ZATCA Phase 2 Integration: What Your ERP and POS Must Support

Zatca phase 2 integration requires businesses in Saudi Arabia to link their e-invoicing or accounting software directly via API to the Zakat, Tax and Customs Authority Fatoora portal. It mandates real-time clearance for B2B invoices and near-live reporting within 24 hours for B2C invoices using structured XML formats. 

Understanding ZATCA Phase 2

ZATCA Phase 2 introduces real-time or near-real-time validation of commercial transactions. Unlike Phase 1, which allowed local PDF or QR code storage, Phase 2 requires strict fatoora integration directly into ZATCA’s cloud portal via secure APIs.

Key Distinction: Clearance vs. Reporting

• B2B Invoices (Standard E-Invoices): Require Clearance. The ERP must transmit the electronic invoice to ZATCA's Fatoora platform in real time. ZATCA validates the XML file, applies a cryptographic stamp, and clears it before it can be issued to the buyer.

• B2C Invoices (Simplified E-Invoices): Require Reporting. Generated primarily at the POS, these invoices are issued to the customer immediately. However, the system must report them to ZATCA's platform within 24 hours of issuance.

ERP Integration Requirements

For mid-market and enterprise businesses in KSA, the core financial ledger and billing engine reside within the ERP. To handle zatca phase 2 integration, your ERP must natively support or integrate with specialized middleware capable of processing complex XML standards.

The system communicates with ZATCA through a direct API connection:

• Source System: Enterprise ERP / POS (handles XML generation and digital signature).

• Communication Channel: Secure REST API (transmits real-time clearance and reporting data).

• Target System: ZATCA Fatoora Central Portal (processes invoice clearance and reporting).

1. XML File Generation (UBL 2.1)

The ERP must automatically convert invoice data into structured XML files compliant with the UBL 2.1 syntax and ZATCA’s specific dictionary rules. Manual CSV or plain PDF formats are strictly non-compliant.

2. Cryptographic Stamp & SHA-256 Hashing

Every generated invoice must include a unique SHA-256 cryptographic hash of the invoice content. Additionally, the system must embed a digital signature issued through a Cryptographic Stamp Identifier (CSID) obtained during device onboarding.

3. Sequential Counter & UUID

To prevent tampering or retrospective invoice insertion, the ERP must maintain an unalterable, sequential invoice counter alongside a universally unique identifier (UUID) for every transaction.

POS Compliance Checklist

Retailers, restaurants, and high-volume merchant networks relying on Point of Sale (POS) terminals face unique operational requirements due to transaction speed and high volumes of simplified tax invoices.

Essential POS Features for Phase 2:

• Cryptographic Stamp Onboarding (CSID): The POS software must support automated device onboarding to generate Production CSID keys directly from ZATCA.

• Dynamic QR Code Generation: Every printed or digital receipt must contain a dynamic, base64-encoded QR code that embeds:

• Seller Name & VAT Registration Number (TRN)

• Invoice Timestamp & Total Amount (including VAT)

• Cryptographic Stamp & SHA-256 Hash

• ECDSA Public Key

• Offline Resiliency & 24-Hour Queueing: In the event of internet disruption, the POS must allow continuous local checkout, store signed offline receipts securely, and automatically upload them to ZATCA within the mandatory 24-hour window once connectivity returns.

• Prohibition of Non-Compliant Actions: The POS software must lock down capabilities that allow invoice deletion, manual counter resets, or unrecorded cash transactions.

Technical Challenges & How to Avoid Common Integration Pitfalls

Integrating your ERP and POS with ZATCA’s Fatoora platform introduces complex technical workflows. Organizations frequently encounter deployment friction in several key areas:

• CSID Certificate Expiration & Renewal Drops: Cryptographic Stamp Identifiers (CSIDs) carry validity periods. If your ERP middleware lacks automated monitoring, an expired certificate will instantly block all B2B invoice clearances.

• Solution: Implement automated alerts and API renewal scripts 30 days prior to certificate expiration.

• Master Data Discrepancies: ZATCA requires precise formatting for buyer TRNs, street names, building numbers, and postal codes. Incorrectly mapped customer master data in the ERP causes instant validation rejections during real-time clearance.

• Solution: Enforce strict data validation rules on customer creation forms within your ERP prior to Phase 2 go-live.

• Network Latency & Timeouts: High-volume POS networks processing thousands of receipts daily risk checkout line delays if API payloads are tied to synchronous response loops.

• Solution: Deploy lightweight middleware that handles B2C hashing locally and queues API payloads asynchronously.

