ZATCA Phase-2 in Saudi Arabia: A Field Guide for Sellers

ZATCA's Phase-2 (Integration Phase) replaced Phase-1 (Generation Phase) for the first wave of taxpayers in January 2023. Three years and twenty-four waves later, every VAT-registered business in the Kingdom is in scope. If you're issuing invoices in SAR, you're issuing them through Fatoora.

What the rules actually require

• Standard tax invoices (B2B) must be cleared in real time — submitted to ZATCA, validated, stamped with a UUID, and only then sent to the buyer.
• Simplified tax invoices (B2C) follow a reporting model — issued first with a TLV-encoded QR code, reported to ZATCA within 24 hours.
• Every invoice must include a chained cryptographic hash linking it to the previous invoice, plus a digital signature using a CSID (Cryptographic Stamp Identifier) issued by Fatoora.
• The XML must conform to UBL 2.1 with the ZATCA-specific extensions defined in the Phase-2 implementation specification.

The ZATCA TLV QR

The Phase-1 QR survives in Phase-2 as a TLV (Tag-Length-Value) base64 string. Five mandatory tags: seller name, VAT number, ISO 8601 timestamp, total with VAT, and VAT amount. Phase-2 adds three more — the XML hash, the digital signature, and the public key. ZATCA's mobile app validates these, so any field encoded incorrectly causes the QR to fail verification at the buyer's end even after the invoice is cleared.

Top operational gotchas

1. Time drift. Invoices stamped more than 30 seconds out of sync with ZATCA's reference clock get rejected. Use NTP, not your laptop.
2. Hash-chain breaks. If you issue an invoice and forget to include the previous invoice's hash, the chain is broken and the entire device must be re-onboarded with a fresh CSID.
3. Cross-tax handling. Goods at 15% mixed with zero-rated exports in one invoice need separate <cac:TaxSubtotal> blocks per rate; collapsing them into a single subtotal is a top-3 rejection cause.

Invocie's MENAStrategy implements all of this — UUID generation, chain hashing, TLV QR, UBL 2.1 with ZATCA extensions — so you focus on issuing invoices, not parsing the implementation spec.