What Is ZATCA E-Invoicing?
Saudi Arabia's Zakat, Tax and Customs Authority (ZATCA) launched its e-invoicing mandate — known locally as FATOORAH — as part of Saudi Vision 2030's digital transformation agenda. It is one of the most ambitious Continuous Transaction Controls (CTC) systems in the world.
Unlike some European mandates that only require e-reporting, ZATCA mandates real-time clearance: invoices are validated and cryptographically stamped by ZATCA before they can be shared with the buyer.
Dec 4, 2021
Phase 1 Start
Jan 1, 2023
Phase 2 Start
600,000+
Target Taxpayers
Phase 1 vs Phase 2
Phase 1: Generation
- Generate invoices in structured electronic format (XML or PDF/A-3 with embedded XML)
- Include UUID, QR code, and cryptographic hash
- Store invoices locally with tamper-proofing
- No real-time integration required
Phase 2: Integration
- Submit invoices to ZATCA in real time for clearance (B2B) or reporting (B2C)
- ZATCA validates, stamps, and returns the cleared invoice
- API integration mandatory — ERP must connect to FATOORAH
- Cryptographic Stamp Identifier (CSID) required
Phase 2 is rolling out in revenue-based waves. The first wave (January 2023) covered businesses with revenues above SAR 3 billion. By 2026, all VAT-registered taxpayers will be included.
Technical Requirements
Phase 2 integration requires significant technical capabilities:
Compliance CSID (CCSID)
Businesses must onboard with ZATCA to receive a Compliance Cryptographic Stamp Identifier. This involves passing a compliance check with sample invoices.
API Integration
Your ERP or invoicing system must integrate with ZATCA's FATOORAH REST APIs for invoice clearance (B2B standard/simplified) and reporting (B2C).
UBL 2.1 XML Format
Invoices must follow the ZATCA ZATCA-modified UBL 2.1 schema with KSA-specific extensions including seller/buyer TIN, QR code (TLV-encoded), and digital signature.
Cryptographic Requirements
ECDSA (secp256k1) digital signatures, SHA-256 hashing, and X.509 certificates issued by ZATCA's PKI infrastructure.
Network Resilience
Systems must handle offline scenarios: queue invoices locally and submit them once connectivity is restored, within the allowed time window.
Penalties & Enforcement
ZATCA enforces compliance with escalating penalties:
Repeated non-compliance can result in VAT deregistration — effectively preventing a business from operating legally in Saudi Arabia.
How to Integrate with InvoStaq
InvoStaq provides a turnkey ZATCA Phase 2 integration that handles all the complexity:
CSID Onboarding
We manage the entire ZATCA onboarding process, including sample invoice submission and CCSID certification.
ERP Connector
Pre-built connectors for SAP, Oracle, Dynamics 365, and other ERP systems. Your invoices flow automatically to ZATCA.
Clearance & Reporting
Standard invoices (B2B) are cleared in real time. Simplified invoices (B2C) are reported within 24 hours.
Compliance Monitoring
AI-powered dashboard tracks submission status, rejection rates, and upcoming wave deadlines.
Ready for ZATCA Phase 2?
Don't wait for your enforcement wave to arrive. InvoStaq handles CSID onboarding, XML generation, digital signing, and real-time clearance — so you can focus on business.