Phase 2 arrives with a vocabulary before it arrives with a deadline: every term, acronym and field code met between the Fatoora portal and a first cleared invoice. For the sequence they sit in, read what Phase 2 requires; for one document's fields, the tax invoice checklist.
The phases and the acts
| Term | Definition |
|---|---|
| ZATCA | The Zakat, Tax and Customs Authority: the Saudi authority behind the regulation, the platform and the validation rules. |
| Phase 1 (Generation) | Mandatory since 4 December 2021: invoices produced by a system, not by hand, with a QR code on simplified invoices. Nothing is transmitted at issue. |
| Phase 2 (Integration) | The stage that connects your system to ZATCA: UBL 2.1 XML, cryptographically stamped, hash-linked to the one before, cleared or reported. |
| Wave | The group a taxpayer joins Phase 2 in, each with its own date. Wave 25: VAT-taxable revenue above 187,500 SAR in any of 2022 to 2025, integrating 1 February 2027. |
| Clearance | The path for standard tax invoices: cleared by ZATCA before sharing, so the buyer receives what the Authority returned. |
| Reporting | The path for simplified tax invoices: given to the customer at once, reported within 24 hours. |
| Fatoora platform | ZATCA's e-invoicing platform, where a taxpayer onboards an issuing unit and generates its onboarding code. |
The documents
| Term | Definition |
|---|---|
| Standard tax invoice | Issued to a business or government buyer (B2B, B2G), cleared before sharing, with the buyer's VAT number and address: a registered buyer cannot deduct input VAT from a simplified one. |
| Simplified tax invoice | Issued to a consumer (B2C), handed over at once and reported within 24 hours. No buyer VAT number. |
| Credit note (381) | Reduces a previously issued invoice; needs a reason (BR-KSA-17, error) and a reference to the original (BR-KSA-56, warning). A cleared invoice is noted, never deleted. |
| Debit note (383) | Increases a previously issued invoice, under the same two obligations. Notes in practice covers which to use. |
| Invoice type code (BT-3) | What the document is: 388 invoice, 386 prepayment invoice, 381 credit note, 383 debit note, from UN/CEFACT code list 1001 (BR-KSA-05, error). |
| UBL 2.1 | Universal Business Language 2.1, the XML schema the invoice is expressed in: fixed element order and controlled code lists — a schema to satisfy, not a template. |
| XML | The format the invoice is issued in; a PDF is only a rendering. Retention is six years in the format issued. |
The cryptography and the chain
| Term | Definition |
|---|---|
| EGS unit | An issuing unit in ZATCA's model — what a certificate is issued to; the abbreviation is used as is. One queue is one unit, three simultaneous tills are three. |
| CSR | Certificate signing request: what your software builds, carrying the establishment's VAT number, name, address and the document types it issues. |
| Compliance CSID | Returned when the onboarding code is accepted; it runs the compliance checks and cannot sign live invoices. |
| Production CSID | The certificate that signs live invoices, with an expiry date after which submissions stop being accepted. |
| OTP (onboarding code) | A single-use code from the Fatoora portal, authorising one issuing unit to obtain a certificate. Not a login password. |
| Cryptographic stamp (KSA-15) | The signature block inside the XML binding the document to the certificate that signed it (BR-KSA-30, error). |
| XAdES | XML Advanced Electronic Signatures: the standard for embedding a signature and its supporting data inside the XML document. |
| Digital signature | A value computed over the invoice with the unit's private key; the public key proves that key signed these bytes. |
| Public key | The published half of the key pair, in the certificate and in the Phase 2 QR code. It verifies, never signs. |
| Hash | A fixed-length digest, here SHA-256: the same input always gives the same digest, any change a different one. |
| PIH (KSA-13) | Previous invoice hash: the Base64-encoded SHA-256 digest of the document issued immediately before this one by the same unit. BR-KSA-61 and BR-KSA-26 are warnings: a broken chain is accepted quietly. |
| ICV (KSA-16) | Invoice counter value: one up per document, never reset, digits only (BR-KSA-33 and BR-KSA-34, errors). |
| Invoice chain | What counter and hash form together: each document states its position and carries the digest of the one before. |
| UUID (KSA-1) | The machine identifier for the document in the exchange with the Authority — letters, digits and dashes, not the invoice number (BR-KSA-03, error). |
The QR code
The code at the foot of a Saudi e-invoice is not a link and opens nothing. It is a Base64 string — binary as plain characters, so it survives printing — holding fields in TLV encoding: a one-byte tag, a length, then the value.
| Tags | What they hold |
|---|---|
| 1 to 5 | Seller name, seller VAT number, invoice timestamp, invoice total with VAT, VAT total — all a Phase 1 code carries. |
| 6 to 8 | Hash of the XML, the signature, the public key of the stamp — none exists unless the document was genuinely stamped. |
| 9 | Where present, ZATCA's signature over the seller's public key, added on clearance: a ninth tag marks a cleared standard invoice. |
Decode any invoice QR code at our QR code reader — in the browser, no sign-in — or check a supplier invoice.
