Master ZATCA Phase 2 FATOORA integration in Saudi Arabia. Clear B2B invoices via clearance APIs, issue CSIDs, and embed TLV QR codes. Consult Impleway experts.
The digital transformation of the Saudi Arabian tax ecosystem under Saudi Vision 2030 has reached an unprecedented milestone. The Zakat, Tax and Customs Authority (ZATCA) has continuously expanded wave onboarding for Phase 2 (Integration Phase) of the national FATOORA e-invoicing initiative. For enterprises operating in Riyadh, Jeddah, Dammam, and across the Kingdom, Phase 2 is an architectural paradigm shift requiring cryptographic signing, XML data restructuring, and real-time clearance.
While Phase 1 (Generation Phase) merely required generating offline electronic invoices containing a basic 5-tag QR code, Phase 2 enforces tight system-to-system integration between your ERP solution and ZATCA’s central Fatoora portal. Unintegrated systems are legally prohibited from issuing invoices, and severe non-compliance penalties apply under Saudi tax regulations.
ZATCA Phase 2 bifurcates all tax documents into two distinct legal classifications with radically different transmission protocols:
| Document Type | Transaction Type | Transmission Requirement | Legal Clearance Gate |
|---|---|---|---|
| Standard Tax Invoice | B2B (Business-to-Business) & B2G | Real-Time Clearance via ZATCA API | Must be cleared and stamped by ZATCA prior to delivering to buyer |
| Simplified Tax Invoice | B2C (Business-to-Consumer / Retail POS) | Near Real-Time Reporting within 24 hours | Issued immediately to consumer with Phase 2 QR; reported in bulk batches to ZATCA |
Every Phase 2 invoice requires rigorous cryptographic verification to guarantee anti-tamper security:
PDF and HTML invoices are merely visual representations. The legal instrument recognized by Saudi courts and ZATCA is the UBL 2.1 XML document structured according to ZATCA syntax binding rules. Furthermore, the embedded Phase 2 QR code expands from 5 tags to 9 Tag-Length-Value (TLV) encoded attributes, including the digital signature, ECDSA public key, and cryptographic stamp.
When transmitting standard B2B invoices to ZATCA's clearance endpoint, the response returns either a clearance stamp or validation error codes (e.g., BR-KSA-01 for incorrect tax exemption reasons, or BR-KSA-25 for VAT number validation). Impleway’s integration middleware implements automated pre-validation rules, catching errors before dispatch to maintain a 100% clean clearance rate.
Failure to comply with Phase 2 deadlines or issuing un-cleared invoices triggers escalating statutory penalties starting at SAR 10,000 and escalating to significant percentages of unpaid tax liabilities. Impleway’s ZATCA compliance practice has successfully transitioned over 50+ enterprise clients across Saudi Arabia with zero clearance downtime.
Navigating Phase 2 (Integration Phase) of the Zakat, Tax and Customs Authority (ZATCA) FATOORA mandate requires Saudi enterprises to implement a rigorous cryptographic identity onboarding process. Unlike Phase 1, which merely required generating offline QR codes, Phase 2 mandates that every ERP instance, Point-of-Sale (POS) terminal, and electronic cash register obtain an individualized Cryptographic Stamp Identifier (CSID) issued directly by ZATCA's FATOORA portal.
The onboarding lifecycle begins with generating a public/private key pair utilizing the Elliptic Curve Digital Signature Algorithm (ECDSA with the secp256k1 curve) alongside an X.509 Certificate Signing Request (CSR). The solution must submit this CSR to ZATCA's Compliance API using an authorized One-Time Password (OTP) generated from the taxpayer's FATOORA portal. Once the ERP successfully executes sample compliance transactions—proving its capability to sign, hash, and format invoices—ZATCA issues a Production CSID (PCSID). Impleway's certified integration architects automate the entire CSID lifecycle; learn more through our dedicated ZATCA ERP implementation services and Oracle Cloud ZATCA integration frameworks.
Furthermore, when hardware replacement occurs or production certificates approach their validity expiration window, our automated lifecycle agent initiates background certificate renewal using the Renewal CSID endpoint, completely avoiding administrative downtime or invoice clearance locks.
Under ZATCA Phase 2 regulations, all standard B2B tax invoices must be issued in Universal Business Language (UBL 2.1) XML format and cleared in real time by ZATCA before being delivered to the buyer. If an invoice fails any of ZATCA's dozens of automated Schematron business rules (e.g., BR-KSA-01 through BR-KSA-80), the clearance API rejects the payload, legally prohibiting the invoice from being issued.
To guarantee sub-second transaction throughput and 100% clearance rates, enterprise ERP architectures must incorporate an automated pre-validation middleware engine. This engine validates XML syntax against official ZATCA Schematron files, computes SHA-256 invoice hashes, generates digital signatures, and formats Phase 2 TLV (Tag-Length-Value) QR codes before transmission. Any non-critical warning codes returned by ZATCA (e.g., WRN-01 to WRN-15) are logged for administrative review while clearance signatures are stored in the financial ledger.
In high-concurrency environments, our middleware incorporates local in-memory clearance caching and automated fallback retry mechanisms. If ZATCA's external API services experience transient maintenance outages, B2B invoices queue securely with cryptographic timestamps, auto-clearing within sub-seconds the moment connectivity restores without halting warehouse dispatch or commercial trade.
Explore our tailored Dynamics 365 e-invoicing solutions and Odoo ERP ZATCA Phase 2 module. To guarantee flawless ZATCA clearance compliance for your enterprise, speak with our ZATCA integration architects today.
Yes. Impleway provides a lightweight, enterprise-grade ZATCA integration middleware that connects to your existing Oracle, SAP, Microsoft Dynamics, Odoo, or custom ERP without requiring a costly core replacement.
Simplified B2C invoices can be issued to consumers immediately with Phase 2 cryptographic QR codes generated locally. The system caches the invoices in an encrypted queue and reports them to ZATCA once connectivity restores within the 24-hour statutory window.
With Impleway’s pre-built connectors and ZATCA sandbox verification scripts, typical enterprise onboarding is completed within 2 to 3 weeks, including CSID generation and end-to-end UAT.
Production CSIDs issued by ZATCA are valid for a maximum period of five years. However, enterprises must renew certificates immediately if device hardware changes, private keys are compromised, or company VAT registration details update.
If an invoice fails Schematron validation, ZATCA rejects the request and returns specific error codes without issuing a clearance signature. The ERP middleware alerts finance administrators, halts buyer delivery, and prompts correction of the underlying invoice data.