ZATCA Phase 2 explained, without the jargon

Phase 2 — ZATCA calls it the integration phase — is where Saudi e-invoicing stops being about the shape of a document and starts being about a connection to ZATCA.

The four things Phase 2 adds

1. The invoice becomes XML

Not a PDF, not a spreadsheet row. A UBL 2.1 XML document with a defined set of fields. A human-readable PDF may still be printed for the customer, but the XML is the invoice as far as ZATCA is concerned.

2. Every invoice is chained to the one before it

Each invoice carries an invoice counter value and the hash of the previous invoice. That makes the sequence tamper-evident: you cannot quietly delete invoice 41 out of the middle, because 42 carries 41’s fingerprint. It also means the chain is a real thing your system must maintain — restoring an old backup over a newer one breaks it, and that is a genuine operational risk, not a theoretical one.

3. The invoice is cryptographically stamped

During onboarding, your device generates a key pair and receives a certificate from ZATCA. Every invoice is then stamped with it. The stamp is what proves the document came from a registered device rather than from a text editor.

4. The invoice reaches ZATCA — but how depends on its type

This is the part worth being precise about:

	Simplified (B2C)	Standard (B2B)
Who it is for	Consumers	VAT-registered buyers
Buyer VAT number	Not required	Required
ZATCA involvement	Reporting — within 24 hours	Clearance — before hand-over
Works offline	Yes, at issue	No
QR code	Required	Required

A simplified invoice is given to the customer immediately and reported afterwards. A standard invoice is not valid until ZATCA has cleared it. If someone tells you their software issues cleared B2B invoices offline, they are describing something that cannot exist.

The QR code

Both types carry a QR code encoding a TLV (tag-length-value) structure, Base64 encoded. It carries the seller’s name, VAT registration number, the invoice timestamp, the total including VAT and the VAT amount. Standard invoices additionally carry the stamp and public key inside the code. An inspector scans it and reads those fields directly — which is why a QR code generated from the wrong total is a worse problem than no QR code at all.

Onboarding, in five steps

The procedure is short and the failure modes are boring, which is the good kind of procedure. See the Fatoora portal walkthrough for the screens, and the steps listed at the top of this page for the shape of it.

What usually goes wrong

• The OTP expires. It is short-lived deliberately. Generate it when you are already sitting in front of the billing software, not ten minutes before.
• A VAT number is malformed. Fifteen digits, starting and ending with 3. Most rejections trace back to this or to the buyer’s number on a standard invoice.
• Totals do not reconcile. The invoice total must equal the sum of the lines plus tax, to the halala. Rounding applied per line and again at the total is the usual culprit.
• A restored backup breaks the chain. Treat the invoice database as the book of record, not as something to overwrite from an older copy.

Doing it without paying for it

Compliance is a legal obligation, and charging a monthly subscription for the ability to obey the law is a business model we decided against. Fatoza includes Phase 2 on every plan, including the free one.

One correction to something you will read elsewhere: ZATCA does not certify or approve accounting software. It publishes a compliance SDK and an onboarding process a solution must pass. When a vendor advertises itself as “ZATCA certified”, it is describing a certification that does not exist.