ZATCA E-Invoicing Solution
CDIT ZATCA E-Invoicing Integration — Get 100% ZATCA Phase II Compliant
ZATCA compliance isn’t optional, and the deadlines are moving closer with every new wave. CDIT’s ZATCA e-Invoicing integration connects your existing ERP or POS directly to the Fatoora platform, covering both Phase 1 (Generation) and Phase 2 (Integration) — so B2B and B2C invoices go out clean, cryptographically sealed, and on time.
Regulatory Context
The KSA E-Invoicing Mandate
ZATCA (the Zakat, Tax and Customs Authority) has mandated electronic invoicing for all VAT-registered taxpayers in Saudi Arabia, rolling out in continuous waves tied to each business's revenue threshold.
-
Phase 1 — GenerationLive since December 4, 2021. Businesses must generate and store structured e-invoices from a compliant system, with QR codes required on B2C invoices and paper-only manual invoices no longer permitted.
-
Phase 2 — IntegrationIntegration — Rolling out in ongoing waves since January 2023. Requires real-time integration with ZATCA’s Fatoora platform: B2B invoices need prior clearance (CTC) before issuing, B2C invoices must be reported within 24 hours, and every invoice needs a cryptographic stamp and UUID.
Recent wave announcements
-
27 June 2025Businesses with more than SAR 750,000 turnover in 2022, 2023, or 2024 must integrate their ERP/POS with the Fatoora portal by 31 March 2026.
-
21 March 2025Businesses with more than SAR 1 million turnover in 2022, 2023, or 2024 must integrate their ERP/POS with the Fatoora portal by 31 December 2025.
-
28 February 2025Businesses with more than SAR 1.25 million turnover in 2022, 2023, or 2024 must integrate their ERP/POS with the Fatoora portal by 30 November 2025.
Non-compliance penalties range from SAR 5,000 to SAR 50,000 per violation. Timely integration is critical.
Capabilities
Key Features & Capabilities
Invoices are generated as ZATCA-compliant XML directly from your ERP data, eliminating manual entry and the errors that come with it. Every invoice is then sealed with a cryptographic stamp, UUID, and tamper-proof hash, ensuring authenticity from issuance through archival.
B2B – Clearance Model — Real-time invoice clearance with ZATCA before issuing to the buyer
B2C – Reporting Model — Simplified invoices reported to ZATCA within 24 hours
Internal Lab & SDK Setup — In-house lab environment using the official ZATCA SDK for pre-validation
Sample XML Generation — Auto-generates ZATCA-compliant sample XMLs for testing and onboarding
Compliance Checkpoints — A built-in rule engine validates invoices against ZATCA specifications at every step
Verification & Integrity
Every Invoice Is Sealed and Verifiable
Cryptographic Stamp - ECDSA digital signature applied to every invoice for tamper-proof integrity
QR Code (TLV Format) - Base64 QR code with all mandatory fields encoded in Tag-Length-Value format
XML Signing — Enveloped XML digital signatures per ZATCA technical specifications
XML & PDF/A-3 Output — Dual format output: structured XML and PDF/A-3 with embedded XML attached
Storage, Counter & Onboarding
Built for Audit-Ready Compliance
Tamper-Resistant Counter - A sequential invoice counter prevents invoice skipping, deletion, or reordering, meeting a ZATCA mandatory requirement
Invoice Storage - Secure electronic archival of all issued invoices in structured format, accessible for audit and reconciliation
PCSID Generation - Automated Production Cryptographic Stamp ID generation for device registration and cryptographic key provisioning
Onboarding Journey
A Structured Path From Simulation to Production
Simulation Portal Onboarding — Register and test your e-invoicing solution on the ZATCA Simulation portal before go-live
Sandbox Testing — End-to-end testing of all invoice types, including clearance, reporting, credit notes, and debit notes
Official ZATCA Portal Onboarding — Final onboarding to the production ZATCA Fatoora portal with full compliance sign-off
Architecture
Integration Architecture
CDIT's solution creates a seamless, auditable data pipeline from your enterprise systems to ZATCA's Fatoora platform, supporting both clearance and reporting modes across four implementation stages.
OTP Generation & Initialization — Fatoora portal login and initial setup
Onboarding & Simulation Portal — Compliance checkpoints, design, and storage requirements confirmed
Simulation Stage Testing — Test case scenarios run through to UAT sign-off
Production Environment Implementation — Onboarding with the official ZATCA portal and deployment on production machines
Development Details
Built for KSA's ERP & POS Ecosystem
The solution is built on an API-based e-invoice generation architecture using the ASP.NET Framework and C#, producing ZATCA-compliant XML output that auto-publishes to the ZATCA portal in both Simulation and Production modes.
DB Model – Windows Service Plugin — Generates a CSV file in an SFTP folder, or updates the database directly
SaaS Model — Updates the QR code directly through API, a lightweight option requiring no on-site software
Retail Pro Prism Dynamic Plugin — Triggers the e-invoicing process immediately after a transaction is posted, following the same flow as the DB model
Security & Compliance
Cryptographic Compliance Controls
UUID (Universally Unique Identifier) — Each invoice is assigned a unique identifier, ensuring traceability and preventing duplication across the Fatoora ecosystem
Cryptographic Hash — A SHA-256 hash of every invoice is computed and embedded, making any post-issuance tampering immediately detectable
QR Code (TLV Encoded) — TLV-format QR codes embedded in all B2C invoices, containing seller info, VAT number, timestamp, and invoice totals for instant consumer verification
Cryptographic Stamp (ECDSA) — ZATCA-issued digital certificates sign every invoice using ECDSA encryption, guaranteeing non-repudiation and regulatory acceptanc
Deployment Options
Cloud-Hosted or On-Premises — Your Choice
Cloud-Hosted — Managed SaaS deployment on CDIT-operated infrastructure, with automatic updates, a 99.9% uptime SLA, and zero on-premise maintenance burden
On-Premises — Deployed within your own data center for organizations with data residency requirements or strict network isolation policies
Note: All cleared invoices are automatically archived in ZATCA-compliant format for 5 years, ready for audit retrieval at any time.
Trusted by Leading Retail Brands
Common Questions
ZATCA E-Invoicing FAQ
Ready to Achieve ZATCA Compliance?
Take the next step with CDIT — whether you need a live product demo, a compliance readiness assessment, or a tailored integration quote, our KSA specialists are ready to help.
Request a Demo
See CDIT's ZATCA e-Invoicing solution in action: a live walkthrough of the Fatoora integration, cryptographic stamping, and ERP connector
Compliance Assessment
Not sure which wave applies to you? CDIT's team will assess your VAT revenue thresholds, invoice types, and readiness gap at no cost
Get a Custom Quote
Every implementation is unique; receive a scope-specific proposal covering integration, licensing, deployment, and ongoing support.