How to Comply with ZATCA Phase 2: Onboarding and Your First Cleared Invoice (2026)

To comply with ZATCA Phase 2, a VAT-registered Saudi taxpayer must onboard a compliant Solution Unit on the ZATCA Phase 2 mandate: generate a CSR, exchange an OTP from the Fatoora portal for a Compliance CSID, pass the four invoice-type compliance checks, promote to a Production CSID, then either clear B2B Standard Tax Invoices in real time or report B2C Simplified Tax Invoices within 24 hours.

Where Phase 2 sits in the global e-invoicing landscape

ZATCA Phase 2 is a Continuous Transaction Controls (CTC) regime in the clearance family — the same category as Italy's SdI, Türkiye's e-Fatura, and India's IRP.

ZATCA Phase 2 is a Continuous Transaction Controls (CTC) regime in the clearance family — the same category as Italy's SdI, Türkiye's e-Fatura, and India's IRP. Invoices flow through a state-operated platform that validates and (for B2B) clears them before they reach the buyer. Mexico's CFDI was the original reference architecture; ZATCA's twist is a hash-chain plus cryptographic stamp at the issuer side, which makes the local invoice the legal original even after clearance.

This matters because anyone moving from a post-audit jurisdiction (UK, US, most of Europe before 2030) is unprepared for the pre-clearance gate: once Phase 2 is live for your wave, an unpassed B2B invoice is legally not an invoice. Build the sequence below before, not during, the integration window.

What you need before you start

Active Saudi VAT registration (15-digit TIN ending in 03). Commercial Registration (CRN) and the exact Arabic legal name as printed on your VAT certificate — character-perfect, including diacritics and spaces.

• Active Saudi VAT registration (15-digit TIN ending in 03).
• Commercial Registration (CRN) and the exact Arabic legal name as printed on your VAT certificate — character-perfect, including diacritics and spaces.
• Access to your ZATCA Fatoora taxpayer portal account with the role permitted to onboard Solution Units.
• An EGS (E-invoice Generation Solution) capable of UBL 2.1 XML with KSA extensions, XAdES B-B signing, TLV QR encoding, hash chaining, and integration with the ZATCA APIs.
• Server clocks NTP-synchronised to UTC with timezone offset preserved in the XML IssueTime element.

Onboarding sequence end to end

What is a Solution Unit, and how many do I need?

ZATCA issues one Compliance and one Production CSID per Solution Unit, not per legal entity or per branch. A Solution Unit is one logical EGS instance; in practice that means one CSID per POS device and one CSID per back-office invoicing tenant.

ZATCA issues one Compliance and one Production CSID per Solution Unit, not per legal entity or per branch. A Solution Unit is one logical EGS instance; in practice that means one CSID per POS device and one CSID per back-office invoicing tenant. Web-based platforms that issue centrally need only one CSID per tenant. Two devices sharing a CSID will collide on the PIH chain and fail clearance.

Step 1 — Generate a Certificate Signing Request (CSR)

Your EGS generates a CSR containing the VAT number, common name, CRN, business category, country code (SA), and the cryptographic public key (ECC P-256 per the ZATCA spec). The CSR also encodes a Solution Unit serial number — keep it stable; it is the identifier ZATCA matches against the certificate at validation.

Step 2 — Request the OTP from the Fatoora portal

Log into Fatoora, navigate to Onboard New Solution Unit / Device, and request a one-time password. The OTP is valid for one hour and binds to a single Solution Unit. Each device or tenant needs its own OTP.

Step 3 — Exchange OTP + CSR for the Compliance CSID

POST OTP and CSR to the ZATCA compliance CSID endpoint. ZATCA returns a Compliance CSID — a short-lived certificate scoped to the sandbox. Persist it; you will use it for steps 4 and 5 only.

Step 4 — Pass the compliance checks

Submit at least one of each invoice type your EGS supports — Standard Tax Invoice, Simplified Tax Invoice, plus credit and debit notes for each — to the compliance endpoint. The platform's UBL 2.1 payload, XAdES signature, TLV QR, and hash chain are all validated. Any rejection blocks the production certificate.

Step 5 — Promote to the Production CSID

Once compliance checks pass, exchange the compliance certificate for a Production CSID via the production CSID API. This is the certificate your live invoices are signed with. The compliance certificate will not work in production; signing with it is the single most common Phase 2 go-live error.

Issuing your first cleared invoice

Issuing your first cleared invoice includes: Create the invoice as normal in your ERP/POS. The EGS renders UBL 2.

