100% ZATCA Compliant - Phase 1 & Phase 2

The #1 ZATCA E-Invoicing Software for Saudi Arabia

Don't just read about compliance—automate it. Qeemah handles XML generation, cryptographic stamping, and Fatoora portal integration automatically. Plus: Get paid 68% faster with automated WhatsApp payment reminders →

Start Free Trial See Technical Specs ↓
100%
Integration Success Rate
<2s
Average Submission Time
Zero
Invoice Rejections
24/7
Arabic Technical Support

ZATCA E-Invoicing Requirements

Official technical requirements from the Zakat, Tax and Customs Authority

1. Required XML Structure

Invoices must be in UBL 2.1 (Universal Business Language) format [7] and contain the following elements: 

<Invoice xmlns="urn:oasis:names:specification:ubl:schema:xsd:Invoice-2">
  <cbc:ID>INV-2025-001</cbc:ID>
  <cbc:IssueDate>2025-01-15</cbc:IssueDate>
  <cbc:IssueTime>14:30:00</cbc:IssueTime>
  
  <!-- Seller Information -->
  <cac:AccountingSupplierParty>
    <cac:Party>
      <cac:PartyTaxScheme>
        <cbc:CompanyID>310122393500003</cbc:CompanyID>
        <cac:TaxScheme>
          <cbc:ID>VAT</cbc:ID>
        </cac:TaxScheme>
      </cac:PartyTaxScheme>
    </cac:Party>
  </cac:AccountingSupplierParty>
  
  <!-- Customer Information -->
  <cac:AccountingCustomerParty>...</cac:AccountingCustomerParty>
  
  <!-- Invoice Lines -->
  <cac:InvoiceLine>...</cac:InvoiceLine>
</Invoice>

Critical Warning

Any error in XML structure will result in immediate invoice rejection. Qeemah automatically validates the format before submission.

2. Mandatory QR Code (TLV Format)

QR code uses TLV (Tag-Length-Value) structure, Base64 encoded (max 700 characters) [5] :

Phase 1 - Basic Tags (All Invoices):

  • Tag 1: Seller Name
  • Tag 2: VAT Registration Number
  • Tag 3: Timestamp (ISO format: 2025-01-15T14:30:00Z)
  • Tag 4: Invoice Total with VAT
  • Tag 5: VAT Total Amount

Phase 2 - Cryptographic Tags (B2B & B2C):

  • Tag 6: Invoice Hash (SHA-256 of XML)
  • Tag 7: ECDSA Digital Signature
  • Tag 8: ECDSA Public Key (secp256k1)
  • Tag 9: Certificate Authority Signature

💡 Pro Tip: Qeemah automatically generates all 9 QR tags in TLV format with proper Base64 encoding. Zero manual work required. For a technical deep-dive, read our complete ZATCA QR Code & TLV Encoding guide.

3. Digital Signature & Integration (Phase 2)

In Phase 2, your system must integrate with the Fatoora platform:

1

Obtain Cryptographic Stamp Certificate

Digital certificate from ZATCA to sign invoices electronically

2

Submit Invoice to Platform (Clearance/Reporting)

B2B Invoices: Clearance (requires approval before issuance) [1]
B2C Invoices: Reporting (submit within 24 hours) [1]

3

Receive Unique Invoice ID (UUID)

ZATCA returns a unique identifier after accepting the invoice

✅ Qeemah handles all of this automatically: Integration, signing, and submission without manual intervention.

Read our full guide on ZATCA Phase 2 Integration →

4. Onboarding Process (Phase 2)

Before going live, you must complete ZATCA's onboarding process:

Step 1: Generate OTP (One-Time Password)

  • • Valid for 1 hour [4]
  • • Maximum 100 OTPs per request [8]
  • • Obtained from ZATCA portal

Step 2: Create Certificate Signing Request (CSR)

Must include 11 mandatory fields:

  • • Common Name (CN)
  • • Serial Number (EGS device serial)
  • • Organization Identifier (VAT number)
  • • Organization Unit Name
  • • Organization Name
  • • Country Code (SA)
  • • Invoice Type (TSXY format)
  • • Location (address)
  • • Industry (business category)

Step 3: Compliance Checks (Testing)

Submit 3 test documents for validation:

  • ✓ Standard Invoice (B2B)
  • ✓ Credit Note
  • ✓ Debit Note

Get Compliance CSID for testing

Step 4: Production Certificate

After passing compliance checks, receive Production CSID (valid for 365 days) [8]

🚀 Qeemah manages your entire onboarding: OTP handling, CSR generation, compliance testing, and certificate renewal.

