ZATCA Phase 2 e-invoicing checklist

Phase 1 and Phase 2 in one minute

Phase 1 (Generation) started on 4 December 2021. Every VAT-registered business must issue invoices from compliant software, with a QR code on simplified (B2C) invoices, and must not issue handwritten or editable invoices.

Phase 2 (Integration) started on 1 January 2023 and is rolled out in waves. ZATCA tells each business its wave in advance; from that date your software must connect to the Fatoora platform.

Standard tax invoices (business to business) must be cleared by ZATCA before you share them with the buyer. Simplified tax invoices (business to consumer) are given to the customer at once and reported to ZATCA within 24 hours.

1. Before your wave date

• Find your wave notice from ZATCA (email or the ZATCA portal) and write down the go-live date.
• Check your VAT registration number (15 digits, starting and ending with 3) and your commercial registration (CR) details are correct.
• Confirm your invoicing software supports Phase 2: XML in UBL 2.1, cryptographic stamp, invoice hash chain and connection to Fatoora.
• List every place that issues invoices: each branch, POS counter, laptop and mobile app. Each one is a separate e-invoicing unit (EGS).
• Make sure your store address in the software is your full Saudi national address (building number, street, district, city, postal code).

2. Onboarding each device

• Log in to the Fatoora portal with your ZATCA account and generate a one-time password (OTP) for each unit.
• Enter the OTP in your software so it can create a signing request (CSR) and receive its compliance certificate (CSID).
• Let the software pass ZATCA's compliance checks (sample standard and simplified invoices, credit and debit notes).
• Receive the production certificate and check the unit shows as active on the Fatoora portal.

3. What every invoice must carry

• Seller name, address and VAT number; for standard invoices, the buyer's name, address and VAT number too.
• Invoice number, issue date and time, a unique ID (UUID) and the hash of the previous invoice.
• Each line's quantity, unit price, VAT rate and VAT amount, and the totals with and without VAT.
• A QR code with the seller name, VAT number, time stamp, total, VAT total and, in Phase 2, the invoice hash and digital signature.
• Arabic text. You may add English, but the Arabic must be there.

4. Day-to-day after go-live

• Clear standard (B2B) invoices with ZATCA before you send or print them for the buyer.
• Report simplified (B2C) invoices within 24 hours, and watch for any that failed to send when the internet was down.
• Never edit or delete an issued invoice. Correct it with a credit or debit note that refers to the original invoice.
• Read rejected invoices and warnings from ZATCA, fix the cause (often a missing buyer VAT number or address) and send again.
• Keep your invoices and their XML for the period the VAT law requires, and back them up.

5. When something changes

• New branch or new POS counter: onboard it as a new unit before it issues its first invoice.
• Replaced or reset device: onboard it again; certificates do not move between devices.
• Changed name, address or VAT details: update ZATCA first, then your software.
• Certificate close to expiry: renew it in your software before it lapses.