Understanding ZATCA E-Invoicing Compliance for Saudi Businesses
What ZATCA Phase 2 actually requires from your invoicing stack — cryptographic stamps, UUIDs, QR codes, Fatoora clearance — and how to get compliant without rebuilding your ERP.
What ZATCA e-invoicing is
ZATCA (the Zakat, Tax and Customs Authority) requires every VAT-registered business in Saudi Arabia to issue invoices electronically in a structured format. The programme rolled out in two waves: Phase 1 (Generation) standardised the invoice itself, while Phase 2 (Integration) connects your billing system directly to ZATCA's Fatoora platform.
In practice, compliance is a software problem, not a paperwork problem. Your invoicing system has to produce a specific XML document, sign it, embed a QR code, and — for Phase 2 — exchange it with Fatoora before the invoice is considered valid.
Phase 2 technical requirements in plain terms
Most vendors describe Phase 2 in regulatory language. Here is what your engineering team actually has to implement:
- UBL 2.1 XML invoice generation with the ZATCA-defined field set
- Cryptographic stamp using an onboarded CSID (cryptographic stamp identity)
- Invoice hash chaining, so each invoice references the previous one
- Base64 TLV QR code printed on the human-readable invoice
- Clearance for B2B (standard) invoices and reporting for B2C (simplified) invoices
- Retry, queue and audit logic so a Fatoora outage never blocks your sales floor
Standard vs simplified invoices
Standard (B2B) invoices must be cleared by ZATCA before you send them to the buyer — clearance is synchronous and the returned, stamped document is the legal invoice. Simplified (B2C) invoices are issued to the customer immediately and reported to ZATCA within 24 hours.
This distinction drives your architecture. Retail and F&B systems need an offline-tolerant queue with 24-hour reporting; B2B billing needs a synchronous clearance step with clear user feedback when ZATCA rejects a document.
Common compliance failures we see
Teams rarely fail on the XML itself. They fail on the operational edges:
- No hash chain persistence, so a database restore breaks invoice continuity
- CSID certificates expiring without monitoring or renewal automation
- Credit and debit notes missing their reference to the original invoice
- Rounding and VAT-per-line calculations that do not match ZATCA validation rules
- No audit trail of the exact payload submitted, making disputes unwinnable
How to get compliant without rebuilding everything
You usually do not need to replace your ERP. The pragmatic route is a compliance layer: a service that receives invoice data from your existing system, generates and signs the ZATCA document, handles clearance or reporting, and stores the signed artefacts for audit.
That layer can sit alongside a custom ERP, an off-the-shelf accounting package, or a POS. It isolates regulatory change — when ZATCA updates a schema, you update one service instead of your whole finance stack.
Where EzTechify fits
We build ZATCA-compliant invoicing into custom ERP, accounting and POS systems for businesses in Riyadh, Jeddah and Dammam, and we ship EzInvoice as a ready-made ZATCA-ready invoicing platform. If you already have a system, we can add the compliance layer and the Fatoora onboarding around it.