ZATCA Phase 2: signing units, onboarding, clearance and the archive

For a Saudi company already on Phase 1: register a signing unit, onboard it with ZATCA (OTP, compliance checks, production certificate), switch Phase 2 on, and every invoice and note is stamped as it is posted. Standard invoices are cleared by ZATCA before they may be given to the buyer; simplified ones are reported within 24 hours. Submissions, a dashboard, an append-only archive and PDF/A-3 with the XML inside. Phase 1 companies are unchanged.

Phase 2 (integration) sits on top of Phase 1. Everything Phase 1 does still happens; Phase 2 adds the XML invoice (UBL 2.1), its hash, the cryptographic stamp and a counter that chains each invoice to the one before. It also onboards each unit with ZATCA’s Fatoora platform, sends every stamped document to ZATCA (clearance or reporting), and keeps what was sent and what ZATCA answered.

Signing units

Accounting → Close & Compliance → E-invoicing → ZATCA Signing Units (only for a company that operates in Saudi Arabia, and only to roles that grant it) lists the e-invoice generation units (EGS) that stamp invoices: Code, Name, Branch, Environment, Status, Test, Certificate, Certificate expires, Last counter (ICV) and Last stamped.

1. Add a unit: code, name, the branch it stamps for (empty for the whole company), the certificate request details (Common name (CN), EGS serial number, Organization unit (OU), Invoice types (TSCZ), Location, the branch’s short national address, and Industry) and Environment (sandbox, simulation or production).
2. Tick Default unit for the one used when a branch has no unit of its own.
3. For a demonstration only, tick Test unit and press Test certificate: the unit gets a key and a self-signed certificate. ZATCA would not accept what it stamps.
4. Onboarding with ZATCA is done on ZATCA Onboarding, whose Onboard (OTP) step makes the unit’s own key and certificate signing request for you. Generate CSR on this screen is only for preparing a request by hand; Download CSR shows it.

Switching Phase 2 on

• Accounting → Close & Compliance → Tax → Tax Jurisdictions, on the Saudi jurisdiction: tick ZATCA Phase 2 (integration), and give Phase 2 from, the first day of the company’s ZATCA wave (empty: from the day it is switched on).
• It is refused unless Phase 1 is already on, and refused without a signing unit.

The buyer and the branch

• CRM → Accounts, for a Saudi customer with no VAT number: Buyer ID type (TIN, CRN, MOM, MLS, 700, SAG, NAT, GCC, IQA, PAS or OTH) and Buyer ID number. Left empty, the CR number is used as the CRN.
• A branch can carry its own CR number and national address; invoices stamped for that branch use them.

What Post does under Phase 2

1. Everything Phase 1 checks, and anything the XML would lack, is checked at once and named in sentences with the ZATCA rule number.
2. The branch’s unit (or the default) is taken, and the invoice is given the unit’s next counter (ICV) and the previous invoice’s hash (PIH). Fifty invoices posted at the same moment still get fifty consecutive counters.
3. The UBL 2.1 invoice is built, hashed (SHA-256), stamped with the unit’s key (ECDSA) and checked.
4. The QR carries nine tags on a simplified invoice (the ninth is the certificate’s signature) and eight on a standard one, in place of Phase 1’s five.
5. If the posting fails, nothing is used up: the counter is given back.

The stamp, the hash, the counter and the UUID are as final as the amounts. A Phase 1 company, and every company in another country, posts exactly as before.

Onboarding a unit with ZATCA

Accounting → Close & Compliance → E-invoicing → ZATCA Onboarding lists each signing unit with its Environment, Status, Step reached, What happened, Checks passed, Certificate expires, Days left and Renewal pending. Register the unit on ZATCA Signing Units first. Taking a step is for the administrator unless somebody is granted ZATCA Onboarding on the Roles screen; others with Accounting display can see the list, which holds nothing secret.

