ZATCA E-Invoicing Integration: Phase 2 Fatoora Integration for ERP, POS and Custom Systems

ZATCA e-invoicing integration is the connection of a business's invoicing system, whether an ERP, billing platform, POS or e-commerce store, to the Fatoora platform run by the Zakat, Tax and Customs Authority (ZATCA). Every invoice is then generated in the mandated XML format, cryptographically stamped, and cleared or reported in line with Phase 2 rules.

Amwaj Solutions designs, builds and maintains that integration for custom and enterprise systems across Saudi Arabia, from a single invoicing app to multi-entity ERP estates with many branches and points of sale. This page explains what Phase 2 requires, who must comply and when, and how an integration project runs. Regulatory dates are current as of October 2026.

What is the difference between Phase 1 and Phase 2 of e-invoicing?

According to ZATCA, Phase 1, the Generation Phase, has been enforced since 4 December 2021. It requires resident taxpayers to issue and store invoices, credit notes and debit notes through a compliant electronic solution. A scanned or photographed paper invoice does not count. Phase 2, the Integration Phase, began on 1 January 2023 and is being rolled out in waves. It requires the electronic solution to be integrated with ZATCA's systems and invoices to follow a specific format with additional fields.

Requirement	Phase 1: Generation	Phase 2: Integration
Effective date	4 December 2021	From 1 January 2023, in waves
Who	All resident VAT-registered taxpayers and anyone invoicing on their behalf	Taxpayers in the wave ZATCA notifies them of
Invoice format	Electronic, through a compliant solution; no specific file format	XML based on UBL 2.1, or PDF/A-3 with the XML embedded
Connection to ZATCA	None	API integration with the Fatoora platform
Standard (B2B) tax invoices	Issued and shared directly with the buyer	Cleared by ZATCA before being shared with the buyer
Simplified (B2C) invoices	Issued with a QR code	Issued to the customer, then reported to ZATCA within 24 hours
Security features	No editing or deletion after issue	Cryptographic stamp, invoice hash chain, invoice counter and UUID
Device onboarding	Not required	Each solution unit onboarded through the Fatoora portal to obtain a cryptographic stamp identifier (CSID)

For a broader overview of the rules, see our guide to e-invoicing in Saudi Arabia.

Who must integrate with Fatoora, and by when?

ZATCA selects each wave by VAT-subject revenue and notifies taxpayers at least six months before their integration date. The first wave, from 1 January 2023, covered taxpayers with taxable revenue above SAR 3 billion in 2021. The threshold has fallen steadily since:

Wave	VAT-subject revenue above	Reference years	Integration date
Wave 1	SAR 3 billion	2021	From 1 January 2023
Wave 22	SAR 1 million	2022–2024	By 31 December 2025
Wave 23	SAR 750,000	2022–2024	By 31 March 2026
Wave 24	SAR 375,000	2022–2024	By 30 June 2026
Wave 25	SAR 187,500	2022, 2023, 2024 or 2025	1 February 2027

ZATCA announced Wave 25 on 24 July 2026. It is the first wave to count 2025 revenue, so businesses founded in 2025 can fall within it. If your business is in scope, the practical deadline is earlier than the integration date: development, sandbox testing and onboarding all need to be finished before it.

What is the difference between clearance and reporting?

Clearance: standard tax invoices (B2B and B2G)

Your system generates the invoice and sends it to ZATCA through the API in real time. ZATCA validates it, applies its stamp and returns it. Only the cleared invoice is valid to share with the buyer. Credit and debit notes against standard invoices follow the same flow.

Reporting: simplified tax invoices (B2C)

The invoice is signed with your own cryptographic stamp and handed to the customer at the point of sale, then reported to ZATCA within 24 hours, as set out in ZATCA's simplified e-invoicing guide. This keeps checkout fast for retail, restaurants and e-commerce, but it means your system must queue, retry and monitor submissions reliably.

What makes a Phase 2 invoice technically compliant?

• UBL 2.1 XML with ZATCA's KSA-specific extensions and business rules, including the correct invoice type and transaction codes.
• Cryptographic stamp: an ECDSA signature applied with a private key held by your solution. The key must never be exportable, so key storage is a security design decision, not an afterthought.
• Hash chain and counter: each invoice carries the previous invoice's hash and a sequential invoice counter value, so gaps or reordering are detectable.
• QR code: a TLV-encoded, Base64 QR that in Phase 2 also carries the invoice hash and signature data.
• Archiving: the stamped XML, or a PDF/A-3 with the XML embedded, retained for the required period.

How does CSID onboarding through the Fatoora portal work?

1. Log in to the Fatoora portal and generate a one-time password (OTP) for each e-invoicing solution unit. The OTP expires quickly, so onboarding is scripted in advance.
2. Generate a certificate signing request (CSR) from the unit, carrying your VAT number and unit details.
3. Submit the CSR with the OTP to receive a compliance CSID.
4. Pass ZATCA's compliance checks by submitting sample invoices and notes of every type you will issue.
5. Request the production CSID and switch to production endpoints.
6. Monitor certificate expiry and renew before it lapses, or submissions will fail.

What systems does Amwaj integrate?

• ERP platforms: through native extensions or an integration layer that sits between the ERP and Fatoora. Our article on ZATCA integration for enterprise systems compares the two approaches.
• Custom billing and SaaS platforms: XML generation, signing, QR and API logic built into your codebase, with clean separation so future ZATCA specification updates are contained.
• POS systems: offline-tolerant reporting queues for simplified invoices across branches. See our guide to ZATCA-ready POS systems in Saudi Arabia.
• E-commerce stores: invoice generation tied to order, refund and payment events.

Where your invoicing lives inside a larger platform, this work often sits alongside our ERP and custom software services.

How does a ZATCA integration project run?

1. Scoping and gap analysis: invoice types, volumes, branches, systems and data quality, mapped against Phase 2 fields.
2. Architecture: native versus middleware, the number of solution units, key storage and failure handling.
3. Build: data mapping, XML generation, signing, QR, clearance and reporting APIs, and an audit log.
4. Sandbox testing: every invoice and note scenario validated against ZATCA's sandbox environment.
5. Onboarding: CSIDs issued and compliance checks passed for each unit.
6. Go-live and monitoring: dashboards for rejections, warnings and reporting backlog.
7. Ongoing support: certificate renewals and changes as ZATCA updates its specifications.

What are the most common rejection errors?

• Missing or wrongly formatted buyer VAT numbers on standard invoices.
• Line totals, VAT and rounding that do not reconcile with document totals.
• Broken hash chains or counter gaps, often caused by parallel issuance or data migration.
• Signature failures because a document was changed after hashing, or a compliance CSID was used in production.
• Credit or debit notes that do not reference the original invoice correctly.
• Simplified invoices reported after the 24-hour window.

ZATCA responses separate warnings, where the invoice is accepted, from errors, where it is not. We treat both as monitored events, not log noise.

What are the penalties for non-compliance?

ZATCA's published list of e-invoicing violations, announced on 16 November 2021, sets fines starting at SAR 5,000 for not issuing electronic invoices and SAR 10,000 for deleting or amending them after issue. Missing QR codes on simplified invoices, missing buyer VAT numbers on tax invoices and failing to notify ZATCA of a system malfunction start with a warning. Fines escalate with repeated violations. In Phase 2 there is also an operational cost: a standard invoice that fails clearance cannot be shared with your customer, which delays payment.

Because the stamping key and invoice data are sensitive, we design integrations to the same standard as our cybersecurity and compliance work.

Next step: request a consultation with your systems, invoice volumes and wave notification. We will respond within 24–48 business hours with a scoping plan.