ZATCA E-Invoicing Phase 2 Compliance Checklist for Accountants

Your client's ERP is live, invoices are going out — and ZATCA's Integration Phase is either already in scope or arriving in the next wave. The question is not whether Phase 2 applies; it is whether your client file can demonstrate compliance on the day an audit letter lands. This checklist cuts through the regulatory summary layer and gives you the exact steps to run on every Saudi client file.

What Phase 2 Actually Changes (vs Phase 1)

Phase 1 (Generation Phase, live since 4 December 2021 / 29 Rabi' Al-Awwal 1443H) required taxpayers to generate structured e-invoices in XML or PDF/A-3 format and store them electronically. That was largely a format and archival obligation.

Phase 2 — the Integration Phase — goes further in three material ways under ZATCA's E-Invoicing Implementing Regulation (Articles 53–64):

1. Cryptographic Stamp (CSID / PCSID): Every invoice must carry a cryptographic stamp issued through the ZATCA Fatoorah portal. Standard tax invoices require clearance (real-time ZATCA sign-off before the invoice is delivered to the buyer). Simplified tax invoices require reporting within 24 hours.
2. Continuous connectivity: The taxpayer's ERP or billing system must maintain an API connection to ZATCA's production environment via the Fatoorah APIs (currently on v2). Batch uploads are not an alternative for standard invoices.
3. Mu'tamad ERP or compliant middleware: Systems must be either a ZATCA-certified (Mu'tamad) solution or a validated third-party integration stack. The taxpayer's IT team cannot "self-certify."

ZATCA has been rolling Phase 2 out in waves by annual revenue threshold. According to the ZATCA official portal, waves have progressively included taxpayers with smaller revenue thresholds — check the portal for the current wave schedule as it updates. If your client crossed ﷼3 million in VAT-taxable turnover, assume they are already in scope or will be notified within the current cycle.

The Phase 2 Compliance Checklist

Use this on every client file before their wave notification date. Tick each item and note the evidence reference in your workpaper.

Pre-Integration (Technical Readiness)

#	Checklist Item	Evidence to Document
1	Confirm client's wave notification letter received from ZATCA	Scanned letter, date noted
2	Verify ERP/billing system is Mu'tamad-listed or middleware is ZATCA-certified	Screenshot from zatca.gov.sa Mu'tamad list
3	CSID (Cryptographic Stamp Identifier) registered for each solution unit	ZATCA portal confirmation
4	UBL 2.1 XML schema validated against ZATCA's published XSD	Validation report
5	UUID generation logic confirmed unique per invoice	Dev sign-off note
6	QR code generation tested on simplified invoices	Sample invoice with QR
7	Clearance API (standard invoices) tested end-to-end in Sandbox	Sandbox response logs
8	Reporting API (simplified invoices) tested — 24-hour window confirmed	Sandbox response logs
9	Digital certificate (X.509) stored securely, expiry tracked	Certificate management record
10	Failover / downtime procedure documented per ZATCA Article 57	Internal SOP

Accounting and VAT Field Accuracy

Phase 2 rejection rates spike on field-level errors, not connectivity failures. The XML must carry:

• Seller TIN (VAT registration number, 15 digits) — verify it matches ZATCA records exactly
• Buyer TIN for B2B standard invoices (mandatory for clearance)
• Invoice type code: 388 (tax invoice), 381 (credit note), 383 (debit note) per UBL 2.1
• Line-level VAT category code: S (standard 15%), Z (zero-rated), E (exempt) — misclassification here triggers both a clearance rejection and a VAT exposure
• Supply date vs invoice date — must be explicitly separated where they differ (Article 53(b) of the Implementing Regulation)
• Currency: SAR with the correct ISO 4217 code; foreign currency invoices must show SAR equivalent at the CBU rate on the invoice date

Run a sample of 10 recent invoices against these fields before go-live. A single incorrect VAT category code at scale means a voluntary disclosure conversation with ZATCA — not a situation to discover post-integration.