The field codes
Two naming systems sit side by side in ZATCA's messages. BT-nn identifiers come from EN 16931, the European semantic model that gives every business term on an invoice a stable number. KSA-nn identifiers name the fields the Saudi specification adds — counter, hash, transaction code — with no European equivalent.
| Code | What it holds | Rule that names it |
|---|---|---|
| BT-2 | Document issue date; not later than today. | BR-KSA-04, error |
| BT-3 | Invoice type code: 388, 386, 381, 383. | BR-KSA-05, error |
| BT-5 | Invoice currency code, per ISO 4217. | BR-KSA-CL-01, error |
| BT-6 | Tax currency code, the currency VAT is accounted in; must be SAR. | BR-KSA-68, BR-KSA-EN16931-02, errors |
| BT-31 | Seller VAT registration number: 15 digits, first and last digit 3. | BR-KSA-39, BR-KSA-40, errors |
| BT-46 | Other buyer identification, where the buyer is not VAT-registered, with a scheme (BT-46-1): TIN, CRN, MOM, MLS, 700, SAG, NAT, GCC, IQA, OTH. | BR-KSA-14, error |
| BT-48 | Buyer VAT registration number: 15 digits, first and last digit 3, never the seller's own. | BR-KSA-44, BR-CUSTOM-VALIDATION-01, errors |
| BT-121 | VAT exemption or exception reason code, where the category is zero-rated, exempt or not subject to VAT. | BR-KSA-49, error; BR-KSA-CL-04, warning |
| BT-151 | Invoiced item VAT category code, per line: S, Z, E or O. | BR-KSA-18, error |
| BT-152 | Invoiced item VAT rate, per line; zero where not subject to VAT. | BR-KSA-11, error |
| KSA-1 | The document UUID. | BR-KSA-03, error |
| KSA-11 | Line VAT amount; mandatory on a standard invoice and its notes. | BR-KSA-52, error |
| KSA-12 | Line amount with VAT: line net amount plus line VAT amount. | BR-KSA-53, error |
| KSA-13 | Previous invoice hash (PIH). | BR-KSA-61, BR-KSA-26, warnings |
| KSA-15 | The document cryptographic stamp. | BR-KSA-30, error; BR-KSA-60, warning |
| KSA-16 | Invoice counter value (ICV), digits only. | BR-KSA-33, BR-KSA-34, errors |
| KSA-25 | Invoice issue time, hh:mm:ss local or hh:mm:ssZ in UTC; a field of its own. | BR-KSA-70, error |
The validation vocabulary
| Term | Definition |
|---|---|
| Validation rule | One machine-checkable condition in ZATCA's schematron, identified by a code. All run at once, so a document can return several. |
| BR-KSA-nn | The identifier of a Saudi business rule; related families are BR-KSA-EN16931-nn, BR-KSA-F-nn for format, BR-KSA-CL-nn for code lists. |
| Severity: error | The document is rejected: nothing was cleared or reported, and the invoice does not exist for the Authority. |
| Severity: warning | The document is accepted and the defect recorded: a successful submission is not proof of a complete invoice. |
Of the 135 rules we index from ZATCA's SDK schematron, 44 are errors and 91 warnings. Our error code reference documents all 135, about thirty with written guides; how to read a rejection covers the rest.
The tax vocabulary
Definitions, not advice: which treatment applies to a supply is a question for an accountant and zatca.gov.sa.
| Term | Definition |
|---|---|
| VAT category code | One letter per line saying how the supply is treated, from a closed list of four — a letter, not a rate: 15 here rejects. |
| S | Standard rated: VAT charged at the standard rate. |
| Z | Zero rated: taxable, at a rate of zero. |
| E | Exempt from VAT: outside the charge by exemption. |
| O | Not subject to VAT, outside the scope; the line rate is then zero. |
| Exemption reason code | The coded reason (BT-121) for a zero-rated, exempt or not-subject category, from ZATCA's list rather than written freely. |
| Output VAT | VAT a business charges on the supplies it makes: the VAT on the invoices it issues. |
| Input VAT | VAT a business is charged on the supplies it receives — the deduction a registered buyer loses on a simplified invoice. |
| Tax point | The moment VAT becomes due: the earlier of supply, invoice or payment. Invoicing early moves it forward, never back. |
| Taxable supply | A supply within the scope of Saudi VAT, standard-rated or zero-rated. Exempt supplies are not. |
These rules come from one SDK release's schematron; a later release can change a message, a severity or a field. zatca.gov.sa governs.
To have these fields filled for you: ZATCA Tools connects to Fatoora in minutes with one OTP, signs every invoice with a compliant QR code, clears standard invoices and reports simplified ones, and keeps the signed XML six years, downloadable. Rejections come back with the official code and a link to its guide. It also issues quotations, credit and debit notes, receipt vouchers, per-customer statements, and branches with their own device and chain. Integrations: WooCommerce, Shopify, n8n, WHMCS, a REST API and a Partner API. Not an accounting system. Free to start: 50 invoices or 30 days from the day you connect, whichever comes first, then from 49 SAR a month — start here, or browse the free tools.