ZATCA Phase 2 E-Invoicing Portal 2026: Step-by-Step Guide

Why Every B.Com Student in KSA Needs to Understand ZATCA Phase 2 Right Now

You are sitting in an accounting class in Riyadh, Jeddah, or Dammam, and your lecturer mentions "e-invoicing integration." Half the room nods. Nobody really knows what happens after you click "submit." That gap — between theory and the actual portal steps — is exactly what costs marks in exams and costs you credibility in your first job.

ZATCA (the Zakat, Tax and Customs Authority) rolled out Phase 2 of its Fatoorah e-invoicing mandate starting January 2023 and has been onboarding taxpayer waves ever since. By mid-2026, the vast majority of VAT-registered businesses in Saudi Arabia are inside the Phase 2 scope. As a B.Com student, understanding the XML integration steps is no longer optional reading — it is core employability knowledge.

This guide is the screen-by-screen walkthrough that the Big 4 whitepapers skip because they assume a CFO audience. We assume you have your textbook open, a cup of coffee, and zero prior XML experience. Let's go.

---

What Exactly Changed Between Phase 1 and Phase 2?

Phase 1 (December 2021) required businesses to generate and store e-invoices digitally. Think of it as "stop using Word and Excel to make invoices."

Phase 2 — officially called the Integration Phase — goes further. It requires your invoicing system to talk directly to ZATCA's platform (called the Fatoorah portal) in real time or near-real time. Two things happen:

1. Cryptographic stamping — a unique digital signature is embedded in every invoice so it cannot be tampered with.
2. Clearance or Reporting — Standard tax invoices (B2B) must be cleared by ZATCA before they are sent to the buyer. Simplified tax invoices (B2C, under SAR 1,000) are reported to ZATCA within 24 hours.

Quick example: Al-Noor Trading issues a B2B invoice to a client for SAR 5,000 + 15% VAT = SAR 5,750. Under Phase 2, that invoice must be submitted to the ZATCA API, cryptographically stamped, and cleared before the PDF reaches the buyer. If the system sends the invoice first and reports later, it is non-compliant.

The official regulatory home for all of this is zatca.gov.sa.

---

The ZATCA Phase 2 XML Integration Steps — Plain English Walkthrough

This is the section most tutorials skip. Here are the steps in the exact order they happen.

Step 1 — Obtain Your Compliance CSID (Cryptographic Stamp Identifier)

Before any invoice can be submitted, your ERP or invoicing software must be onboarded. This produces a CSID — think of it as the digital ID card for your invoicing device.

• Log in to the ZATCA Fatoorah Sandbox Portal: https://fatoora.zatca.gov.sa
• Navigate to Onboarding → Generate CSR (Certificate Signing Request).
• Fill in your VAT registration number (15-digit format, starting with 3).
• The portal returns a signed X.509 certificate. Store this — it links every future invoice to your organisation.

Student tip: In exams, remember that the CSID is device-specific, not company-wide. A company running three invoicing terminals needs three CSIDs.

Step 2 — Understand the UBL 2.1 XML Structure

ZATCA mandates invoices in Universal Business Language (UBL) 2.1 format with ZATCA extensions. UBL is just a standardised XML vocabulary. Here is the skeleton every invoice XML must contain:

XML Element	What It Holds	Example Value
<cbc:ID>	Invoice number	INV-2026-00451
<cbc:IssueDate>	Invoice date (Gregorian)	2026-07-15
<cbc:InvoiceTypeCode>	Standard (388) or Simplified (381)	388
<cac:AccountingSupplierParty>	Seller details + VAT number	310122393500003
<cac:AccountingCustomerParty>	Buyer details	—
<cac:TaxTotal>	Total VAT amount in SAR	750.00
<cac:LegalMonetaryTotal>	Invoice totals	5750.00
<ext:UBLExtensions>	ZATCA cryptographic stamp	(system-generated)

The full XSD schema is downloadable from the official ZATCA developer portal. Do not try to memorise every tag — understand why each section exists and you will answer any exam question on it.

Step 3 — Generate the Invoice Hash and Cryptographic Stamp

This is the step that makes Phase 2 tamper-proof.

1. Your system generates the invoice XML.
2. It computes a SHA-256 hash of the invoice content. A hash is a fixed-length fingerprint — change one digit in the invoice and the hash changes completely.
3. The hash is signed using the private key paired with your CSID certificate.
4. The signed hash (the cryptographic stamp) is embedded inside <ext:UBLExtensions>.
5. A QR code is generated from specific invoice fields (seller name, VAT number, date, total, VAT amount) using TLV encoding (Tag-Length-Value). This QR is mandatory on all invoices.

Why does this matter for your exam? Many questions test whether students understand that the QR code is derived from the invoice data, not a random label. If any field changes after the QR is generated, the QR scan fails.

Step 4 — Submit to the ZATCA API (Clearance or Reporting)

Now the invoice goes to ZATCA.

