ZATCA Phase 2 integration connects your invoicing system to ZATCA. In ERPNext, it needs a separate compliance app, clean invoice data and careful testing. We break the work into simple stages so managers can track it without learning the technical setup.
What ZATCA Phase 2 integration changes
Phase 1 focused on creating electronic invoices. Phase 2 adds a live link with ZATCA's Fatoora platform, along with new checks before or after an invoice reaches the customer.
The system sends invoice data as XML, a file format that lets two systems read the same data. The customer can still receive a normal, readable invoice.
Invoices also include a secure digital stamp and a QR code. These help prove where the invoice came from and protect the record from hidden changes.
For managers, the key change is control. Your team must know which invoices need approval before delivery, and it must watch for rejected or delayed invoices every day.
Which businesses need ZATCA Phase 2 integration
ZATCA is bringing businesses into Phase 2 in waves, and each wave uses a taxable revenue threshold. ZATCA also sends a direct notice to each business before its required date.
Wave 25 covers taxpayers whose revenue subject to VAT exceeded SAR 187,500 in any year from 2022 through 2025. ZATCA announced this wave on July 24, 2026, and the integration deadline is February 1, 2027.
Check your notice and the official ZATCA roll-out phases before you set a project date. If you received a notice, work back from the deadline and protect a few weeks for tests.
Don't wait for the final month. In our experience, the teams that get squeezed are the ones that start late. Data fixes and staff training usually take longer than the connection itself.
How B2B and B2C invoices move through ZATCA
ZATCA uses two routes. A standard tax invoice usually serves a VAT-registered business, while a simplified tax invoice usually serves a consumer or retail customer.
| Invoice route | What happens | Manager check |
|---|---|---|
| Standard B2B | ZATCA must clear it before delivery to the buyer. | Send only the cleared version. |
| Simplified B2C | Your system issues it, then reports it within 24 hours. | Review pending reports each day. |
Clearance means ZATCA checks a B2B invoice before the buyer receives it. A rejected B2B invoice isn't ready for delivery, so your team must fix it and send it again.
B2C sales follow the reporting route. The customer receives the invoice at the sale, and your system must then report it to ZATCA within 24 hours.
A failed B2B invoice can't go to the buyer until it's fixed and cleared. A failed B2C report has already reached the customer, so it needs quick review and resubmission. We test both routes fully, including the failures and the corrections.
Credit and debit notes follow the route of their related invoice type. Your returns process must point back to the original invoice, which keeps each correction linked to the right sale.
What ERPNext needs before it can connect
ERPNext does not support Phase 2 on its own. It needs a ZATCA compliance app, which creates the required file, applies the digital stamp and sends invoices to Fatoora.
Open-source options include KSA Compliance, ERPGulf apps and Beveren ZATCA Integration. Support differs by ERPNext version and sales setup, so check the app against your version, companies, branches and point-of-sale use.
Be careful with the phrase "ZATCA approved." ZATCA says its solution providers directory is not an approval list. Your business remains responsible for compliant invoices.
Check your ERPNext version
Version 15 has an extra point to check. Saudi localization moved from ERPNext core into a separate app that covers Saudi VAT settings, the VAT return report and the Phase 1 QR code.
In versions 13 and 14, that localization was part of core. We first confirm what is actually installed, then check whether the chosen compliance app supports that setup.
Match the app to how you sell
A retail counter has different needs from a business sales team, and a group with several companies adds more choices. We map these needs before we select or set up the app, and we don't recommend picking an app before you know them.
If you are still assessing the system, read our ERPNext pros and cons. You can also see how the main ERPNext modules work together.
How to prepare invoice data
In our experience, this is where Phase 2 projects slip. The access code and certificate steps are quick once the setup is ready, but cleaning the data can take far longer. The software can send only what your records contain, and missing or wrong fields lead to rejections.
Review company and customer records
Start with your legal company name and VAT number, which should match the ZATCA registration exactly. Then add the full Saudi national address, including the building number and district. Missing building numbers and districts are the gap we see most often.