5. Business Rules (BR-KSA) & Validation

ZATCA validates invoices using a 3-tier validation pyramid:

🔺

Priority 1: KSA Rules (BR-KSA)

🔸

Priority 2: EN 16931 (European Standard)

◾

Priority 3: UBL 2.1 Specifications

Decimal Precision Rules

  • • Amounts: 2 decimal places
  • • Unit Prices: Unlimited decimals
  • • Quantities: Unlimited decimals

VAT Categories

  • • S: Standard (15%)
  • • Z: Zero-rated (0%)
  • • E: Exempt
  • • O: Not subject to VAT

Validation Outcomes

❌

Invalid: Invoice rejected with errors (must fix and resubmit)

⚠️

Accepted with Warnings: Invoice accepted but has non-critical issues

✅

Valid/Compliant: Invoice fully compliant (no errors or warnings)

📋 Critical: Invoice chaining via Previous Invoice Hash (PIH) - even rejected invoices are tracked in the sequence.

Top 10 Errors That Cause Invoice Rejection

Common BR-KSA validation errors and how to fix them

View all 15 common ZATCA errors with detailed solutions →
❌

1. Invalid or Expired VAT Number

Error: "Invalid VAT Registration Number" or "310122393500003 is not registered"

✅ Solution: Verify VAT number validity directly from ZATCA website: zatca.gov.sa

❌

2. Incomplete QR Code (Phase 2)

Error: "Missing cryptographic tags in QR code" (BR-KSA-51)

API Response: 400 Bad Request | Error Code: MISSING_QR_TAGS_6_9

✅ Solution: Phase 2 requires all 9 tags (including Tags 6-9: Invoice Hash, ECDSA Signature, Public Key, CA Signature) in TLV format.

❌

3. VAT Calculation Error (BR-KSA-DEC-02)

Error: "VAT amount precision error" or "TaxAmount calculation mismatch"

API Response: 400 Bad Request | Error Code: VAT_CALCULATION_ERROR

✅ Solution: Amounts must have exactly 2 decimal places. Formula: TaxAmount = ROUND(TaxableAmount × 0.15, 2)

❌

4. Invalid Date/Time Format (BR-KSA-05)

Error: "Invalid IssueDate or IssueTime format"

API Response: 400 Bad Request | Error Code: INVALID_DATETIME_FORMAT

✅ Solution: Date: YYYY-MM-DD | Time: HH:MM:SS or HH:MM:SSZ (UTC)

❌

5. Missing Customer Data (B2B Invoices)

Error: "Customer VAT Number is required for B2B invoices"

✅ Solution: For B2B invoices, customer VAT number is mandatory.

❌

6. Expired CSID Certificate (BR-KSA-CERT-01)

Error: "Cryptographic Stamp Identifier (CSID) expired"

API Response: 401 Unauthorized | Error Code: EXPIRED_CERTIFICATE

✅ Solution: Renew CSID before 365-day expiry. Qeemah auto-renews 30 days before expiration.

❌

7. Duplicate Invoice Number (BR-KSA-45)

Error: "Invoice ID already submitted"

API Response: 400 Bad Request | Error Code: DUPLICATE_INVOICE_ID

✅ Solution: Each invoice ID must be unique per company. Use sequential numbering (INV-2025-0001, INV-2025-0002...).

❌

8. Invalid Previous Invoice Hash (BR-KSA-PIH-01)

Error: "Previous Invoice Hash (PIH) mismatch or missing"

API Response: 400 Bad Request | Error Code: INVALID_PIH_CHAIN

✅ Solution: Each invoice must reference the hash of the previous invoice (including rejected ones). First invoice uses empty hash.

❌

9. Missing Arabic Language Fields (BR-KSA-16)

Error: "Arabic language required for visual invoice"

API Response: 400 Bad Request | Error Code: MISSING_ARABIC_LANGUAGE

✅ Solution: Visual invoices (PDF/printed) must include Arabic. XML can be bilingual (Arabic + English).

❌

10. B2B Clearance Timeout (BR-KSA-CLR-01)

Error: "Invoice issued before clearance approval"

API Response: 303 See Other | Warning Code: PREMATURE_ISSUANCE

✅ Solution: B2B invoices require clearance BEFORE issuing to customer. Wait for 202 Accepted response from ZATCA API.

Why Qeemah is Different

We validate 100+ BR-KSA compliance rules before submission using ZATCA's official SDK. Every invoice passes through the same validation ZATCA uses. Not sure if your current software passes? Run our 5-point compliance audit.

Result: Zero rejected invoices in production since launch. Every invoice validated offline before API submission.

How Qeemah Works

From invoice creation to ZATCA integration - everything is automatic

1

Create Invoice

Add items and customers as usual. No need to worry about XML or QR codes. Start with professional quotations that convert to compliant invoices automatically.

2

Automatic Validation

Qeemah validates 71 checkpoints (XML, QR, VAT, dates) and auto-fixes errors.

