As Saudi Arabia accelerates its Vision 2030 digital economy initiatives, the Zakat, Tax and Customs Authority (ZATCA) has enforced Phase 2 (the Integration Phase) of E-Invoicing (Fatoora). For business leaders, accountants, and IT directors across the Kingdom, compliance is no longer just about generating a PDF—it requires direct API synchronization with ZATCA’s portal in real-time.
Key Takeaways for Saudi Businesses
- Clearance Mandate for B2B: Standard B2B invoices must be cleared by ZATCA before being issued to the buyer.
- Reporting Mandate for B2C: Simplified B2C tax invoices must be submitted to ZATCA within 24 hours of issuance.
- Cryptographic Digital Stamp: Invoices must contain a unique ECDSA cryptographic signature generated via a Cryptographic Stamp Identifier (CSID).
- UBL 2.1 Standard: Invoices must be structured strictly in Universal Business Language (UBL 2.1) XML format with embedded QR codes.
1. Overview of ZATCA Phase 2 (Integration Phase)
Phase 1 (the Generation Phase), effective since December 2021, required taxpayers to generate and store tax invoices using compliant electronic solutions without editing or deleting records.
Phase 2 (the Integration Phase) elevates regulatory control by requiring taxpayers' billing systems and ERP platforms to integrate directly via RESTful APIs with ZATCA’s centralized Fatoora Portal. Phase 2 rollout is executed in wave-based enforcement criteria tied to revenue thresholds.
Under Phase 2 rules, e-invoices are categorized into two primary technical flows:
- Standard Tax Invoices (B2B / B2G): Real-time Clearance model. The ERP sends XML payload to ZATCA API, receives validation and a cryptographic stamp, and attaches it to the final invoice before delivery.
- Simplified Tax Invoices (B2C): Reporting model. The ERP or POS issues the invoice immediately with a local cryptographic stamp and transmits it to ZATCA within 24 hours.
2. Phase 1 vs. Phase 2: Key Differences
Understanding the technological transition between Phase 1 and Phase 2 is crucial to avoiding non-compliance penalties:
3. Technical Requirements & Cryptographic Signature
To pass ZATCA Phase 2 validation, your ERP software must compile invoices into XML structures compliant with ISO/IEC 19845 (UBL 2.1). Each document requires:
- UUID (Universally Unique Identifier): 128-bit RFC 4122 Version 4 identifier assigned per invoice.
- Previous Invoice Hash (PIH): SHA-256 cryptographic link connecting the current invoice to the preceding document to prevent tampering or insertion of backdated entries.
- Invoice Counter Value (ICV): Sequential integer counter incremented with every single document.
- Cryptographic Digital Stamp: Generated using the public-private keypair obtained during CSID onboarding.
4. 4-Step ZATCA Integration Roadmap
Fujishka streamlines Phase 2 deployment into a structured 4-step execution path:
5. How Fujishka ERP Automates Compliance
Fujishka’s flagship product, Fujishka ERP, provides a turn-key solution built specifically for businesses operating in Saudi Arabia, UAE, and the wider GCC region:
- Native Bilingual Invoicing: Standard dual Arabic/English invoice template engine with automatic VAT calculation (15% KSA / 5% UAE).
- Automated Clearance Queues: Sub-second API clearance engine with built-in retry mechanisms and offline buffer handling.
- Van Sales Mobile Sync: Drivers on sales routes produce compliant thermal receipt QR codes instantly on handheld Bluetooth printers with background cloud sync.
- Tamper-Proof Audit Trail: Complete cryptographic hash chaining securing accounts receivable and general ledger entries.
| Feature / Requirement | Phase 1 (Generation) | Phase 2 (Integration) |
|---|---|---|
| Portal Connection | Not Required (Standalone) | Mandatory API Integration |
| File Standard | PDF / Digital Format | Structured UBL 2.1 XML + PDF/A-3 |
| Security Stamps | Basic QR Code | ECDSA Cryptographic CSID Signature |
| B2B Transaction Flow | Issue directly to buyer | ZATCA Clearance Required First |
| UUID Generation | Optional / Standard ID | Mandatory RFC 4122 Version 4 UUID |
| Hash Chaining | Not Enforced | SHA-256 Previous Invoice Hash Chain |
<Invoice xmlns="urn:oasis:names:specification:ubl:schema:xsd:Invoice-2">
<cbc:ProfileID>reporting:1.0</cbc:ProfileID>
<cbc:ID>INV-2026-00489</cbc:ID>
<cbc:UUID>9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d</cbc:UUID>
<cbc:IssueDate>2026-07-24</cbc:IssueDate>
<cbc:IssueTime>14:30:00</cbc:IssueTime>
<cbc:InvoiceTypeCode name="0100000">388</cbc:InvoiceTypeCode>
<cac:AdditionalDocumentReference>
<cbc:ID>ICV</cbc:ID>
<cbc:UUID>489</cbc:UUID>
</cac:AdditionalDocumentReference>
</Invoice>OTP Onboarding
Generate one-time onboarding password from ZATCA Fatoora portal for each unit/branch.
CSID Certificate
Issue Private Key and request Compliance CSID certificate via automated API handshake.
Compliance Checks
Execute synthetic invoice validation tests across all invoice subtypes (B2B, B2C, Credit Notes).
Production Clearance
Activate Production CSID certificate for live automated clearance and reporting.
Automating ZATCA Phase 2 compliance isn't just a regulatory obligation—it's a massive leap forward in digital transaction speed, fraud prevention, and real-time cash flow visibility for GCC enterprises.
Frequently Asked Questions (FAQ)