Next, review business customers. Each B2B customer needs the right VAT number and address. Don't assume a missing VAT number will send an invoice down the right route. Check how your compliance app decides between standard and simplified invoices, and test both cases.
Review taxes and invoice rules
Check standard, zero-rated and exempt sales, and make sure each zero-rated or exempt line has the right reason. Also test rounding so that line taxes agree with invoice totals.
This review is quicker when the ERPNext accounting setup is already sound. We also check the sales process in ERPNext so that staff follow one approved flow.
List every invoicing unit
List each server, branch unit or terminal that issues invoices. Each invoicing unit needs separate onboarding and its own digital identity, so agree on this list before anyone requests access codes.
How the connection and onboarding work
Once the data is ready, onboarding follows five stages. We repeat the process for each invoicing unit.
- Set the company details, invoice types and test environment in the compliance app.
- Request an OTP from Fatoora. An OTP is a one-time password, valid for one hour.
- Create and send a CSR, which is a request for the unit's digital certificate.
- Receive a compliance CSID and test sample invoices. A CSID is the unit's digital identity.
- After the tests pass, request the production CSID for live invoices.
We always request the OTP last. It's the step people want to do first, and then an hour goes on fixing a setting and the code expires. The team then needs a new one.
Tests should cover every invoice type the unit will issue. That means standard and simplified invoices where both apply, along with their related credit and debit notes.
A production CSID can be renewed later through the same OTP process, which replaces the old CSID. ZATCA also revokes CSIDs if a company's VAT registration is cancelled or suspended, so keep each unit's CSID status under review.
The official ZATCA technical guidelines describe the full process. Managers do not need to run each technical step, but they should ask for proof that every unit passed its tests.
What to test before and after go-live
Test real sales cases
Use realistic test data before going live. Test one B2B invoice and one B2C invoice, then add a return, a zero-rated item and a failed submission.
If you use retail terminals, test a full shift and its printed receipts. Scan each QR code and confirm the compliance app is producing the Phase 2 data, not an old Phase 1 layout. Our page on ERPNext point of sale explains the wider retail process.
Also train staff to recognize a rejection before go-live. They should know who fixes the data and who approves the next step, because a clear owner for each error prevents delays.
Set daily controls
After launch, B2B invoices should reach customers only after clearance, and B2C invoices must be reported within 24 hours. Assign one person to review pending and rejected records each day.
- Check all B2B invoices received clearance before delivery.
- Check all B2C invoices were reported within 24 hours.
- Review rejections, fix the cause, and send the invoice again.
- Keep track of the CSID status for every invoicing unit.
If you need help planning the work, see our ERPNext implementation services. You can also contact IBAN about your ZATCA deadline, and we'll tell you honestly what's realistic before it.
Frequently asked questions
Does ERPNext support ZATCA Phase 2 out of the box?
No. ERPNext needs a separate ZATCA compliance app for Phase 2. That app handles the digital stamp, clearance, reporting and the file sent to Fatoora.
Is any ERPNext app approved by ZATCA?
ZATCA does not treat its provider directory as an approval list. You may use any solution that meets the rules, but your company remains responsible for the invoices it issues.
How do I know which ZATCA wave applies to my company?
Check the notice sent by ZATCA and the published wave rules. Wave 25 applies above SAR 187,500 of revenue subject to VAT in any year from 2022 to 2025, and its deadline is February 1, 2027.
Does every POS terminal need separate onboarding?
Yes, if the terminal issues invoices as its own invoicing unit. Each such unit needs its own onboarding and digital identity, so confirm the unit list with your app provider before setup.
How long does ZATCA Phase 2 integration take?
There is no safe fixed time for every business. The connection can be quick once data is ready, but data cleanup, tests and staff training set the real schedule.
What happens if a B2B or B2C invoice fails?
A failed B2B invoice must be fixed and cleared before delivery. A failed B2C report needs prompt review and correction, and your daily control should catch both cases.
