ZATCA Phase 2: the complete guide for Saudi merchants

Phase 2 of Saudi e-invoicing — the Integration phase — changed what a point of sale has to be. In Phase 1 your system had toproduce a structured electronic invoice. In Phase 2 it has totalk to the Zakat, Tax and Customs Authority, prove who it is with a cryptographic certificate, and chain every invoice to the one before it.

This guide explains what that means for a shop, without the acronym soup.

The two invoice types, and why the difference matters

Standard tax invoices (B2B). Issued to another registered business. These go to ZATCA forclearance — the authority validates and stamps the invoice, and only then may you give it to your customer. The flow is: generate, submit, wait for clearance, deliver.

Simplified tax invoices (B2C). Issued to a consumer at the counter. These arereported to ZATCA, not cleared — you give the invoice to the customer immediately and report it within 24 hours.

Almost everything a retail shop or restaurant issues is a simplified invoice. That single fact is why offline capability is possible at all: reporting has a 24-hour window, clearance does not.

What the invoice itself must contain

A Phase 2 invoice is an XML document in UBL 2.1 format carrying, among other fields:

• Seller name, VAT registration number and address
• Invoice type, number and aUUID
• Timestamp
• Line items with quantity, unit price, VAT rate and VAT amount
• Totals excluding and including VAT
• Theinvoice hash, and theprevious invoice hash (PIH) — this is what chains invoices together
• Acryptographic stamp produced with the device's own certificate
• AQR code encoding the key fields plus the stamp

The hash chain is the part people underestimate. Each invoice references the hash of the one before it, so the sequence is tamper-evident: you cannot quietly delete invoice number 400 without breaking 401 and everything after it.

The QR code

The QR on a simplified invoice is not a link. It is a Base64-encoded TLV (tag-length-value) structure containing the seller name, the VAT number, the timestamp, the invoice total, the VAT total, and in Phase 2 also the XML hash, the cryptographic stamp and the public key.

Anyone can scan it and verify the invoice. That is the point.

Onboarding: how your device gets a certificate

Your point of sale cannot sign anything until it has been onboarded:

1. The system generates a key pair and a certificate signing request (CSR)
2. You obtain a one-time password (OTP) from the Fatoora portal for that device
3. The system exchanges the CSR and OTP for acompliance CSID
4. It passes ZATCA's compliance checks — sample invoices of each type
5. It receives aproduction CSID, which is the certificate it signs with from then on

This is per device. Six terminals means six onboardings. A good POS does the whole exchange for you and asks only for the OTP; if a vendor tells you their onboarding is a support ticket, ask what happens when you add a terminal on a Thursday.

Clearance and reporting, day to day

For a shop issuing simplified invoices, the daily reality is:

• The invoice is generated, hashed, stamped and printed at the counter — immediately
• It is reported to ZATCA within 24 hours
• ZATCA returns an acceptance, an acceptance with warnings, or a rejection
• Warnings need attention but the invoice stands;rejections mean the invoice was not accepted and must be investigated

A system that hides the difference between accepted, warned and rejected is hiding the only thing you need to know.

What happens when the internet is down

This is the question that decides which POS you should buy.

Because simplified invoices arereported rather thancleared, an invoice can be validly issued while disconnected —provided the device can sign it locally. The certificate lives on the device, so the stamp does not require the network. The reporting happens when connectivity returns.

Wameed signs on the device and continues issuing fully compliant invoices for 24 hours offline, in the native app and in the browser cashier. Systems that submit to a server to obtain the stamp cannot do this; when the line drops, they can queue a sale but not issue a compliant invoice. See ouroffline comparison for how to test this in ten minutes.

When does your wave start?

ZATCA rolls Phase 2 out in waves defined by annual taxable revenue, starting with the largest taxpayers and working down.ZATCA notifies affected taxpayers directly, at least six months before their wave begins.

Do not rely on a blog — including this one — for your date. Check the Fatoora portal and your registered correspondence. What you can do without knowing your date is make sure your system is ready, because readiness is what the six months are for.

Eight things to check before your wave

1. Does your POS produceUBL 2.1 XML, not a PDF?
2. Does it implement thehash chain with a previous-invoice hash?
3. Does it sign with aproduction CSID held on the device?
4. Can it onboard anew terminal without a support ticket?
5. Does the printed QR contain the Phase 2 fields, including the stamp?
6. Does it show youaccepted, warned and rejected invoices separately?
7. Does it keep issuing compliant invoicesoffline?
8. Can it issuecredit and debit notes correctly, referencing the original invoice?

What Wameed does

On-device signing, full UBL 2.1, the hash chain, per-device onboarding you run yourself, a compliance dashboard that separates accepted from warned from rejected, and 24 hours of offline issuance. Details on theZATCA page.

Nothing here is legal or tax advice. Confirm your own obligations with ZATCA or your tax adviser.