compliant, your accounting or ERP system must support: generation of ZATCA-compliant invoice XML from the sales invoice data, digital signature using the CSID certificate, real-time API connection to the Fatoorah portal, storage of the clearance UUID and timestamp against each invoice, QR code generation and embedding, and handling of ZATCA error codes with resubmission logic.

Systems that are not natively integrated require a middleware layer — a connector that sits between the ERP and Fatoorah, translates the invoice data, handles the signing, and manages the API communication. This middleware adds cost, adds a failure point, and requires its own maintenance and updates when ZATCA changes the API.

Native integration — where the ZATCA compliance layer is built into the ERP rather than bolted on — is the preferred architecture for any business doing more than 50 invoices per month.

Common compliance failures and how to avoid them

The most common ZATCA compliance failures we see in newly onboarded businesses are: invoices submitted without a valid CSID (certificate not renewed after expiry), invoices rejected for XML validation errors (fields missing or in wrong format), hash chain breaks (invoice numbers out of sequence or timestamps incorrect), and late submission of simplified invoices past the 24-hour window.

Avoid them by: setting up certificate expiry monitoring with alerts 30 days before expiry; running ZATCA's compliance check (FATOORAH compliance simulation) before going live; implementing strict invoice numbering that cannot be manually overridden; and automating the simplified invoice reporting queue so it runs without manual intervention.

For businesses with high invoice volume, configure a queue with retry logic for API failures — Fatoorah has occasional outages, and invoices that fail to submit during an outage need automatic retry when the service recovers.

Tafkiro ZATCA integration

Tafkiro's ZATCA compliance module is built into the platform — no middleware, no additional licence, no SI engagement required. When an invoice is posted in the Tafkiro Finance module, the ZATCA XML is generated automatically, signed with the stored CSID, and submitted to Fatoorah. The clearance response is stored against the invoice record, and the QR code is embedded in the invoice PDF.

For Saudi Arabia deployments, Tafkiro handles the full ZATCA onboarding process — CSID generation, ZATCA simulation environment testing, and production onboarding — as part of the standard implementation. Certificate renewal reminders are automated. Hash chain integrity is maintained at the platform level.

For businesses migrating from a non-compliant system, Tafkiro's implementation team manages the transition including CSID transfer, open invoice handling, and Fatoorah onboarding coordination with ZATCA.