For Standard Invoices (B2B Clearance):

• API endpoint: POST /invoices/clearance/single
• The invoice XML (Base64-encoded) is sent in the request body along with your CSID.
• ZATCA validates: VAT number exists, XML schema is correct, hash matches, no duplicate invoice number.
• ZATCA returns a cleared invoice with its own stamp embedded. Only this cleared version is sent to the buyer.
• Response time target: under 2 seconds under normal load.

For Simplified Invoices (B2C Reporting):

• API endpoint: POST /invoices/reporting/single
• Must be submitted within 24 hours of issuance.
• ZATCA returns a "reported" status. The buyer receives their copy immediately; ZATCA's acknowledgment follows.

---

Common ZATCA Portal Integration Errors and How to Fix Them (2026)

If you work in an accounting role or internship, you will hit these errors. Knowing them also earns marks in practical-case exam questions.

Error Code	Meaning	Fix
BV-VAT-002	Buyer VAT number format invalid	Verify 15-digit number starting with 3
XSD-001	XML does not match UBL 2.1 schema	Validate XML against ZATCA's published XSD before submitting
IV-VAT-007	Tax calculation mismatch	Recalculate: taxable amount × 0.15 must equal <cbc:TaxAmount> to the fils
SEC-002	CSID certificate expired	Renew certificate via the onboarding API before resubmission
DUP-001	Duplicate invoice number	Every <cbc:ID> must be unique within your VAT registration

Real-number sanity check: If your invoice is SAR 4,347.83 net, the VAT is SAR 4,347.83 × 0.15 = SAR 652.17. The gross total is SAR 5,000.00. If your XML has SAR 652.18, ZATCA returns IV-VAT-007. Round to two decimal places (fils) and resubmit.

---

Using the ZATCA Sandbox Portal for Practice (No Real Data Needed)

Here is the part nobody tells students: ZATCA operates a free sandbox environment specifically for testing. You do not need a real business or real VAT number to practise the steps above.

1. Go to zatca.gov.sa and locate the developer/sandbox section.
2. Register with a test VAT number (ZATCA provides test credentials in their SDK documentation).
3. Download the ZATCA e-invoicing SDK — it includes sample XML files, a hash-generation tool, and a QR code generator.
4. Submit a sample invoice, observe the clearance response, and deliberately introduce errors to see which error codes fire.

Spending two hours in the sandbox is worth more than ten hours of passive reading. This is exactly the kind of practical skill that separates candidates in accounting internship interviews.

If you want structured guidance through these steps alongside a peer group also studying for exams in KSA, check out the SuperAccountant cohort programme — it includes live sessions on topics like this.

---

How ZATCA Phase 2 Connects to Your B.Com / CA Inter Syllabus

You might be thinking: "I'm a student, not a developer. Why do I need XML steps?" Here is the connection:

• Financial Accounting: Phase 2 changes the recognition point of a sale. A B2B invoice is not legally complete until ZATCA clears it. This affects revenue recognition timing under IFRS 15 as endorsed by SOCPA.
• Auditing: Auditors verify that the QR codes on a sample of invoices match the XML data in the ERP. Understanding TLV encoding helps you understand what auditors are actually checking.
• Taxation: VAT returns filed on the ZATCA portal must reconcile with cleared/reported invoice counts. Discrepancies trigger audits.
• ERP / Accounting Software: Mu'tamad (ZATCA-approved) ERPs — including SAP, Oracle, and several local solutions — handle the XML generation automatically, but accountants are expected to understand the output and troubleshoot errors like the ones listed above.

---

A Quick Revision Checklist for ZATCA Phase 2 Exam Questions

Use this before your next paper:

• I can explain the difference between clearance (B2B) and reporting (B2C)
• I know that standard invoices need clearance before delivery to the buyer
• I can name the five mandatory XML elements in a ZATCA-compliant UBL 2.1 invoice
• I understand that the QR code is built from invoice data using TLV encoding
• I can explain what a CSID is and why it is device-specific
• I know that VAT in KSA is 15% and rounding to the fils (two decimal places) is mandatory
• I am aware that the cryptographic stamp uses SHA-256 hashing and an X.509 certificate

---

Final Thoughts: Theory Is Not Enough Anymore

ZATCA Phase 2 is live, mandatory, and deeply woven into every accounting role in Saudi Arabia. Employers asking "are you familiar with e-invoicing?" in 2026 are not asking a bonus question — they are filtering candidates. Understanding the XML integration steps, knowing how to read an error code, and being able to explain the clearance flow puts you ahead of graduates who only know the theory.

The sandbox portal is free. The ZATCA documentation is public. The only thing between you and this knowledge is the time you choose to invest.

If you're not sure where to start, take SuperAccountant's free 10-minute quiz at https://app.superaccountant.in/en/quiz — it places you at the exact phase of our curriculum that matches your current level, so you stop revising what you already know.