What does ZATCA Phase 2 integration actually require?

Phase 2 — ZATCA calls it the integration phase — requires five things that Phase 1 did not: invoices generated in XML, an invoicing solution registered on the Fatoora portal, a UUID and a hash chaining each invoice to the one before it, clearance of standard tax invoices with ZATCA before they reach the buyer, and reporting of simplified tax invoices within 24 hours of issue. It also prohibits a list of functions your invoicing software may well have today.

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

The dates are set by wave. Integration began on 1 January 2023 and has rolled out in groups by revenue since; if you are in the current group, see ZATCA Wave 25 for the threshold and the deadline.

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

Phase 1, the generation phase, was about the invoice being electronic. There was no prescribed format: you could issue XML, or PDF/A-3, or anything else electronic, as long as it carried the required fields and was not simply a paper invoice that had been scanned. A UUID was not mandated. A hash was not mandated. Nothing was shared with the Authority.

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

Phase 2 removes all of that latitude. The format is prescribed, the fields are prescribed, the security features are prescribed, and every invoice goes to ZATCA — either before the buyer sees it or within a day of it being issued.

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

It depends on the invoice type, and most businesses issue both.

A standard tax invoice — usually issued to another business or to a government body — must be cleared by ZATCA before it is shared with the buyer, and clearance is a prerequisite for the invoice to be regarded as legal and valid. Your solution sends the XML to Fatoora in real time, ZATCA validates it, and if it passes, ZATCA applies its cryptographic stamp and the QR code and returns the cleared XML to you. You store that cleared invoice and share it with the buyer as XML or PDF/A-3 with the XML embedded. Clearance applies to the associated credit and debit notes too.

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

A simplified tax invoice — usually issued to a consumer — is not cleared in advance. You give the customer the invoice and complete the sale, and your solution uploads the XML to Fatoora within 24 hours of issue. Here the cryptographic stamp is applied by your own solution rather than by ZATCA, and the QR code is mandatory and carries additional information. Fatoora validates the invoice and acknowledges it back through the API.

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

• The XML format ZATCA specifies, with the additional fields required for the integration phase.
• A UUID, generated by the solution and stored inside the XML.
• A hash of the invoice, and the hash of the previous invoice, so that the sequence cannot be reordered.
• A sequential invoice counter that cannot be reset.
• A cryptographic stamp — applied by your solution on simplified invoices, by ZATCA on cleared standard invoices.
• A QR code. On simplified invoices it is mandatory and carries additional information; on standard invoices ZATCA adds it during clearance and you print it on the human-readable copy.
• A human-readable form in Arabic, in addition to any other language. Arabic or Hindi numerals are both accepted.

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

This is the part that catches systems built before the rules, because these are ordinary conveniences in ordinary accounting software. From the integration phase, a compliant solution must not:

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

• Allow anonymous access, or run on a default or factory password that is never changed.
• Allow an issued invoice or note to be modified or deleted — by anyone. Cancelling an invoice means issuing a credit note and a new invoice, not editing the old one.
• Allow its activity logs to be modified or deleted.
• Allow the system date or time to be changed in a way that would put false information on a document.
• Allow the invoice counter to be reset, or more than one invoice sequence to run at a time.
• Allow the cryptographic stamp private key to be exported.

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

1. Log in to the Fatoora portal at fatoora.zatca.gov.sa using your ERAD credentials.
2. Request an OTP for each solution you are onboarding.
3. Enter the OTP into the solution.
4. Check that the solution shows as successfully onboarded.

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

Onboarding is what gives the solution its cryptographic stamp identifier, the credential that links its invoices to it. That is a per-solution step, so a business running more than one invoicing device or branch system onboards each of them.

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

ZATCA publishes the expected behaviour, and it differs by cause. An invoice accepted with warnings — a missing building number in an address, for example — needs no immediate action, but the warning should be investigated and fixed on the next invoice. A rejected invoice must be corrected from the response and resubmitted. If ZATCA’s servers are overloaded, the system should keep resubmitting the same invoice until they respond. If ZATCA’s servers are down, share the invoice you generated and resubmit once the problem is fixed. If your own connection or hardware fails, report the failure to ZATCA, keep trading, and submit once you are back.

Zakat, Tax and Customs Authority, E-Invoicing Detailed Guideline, version 2, May 2023.

Phase 2 can be bought as an add-on: a compliance module bolted onto whatever produces the invoice today. That works on the day it is installed. What an add-on cannot do on its own is stay correct, because the invoice it is stamping is assembled somewhere else — from prices in one system, customers in another and stock in a third — and every one of those is now a compliance surface. The stamping is the easy part. Getting one true version of the invoice to stamp is the work.

Nizamics has ZATCA Phase 2 e-invoicing live in production, including cryptographic stamping, QR codes and reporting to ZATCA’s platform, and builds it into the core of an ERP implementation rather than around it. See how we implement ERP, or integration work generally. If you want to know what your current setup would need, tell us what you run.