ZATCA Compliance Checklist: What You Need Before Your Deadline

1. Know your deadline

• Log in to Fatoora and confirm your Phase 2 wave and integration date.
• Plan to be live at least a few weeks before the deadline so you can fix issues without pressure.

2. Fatoora and business details

• Business is registered for VAT and linked in Fatoora
• You can log in to the Fatoora portal
• Address, VAT number, and legal name match your official records

See how to register on Fatoora and connect your solution for step-by-step instructions.

3. Choose how you’ll integrate

• Option A: Use a ZATCA-compliant solution or API (fastest; they handle format, signing, QR, and Fatoora)
• Option B: Build in-house (UBL XML, CSID, QR, clearance/reporting APIs)

If you’re building yourself, allow time for UBL 2.1, ZATCA OIDs, hashing (PIH), and testing.

4. EGS units (devices/branches)

• Each point of sale or system that issues invoices is an EGS unit. You register each one in Fatoora.
• You’ll need to generate an OTP in Fatoora and complete the onboarding (either in your solution or via CSR/certificate flow).
• One EGS unit = one CSID. Don’t share one CSID across multiple physical devices if ZATCA expects separate units.

5. Invoice types and flow

• B2B (standard): Clearance with ZATCA before sending the invoice to the buyer. Don’t deliver the invoice until status is cleared.
• B2C (simplified): Issue first, report to ZATCA within 24 hours. Customer can get the receipt immediately.

Your system must support the right flow for each invoice type.

6. Invoice content and format

• All mandatory ZATCA fields present (seller, buyer where required, amounts, VAT, dates, etc.)
• UBL 2.1 Saudi profile (or PDF/A-3 with embedded XML) and correct namespaces
• QR code on every invoice, TLV-encoded as per ZATCA
• Digital signature with your CSID; previous invoice hash (PIH) chain correct and sequential

7. Testing before go-live

• Use ZATCA sandbox (or your provider’s sandbox) for test invoices
• Run at least the compliance checks ZATCA requires (e.g. 3 test invoices) and get a production CSID
• Test both B2B clearance and B2C reporting if you use both

8. Go-live and monitoring

• Switch to production CSID and production Fatoora endpoint
• Monitor clearance/reporting success and fix failures (e.g. invalid XML, PIH errors, timeouts)
• Plan for certificate renewal and any ZATCA system outages (retries, queues)

Using a dedicated ZATCA API can simplify steps 3–8: integrate ZATCA compliance into your system without building UBL, signing, or direct Fatoora integration yourself.

---

Start free — 14 days →