ZATCA Phase 2 requirements come down to one change: your invoicing system has to connect to ZATCA's Fatoora platform, stamp every invoice cryptographically and send it in ZATCA's XML format. For an SME, most of the work is onboarding each invoicing device on the Fatoora portal and passing ZATCA's compliance checks before your integration date. Here's the checklist, step by step.
The short answer
- What Phase 2 requires: a tamper-resistant e-invoicing solution that issues XML invoices with a UUID, a counter that can't be reset, a hash chain linking each invoice to the last, a QR code and a cryptographic stamp, and that connects to ZATCA through its APIs.
- How you get connected: log in to the Fatoora portal, generate a one-time password (OTP) for each e-invoicing unit, let your software request a compliance certificate, pass the compliance checks, then receive a production certificate (CSID).
- What happens after go-live: standard (B2B) tax invoices are cleared by ZATCA before your customer gets them; simplified (B2C) invoices are reported within 24 hours.
- When: ZATCA rolls Phase 2 out in waves and notifies each group at least six months ahead. The current wave, Wave 25, must integrate by 1 February 2027.
What Are the ZATCA Phase 2 Requirements?
Phase 2, the Integration Phase, has applied in waves since 1 January 2023, as ZATCA's roll-out phases page explains. It sits on top of Phase 1: you still issue electronic invoices with all the required fields, but now your system must also meet the technical rules in ZATCA's E-Invoicing Implementation Resolution and integrate with Fatoora. In plain terms, the resolution asks for this:
| Requirement | What it means for you |
|---|---|
| Tamper resistance | The system must prevent and reveal any attempt to alter or delete invoices, notes or logs. |
| UUID and sequence number | Every invoice and note gets a unique ID as well as its sequential invoice number. |
| Invoice counter | A counter that goes up with every invoice and note and can never be reset. |
| Hash chain | Each invoice carries a hash of the previous one, so a deleted or replaced invoice shows up. |
| QR code | Printed on the invoice so anyone can scan it for a basic check. |
| Cryptographic stamp | Simplified invoices are stamped by your system; standard invoices are stamped by ZATCA at clearance. |
| XML and APIs | Invoices go to ZATCA as XML, over an internet connection, using ZATCA's published APIs. |
| Offline archive | You can save and export your invoices without an internet connection. |
The resolution also lists prohibited functions. Your system must not allow anonymous access, default passwords or missing session management. It must not allow editing or deleting issued invoices or logs, inaccurate timestamps or a counter reset, and each unit must run only one invoice sequence at a time. If your software allows any of these, it isn't ready.
The QR code also grows in Phase 2. For simplified invoices, the resolution lists nine fields: seller name, seller VAT number, timestamp, invoice total with VAT, VAT amount, the hash of the XML invoice, the ECDSA signature, the ECDSA public key, and the signature of the stamp issued by ZATCA's certificate authority.
Before You Start: Count Your E-Invoicing Units
ZATCA calls each invoicing device or system an EGS unit (e-invoice generation solution). Each one that signs and sends invoices needs its own certificate, so count them before you touch the portal.
ZATCA's Detailed Technical Guideline gives the rules of thumb. A smart POS device that signs and sends its own invoices needs a CSID on the device. If your tills are simple terminals and a server stamps the invoices before the customer sees them, the CSID sits on the server instead.
Here's how that might look for a made-up business. Confirm your own count with your provider.
| Where invoices are made (hypothetical SME) | Invoice types | Likely CSIDs |
|---|---|---|
| Office PC issuing B2B tax invoices from a cloud system | Standard | Depends on the system: ask your provider |
| Two smart POS tills that sign their own receipts | Simplified | Two, one per till |
| Van salesman's phone app that signs and sends invoices | Standard and simplified | One for the phone |
| Old desktop billing software with no Phase 2 support | Not compliant | None: replace or upgrade it |
Fatoora Onboarding Step by Step
This is the onboarding flow from ZATCA's guideline and the Fatoora portal user manual. Your software does most of it.
Step 1: Log in to the Fatoora portal
Go to fatoora.zatca.gov.sa, or click the Fatoora icon on ZATCA's website, and sign in with your ERAD credentials: your TIN or the email registered with ZATCA, and your password. These are not the same as Developer Portal credentials.
Step 2: Generate OTPs for your units
Choose "Onboard new solution unit/device" and enter how many OTPs you need. You can generate up to 100 in one request. Each OTP is valid for one hour, so have your software open and ready before you generate them. Some solutions can read the OTP automatically when you open the portal from the device itself, but that works for one unit at a time.
Step 3: Enter the OTP and send the CSR
Enter the OTP in your e-invoicing software. The software then sends a certificate signing request (CSR) to ZATCA, with details about your business and the unit (see the table in the next section). In return it receives a compliance CSID, which the unit uses only for the compliance checks.
Step 4: Pass the compliance checks
Your software now submits sample documents for every invoice type it declared. A unit set up for standard invoices sends a standard tax invoice, debit note and credit note; a unit for simplified invoices sends the simplified versions. All checks must pass. If any fail or are left incomplete, ZATCA's guideline says the unit has to start again with a new OTP and CSR.
Step 5: Receive the production CSID
Once the checks pass, ZATCA's certificate authority issues the production CSID and Fatoora sends it to the unit. From now on the unit talks to ZATCA directly through the APIs; you don't log in to the portal to send invoices.
