Guide · Saudi Arabia

ZATCA Phase 2 e-invoicing integration for your POS and accounting system

Who has to integrate and by when, what clearance and reporting mean, the onboarding steps in plain words, and how a cloud POS or accounting system gets connected.

Who has to integrate, and when

Phase 1, the generation phase, has applied since 4 December 2021. Phase 2, the integration phase, is rolling out in waves. ZATCA picks each wave by VAT-subject revenue and notifies its taxpayers at least six months before the date, by the official email and SMS registered with ZATCA.

Wave 24: VAT-subject revenue above SAR 375,000 in 2022, 2023 or 2024. The deadline was 30 June 2026 and has passed.
Wave 25: VAT-subject revenue above SAR 187,500 in any year from 2022 to 2025. ZATCA has set 1 February 2027 as the integration date.

This guide is for two groups. If you are in Wave 25, you have time to onboard and test before the date. If you are already live and invoices are being rejected, coming back with warnings, or failing on an expired certificate, go to when it goes wrong.

Clearance and reporting

The route an invoice takes depends on its type. ZATCA writes “standard (B2B)” and “simplified (B2C)” in its guidelines, and the legal names are tax invoice and simplified tax invoice. Credit and debit notes follow the invoice type they belong to.

Clearance, for standard tax invoices. You send the invoice to ZATCA before it reaches the buyer. ZATCA checks it, applies its own cryptographic stamp, and returns it with the QR code. The invoice is only valid once it has been cleared.
Reporting, for simplified tax invoices. The customer gets the receipt straight away, and your system reports it to ZATCA within 24 hours of issue. ZATCA does not stamp these, so your system applies the cryptographic stamp and QR code itself.

Documents go to ZATCA as XML. The copy for the customer can be XML, or a PDF/A-3 with the XML embedded.

Onboarding, step by step

Every unit that generates invoices goes through the same steps. ZATCA calls it an EGS unit: a device or a server, with one invoice sequence of its own.

OTP. A person generates a one-time password in the Fatoora portal. It is valid for one hour. There is no API for it, so this step stays manual.
CSR.The unit creates a key pair and sends a certificate signing request. Every field is mandatory: the 15-digit VAT number, the unit's serial number, the branch, and whether it issues standard invoices, simplified invoices or both. A missing field can get the request rejected.
Compliance CSID. ZATCA answers with a compliance certificate that lets the unit run the compliance checks.
Compliance checks. The unit submits test documents: a standard invoice, a debit note and a credit note, or the simplified versions, depending on what it issues. If one fails, onboarding starts again from a new OTP and CSR.
Production CSID. Once the checks pass, ZATCA issues the production certificate. The unit uses it to authenticate to the production APIs. It lasts up to five years, and renewing it revokes the old one.

A business that has just registered for VAT waits two business days before it can onboard a unit and start submitting. Invoices issued to a newly registered business are also rejected until those two business days have passed.

What every document carries

UUID. A unique 128-bit ID the system gives each document, next to the sequential invoice number.
Invoice counter (ICV). A number that goes up by one on every document. ZATCA says a counter value cannot be mentioned on another document.
Previous invoice hash (PIH). Each document carries the SHA-256 hash of the one before it in that unit's sequence. That makes a chain: delete or replace an invoice and it breaks. The first document uses a fixed starting value.
Cryptographic stamp. Your unit applies it to simplified invoices. For standard invoices ZATCA applies its own stamp at clearance.
QR code.Five fields have applied since Phase 1: seller name, VAT number, timestamp, total with VAT and VAT total. Phase 2 adds four more: the XML hash, the signature, the public key and, for simplified invoices, ZATCA's signature over the stamp key.

Where the certificate lives depends on the POS setup. A central server, cloud or on-premises, holds one certificate per invoice sequence. Smart POS devices that sign and send themselves each need their own. For terminals that cannot sign, ZATCA allows the server to stamp the invoice and add the QR code before the receipt is shown, so the terminals need no certificate. Standard invoices still have to be cleared before the transaction is completed.

