Phase 2 of Saudi e-invoicing is often described with a wall of acronyms: UBL, UUID, PIH, CSID, TLV. Behind them is one simple idea. Every invoice you issue becomes a piece of signed, structured data that ZATCA can check, and for business customers ZATCA checks it before your buyer receives it.
This guide explains each requirement in plain language, so finance and IT can agree on what the system must do.
Phase 1 vs Phase 2 in one minute
- Phase 1 (generation), from 4 December 2021: issue invoices electronically from a compliant system, with a QR code on simplified invoices. No connection to ZATCA.
- Phase 2 (integration), from 1 January 2023, in waves: your system connects to ZATCA's FATOORA platform and sends invoices to it. The current wave, Wave 25, covers businesses with VAT-able revenue above SAR 187,500 and has a deadline of 1 February 2027.
The two flows: clearance and reporting
Phase 2 treats your two kinds of invoice differently.
| Standard tax invoice | Simplified tax invoice | |
|---|---|---|
| Who it's for | Businesses and government (B2B, B2G) | Consumers (B2C) |
| Flow | Clearance | Reporting |
| When ZATCA sees it | Before you share it with the buyer | Within 24 hours after you issue it |
| What comes back | The invoice, stamped by ZATCA | An acknowledgement |
Clearance is the bigger change. A standard invoice is not valid until FATOORA has accepted it, so a connection problem or a rejected field stops you invoicing a business customer. Plan for it.
What every invoice must carry
1. UBL 2.1 XML. The invoice is produced as structured XML in the UBL 2.1 standard, the format ZATCA reads. The XML is the authoritative invoice. A human-readable PDF/A-3 with the XML embedded inside it is also accepted, but the data in the XML is what counts.
2. A UUID. Every invoice gets a universally unique identifier, so it can never be confused with another one.
3. An invoice hash, chained to the previous invoice. Your system calculates a hash (a digital fingerprint) of each invoice and records the hash of the one before it. That chain makes deleted or altered invoices obvious, which is why tampering is easy to detect.
4. An invoice counter. A sequential counter value runs alongside the hash chain, so gaps show.
5. A cryptographic stamp. Each invoice is signed with your system's cryptographic key. It proves which system issued it and that nobody has changed it since.
6. A QR code. Simplified invoices carry a QR code with the seller's details, VAT number, date, totals and the signature data, so a customer or inspector can verify them with a phone.
The CSID: how your system joins FATOORA
Before your system can send anything, it has to be onboarded. Your system generates a request, you approve it in the FATOORA portal, and ZATCA issues a Cryptographic Stamp Identifier (CSID): a certificate tied to that system. There are separate steps for the simulation environment and for production, and each device or system that issues invoices needs its own.
In practice, onboarding is where many projects first discover they have more invoicing systems than they thought, such as a branch POS or an old billing tool.
What your system has to do, end to end
- Create the invoice in your ERP, accounting software or POS.
- Turn it into UBL 2.1 XML with a UUID, counter value and the previous invoice's hash.
- Sign it with the cryptographic stamp and build the QR code.
- For a standard invoice: send it for clearance and wait for ZATCA's stamped version before sharing it.
- For a simplified invoice: issue it, then report it within 24 hours.
- Store everything (invoices, credit notes, debit notes) safely, and handle rejections: read the error, fix the data, resend.
You can build this into your ERP, or let a specialist platform such as Taxilla enInvoice do steps 2 to 6 for any system you run. We compare the options in how to connect your ERP to FATOORA.
Questions we hear most
Does ZATCA approve or certify e-invoicing vendors? ZATCA publishes requirements and a list of solution providers for information, but it does not endorse providers. What matters is that your setup meets the requirements and passes onboarding.
Can we keep sending PDFs? You can give customers a PDF/A-3, but it must embed the compliant XML. A plain PDF is not an e-invoice.
What about credit and debit notes? They follow the same rules as invoices and go through the same flows.
What happens if we get it wrong? ZATCA starts with a warning, then fines rise for repeated violations. See e-invoicing penalties.
The short version
Phase 2 asks your system to produce signed, chained, structured invoices and to exchange them with ZATCA in real time for business customers. The rules are fixed. The work is mapping every system that invoices and choosing how each one connects.
Prestige Saudi Company is an official partner of Taxilla and implements ZATCA-compliant e-invoicing across the Kingdom. See our ZATCA e-invoicing solution or ask us for a review of your systems.
General information, not tax advice. Always check the current requirements with ZATCA.
