Overview and Practical Implementation Guidelines
Executive Overview of ZATCA Phase 2 Technical Integration
Phase 2 of E-Invoicing (Integration Phase - مرحلة الربط والتكامل) mandated by the Zakat, Tax and Customs Authority (ZATCA) is a transformative technological upgrade requiring enterprises to connect their ERP and accounting systems directly to the Fatoora portal. Beyond simple PDF creation or generic QR codes, Phase 2 enforces generating XML UBL 2.1 invoices, hashing invoices with SHA-256 cryptographic algorithms, appending ECDSA digital signatures, and submitting Standard B2B invoices for real-time clearance or Simplified B2C invoices for automated reporting.
To guarantee flawless ZATCA Phase 2 compliance and integrate your enterprise billing with zero operational downtime, leverage GNSCO Enterprise Cloud ERP & ZATCA Integration Services to certify your billing infrastructure.
Mandatory Technical Benchmarks for ZATCA Phase 2
- Cryptographic Stamp Identifier (CSID): Acquiring unique cryptographic certificates for every active point-of-sale terminal and ERP billing instance via the official onboarding protocol.
- Cryptographic Hash Chaining (SHA-256): Calculating cryptographic hashes that sequentially chain every new invoice to the hash of the preceding invoice, preventing retroactive tampering.
- Encrypted TLV QR Codes: Encoding mandatory tax fields into Base64 TLV (Tag-Length-Value) format for instant verification by the ZATCA mobile inspection app.
- Clearance vs. Reporting Differentiation: Sub-second real-time clearance for B2B standard tax invoices versus 24-hour batch reporting for B2C simplified receipts.
1. Technical Comparison: Standard Tax Invoice vs. Simplified Tax Invoice
The following matrix illustrates the architectural and procedural distinctions enforced by ZATCA between standard and simplified e-invoices:
| Evaluation Metric | Standard Tax Invoice (B2B Clearance) | Simplified Tax Invoice (B2C Reporting) |
|---|---|---|
| Transaction Scope | Commercial transactions between registered enterprises (B2B / B2G). | Retail transactions directly serving final consumers and individuals (B2C). |
| ZATCA Communication API | Real-Time Clearance API (must be approved prior to buyer transmission). | Reporting API (transmitted within a 24-hour window post-issuance). |
| Digital Signature Mechanism | Digitally signed and cryptographically stamped by ZATCA central servers. | Digitally signed locally within the ERP using the local ECDSA private key. |
| Buyer Disclosures | Full legal business name, national address, and buyer VAT Registration Number. | Buyer identification optional unless transactions exceed statutory thresholds. |
| QR Code Encoding | Appended following successful clearance confirmation from ZATCA. | Mandatory Base64 TLV format rendered on physical or digital receipts immediately. |
2. ERP Onboarding Workflow with the Fatoora Portal
Connecting an accounting system or ERP to ZATCA follows a strict four-step cryptographic onboarding lifecycle:
- Cryptographic Key Generation (CSR): Generating a private/public key pair (ECDSA secp256k1) and a Certificate Signing Request (CSR) from within your server environment.
- Obtaining the Compliance CSID: Submitting the one-time password (OTP) generated from the ZATCA portal to obtain a temporary testing certificate.
- Executing Automated Compliance Checks: Transmitting simulated test invoices (Standard, Simplified, Debit/Credit Notes) to validate schema syntax, tax computations, and hash chaining.
- Acquiring the Production CSID: Promoting your solution to the live production environment to sign and clear commercial transactions permanently.
Severe Financial Sanctions for Delayed Compliance
Issuing non-integrated invoices past your entity's wave enforcement date incurs immediate administrative fines that compound per non-compliant document, alongside the suspension of customs clearance privileges.
3. Native E-Invoicing Integration Across GNSCO Cloud Systems
Enterprise software architectures provided by GNSCO—including Moon LIS for diagnostic laboratories and custom ERP frameworks—feature native Phase 2 compliance:
- Automated UBL 2.1 XML Serialization: Formulating valid XML data structures adhering to official ZATCA business validation rules without latency.
- High-Throughput Cryptographic Engine: Sub-second local signing and hash generation capable of sustaining peak retail checkout volumes.
- Asynchronous Offline Resiliency Queue: Queuing simplified invoices locally during network disruptions, automatically reporting payloads upon internet restoration.
Need to apply this to your facility?
Share the activity, city and current stage, and we can help define an appropriate work scope.
Explore healthcare IT solutions