Step 6: Check the list of units
Back in the portal, "View list of solutions and devices" shows every onboarded unit, its CSID status (active, expired or revoked) and the certificate expiry date. Check every unit you counted is there and active.
The CSR Details Your Software Will Ask For
Most of these fill in automatically, but check them before you start:
| Field | What to enter |
|---|---|
| Common name | A name or asset tracking number for the unit |
| Serial number | Solution provider name, model or version and serial number (usually filled by the software) |
| Organization identifier | Your VAT registration number: 15 digits, starting and ending with 3 |
| Organization unit name | Your branch name (for VAT groups, the 10-digit TIN of the member whose unit it is) |
| Organization name | Your taxpayer name |
| Country | SA |
| Invoice type | 1000 for standard only, 0100 for simplified only, 1100 for both |
| Location | Where the unit is mainly used, preferably as a Saudi National Address short address |
| Industry | The business category the unit invoices for |
The invoice type matters later. A unit onboarded as 1000 can't send simplified invoices, and vice versa, so pick 1100 for any device that does both.
Test Before You Go Live
ZATCA offers a Developer Portal with a Compliance and Enablement Toolbox (an SDK that validates XML invoices and QR codes offline) and an integration sandbox for test onboarding and test submissions. There is also a Fatoora simulation portal, described in the same user manual, that mirrors onboarding without touching your live account. If you use a provider, ask whether they've tested your exact setup there.
You don't strictly need software from ZATCA's Solution Providers Directory. ZATCA calls it indicative, and the compliance responsibility stays with you either way.
After Go-Live: Clearance, Reporting and Renewals
- Clearance (B2B): under the Implementation Resolution, ZATCA checks each standard tax invoice and its notes and stamps the ones that pass before you share them with the buyer. The invoice has to clear before the transaction is complete.
- Reporting (B2C): simplified invoices go to the customer immediately and must be reported to ZATCA within 24 hours of being generated.
- XML only: your system submits XML to ZATCA, not PDF/A-3 files.
- Internet outages: the resolution's annex expects invoices to queue while the system stays usable, then report once the connection is back.
- Renewals: renew each CSID before it expires, using "Renewing Existing Cryptographic Stamp Identifier (CSID)" on the portal and a new OTP. ZATCA revokes the old certificate and issues a new one.
- Revocation: revoke a unit's CSID if a device is lost, stolen, sold, compromised or onboarded by mistake. This can't be undone, though the device can be onboarded again.
- VAT group changes: creating or joining a VAT group triggers automatic revocation of members' CSIDs, and the group's representative member has to onboard the units again under the group's VAT number.
Missing your date can lead to fines that rise with each repeat; our Wave 25 guide sets out ZATCA's penalty table.
Your ZATCA Phase 2 Checklist
- Confirm your wave and date from your ZATCA notification and your revenue subject to VAT.
- Check your software against the requirements table above, including the prohibited functions.
- List every EGS unit: office systems, servers, POS tills, van phones and branch systems.
- Agree who does what with your provider: who generates OTPs, who enters them, who handles failed checks.
- Check portal access: make sure someone can log in to Fatoora with your ERAD credentials.
- Prepare the CSR details: VAT number, branch names, National Address and the invoice type for each unit.
- Clean your master data: customer VAT numbers and addresses for B2B invoices, item names and VAT treatment.
- Test in simulation with a tax invoice, a credit note, a debit note and a POS receipt.
- Onboard in production well before your deadline, one batch of units at a time, within the one-hour OTP window.
- Verify the units list in the portal, and note each certificate's expiry date for renewal.
- Train your staff on what to do when ZATCA rejects an invoice or the connection drops.
How Raad ERP Helps
Raad ERP is a cloud ERP for trading, van sales, retail and manufacturing businesses in the GCC. For Saudi Arabia it covers ZATCA Phase 1 and 2, with a QR code on every invoice and receipt and Phase 2 invoices sent to ZATCA automatically in the background. Invoices are made in Arabic and English, in the office, the shop or the van.
Supermarkets and grocery stores can add Raad POS, which prints ZATCA receipts with the QR code and feeds every sale into Raad ERP. When you move over, our team imports your products, customers and opening balances and trains your staff, which is a good moment to clean the data Phase 2 depends on. See Raad ERP for the full feature list.
Frequently Asked Questions
What are the ZATCA Phase 2 requirements?
How do I onboard on the Fatoora portal?
How long is a Fatoora OTP valid?
Do I need a separate CSID for every POS till?
What happens if the compliance checks fail?
What is the difference between clearance and reporting?
Do CSIDs expire?
Do I need software from ZATCA's directory?
Getting Ready for Phase 2? WhatsApp Us
Tell us how many tills, devices and branches you invoice from, and we'll walk you through what Phase 2 onboarding looks like for your setup.
WhatsApp "ZATCA" to +971 56 102 1565 and we'll reply quickly.
Selling in the UAE too? It's a different system. Read UAE E-Invoicing 2027 Made Simple.
This article is general information only and is not legal, tax or professional advice. Regulations, including ZATCA, UAE Ministry of Finance and FTA requirements, change often, and this content may be incomplete, out of date or contain errors. Before you act on it, check with the official authority (ZATCA in Saudi Arabia, or the Ministry of Finance or Federal Tax Authority in the UAE) or a qualified tax adviser. Raad ERP makes no warranties about the accuracy or completeness of this content and accepts no liability for any loss arising from reliance on it. Links to third-party websites are provided for convenience and are not endorsements.