How a cloud POS or accounting system gets connected

This is how we would connect a cloud POS or accounting system that can send completed sales over an API or webhook. If you use Foodics or Odoo, for example, the first thing to check is whether it can send completed sales, refunds and voids with their full detail. A middleware service then sits between that system and ZATCA:

Get each sale out of the system, by polling its API or through a webhook on completed sales, refunds and voids. The middleware needs every line, the VAT category per line, customer data for standard invoices, and the original invoice reference for refunds.
Decide where the EGS unit lives. In a middleware setup the middleware server is the unit and holds the certificate, with one certificate per invoice sequence.
Onboard the unit with the OTP, CSR, compliance checks and production CSID steps above.
Build and send each document as UBL 2.1 XML to ZATCA’s XML standard, with its UUID, the next counter value and the PIH. For a simplified invoice the middleware stamps it, builds the QR code, returns the QR code to the POS for the receipt, and reports within 24 hours. For a standard invoice it sends for clearance before the invoice goes to the buyer, then returns ZATCA’s stamped XML and QR code to the POS or accounting system.
Store the responses: the submitted XML, ZATCA’s response, any warnings, and the cleared XML. The taxpayer has to keep e-invoices and their data, and repeated warnings get investigated, so the warnings are worth tracking.
Retry and handle outages. Retry on HTTP 429, 500, 503 and 504. On 400, correct the document and send it as a new one. On 401, check the certificate. If an outage stops you meeting your obligations, ZATCA has a failure-notification form.
Send refunds as a credit note that references the original invoice and gives a reason. Negative invoices are rejected.

Connecting does not work for every system. If it is closed to any data access, or so old that connecting it costs more than moving off it, replacing it is the cheaper route. The audit looks at where your invoice data lives and tells you which path costs less over two years, even when the answer is an off-the-shelf compliant system.

When it goes wrong

ZATCA returns one of three outcomes: accepted, accepted with warnings, or rejected. A rejected document is stopped completely. Warnings are accepted for now, but ZATCA says they might become rejections in the future, and it investigates repeated ones.

Live integrations usually break in the same places: VAT totals that round differently from ZATCA's rules, missing buyer data on standard invoices, refunds sent as negative invoices, an expired or wrong certificate, and a PIH that points at the wrong document. Our guide to ZATCA Phase 2 rejection errors and how to fix them lists the codes a POS or accounting integration meets most often, with the usual cause and fix for each.

Common questions

It depends on whether your current system can send completed sales over an API or webhook. If it can, a middleware layer can build the XML, stamp simplified invoices, and send everything to ZATCA while your team keeps working in the software they know. If the system is closed to any data access or no longer supported, replacing it is the alternative.

Phase 1 (since 4 December 2021) required generating and storing invoices electronically, with a QR code on simplified invoices. Phase 2 adds integration: your system connects to ZATCA’s Fatoora platform, standard (B2B) invoices go for clearance before the buyer receives them, and simplified (B2C) invoices are reported within 24 hours. Each document is XML with a UUID, a hash chain and a cryptographic stamp.

ZATCA brings businesses in by waves based on VAT-subject revenue, and notifies each wave at least six months before its date, by the official email and SMS registered with ZATCA. Wave 24 (above SAR 375,000) had until 30 June 2026. Wave 25 covers businesses above SAR 187,500 in any year from 2022 to 2025, and ZATCA has set 1 February 2027 as the integration date.

It depends on whether the invoice data is reachable through a database, an export or an API. If it is, a compliance layer can be built around it. The audit tells you whether integration is feasible or a migration makes more sense.

A standard invoice is only valid once ZATCA has cleared it, so uncleared invoices cause trouble for your customers as well. ZATCA also publishes a list of e-invoicing violations and fines, applied by type of violation and number of repeats. We do not quote amounts here. Ask your accountant or check ZATCA for the current figures.

Do not assume so. ZATCA extended its fines exemption initiative to 31 December 2026, but the 29 June 2026 notice does not mention e-invoicing fines, and it excludes penalties tied to returns due after 30 June 2026. Ask your accountant or ZATCA whether it covers your case.

Read the code in the response first. Our rejection errors guide lists the codes a POS or accounting integration meets most often, with the usual cause and fix for each. A rejected invoice is corrected and sent again as a new document with its own UUID and counter. Warnings are accepted for now, but ZATCA says they might become rejections and repeated ones get investigated.

Sources

The ZATCA facts above come from ZATCA's own publications. Dates and thresholds are as published when we last checked, on 24 October 2026. The middleware steps describe how we would build the connection and are not a ZATCA requirement.

Find out what your system needs before the date.

Start with a 30-minute audit. You leave knowing whether your current system can be integrated, what it would take, and what it would cost, whether or not you hire us.

Book a 30-min automation audit