Preparing for Successful Integration

Achieving full e invoicing compliance KSA standards demands a structured rollout plan to avoid operational halts or compliance penalties.

1. Audit Current ERP and POS Architecture

Determine if your current software suite (such as Oracle NetSuite, SAP, Microsoft Dynamics 365, or local POS solutions) offers native ZATCA Phase 2 API connectors, or if specialized middleware is required.

2. Obtain CSID Credentials via ZATCA Portal

Access the ERAL / Fatoora portal to obtain your initial onboarding OTPs. Generate cryptographic keys (CSRs) to obtain both Compliance and Production CSIDs for each billing device.

3. Conduct Sandbox & Staging Testing

Validate XML schemas, digital signatures, and API response codes within ZATCA's developer sandbox before pushing changes to your production environment.

4. Train Operational and Finance Teams

Ensure your accounting and IT staff understand error codes (e.g., clearance rejections), invoice cancellation protocols via Credit/Debit notes, and emergency offline reporting procedures.

How Trustangle Simplifies Your ZATCA Phase 2 Integration

Navigating ZATCA compliance does not have to disrupt your core business operations. At Trustangle, we provide end-to-end solutions for payments & ZATCA e-invoicing integration engineered specifically for Saudi enterprises and retail networks. 

Our solutions deliver:

• Seamless ERP & POS Connectors: Direct API integration for leading platforms including Oracle NetSuite, SAP, Microsoft Dynamics, and custom POS systems.

• 100% ZATCA Compliant Middleware: Automated XML UBL 2.1 formatting, SHA-256 hashing, digital signing, and real-time clearance/reporting workflows.

• Robust Offline Queue Management: High-speed POS compliance with guaranteed reporting sync within the 24-hour window.

Ready to ensure full ZATCA Phase 2 compliance for your ERP and POS systems? Contact the Trustangle team today to speak with our integration specialists.

Frequently Asked Questions about zatca phase 2 integration

What is ZATCA Phase 2?

ZATCA Phase 2 is the Integration Phase of the Saudi e-invoicing mandate. It requires enterprises to integrate their billing, ERP, and POS systems directly with ZATCA’s central Fatoora platform via secure APIs. Under Phase 2, B2B e-invoices require real-time clearance before issuance, while B2C simplified e-invoices must be reported to the platform within 24 hours.

Which ERP systems support Phase 2?

Most leading international and regional ERP platforms support ZATCA Phase 2 either natively or through certified local integration middleware:

• Global Platforms: Oracle NetSuite, SAP S/4HANA, and Microsoft Dynamics 365 connect seamlessly via API connectors and certified Saudi partner solutions.

• Localized/Mid-Market Platforms: Local solutions and platforms like Odoo KSA edition provide pre-configured ZATCA XML UBL 2.1 formatting and digital signing capabilities out of the box.

What should a POS system support?

To comply with Phase 2 requirements for simplified tax invoices, a POS system must support:

• Dynamic QR Code Generation: Encoding seller details, timestamp, VAT totals, SHA-256 hash, and ECDSA digital signatures.

• CSID Onboarding: Automated generation and management of Cryptographic Stamp Identifiers obtained from the Fatoora portal.

• Offline Resiliency: Secure local storage of signed receipts during internet outages with automated syncing to ZATCA within 24 hours.

• Tamper Prevention: Absolute prohibition of invoice deletion, backdating, or manual counter resets.

How do I prepare for integration?

• Audit Current Infrastructure: Verify whether your ERP/POS natively generates compliant UBL 2.1 XML files and SHA-256 hashes, or if middleware is required.

• Obtain CSID Credentials: Access the ZATCA portal to generate One-Time Passwords (OTPs) and issue Cryptographic Stamp Identifiers for each device.

• Perform Sandbox Testing: Test invoice payloads and response codes in ZATCA’s developer environment prior to production deployment.

• Train Finance & IT Teams: Establish clear protocols for handling clearance error codes, offline sync monitoring, and issuing compliant Credit/Debit notes.

What happens if I don't comply?

Failure to comply with ZATCA Phase 2 integration deadlines results in strict legal and financial penalties:

• Monetary Fines: Fines issued per non-compliant invoice or missing system capability, escalating for repeated violations according to ZATCA tax regulations.

• Commercial Restrictions: Risk of delayed Zakat certificate renewals, blocked government service portals, or operational holds.

• VAT Deductibility Risks: Inability for B2B buyers to claim input VAT deductions on unapproved or non-cleared invoices.