3

Instant Submission

Invoice is automatically sent to ZATCA. Receive UUID in less than 2 seconds.

Frequently Asked Questions

Common questions about ZATCA e-invoicing compliance

What is ZATCA e-invoicing and who needs to comply?
ZATCA e-invoicing (Fatoora) is Saudi Arabia's mandatory electronic invoicing system. All VAT-registered businesses in Saudi Arabia must comply. Phase 1 (Generation Phase) started December 4, 2021, requiring invoices to be generated electronically. Phase 2 (Integration Phase) requires direct integration with ZATCA's Fatoora platform for invoice clearance (B2B) or reporting (B2C).

What is the difference between Phase 1 and Phase 2?
Phase 1 (Generation): Invoices must be generated electronically with a QR code containing 5 TLV fields. No integration with ZATCA required.

Phase 2 (Integration): Invoices must be in UBL 2.1 XML format, digitally signed with an ECDSA certificate, and submitted to ZATCA's Fatoora platform. B2B invoices require clearance before issuance; B2C invoices must be reported within 24 hours. The QR code expands to 9 TLV fields including cryptographic stamps.

What are the penalties for non-compliance?
ZATCA imposes significant penalties for e-invoicing non-compliance: First violation starts at SAR 5,000, with repeated violations escalating up to SAR 50,000 per invoice [2] . Serious violations can result in business suspension [2] . Additionally, non-compliant invoices cannot be used to claim VAT input tax deductions.

How do I get a CSID (Cryptographic Stamp Identifier)?
To obtain a CSID: 1) Generate an OTP from the Fatoora portal (valid for 1 hour), 2) Create a Certificate Signing Request (CSR) with your company details, 3) Submit the CSR to ZATCA's compliance API, 4) Complete compliance checks with 6 sample invoices, 5) Request production CSID after passing compliance. Qeemah automates this entire process for you.

What is the difference between Clearance and Reporting?
Clearance (B2B): Standard tax invoices for business-to-business transactions must be submitted to ZATCA and approved BEFORE you can issue them to your customer. ZATCA adds its cryptographic stamp to the invoice.

Reporting (B2C): Simplified tax invoices for retail/B2C transactions can be issued immediately to customers, but must be reported to ZATCA within 24 hours. The seller applies their own cryptographic stamp.

How long does ZATCA integration take with Qeemah?
With Qeemah, you can complete ZATCA Phase 2 integration in under 10 minutes. Sign up, enter your company details and VAT number, and Qeemah handles the entire onboarding process: generating your CSR, obtaining your CSID, running compliance checks, and getting production approval. No technical knowledge required.

"E-invoicing is a cornerstone of Saudi Arabia's digital transformation. By mandating electronic invoicing across all VAT-registered businesses, we aim to enhance tax transparency, reduce evasion, and support the goals of Vision 2030."

— ZATCA E-Invoicing Introduction Guidelines [1]

Works Cited & Technical References
  1. ZATCA, "E-Invoicing Detailed Guidelines Version 2," zatca.gov.sa (2024).
  2. ZATCA, "VAT Implementing Regulations," zatca.gov.sa (2024).
  3. ZATCA, "E-Invoicing Roll-out Phases," zatca.gov.sa (2025).
  4. ZATCA, "Fatoora Portal User Manual," zatca.gov.sa (2024).
  5. ZATCA, "Security Features Implementation Standards," zatca.gov.sa (2024).
  6. ZATCA, "How to Get Ready for Phase 2," zatca.gov.sa (2024).
  7. ZATCA, "XML Implementation Standard - UBL 2.1," zatca.gov.sa (2024).
  8. ZATCA, "Developer Portal Manual Version 3," zatca.gov.sa (2024).
  9. EY Global, "Saudi Arabia announces 22nd wave of Phase 2 e-invoicing integration," ey.com (2025).
  10. Thomson Reuters, "E-invoicing Phase 2 in KSA: How ZATCA's Guidelines Affect You," thomsonreuters.com (2024).
  11. Monsha'at, "SME Monitor Report," monshaat.gov.sa (2024).
  12. Vision 2030, "Financial Sector Development Program," vision2030.gov.sa.

Related Resources

🧾

Best Accounting Software in Saudi Arabia

Compare ZATCA-compliant accounting solutions for Saudi SMEs. Full feature comparison and pricing.
📖

ZATCA Phase 2 Complete Guide

Understand wave deadlines, technical requirements, and how to prepare your business for compliance.
🏪

Accounting for Retail in Saudi Arabia

POS integration, inventory tracking, and real-time ZATCA reporting for retail businesses.

Ready to integrate with ZATCA?

Start free today. No credit card required. Full integration with the e-invoicing platform in less than 10 minutes.

Start Free Trial Book a Demo
Chat with us on WhatsApp