1. On the Fatoora portal, the company’s authorised person chooses Onboard new solution unit/device and gets a one-time password (OTP): six digits, single use, valid for one hour. Hand it over as you would a password; it is never stored.
2. Onboard (OTP): choose the Environment (Developer Portal sandbox, Simulation or Production) and type the OTP. A key pair and certificate signing request are made and sent; ZATCA returns the compliance certificate (compliance CSID). A refused OTP leaves the unit waiting with its request: get a new OTP and press Onboard again.
3. Run compliance checks: one sample of each document the unit is registered for goes to ZATCA. A unit with invoice types 1100 (standard and simplified) sends six: standard invoice, credit and debit note, and simplified invoice, credit and debit note. Each must pass; read any warnings.
4. Request production certificate: from then on the unit stamps the company’s invoices, and they are cleared or reported with ZATCA. The certificate’s expiry is shown.
5. Renew certificate, with a new OTP from Renew existing cryptographic stamp identifier on the portal, before it expires. The unit keeps stamping with its current key until the new certificate arrives, and the counter chain carries on.

From 30 days before a certificate expires, the daily job ACCT-ZATCA-WATCH raises a finance alert, a notification and an automation-inbox entry, once a day per unit.

Clearance and reporting

• A standard (B2B) invoice or note is sent to ZATCA for clearance as soon as its posting is saved, and Post says whether it was cleared, rejected or will be retried. Only ZATCA’s cleared XML and its QR may be printed or given to the buyer: a standard invoice that is still pending, or any rejected document, cannot be printed, and the refusal says why.
• A simplified (B2C) invoice is issued at once with the stamp and nine-tag QR, and reported to ZATCA within 24 hours, first in the background and then by the hourly job ACCT-ZATCA-SUBMIT. A finance alert is raised for any not reported 20 hours after issue.
• If ZATCA cannot be reached, the same document (same UUID and hash) is tried again with growing waits, up to hourly. Accepted with warnings is accepted; the warnings are kept and shown.
• If ZATCA has switched clearance off, the same signed document is reported instead, and the dashboard shows when clearance was last seen off.
• AR Invoices shows a ZATCA column for a Saudi company, and offers Resubmit to ZATCA, Re-issue (rejected by ZATCA), PDF/A-3 with ZATCA XML and ZATCA log on the invoice.

ZATCA Submissions

Every invoice and note stamped under Phase 2 and what ZATCA said, with a badge: Cleared, Reported, Warning (accepted with warnings), Rejected or Pending. Columns include Attempts, Hours waiting, Next attempt, What ZATCA said and Re-issued as.

• Send due now clears or reports every document whose next attempt is due. Resubmit sends one document again now: the same document, with the same UUID and hash.
• Re-issue is for a rejected document. A rejected document is never sent again as it is: Re-issue voids it in the books (its journal is reversed) and makes a draft copy to correct and post as a new document, with the next counter. The rejected one is kept, with ZATCA’s answer, in the archive.
• PDF/A-3 with XML gives the invoice as a PDF with its e-invoice XML inside (the cleared XML for a standard invoice, the stamped one for a simplified invoice). XML for the buyer gives the XML alone.
• ZATCA log lists every request about that invoice and ZATCA’s answer.

Dashboard, log and archive

• ZATCA Dashboard: per signing unit, how many invoices were cleared, reported, accepted with warnings, rejected and pending; the oldest pending in hours and how many are over 24 hours; rejections in 30 days and the latest; certificate expiry and days left.
• ZATCA API Log: every call to Fatoora (onboarding, compliance checks, clearance, reporting) with the HTTP answer, outcome, message and time taken. OTPs, secrets and the authorization header are taken out before it is written. Append-only.
• ZATCA Archive: every stamped document as issued, every cleared document and every ZATCA answer, each with its SHA-256. Append-only: the database refuses any change or removal. Records are kept for the company’s retention, at least six years (the KSA VAT record-keeping period; keep longer for capital assets or real estate if your tax adviser says so). Download gives the archived document.