Complete guide to Saudi Arabia ZATCA e-invoicing Phase 2 requirements including cryptographic signing, clearance model, and integration timelines.
Saudi Arabia implemented e-invoicing in two phases under the Zakat, Tax and Customs Authority. Phase 1 launched in December 2021 and required businesses to generate and store structured electronic invoices. Phase 2 launched in January 2023 and introduced real-time integration with ZATCA systems for invoice clearance and reporting.
Phase 2 applies to all businesses with annual revenue exceeding specified thresholds and operates on a clearance model. Taxpayers must obtain cryptographic stamps from ZATCA, sign invoices with private keys, and submit invoices for clearance before issuing to customers. ZATCA validates each invoice and returns a clearance code or rejection message within seconds.
The mandate covers B2B invoices, B2C simplified invoices, credit notes, and debit notes. Businesses must use UBL 2.1 XML format and embed QR codes on all invoices. Non-compliance results in penalties up to 50000 SAR per violation.
Required electronic invoice generation using compliant solutions. Invoices stored locally with QR codes but no real-time ZATCA integration. Applied to all VAT-registered businesses from December 2021.
Requires real-time clearance via ZATCA API. Invoices must be cryptographically signed with ZATCA-issued certificates and submitted before customer delivery. Rollout began January 2023 in waves based on revenue thresholds.
The clearance model requires taxpayers to submit each invoice to ZATCA before issuing to customers. The process follows these steps: generate invoice in UBL XML format, apply cryptographic signature using ZATCA certificate, submit to ZATCA API for validation, receive clearance UUID or rejection, embed clearance UUID in invoice, deliver cleared invoice to customer.
ZATCA validates invoice schema, digital signature, taxpayer status, and tax calculations. Clearance typically completes within 1 to 3 seconds. If rejected, the invoice must be corrected and resubmitted. Issuing an invoice without clearance is a violation subject to penalties.
Simplified invoices for B2C transactions follow a reporting model instead of clearance. They must still be signed and submitted to ZATCA but can be issued immediately. ZATCA validates them asynchronously within 24 hours.
Every invoice must be digitally signed using X.509 certificates issued by ZATCA. Taxpayers generate a Certificate Signing Request through their compliant solution, submit it to ZATCA for approval, and receive a signed certificate valid for cryptographic operations.
The certificate contains the taxpayer TIN, organization identifier, and public key. Invoices are signed using the corresponding private key stored securely within the compliant solution. The signature covers the entire invoice content to prevent tampering.
Certificates have expiry dates and must be renewed periodically. ZATCA validates the certificate chain and signature integrity during invoice clearance. Invalid or expired certificates result in rejection.
Select a ZATCA-approved e-invoicing solution that supports Phase 2 requirements including UBL generation, cryptographic signing, and API integration.
Use your solution to generate a Certificate Signing Request containing your TIN and organization details.
Submit CSR via ZATCA portal or API. ZATCA validates taxpayer status and issues a signed certificate if approved.
Install certificate in your solution and configure ZATCA API endpoints for production environment.
Submit test invoices to ZATCA sandbox environment. Resolve any validation errors before going live.
Switch to production API. Begin submitting real invoices for clearance. Monitor for errors and maintain compliance.