ZATCA Phase 2 E-Invoicing Compliance Guide 2026: Technical Integration, XML Hashing & Cryptographic Signatures for KSA Enterprises

Executive Summary: Navigating ZATCA Phase 2 in 2026

The Zakat, Tax and Customs Authority (ZATCA) of Saudi Arabia has transformed the Kingdom's commercial landscape through mandatory e-invoicing (Fatoora). While Phase 1 (Generation Phase) focused on generating and storing compliant electronic tax invoices, Phase 2 (Integration Phase) mandates direct API connectivity between business ERPs, POS terminals, accounting software, and ZATCA's central Fatoora platform.

For enterprises operating in Riyadh, Jeddah, Dammam, and Al Jubail, non-compliance is not merely an administrative risk — it carries severe financial penalties, operational halts, and potential suspension of commercial registration (CR).

In this comprehensive guide, Bycom Solutions breaks down the technical architecture, cryptographic algorithms, XML schemas, and step-by-step integration workflow required to achieve flawless ZATCA Phase 2 compliance in 2026.

Key Differences: ZATCA Phase 1 vs. ZATCA Phase 2

Understanding the architectural delta between Generation Phase and Integration Phase is critical for software developers, CTOs, and financial controllers:

1. ZATCA Phase 2 Core Technical Requirements

To achieve ZATCA Phase 2 certification, your billing system or ERP (such as BycomERP) must generate and transmit invoices following strict cryptographic standards:

A. UBL 2.1 XML Schema Standardization

Every tax invoice must be serialized in Universal Business Language (UBL 2.1) standard compliant with ZATCA’s specific JSON/XML Schematron rules. Key fields include:

• cbc:InvoiceTypeCode: Demarcates B2B Standard Tax Invoices (0100000) vs. B2C Simplified Invoices (0200000).
• cbc:UUID: Universally Unique Identifier (UUID v4) assigned at generation.
• cac:AdditionalDocumentReference: Contains the Previous Invoice Hash (PIH), creating an immutable cryptographic ledger across sequence numbers.

B. SHA-256 Hashing & Invoice Chaining

ZATCA requires every invoice to reference the SHA-256 hash of the immediately preceding invoice. This cryptographic hash chain prevents backdating, deletion, or insertion of unrecorded transactions:

$$ \text{PIH}n = \text{SHA-256}(\text{Canonicalized XML}{n-1}) $$

C. Digital Signatures (ECDSA secp256k1) & X.509 Certificates

B2B invoices require a valid Cryptographic Stamp (CSID) issued via ZATCA’s Fatoora Onboarding Portal. The invoice digest is signed using an Elliptic Curve Digital Signature Algorithm (ECDSA) with curve secp256k1.

2. Step-by-Step ZATCA Phase 2 Integration Workflow

+------------------+         +------------------+         +--------------------+
|  Enterprise ERP  | ------> | Cryptographic    | ------> | ZATCA Fatoora API  |
|  (e.g. BycomERP) |         | XML Signer Engine|         | (Clearance/Report) |
+------------------+         +------------------+         +--------------------+
         |                            |                              |
         | 1. Generate UBL 2.1 XML   | 3. Embed Sign & CSID         | 5. Return Clearance/
         | 2. Compute PIH Hash       | 4. Generate QR (TLV Base64)  |    Validation Token

Step 1: Device Onboarding & CSID Provisioning

Before issuing live invoices, every solution unit (POS terminal, server node) must perform two-stage onboarding:

1. Compliance CSID (CCSID): Generate a Certificate Signing Request (CSR) with specific ZATCA OIDs (Organization Unit, Serial Number, Invoice Types supported) and send to /fatoora/v1/compliance.
2. Production CSID (PCSID): Execute compliance check test scenarios via ZATCA API. Upon passing, request live production certificate from /fatoora/v1/production/csid.

Step 2: B2B vs. B2C Invoice Processing Modes

1. B2B Standard Invoices (Clearance Mode)

• The ERP generates UBL 2.1 XML and computes SHA-256 digest.
• The invoice is transmitted to ZATCA's /fatoora/v1/invoices/clearance endpoint BEFORE issuing it to the buyer.
• ZATCA validates tax calculations, signatures, and cryptographic hashes in real-time.
• If valid, ZATCA returns a Cryptographically Cleared XML containing ZATCA’s official stamp, which can then be printed/emailed to the buyer.

2. B2C Simplified Invoices (Reporting Mode)

• The POS/ERP signs the simplified invoice locally using the Onboarded CSID.
• The invoice with QR code is issued immediately to the end-consumer at checkout.
• The ERP asynchronously reports the invoice payload to /fatoora/v1/invoices/reporting within 24 hours.

