ZATCA Phase 2 integration with Fatoora, step by step

Short answerPhase 2 of Saudi e-invoicing connects your invoicing system to ZATCA's Fatoora platform from your wave's integration date. It takes four steps: log in to the Fatoora portal, choose to onboard a new unit or device, generate an OTP valid for one hour, and enter it in your software, which passes compliance checks and receives a Production CSID.

What is ZATCA Phase 2 integration?

ZATCA (the Zakat, Tax and Customs Authority) introduced e-invoicing in two phases. Phase 1 (Generation) has applied since 4 December 2021 to all taxpayers except non-residents, with no required file format. Phase 2 (Integration) has applied since 1 January 2023, in waves.

In Phase 2 your system connects to Fatoora through an API. XML becomes mandatory for invoices and notes; each invoice gains a UUID, the previous invoice hash and a tamper-resistant counter; and the QR code adds the invoice hash, signature and public key. Customers may get a PDF/A-3 with embedded XML, but ZATCA receives XML only.

When does your business have to integrate with Fatoora?

You need not meet Phase 2 requirements until ZATCA notifies you of your wave's integration date; until then Phase 1 applies, though ZATCA recommends adopting it early. Each wave is set by a VAT-taxable revenue threshold, and ZATCA notifies targeted businesses directly at least six months ahead.

As of 28 September 2026, the latest announcement we found is Wave 25; see our e-invoicing waves guide. Non-residents need not issue e-invoices for supplies taxable in the Kingdom.

Unsure whether a wave covers you? Check ZATCA's notice or call ZATCA on 19993.

What do you need before you start integrating?

Prepare these first: an OTP expires one hour after it is generated.

• VAT status Active or Reactive. If Deregistered or Suspended, you keep view-only access for 90 days and cannot generate OTPs.
• ERAD login: TIN or email registered with ZATCA, plus password (not the Developer Portal login).
• Your provider's confirmation that the software is integration-compliant; see how to choose e-invoicing software.
• A list of every device or system issuing invoices under your VAT number (tills, online store, accounting). Each must be onboarded.
• Certificate request data, including: VAT number (15 digits, starting and ending with 3), organization name, unit or branch, location, industry, invoice types.
• An additional seller ID such as the CR number, mandatory on invoices from the integration phase.

ZATCA's own example: a restaurant integrated only 2 of its 3 cashier devices; it gets a warning, then SAR 10,000 if found again after 30 days.

How do you generate an OTP in the Fatoora portal?

The OTP is six numeric digits. The certificate request fails if the code is not exactly six digits, does not match the VAT number, or has expired; then generate a new one.

Manual entry can onboard or renew several units at once; automatic entry, by opening the portal from inside the software, handles one unit only.

ZATCA's four published steps, with details from its portal and technical manuals:

Fatoora and Fatoora Simulation are independent, separately onboarded environments; testing in Simulation does not replace onboarding in production.

After the OTP: cryptographic stamp IDs (CSIDs) and compliance checks

Once the OTP is entered, the software generates a key pair, sends a Certificate Signing Request (CSR) with every field mandatory, and receives a Compliance CSID. The invoice type field sets what the device issues: 1000 tax invoices only, 0100 simplified only, 1100 both.

It then submits test documents for its type: for 1000, a tax invoice, debit note and credit note; for 0100, a simplified invoice, debit note and credit note. If any test fails, onboarding restarts with a new OTP and CSR.

When the checks pass, the ZATCA certificate authority issues a Production CSID for the clearance and reporting services. Renew it before expiry; on renewal, ZATCA revokes the current CSID first, then issues a new one. The portal shows each expiry date.

From the integration phase, software must block exporting the stamping key and changing the time; earlier bans include deleting issued invoices and resetting the counter.

How are invoices handled after integration: clearance or reporting?

With a Production CSID, each invoice follows one of two paths by type; see our tax invoice vs simplified invoice guide.

Clearance is a prerequisite for a tax invoice to be legal and valid, and, under the integration-phase requirements, input VAT can be claimed only on e-invoices and notes cleared by or reported to ZATCA.

What if the connection fails or some devices aren't connected?

If you cannot report simplified invoices within 24 hours, notify ZATCA through the form on its website and report once reconnected. A tax invoice can be issued within 15 days of the end of the month of supply, but uncleared invoices are not eligible for input VAT deduction, so keep evidence of your clearance attempts, such as API logs.

Each general violation starts with a warning and 30 to 60 days to fix it, except obstructing ZATCA staff, where the grace period is no more than 10 days; fines then rise with each repeat. The integration and sharing violations apply from the mandatory integration date, unless a ZATCA system fault is proven.

Key items from ZATCA's guide (2nd edition, May 2024) are below; the full list is in our e-invoicing fines guide.

A summary of ZATCA's guide, not legal advice; for your case, contact ZATCA on 19993.

How does Xrero handle the integration?

In Xrero, you generate the OTP in your own Fatoora account; the wizard requests the certificates and runs the six compliance checks. Certificates are issued to your business, never to us. A readiness dashboard shows certificate status and every ZATCA answer, with automatic retries.

Our status, exactly: validated on ZATCA's developer sandbox on 18 September 2026 (all six compliance document types accepted; live clearance, reporting and a credit note accepted with zero warnings). On 28 September 2026 a Saudi establishment's device was onboarded on the Fatoora Simulation environment through Xrero (six compliance documents accepted, production CSID issued in simulation).

Our application to be listed in ZATCA's solution-provider directory was submitted on 28 September 2026 and is under review. ZATCA's solution-provider list is indicative: any compliant solution may be used, listed or not.

• The point of sale reports simplified invoices to ZATCA from the till.
• Counters never reset, the transmission log is append-only, and cleared invoices cannot be edited or deleted; corrections are credit or debit notes.

See e-invoicing, pricing or contact us.

Frequently asked questions