Who is in scope
- All VAT-registered taxpayers in Saudi Arabia, and anyone issuing tax invoices on their behalf, for Phase 1.
- Non-resident taxpayers are excluded.
- Phase 2 applies wave by wave, by VAT-subject revenue. ZATCA notifies each taxpayer of its wave at least six months before its integration date. See ZATCA Phase 2 waves and readiness checklist.
VAT in Saudi Arabia is 15%, the standard rate since 1 July 2020.
Phase 1: generation (since 4 December 2021)
- Invoices, credit notes and debit notes must be generated and stored electronically by a compliant solution. Handwritten and invoices typed in a word processor or spreadsheet are not accepted.
- Simplified tax invoices (mainly for consumers) must carry a QR code.
- The system must not allow anonymous access, editing or deleting an invoice after it is issued, or keeping more than one sequence that hides invoices.
- The Phase 1 QR is a Base64 string of five TLV fields: seller name, VAT registration number, invoice date and time, invoice total including VAT, and VAT total.
Phase 2: integration with Fatoora
Phase 2 changes the file and the flow. Invoices are produced as XML in the UBL 2.1 standard with ZATCA’s extensions (a PDF/A-3 with the XML embedded can be shared with the buyer). Each invoice carries a UUID, an invoice counter (ICV), the hash of the previous invoice (PIH) so invoices form an unbroken chain, a cryptographic stamp and an extended QR code.
| Standard tax invoice | Simplified tax invoice | |
|---|---|---|
| Typical buyer | Business or government (B2B, B2G) | Consumer (B2C) |
| Model | Clearance: send to Fatoora first, ZATCA validates and stamps it | Reporting: issue to the customer, then report to Fatoora |
| When | Before the invoice is given to the buyer | Within 24 hours of issue |
| Who stamps | ZATCA, on clearance | Your system, with your ZATCA-issued certificate |
| QR code | Required on the printed or PDF copy | Required, generated by your system |
Credit and debit notes follow the same model as the invoice type they relate to.
Onboarding: getting a CSID
Your invoicing system (ZATCA calls each instance an EGS unit) has to be onboarded before it can clear or report. The steps, done on the Fatoora portal and through the system:
- Generate an OTP on the Fatoora portal for each EGS unit.
- The system creates a key pair and a certificate signing request (CSR) with your VAT number and unit details.
- Submit the CSR with the OTP to receive a compliance CSID (Cryptographic Stamp Identifier).
- Pass ZATCA’s compliance checks by sending sample standard and simplified invoices, credit notes and debit notes.
- Receive the production CSID, after which live invoices are cleared or reported.
- Renew certificates before they expire, and onboard every new branch, POS terminal or server separately.
Worked example: one sale, two flows
An illustration. A Riyadh distributor sells goods for SAR 10,000 plus 15% VAT (SAR 1,500) to a retailer, and the retailer’s shop sells part of it to a walk-in customer for SAR 230 including VAT.
| Distributor → retailer | Retailer → consumer | |
|---|---|---|
| Invoice type | Standard tax invoice | Simplified tax invoice |
| Totals | SAR 10,000 + VAT 1,500 = SAR 11,500 | SAR 200 + VAT 30 = SAR 230 |
| Flow | XML sent to Fatoora → cleared and stamped → shared with retailer | Printed at the till with QR → reported within 24 hours |
| If Fatoora rejects it | Not a valid invoice until fixed and cleared | Fix and report again; the sale is already done |
Check before you choose an e-invoicing system
- Does the vendor have live Phase 2 customers, and has its solution passed ZATCA compliance checks? ZATCA publishes a list of qualified solution providers; ask where the vendor stands.
- How does it handle Fatoora downtime, rejected invoices and resubmission?
- Does it support every EGS unit you run (branches, POS terminals, e-commerce), and certificate renewal?
- Can it produce Arabic invoices with all required fields, plus credit and debit notes linked to the original?
- Where are the XML, hash chain and keys stored, and for how long? See Saudi VAT invoice requirements.
Where WebSoftOS stands
WebSoftOS runs ERPNext for businesses in India and the Gulf. Our ZATCA work today covers the Phase 1 QR (TLV) and invoice hash chaining; Phase 2 clearance with a production CSID is not yet a live, certified feature. If your business is in a Phase 2 wave, talk to us about your timeline before relying on any ERP for clearance.
Frequently asked questions
What is ZATCA Phase 2?
The integration phase of Saudi e-invoicing. Invoicing systems connect to ZATCA’s Fatoora platform: standard (B2B) invoices are cleared before they reach the buyer, and simplified (B2C) invoices are reported within 24 hours.
What is the difference between Phase 1 and Phase 2?
Phase 1 (from 4 December 2021) requires invoices to be generated electronically with a QR code on simplified invoices. Phase 2 (in waves from 1 January 2023) adds UBL 2.1 XML, cryptographic stamps, hash chaining and real-time connection to Fatoora.
What is a CSID?
A Cryptographic Stamp Identifier, the certificate ZATCA issues to each invoicing unit after onboarding. A compliance CSID is used for testing and a production CSID for live invoices.
How fast must simplified invoices be reported?
Within 24 hours of issue.
Does ZATCA e-invoicing apply to non-residents?
No. Non-resident taxpayers are excluded.
Practical, India-specific guides from the team behind WebSoftOS cloud ERP, by Ridhi Technologies, Zirakpur, Punjab.