Client Onboarding Steps (What You Own as the Accountant)

Your role in a Phase 2 project is not to build the API — that is the IT team or the ERP vendor. Your role is to:

1. Confirm the VAT registration is current and the address on the ZATCA portal matches the invoice header. Discrepancies cause clearance failures at the identity-matching stage.
2. Map the client's transaction types to invoice categories: which transactions produce standard tax invoices (B2B, B2G) vs simplified tax invoices (B2C retail). Mixed-model businesses — e.g., a distributor that also runs a retail counter — need a split workflow documented.
3. Review the credit note and debit note process. Under ZATCA's Implementing Regulation Article 54, a credit note referencing a Phase 2 invoice must itself be cleared or reported through the same API. Manual credit notes issued outside the ERP break the chain — this is a common gap in client setups.
4. Archive obligations: Article 66 of the VAT Implementing Regulation requires records for 6 years (10 years for real estate). Confirm the e-archive solution stores the ZATCA-signed XML (not just a PDF export) and that the signature remains verifiable.
5. Staff training sign-off: Document who in the client's finance team has been trained on the new workflow. ZATCA field auditors ask for this.

Go-Live and Post-Integration Review

In the first 30 days after going live on production:

• Pull a clearance success/failure report from the ERP. Target: 100% clearance success on standard invoices within the same business day.
• Check the 24-hour reporting compliance rate for simplified invoices. Late reporting (post-24 hours) is a reportable infraction under Article 63.
• Reconcile the ZATCA-cleared invoice count against the VAT return filing for the same period. Any gap means an invoice either bypassed the system or failed clearance silently — investigate before the return is filed.
• Schedule a 90-day post-live review in your engagement calendar. Regulation changes, certificate renewals (ZATCA certificates expire), and ERP upgrades all create fresh compliance risk.

Penalties You Are Helping Clients Avoid

ZATCA's penalty framework (published in the Official Gazette and summarised at zatca.gov.sa) is not trivial:

• Failure to integrate within the wave deadline: up to ﷼50,000 per violation
• Issuing an invoice not compliant with e-invoicing rules: ﷼1,000 per invoice (up to ﷼50,000 per year for repeated violations)
• Failure to retain e-invoices in prescribed format: up to ﷼50,000

For a mid-size distributor issuing 500 B2B invoices a month, non-compliance for a single quarter is a ﷼450,000 exposure on paper — before any VAT adjustment penalties. Frame this clearly when scoping your Phase 2 advisory engagement.

Common Gaps You Will Find in Client Files

Based on the structure of the regulation, the highest-frequency gaps at the time of an accountant-led review tend to be:

• Simplified vs standard invoice misclassification — a B2B transaction processed through the simplified (reporting) channel instead of the clearance channel. This is an Article 53 violation and also means the buyer cannot claim input VAT on an uncleared invoice.
• Certificate management absent — no one owns the X.509 certificate renewal. ZATCA certificates have defined validity periods; expiry means the API goes dark.
• Credit notes issued manually outside the ERP integration, breaking the audit trail.
• VAT group members treated as a single integration unit when each member requires a separate CSID registration.

Test your client file against each of these before signing off any Phase 2 readiness memo.

Keeping Up With Wave Announcements

ZATCA publishes each new wave on its official portal with a six-month notice period. Bookmark https://zatca.gov.sa and set a calendar alert to check for new wave announcements on the first Monday of each month. Subscribe to ZATCA's official communication channel — notifications are issued in Arabic first; the English translation follows within days.

If you are managing a portfolio of clients near the ﷼500,000 to ﷼3,000,000 annual turnover band, plan pre-emptively: the integration project takes 8–16 weeks for a mid-size client depending on ERP complexity. Waiting for the notification letter and then starting the project puts you in default territory.

Want a quick benchmark on your current Phase 2 knowledge before walking into a client meeting? Test yourself with the SuperAccountant practice quiz — it covers ZATCA e-invoicing scenarios alongside broader VAT and IFRS questions used in live client work.

---

Sharpen your edge with SuperAccountant's next live cohort — small batches, real client workpapers, taught by partners. Details and seats at https://app.superaccountant.in/en/cohort?utm_source=blog&utm_medium=cta&utm_campaign=accountants.