1. Create the invoice as normal in your ERP/POS.
2. The EGS renders UBL 2.1 XML with the ZATCA KSA extensions (ProfileID = reporting:1.0 for Simplified, standard:1.0 for Standard).
3. Compute the invoice hash and chain it to the previous invoice's hash (PIH).
4. Apply XAdES B-B signing with the Production CSID after canonicalisation.
5. Embed the Base64-encoded TLV QR (seller name, VAT number, timestamp, total with VAT, VAT amount, plus tags 6–9 for the cryptographic stamp in Phase 2).
6. For Standard Tax Invoices, POST to the ZATCA clearance endpoint and only deliver to the buyer once the cleared response returns. For Simplified Tax Invoices, deliver immediately to the buyer and POST to the reporting endpoint within 24 hours.

Archive and audit

Every cleared or reported invoice must be retained for six years in tamper-resistant storage. ZATCA requires the signed XML, the cleared response (or reporting acknowledgement), the QR, and the PDF/A-3 rendering preserved together.

Every cleared or reported invoice must be retained for six years in tamper-resistant storage. ZATCA requires the signed XML, the cleared response (or reporting acknowledgement), the QR, and the PDF/A-3 rendering preserved together. Cloud object storage with versioning plus object-lock is the standard pattern; on-premise archives must use WORM media.

Where it differs from Phase 1

The Phase 1 (Generation Phase) controls — structured payload, sequential numbering, tamper-resistance, TLV QR on Simplified Tax Invoices — remain in force but become preconditions, not the finish line.

The Phase 1 (Generation Phase) controls — structured payload, sequential numbering, tamper-resistance, TLV QR on Simplified Tax Invoices — remain in force but become preconditions, not the finish line. Phase 2 adds the CSID, the XAdES signature, the hash chain, the cryptographic stamp tags on the QR, and the real-time transport. A full delta is in ZATCA Phase 1 vs Phase 2.

Go-live compliance checklist

Go-live compliance checklist includes: ☐ Production CSID installed; compliance certificate purged from production keystore. ☐ All four invoice/note types tested end-to-end against the sandbox.

• ☐ Production CSID installed; compliance certificate purged from production keystore.
• ☐ All four invoice/note types tested end-to-end against the sandbox.
• ☐ Hash chain initialised; PIH stored alongside every issued invoice.
• ☐ ICV allocated atomically per Solution Unit, no gaps.
• ☐ Arabic seller name matches the VAT certificate byte-for-byte.
• ☐ Server time NTP-synced; IssueTime emitted in ISO-8601 with offset.
• ☐ B2B clearance flow blocks buyer delivery until cleared response received.
• ☐ B2C reporting job runs at least every 60 minutes (24-hour SLA with margin).
• ☐ 6-year archive policy with object-lock or WORM in place.

Common pitfalls (catalogue)

If you hit rejections during compliance checks or in production, the most frequent causes are hash-chain breaks, signing with the compliance certificate in production, time-zone drift, missing Arabic seller name, and CSR fields that do not match the VAT record.

If you hit rejections during compliance checks or in production, the most frequent causes are hash-chain breaks, signing with the compliance certificate in production, time-zone drift, missing Arabic seller name, and CSR fields that do not match the VAT record. The complete catalogue with fixes is in ZATCA Phase 2 common errors and how to fix them.

Key takeaways

Key takeaways includes: Onboarding is one CSR → one OTP → one Compliance CSID → four compliance submissions → one Production CSID, per Solution Unit. B2B Standard Tax Invoices are cleared before delivery; B2C Simplified Tax Invoices are reported within 24 hours of delivery.

• Onboarding is one CSR → one OTP → one Compliance CSID → four compliance submissions → one Production CSID, per Solution Unit.
• B2B Standard Tax Invoices are cleared before delivery; B2C Simplified Tax Invoices are reported within 24 hours of delivery.
• The hash chain, the XAdES signature, and the Arabic seller name are the three artefacts that cause most rejections.
• Six-year tamper-resistant archive of XML + QR + PDF/A-3 is a structural requirement, not a tooling preference.

Authority sources

• ZATCA — E-Invoice specifications (XML Implementation Standard, Security Features Standard)
• ZATCA — E-invoicing Detailed Technical Guidelines (PDF)
• ZATCA — How to prepare for Phase 2
• ZATCA — TLV QR Code Creation guide (PDF)
• ZATCA — Roll-out phases (wave schedule)
• ZATCA Fatoora Developer Community (official forum)

Want the mandate context first?

Read ZATCA Phase 2 explained: scope, thresholds, penalties, timeline for the regulatory background, or jump to the upstream Phase 1 baseline in ZATCA Phase 1 explained.

Read ZATCA Phase 2 explained: scope, thresholds, penalties, timeline for the regulatory background, or jump to the upstream Phase 1 baseline in ZATCA Phase 1 explained.

Ready to issue a cleared invoice today? See how Invoicemonk implements ZATCA Phase 2 end to end.