3. Cryptographic Implementation: Hashing & QR Code Construction

A compliant ZATCA Phase 2 QR Code is not merely text — it is a Base64-encoded TLV (Tag-Length-Value) structure containing 9 mandatory fields:

1. Tag 1: Seller Name
2. Tag 2: Seller VAT Registration Number (15 digits ending in 3)
3. Tag 3: Invoice Timestamp (ISO 8601 YYYY-MM-DDTHH:mm:ssZ)
4. Tag 4: Invoice Total Amount (including VAT)
5. Tag 5: VAT Total Amount
6. Tag 6: SHA-256 Hash of UBL 2.1 XML
7. Tag 7: ECDSA Cryptographic Signature
8. Tag 8: ECDSA Public Key of CSID Certificate
9. Tag 9: ZATCA Certificate Authority (CA) Stamp Signature

Node.js Cryptographic Signing Example

const crypto = require('crypto');
const fs = require('fs');

// Function to compute ZATCA SHA-256 Invoice Hash
function computeInvoiceHash(canonicalXmlContent) {
  return crypto.createHash('sha256').update(canonicalXmlContent, 'utf8').digest('base64');
}

// Function to construct TLV Tag
function createTlvTag(tagNumber, value) {
  const valueBuffer = Buffer.from(value, 'utf8');
  const tagBuffer = Buffer.from([tagNumber]);
  const lengthBuffer = Buffer.from([valueBuffer.length]);
  return Buffer.concat([tagBuffer, lengthBuffer, valueBuffer]);
}

// Constructing Phase 2 QR TLV Buffer
function generateZatcaQr(seller, vatNum, timestamp, total, vatTotal, invoiceHash, signature) {
  const tlvArray = [
    createTlvTag(1, seller),
    createTlvTag(2, vatNum),
    createTlvTag(3, timestamp),
    createTlvTag(4, total),
    createTlvTag(5, vatTotal),
    createTlvTag(6, invoiceHash),
    createTlvTag(7, signature)
  ];
  const combinedTlv = Buffer.concat(tlvArray);
  return combinedTlv.toString('base64');
}

4. Common ZATCA Compliance Errors & How to Avoid Them

Based on real-world deployments across Riyadh, Dammam, and Jubail, enterprise IT teams frequently encounter validation rejections:

1. KSA-2 Schematron Error (Incorrect PIH Chaining): Occurs when the Previous Invoice Hash does not match the exact Base64 SHA-256 string of the preceding invoice. Ensure database locking during sequential numbering.
2. KSA-9 Timestamp Syntax Violation: ZATCA strictly enforces UTC ISO 8601 formatting with proper timezone offsets (e.g. 2026-07-28T14:30:00Z).
3. Canonicalization Discrepancies: Whitespace, indentation, or un-normalized line breaks before hashing will cause hash verification failures. Always strip non-significant XML whitespace prior to SHA-256 calculation.
4. Invalid CSID Expiry Handling: CSIDs expire annually. Implement automated token refresh monitors inside your ERP infrastructure.

How BycomERP Simplifies ZATCA Phase 2 Compliance

Implementing ZATCA Phase 2 internally requires hundreds of hours of cryptographic R&D, Schematron testing, and security auditing. BycomERP — Bycom Solutions' proprietary cloud enterprise system — provides out-of-the-box, certified ZATCA Phase 2 integration:

• Automated CSID Onboarding: One-click CSR generation and automated Fatoora portal certificate fetching.
• Real-Time B2B Clearance Engine: Asynchronous XML signing and instant clearance handshake with zero checkout delay.
• Cryptographic Hash Ledger: Built-in SHA-256 PIH chaining with multi-branch database isolation.
• Native Arabic & English Support: Dynamic RTL invoices formatted to exact Saudi Ministry requirements.

Frequently Asked Questions (FAQ)

Q1: What happens if ZATCA API goes down during B2B clearance?

ZATCA maintains a fallback offline queue mechanism. If the Fatoora Portal suffers documented downtime, invoices can be temporarily assigned an offline status token and re-submitted automatically once connectivity restores within prescribed SLA windows.

Q2: Is ZATCA Phase 2 mandatory for foreign companies operating in KSA?

Yes. Any entity registered for VAT in Saudi Arabia — whether local or a foreign branch operating in Riyadh, Al Jubail, or Jeddah — must comply with Phase 2 integration timelines established for their revenue wave.

Q3: How long does ZATCA integration take for custom ERPs?

Standard manual integration takes 6 to 12 weeks. Using Bycom Solutions' ZATCA Middleware Engine, integration can be completed in as little as 5 business days.

Get Compliant with Bycom Solutions

Don't let e-invoicing compliance disrupt your business operations in Saudi Arabia. Contact Bycom Solutions' enterprise engineering team to audit your current ERP setup or migrate to BycomERP.

• Riyadh Office: Tahliah Street, Al Aqiq, Riyadh 13515 | +966 57 527 1327
• Al Jubail Office: Al Jubail Industrial City, Eastern Province, KSA
• Email: [email protected]
• Website: https://bycomsolutions.com/products/bycomerp